Based on system management software, like HP OpenView or Tivoli, the system can look for false positives and reroute good data back into the network. Once the decoy server has the malicious code it can also track and trace the code back to its source.

"It becomes a back-hacking device," said Ciongoli.

It is less clear whether a country could pursue an information attacker electronically through the Internet, even if that pursuit required back-hacking through hubs in other countries, without violating the territorial integrity of those countries?

Intrusions into government computers are detected only about 10 percent of the time….It is relatively easy to mask the true identity of the attacker and to lay false trails to frustrate "back hacking."