The International Legal Framework for Hunt Forward and the Case for Collective Countermeasures

United States Cyber Command's “persistent engagement” strategy and “defend forward” operational concept have produced the “Hunt Forward” operation. As Cyber Command describes them, Hunt Forward operations are “strictly defensive operations” that Cyber Command conducts “at the request of partner nations.” Hunt Forward protects both US allies and the United States by blunting the harm of malicious attacks on shared networks, and it provides the United States with valuable intelligence about adversaries' methods. Cyber Command has publicly reported successful Hunt Forward operations in Ukraine, Latvia, Albania, Estonia, and other nations. This paper draws on publicly available sources, including Cyber Command reports and media commentary, to give a comprehensive picture of Hunt Forward's capabilities, operations, and limitations. The paper argues that Hunt Forward has already resulted in numerous successful operations around the world and benefited both the United States and its allies. The paper then analyzes the basis for Hunt Forward under international law and concludes that current operations, as publicly described, are permissible. The paper goes on to argue that although Hunt Forward is purely defensive, future collaborative operations should include assistance in degrading adversaries' ability to conduct malicious cyber campaigns against the United States and its allies. To provide further breathing space for collaborative operations, the global community should affirm the use of collective countermeasures, a concept that some countries, such as Estonia and Costa Rica, have embraced and that others, such as Canada and France, have questioned.