Rep. Graves: 'Active defense' bill will launch a new industry

Companies will soon offer public support for the legislation because "they're under tremendous attacks all the time," said the congressman.

One of the authors of a controversial “hack back” bill in Congress believes the legislation can launch a new industry around “active defense” that allows companies to strike back against hackers who steal data.

Rep. Tom Graves, R-Ga., predicts the private sector will develop new tools that will add a new layer of deterrence. Graves, who strenuously objects to the “hack back” terminology for the bill, spoke with CyberScoop earlier this month about the legislation.

“You currently have a 1.5 percent conviction rate in cyberattacks,” Graves said. “I think you’ll see that rate go up because attribution will go up, but also because I think you’ll see the number of attacks reduced. And then you’ll see information sharing occurring prior to successful attacks, which will protect additional systems and networks as information being shared about attacks taking place or attempted attacks and the process they’re going about.”

Graves and Rep. Kyrsten Sinema, D-Ariz., co-authored the Active Cyber Defense Certainty (ACDC) Act, which recently gained seven new co-sponsors.

The ACDC would amend the Computer Fraud and Abuse Act, the broad U.S. law that makes it illegal to access computers without expressed permission. Under ACDC, companies and individuals would be able to use “active defense” to identify, disrupt and even destroy their stolen data.

The bill has attracted spirited criticism in the tech world while gaining growing support on Capitol Hill. Few know exactly which companies or individuals outside of Congress are pushing the legislation, but there’s a growing population advocating for the bill’s passage.

Graves said financial technology firms and industry groups will soon offer public support because “they’re under tremendous attacks all the time and they know the government isn’t providing the protection necessary.”

Some lawmakers are lining up to oppose the bill, including Rep. Jim Himes, D-Conn., chairman of the House Intelligence Committee’s NSA and Cybersecurity Subcommittee. He warns that non-state actors attempting to carry out active defense measures will only make the domain messier.

Graves contrasts his vision of the “active defense” future with how he sees the present.

“We live in a very passive environment now with antivirus and firewalls,” Graves said. “That sector has already been developed and matured. There is an opportunity for tools to be developed, for individuals or industries, to allow this defense to take defense on the outside, the more active side.”

However, Graves sees the law, if enacted, as a tool wielded by businesses more than everyday users of the internet.

“I don’t see that your everyday computer user personally employing active defense,” he said. “I see it as every-day industry employing qualified individuals who work with the FBI Joint Task Force on Cybersecurity and who have developed tools that are safe and effective. That’s where I see there’s an opportunity for a new industry to be developed.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure