title = "Cyber Rules of Engagement"

content = """
Cyber rules of engagement (ROE) define the legal and policy boundaries within which
the unit may take action on, through, or in cyberspace. Failure to operate within
ROE boundaries can constitute an unauthorized act under domestic and international law.

**Defensive vs. Offensive Authority:** The unit holds authority for defensive cyber
operations (DCO) only. DCO-internal actions (monitoring, blocking, isolating) on
assigned networks require no higher approval beyond unit-level authorization. DCO-
response actions that reach beyond the unit's assigned networks require explicit
approval from the appropriate commander and legal review.

**Active Defense:** Certain measures — such as deception technologies (honeypots,
honeytokens) and traffic redirection to sinkholes — are considered active defense.
These are authorized within assigned networks without higher approval, but deployment
must be documented and reported in the unit's active defense registry.

**Hack-Back Prohibition:** Retaliatory actions against systems believed to be used by
an adversary — commonly called "hack back" — are not authorized at the unit level
under any circumstance. All potential offensive responses are escalated to the
appropriate command authority with OCO authorities.

**Third-Party Network Considerations:** Even in an incident response context, the unit
may not access systems outside its AOR without a specific legal authority. This includes
commercial cloud environments used by adversaries, internet infrastructure, and systems
belonging to coalition partners without their explicit consent and a formal agreement.

**Documentation Requirements:** Every cyber action that is non-trivial (beyond standard
automated monitoring) must be documented in the operations log with: timestamp, action
taken, system affected, operator identifier, and authorization reference. This log
constitutes an official record and may be subject to legal discovery.
"""

version = "0.0.1"
