Every security team I have worked with eventually hits the same wall. You patch, you monitor, you segment the network, and attackers still get in. At that point a tempting question comes up in the room: why not hit back?
In 2018, Harvard Business Review put that question to two people who have spent their careers on it: Dorothy Denning, one of the pioneers of information-warfare research, and Robert M. Lee, founder of the industrial-security company Dragos. Their answers are still the clearest map I know of the line between active defense and hacking back. In 2026 that line is being redrawn in law, including here in Germany.
Two terms that are not synonyms
Active defense means going beyond passive monitoring to stop, block or weaken an attack that is aimed at your own assets. Lee uses an air-defense analogy: shooting down a missile in your own airspace is defense, while firing one into someone else’s territory is aggression. An intrusion-prevention system that cuts off traffic from an attacking source and alerts an administrator is active defense. So is a DDoS-mitigation service. Denning points out that many companies already practise active defense without ever calling it that.
Hacking back means entering systems you do not own: the attacker’s machine or, far more often, a machine the attacker has hijacked. The goal may be to identify the intruder, delete stolen data or disable the attack. Denning treats it as a narrow form of active defense that belongs to state authorities. Lee refuses to file it under active defense at all, because he doubts it is either legal or effective. On one point they agree completely: companies should not do it. In the US it can fall foul of computer-fraud law, and in Germany the same act can be a crime under sections 202a, 303a and 303b of the Criminal Code (data espionage, data alteration and computer sabotage).
The Georgian honeypot
Denning’s favourite example is a case from 2012. CERT-Georgia was investigating malware, later called Georbot, that had infected government computers. It searched documents for keywords such as “USA” and “NATO” and quietly uploaded every match to a server.
Instead of simply cleaning the machines, the investigators set a trap. On one of the compromised computers they placed a file called “Georgian-NATO Agreement” that carried their own spyware. The attacker’s malware did exactly what it was built to do: it found the file and sent it home. The operator downloaded and opened it, and infected himself. The investigators then had access to his machine, including its webcam, and Georgia published images of the man in its October 2012 report, together with clues pointing to Russia. As with most attribution, those clues were circumstantial.
Is that hacking back? Denning argues it is not, and I find her reasoning convincing. The bait never left Georgian systems. A state acted inside its own boundaries, and the attacker carried the payload across the border with his own tools while committing a crime. No third-party network was broken into.
As an engineer, what I admire is the design. The defenders did not write an exploit; they turned the attacker’s own automation into the delivery mechanism. But I would not call it risk-free. The moment that payload runs, you are executing code on a computer you do not own and cannot see. A national CERT with a legal mandate can justify that. A company cannot, and HBR’s article makes the same point: once you can switch on an attacker’s camera, you need someone above you deciding whether you should.
The machine in the hospital
Denning’s strongest warning is about collateral damage. Most attacks are launched from ordinary computers that the attacker took over earlier. Those machines can be anywhere: in a hospital, or in an energy plant. Shut one down in the name of self-defense, and you may cause harm that cannot be undone.
This is not an abstract risk for me. In the energy sector, the “attacking server” you are looking at may be a historian or an engineering workstation inside someone else’s control system. In automotive manufacturing it might be a PC that flashes ECUs on a production line. Attribution on the internet is hard, and in industrial environments a wrong guess has physical consequences. Lee adds another reason to stay out: a government agency may already be watching the same infrastructure, and a private counterattack can wreck its operation.
What the legitimate version looks like
There is a responsible way to reach into infected machines, and it has a recognisable shape. In 2011 the US Justice Department and the FBI obtained a court order against the Coreflood botnet, took over its command-and-control servers and simply told the infected computers to stop. No data was read and nothing else on the machines was touched.
The model has matured since then. In January 2025 the Justice Department confirmed that the FBI, in an international operation led by French authorities with the French security firm Sekoia, had sent a self-delete command to PlugX malware on about 4,258 US computers. The operation ran under nine court warrants, and the FBI tested the commands beforehand to make sure they did not affect the computers’ legitimate functions or collect their content.
The pattern is consistent: a legal mandate, judicial oversight, the smallest possible action, a tested payload and international cooperation. That is the opposite of an angry company deciding on a Friday evening to “take the server down”.
The debate in 2026
In the US, the Active Cyber Defense Certainty Act, the 2017 bill that the press called the “hack back bill”, would have let companies enter outside systems under certain conditions. It was revised and debated, and it never became law.
Germany is now having its own version of this debate, but about the state. The federal government’s bill to strengthen cybersecurity (Bundestag printed paper 21/6585) would give the BSI, the BKA and the Federal Police powers to access, alter or delete data in IT systems and to disrupt attackers’ infrastructure. Interior Minister Alexander Dobrindt calls this aktive Cyberabwehr. At the Interior Committee hearing on 5 October 2026, the experts were divided. Several supported a legal basis for active defense but asked for judicial approval and stronger protection for uninvolved third parties; the Chaos Computer Club warned that the collateral damage of hacking back is being underestimated. For companies nothing changes: private hacking back stays illegal.
What I recommend to teams
- Do active defense inside your own perimeter. Block, isolate, rate-limit and use DDoS protection. That is where most of the value is.
- Use deception that stays at home. Honeypots, honey accounts and canary documents follow the logic of the Georgian trap without running anything on the attacker’s machine: they tell you that an intruder touched something they should not have.
- Prepare evidence and partners before you need them. Know your contacts at CERT-Bund/BSI and the police cybercrime units (ZAC), and share indicators of compromise.
- Never touch systems you do not own. Assume the “attacker’s server” is someone else’s victim, maybe a hospital’s.
- Treat security as risk management. Denning’s closing advice is to understand your threats and weaknesses, then choose the most cost-effective mix of passive and active measures. You cannot do everything, but you can do the things that make a difference.
Sources
- Scott Berinato, “Aktif Savunma ve Karşı Hackleme Rehberi”, Harvard Business Review Türkiye, August 2018
- SecurityWeek: Georgian CERT catches alleged Georbot operator on camera (2012)
- US Department of Justice: international operation to delete PlugX malware (January 2025)
- CyberScoop: the Active Cyber Defense Certainty Act (2017)
- Deutscher Bundestag: hearing on the bill to strengthen cybersecurity (October 2026)