House Panel Urged to Rethink Cyber Restraint, Consider Broader Counterattack Authority

Lawmakers on a House Homeland Security subcommittee heard testimony Tuesday urging the United States to abandon what witnesses described as an overly cautious approach to cyber conflict and to consider loosening restrictions on both government and, potentially, private-sector responses to foreign cyberattacks. Appearing before the cybersecurity and infrastructure protection subcommittee, experts argued that Washington’s long-standing fear of escalation in cyberspace has failed to deter adversaries and may have instead emboldened them.

Calls to Move Beyond Cyber Restraint

Joe Lin, chief executive of cyber warfare firm Twenty Technologies Inc., said U.S. policymakers have wrongly treated offensive cyber operations as uniquely dangerous. In written testimony, Lin argued that the government’s reluctance to respond forcefully has produced a cycle of repeated intrusions followed by limited diplomatic protests or sanctions.

“Restraint was supposed to prevent escalation,” Lin wrote. “In reality, it has created an environment where adversaries feel free to keep pushing.” Similar concerns were raised by Emily Harding, vice president at the Center for Strategic and International Studies’ Defense and Security Department. Harding told lawmakers that traditional deterrence concepts have not translated well into the cyber domain.

‍

“The United States has responded to cyberattacks in limited ways, and escalation dominance simply does not exist online,” Harding said in her testimony. To restore deterrence, she argued, cyberattacks should be viewed as hostile acts rather than unavoidable annoyances.

Adversaries Operating in a Gray Zone

Harding added that countries such as China, Russia, Iran, and North Korea operate with a blurred distinction between peace and conflict, using cyber operations as a routine tool of competition rather than a last resort. While several witnesses endorsed a more assertive cyber posture, others emphasized that offensive operations must be matched with stronger domestic defenses. Frank Cilluffo, director of the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University, warned that counterattacks abroad could trigger retaliation at home.

‍

Cilluffo said the Department of Homeland Security, particularly the Cybersecurity and Infrastructure Security Agency, would need to play a central role in hardening U.S. networks and coordinating with critical infrastructure operators to absorb potential blowback. He also suggested that private companies could play a limited role in active cyber defense, noting that many of the most advanced cyber capabilities such as threat intelligence, rapid response, and large-scale mitigation tools—reside in the private sector rather than within government agencies.

‍

At the same time, Cilluffo acknowledged unresolved questions about how far private actors should be allowed to go, how their actions would be overseen, and how civil liberties and escalation risks could be managed. Not all witnesses supported expanding private-sector authority. Drew Bagley, chief privacy officer at CrowdStrike Holdings Inc., cautioned that reviving “hack back” policies could create more problems than they solve.

‍

Bagley said early debates over hack-back authority were driven by relatively unsophisticated attacks in which stolen data was sometimes left exposed. Today’s cyber operations, he said, are far more complex, making retaliation riskier.

Risks of Escalation and Collateral Damage

“A broader set of actors conducting offensive actions could result in collateral damage, disrupted investigations, and escalation along sensitive geopolitical fault lines,” Bagley warned, arguing that cyber offense should remain in the hands of government professionals operating under clear legal authority and oversight.

‍

Members of Congress signaled growing interest in revisiting U.S. cyber strategy. Subcommittee Chairman Rep. Andy Ogles (R-Tenn.) said that years of investment in cyber defense and resilience have improved survivability but have not changed adversary behavior.

‍

“Defense by itself hasn’t been enough,” Ogles said. “Without credible offensive capabilities, deterrence in cyberspace simply doesn’t exist.”

Allies and Norms Still a Concern

Rep. Bennie Thompson (D-Miss.), ranking member of the full Homeland Security Committee, voiced cautious support for a tougher cyber stance but stressed the importance of coordination with U.S. allies.

‍

“If we are going to shift norms around offensive cyber tools, we need to do it alongside our partners,” Thompson said. “Going it alone would carry its own risks.”

‍

The hearing underscored bipartisan concern that existing cyber policies may be outdated, even as lawmakers remain divided over how far the United States and the private sector should go in taking the fight back to its digital adversaries.