SAN FRANCISCO (Reuters) - A high-profile cybersecurity company that has pledged to respond to hackers with unusual aggression has hired the former commanding officer of a top U.S. information-warfare unit to spearhead the most direct counter-attacks.
CrowdStrike said the retired Air Force colonel, Mike Convertino, would coordinate the company’s offensive operations on behalf of corporate clients, aiming in some cases to disrupt the infrastructure of their attackers.
Convertino commanded the Air Force’s 318th Information Operations Group, which describes itself as the military’s “premier information warfare group.” More recently, he worked in a senior security role at Microsoft Corp.(MSFT.O)
Founded just a year ago, CrowdStrike has garnered attention through several early hires as well as its complaints about the prevailing approaches to cybersecurity. It has more than 60 employees and is based in Irvine, Calif.
The company’s founders include prominent veterans of No. 2 security software company McAfee, now part of Intel Corp(INTC.O) , but other executives include former FBI cybercrime chief Shawn Henry and Steven Chabinsky, an FBI legal specialist who joined last month as CrowdStrike’s top lawyer.
Most recently, Chabinsky has theorized that hacked companies could have legal protection if they find stolen data on criminals’ computers and then delete or encrypt it.
“If I tackle you on the street, that’s assault and battery. But if a few minutes prior you had taken my wallet, it’s completely legal, I‘m defending my property rights,” said CrowdStrike co-founder and Chief Technology Officer Dmitri Alperovitch.
Alperovitch and Convertino cautioned that the company is not currently going that far on behalf of clients.
Instead, they said they could act to disrupt criminal groups and state-sponsored hackers by misleading them or by publicly identifying the offending individuals and the companies that provide them with hosting and other services.
“Government is overwhelmed with the number of attacks from various nation-states, criminals and others,” Convertino said. “I do believe the legal system needs to allow a greater form of self-defense.”
CrowdStrike already offers assessment and intelligence services and is close to a test version of a core product, Alperovitch said.
(This story corrects misspelled name Dmitri Alperovitch In 7th paragraph.)
Reporting by Joseph Menn