In 2018, the Paris Call for Trust and Security in Cyberspace was launched and established 9 foundational cybersecurity principles for governments, industry and civil society to help promote a safe and secure online world. With over 1,000 supporting entities today – including over 75 governments and hundreds of industry and civil society organizations – the Paris Call is the largest multistakeholder agreement in the world focused on cybersecurity principles. One of these principles, number 8, creates a new expectation that Paris Call supporters will “take steps to prevent non-State actors, including the private sector, from hacking-back, for their own purposes or those of other non-State actors.” This principle raises important questions about what activities constitute “hacking-back,” as well as which ones do not. As an enthusiastic supporter of the Paris Call, the Cybersecurity Tech Accord – a global coalition of technology companies committed to improving cybersecurity – has taken the initiative to clarify what, from an industry perspective, should constitute “hacking-back” under the principle and which activities should not. This is an important discussion as hacking-back can set dangerous precedents that invite escalations in cyberattacks and unintended consequences that can put technology users at risk. Meanwhile, it is just as important to be clear about what hacking-back is not, as painting with too broad a brush could prohibit valuable security practices, including so-called “active defense” measures employed widely by industry to keep users and customers everywhere safe. This session will give representatives from the Cybersecurity Tech Accord an opportunity to share both their consensus view as to how the technology industry broadly thinks about “hacking-back,” as well as the nuanced perspectives of their respective companies on the issue. It will also provide a valuable opportunity to seek input and feedback from other stakeholder groups in attendance as to whether this industry perspective seems consistent with the Paris Call principle ahead of the second anniversary of the agreement in November 2020.
