"Informed deliberations over whether corporations and individuals should be legally able to conduct threat-based deterrence operations against network intrusion, without doing undue harm to an attacker or to innocent third parties, ought to be undertaken."

"he Department of Homeland Security, the Department of Defense, and law enforcement agencies should have the legal authority to use threat-based deterrence systems that operate at network speed against unauthorized intrusions into national security and critical infrastructure networks."

Apart from the proposal that starts "In the future..." and ends "The Commission is not ready to endorse this recommendation", that's as crazy as it gets.

-------------

edit: after reading the boingboing article I see it's about 20 words and two out of context paragraphs.

The first paragraph specifically states that "such measures do not violate existing laws on the use of the Internet." It is simply recommending this as a measure to protect corporate IP, not as something that should be changed.

The second paragraph is immediately followed by noting that such actions are currently illegal, and then recommending deliberation on whether it should be made legal.

>>> that's as crazy as it gets.

Not really. If you read recommendations on page 81, it does not explicitly endorses, but consistently hints at the law as inadequate in areas where it prohibits discussed offensive techniques. See "second" and "finally" parts where it does not explicitly says the mentioned tactics should be allowed but again strongly hints the changes in the law should be made, and implies allowing such methods are those changes.

The issue of IP theft is not simply moral panic. There are national security implications, as we saw in the Chinese attacks on defense contractors.

(Not that I believe that embedded rootkits would have been helpful or anything)

Would I want the RIAA/MPAA to install rootkits in media files that are distributed to customers? Absolutely not.

Would I want the ability to install rootkits in engineering schematics and documentation that are never intended to be distributed outside of my organization and are only activated in cases where data theft has occurred? Absolutely.

I certainly have the right to disable my car remotely if it is stolen. I also have the right to lock the doors and take pictures of the assailant who stole it and send them to the police.

Wouldn't locking the doors effectively be kidnapping?

Especially as it is unlikely this would affect serious criminals: If tech like this becomes common, then nobody sane would open stolen files without ensuring it was done in a self-contained environment and with software that ought to be unable to execute any of this crap. It will be trivial to stop for all but people who are unaware.