Way back in February, a Georgia Republican introduced a bill to Congress to give legal protection to hacking victims who “hack back” at attackers. The law is continuing to wend its way through the legislative process and might just end up (in some form) as a real a law.

That’s right: you could hit the bad guys back—and hard.

“This bill is about empowering individuals to defend themselves online, just as they have the legal authority to do during a physical assault,” said Rep. Graves in a press release dated March 3, 2017.

ACDC would allow victims of cybercrime to gain unauthorized access to their attackers’ systems legally as long as their actions are only meant to identify the attacker or disrupt the attack. The bill doesn’t allow retaliation that destroys the attacker’s data, causes physical injury, or “creates a threat to the public health or safety.”

Though the bill may never become law in this form, it’s certainly opening discussions around “hacking back,” and raising awareness of the difficulty in stopping criminal cyber activity.

High Return, Low Risk. What’s Not to Like?

Attackers work anonymously and, largely, with impunity. Billions of dollars are stolen each year, with little to none of it recovered, and the criminals are rarely caught. Even when they are, it’s difficult to prosecute them—it can take years to track them down, build a case, indict and convict them. Moreover, some countries or regions tolerate—or even profit from—cybercriminals’ activities, and offer little help to or even thwart international law enforcement efforts.

If the incentives are good, and the risks low, powerful cybercrime syndicates will continue. And as things currently stand, the law limits CISOs’ options. The hope among leading CISOs is that shifting to offense will change the game. After all, the adversary remains ahead if you simply react to every problem defensively.

But, Hacking Back is Never as Simple as It Sounds

First there’s the issue of “attribution.” How do you correctly identify your attacker? It’s not as easy as it sounds.

What if an attack comes from a botnet? Not one computer, but thousands or millions spread over the globe. Owners of botnet computers may not know they’re contributing to an attack. If your attacker is somewhere in the cloud, good luck finding her. Are you going to strike back against your cloud provider? They’re potentially innocent middlemen.

Second, ACDC wouldn’t allow striking back against distributed denial-of-service (DDoS) attacks, for example, a common attack. DDoS attacks don’t involve unauthorized access. And who are you going to blame? Typical DDoS attacks come from devices that are part of the Internet of Things (IoT). Say Grandma’s digital picture frame routed requests in a DDoS attack—are you going to hack back against Grandma?

Third, what if your attacker is not on US soil? You will not be legally protected if you’re retaliating in another country with different laws. In fact, you could find yourself being the one carted off by the police or buried in lawsuits.

Strike Back Already Exists for the Largest Tech Players

If the problem is large, those with resources—primarily large IT vendors—will work with law enforcement to stop attackers. When your actions are sanctified by the authorities, it isn’t vigilantism. It helps if you’re a large company with a good legal team. In fact, many large IT vendors hire ex-DOJ prosecutors and investigators as company liaisons with law enforcement.

How You Can Strike Back Now

Hack backs can take several forms that you can take advantage of without the additional legal protection of the proposed ACDC law.