Legal Limits of Active Cyber Countermeasures by Private Corporations
DOI:
https://doi.org/10.59022/IRSHAD-iijcl.16Keywords:
Private Cyber Defense, Active Cyber Countermeasures, Article 615-ter, Italian Criminal Law, Cyber security Regulation, Proportionality and Necessity, Corporate LiabilityAbstract
Private corporations increasingly face cyber attacks yet lack clear legal authority to respond. International law grants states self-defense rights but offers no equivalent protection for firms. Italian law, particularly Article 615-ter of the Criminal Code, criminalizes unauthorized access without exception for defensive intent. This creates a gap between corporate technical capability and legal permission. This study aims to examine existing legal limits, identify boundaries between lawful defense and unlawful retaliation, and propose clearer standards for corporate conduct. Using a qualitative, doctrinal approach combined with document analysis, the research examined statutes, European directives, and peer-reviewed legal scholarship. Results show international law provides no defensive right, current statutes ignore intent and proportionality, and a narrow amendment could responsibly close this gap. The study recommends precise legislative drafting, mandatory oversight, sector-specific rules, judicial training, and international cooperation. These findings offer a practical path toward balanced, accountable private cyber defense across evolving digital legal systems.
References
Akande, D., & Liefländer, T. (2013). Clarifying necessity, imminence, and proportionality in the law of self-defence. American Journal of International Law, 107(3), 563–572. https://doi.org/10.5305/amerjintelaw.107.3.0563
AlDaajeh, S., & Alrabaee, S. (2024). Strategic cybersecurity. Computers & Security, 141, 103845. https://doi.org/10.1016/j.cose.2024.103845
AllahRakha, N. (2023). Cyber law: Safeguarding digital spaces in Uzbekistan. International Journal of Cyber Law, 1(5). https://doi.org/10.59022/ijcl.53
AllahRakha, N. (2024). Cybercrime and the law: Addressing the challenges of digital forensics in criminal investigations. Mexican Law Review, 16(2), 23–54. https://doi.org/10.22201/iij.24485306e.2024.2.18892
AllahRakha, N. (2024). Cybersecurity regulations for protection and safeguarding digital assets (data) in today's worlds. Lex Scientia Law Review, 8(1), 405–432. https://doi.org/10.15294/lslr.v8i1.2081
Allegri, M. R. (2021). Le categorie di intermediari digitali e le nuove forme di responsabilità. Rivista Italiana di Informatica e Diritto, 3(2), 7–23. https://doi.org/10.32091/RIID0036
Barnes, I. A. (2018). Implementation of active cyber defense measures by private entities: The need for an international accord to address disputes. Homeland Security Affairs. https://www.hsaj.org/articles/14933
Bracciale, L., et al. (2023). Cybersecurity vulnerability analysis of medical devices. Scientific Reports, 13, 18592. https://doi.org/10.1038/s41598-023-45927-1
Broeders, D. (2021). Private active cyber defense and (international) cyber security—pushing the line? Journal of Cybersecurity, 7(1), tyab010. https://doi.org/10.1093/cybsec/tyab010
Chiara, P. G. (2024). Towards a right to cybersecurity in EU law? The challenges ahead. Computer Law & Security Review, 53, 105961. https://doi.org/10.1016/j.clsr.2024.105961
Cirone, E. (2025). Gli spazi di sperimentazione normativa nell'Unione europea: regolamentare l'innovazione tra principi e prassi applicative. Rivista Italiana di Informatica e Diritto, 7(1), 257–278. https://doi.org/10.32091/RIID0211
Cook, C. (2018). Cross-border data access and active cyber defense: Assessing legislative options for a new international cybersecurity rulebook. Stanford Law & Policy Review, 29(2), 235–268.
Crescioli, C. (2024). La lucha contra el cibercrimen y las últimas reformas penales en España e Italia: luces y sombras. Revista de Estudios Jurídicos y Criminológicos, (10), 403–427. https://doi.org/10.25267/REJUCRIM.2024.i10.12
Darem, A. A., Alhashmi, A. A., Alkhaldi, T. M., Alashjaee, A. M., Alanazi, S. M., & Ebad, S. A. (2023). Cyber threats classifications and countermeasures in banking and financial sector. IEEE Access, 11, 125138–125158. https://doi.org/10.1109/ACCESS.2023.3327016
Denning, D. E. (2014). Framework and principles for active cyber defense. Computers & Security, 40, 108–113. https://doi.org/10.1016/j.cose.2013.11.004
Dziwisz, D. (2024). Legalising forms of active cyber defense (ACD): The theory and practice of private cybersecurity provisioning. Politeja, 21(6), 135–160. https://doi.org/10.12797/Politeja.21.2024.93.06
Fiorinelli, G. (2024). Il ransomware nel DDL Cybersicurezza: dalla fattispecie di estorsione "informatica" al coordinamento tra indagini e incident response. Rivista Italiana di Informatica e Diritto, 6(1), 35–39. https://doi.org/10.32091/RIID0143
Flor, R. (2025). Cybersecurity e diritto penale. Verso la tutela di un bene giuridico di nuova generazione, tra passato, presente e prospettive future. Ius Online, 1, 106–127. https://doi.org/10.3280/ius2025oa21816
Flor, R., & Panattoni, B. (2023). Digital criminal investigations in Italy: The intersection between data protection and cybersecurity. New Journal of European Criminal Law, 14(4), 456–475. https://doi.org/10.1177/20322844231212836
Fusco, L. E. (2020). Los delitos informáticos en el Código Penal Italiano. Derecho Global. Estudios sobre Derecho y Justicia, 5(14), 127–149. https://doi.org/10.32870/dgedj.v5i14.2505
Gerke, K. (2021). Canadian hack-back?: A consideration of the Canadian legal framework for private-sector active cyber defence. Alberta Law Review, 59(1), 171–200. https://doi.org/10.29173/alr2668
Gruodytė, E., Milčiuvienė, S., & Palionienė, N. (2020). The principle of direct effect in criminal law: Theory and practice. European Studies, 7(1), 66–87. https://doi.org/10.2478/eustu-2022-0047
Jasmontaite, L., Kamara, I., & Zanfir-Fortuna, G. (2018). Data protection by design and by default: Framing guiding principles into legal obligations in the GDPR. European Data Protection Law Review, 4(2), 168–189. https://doi.org/10.21552/edpl/2018/2/7
Jitariuc, V., & Greco, F. (2020). Investigative techniques in the digital age: Cybercrime and criminal profiling. International Journal of Cyber Criminology. https://doi.org/10.5281/zenodo.3877668
Kazmali, A. S. (2025). Web scraping: Legal and ethical considerations in general and local context. Procedia Computer Science, 259, 1563–1572. https://doi.org/10.1016/j.procs.2025.04.111
Kello, L. (2021). Cyber legalism: Why it fails and what to do about it. Journal of Cybersecurity, 7(1), tyab014. https://doi.org/10.1093/cybsec/tyab01
Kemp, L., & Van der Hulst, M. (2020). Pathways into organized crime: Comparing founders and joiners. Trends in Organized Crime, 23(3), 203–226. https://doi.org/10.1007/s12117-019-09371-w
Kulesza, M. (2021). Criminalizing cybercrimes: Italian and Polish experiences. Białostockie Studia Prawnicze, 26(3), 115–130. https://doi.org/10.15290/bsp.2021.26.03.09
Lavorgna, A., & Sergi, A. (2014). Types of organised crime in Italy: The multifaceted spectrum of Italian criminal associations. International Journal of Law, Crime and Justice, 42(1), 54–72. https://doi.org/10.1016/j.ijlcj.2013.11.002
Leventopoulos, S., Pipyros, K., & Gritzalis, D. (2024). Retaliating against cyber-attacks: A decision-taking framework for policy-makers and enforcers of international and cybersecurity law. International Cybersecurity Law Review, 5, 237–262. https://doi.org/10.1365/s43439-024-00113-5
Lobascio, C. (2024). Tabella riassuntiva dell'evoluzione del diritto europeo dei dati e delle piattaforme. Rivista Italiana di Informatica e Diritto. https://doi.org/10.32091/RIID0173
Matsuoka, A. (2020). Remember the balance of forces. Journal of Financial Crime, 27(4), 1379–1388. https://doi.org/10.1108/JFC-09-2019-0119
Meccariello, T. (2026). Il cyberspazio tra impostazioni tradizionali e consolidamento normativo della 'riservatezza'. Rivista Italiana di Informatica e Diritto, 7(2), 139–146. https://doi.org/10.32091/RIID0257
Morgante, G. (2025). Transizione digitale e diritto penale. Dall'evoluzione delle categorie sostanziali al "nuovo volto" del law enforcement. Rivista Italiana di Informatica e Diritto, 7(2). https://doi.org/10.32091/RIID0254
Pattison, J. (2020). From defence to offence: The ethics of private cybersecurity. European Journal of International Security, 5(2), 233–254. https://doi.org/10.1017/eis.2020.6
Pepoli, V. S. Z. B. (2022). Profili di contrasto al cybercrime in iure condito e de iure condendo. Rivista Italiana di Informatica e Diritto, 4(2), 109–121. https://doi.org/10.32091/RIID0087
Perri, P., & Zanero, S. (2004). Lessons learned from the Italian law on privacy – Part II. Computer Law & Security Report, 20(5), 354–360. https://doi.org/10.1016/S0267-3649(04)00069-X
Pietropaoli, S. (2024). Un'occasione (forse) mancata. Considerazioni sulla revisione dei reati informatici proposta con il DDL Cybersicurezza. Rivista Italiana di Informatica e Diritto, 1(1), 106–127. https://doi.org/10.32091/RIID0153
Rampášek, M., Andraško, J., Sokol, P., & Hamulak, O. (2026). Hunting for vulnerabilities: Call for European protection of ethical hackers. Journal of Cybersecurity, 12(1). https://doi.org/10.1093/cybsec/tyag002
Rid, T., & Buchanan, B. (2015). Attributing cyber attacks. Journal of Strategic Studies, 38(1–2), 4–37. https://doi.org/10.1080/01402390.2014.977382
Russkevich, E. A. (2026). Criminal law compliance with cyber resilience testing of information systems: Penetration testing and bug bounty. Legal Issues in the Digital Age, 7(1), 141–163. https://doi.org/10.17323/2713-2749.2026.1.141.163
Sánchez-García, I. D., Gilabert, T. S. F., & Calvo-Manzano, J. A. (2023). Countermeasures and their taxonomies for risk treatment in cybersecurity: A systematic mapping review. Computers & Security, 128, 103170. https://doi.org/10.1016/j.cose.2023.103170
Thumfart, J. (2020). Public and private just wars: Distributed cyber deterrence based on Vitoria and Grotius. Internet Policy Review, 9(3). https://doi.org/10.14763/2020.3.1500
Zlati, G. (2024). Romanian jurisprudence on cybercrime: Focus on illegal access to an information system. ERA Forum, 25(3), 425–440. https://doi.org/10.1007/s12027-024-00810-y
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Tiberio Graziani (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
