At the RSA Conference Europe 2012 last week David and I explained how businesses can build a real Active Defense plan, as reported by The Register.

Companies and governments are constantly under siege by hackers and malware. Standard incident response is failing and police are overstretched. Faced by these challenges, small businesses have the option to actively respond against attackers rather than mounting only a passive defense.

Rather than jumping to the conclusion that any defensive action beyond currently accepted techniques is illegal, better and more effective options need to be considered, the argument runs.

Our presentation emphasizes the philosophy and law of self-defense and the need to formally document engagement rules and steps. After the presentation an audience member asked me to comment on the Clegg criminal law case from Northern Ireland.

I found this case described in detail at a school of law and in Cases & Materials on Criminal Law: Fourth Edition by Mike Molan

In relation to the first three shots, the judge accepted Private Clegg’s defence that he fired in self-defence or in defence of Private Aindow. But with regard to the fourth shot he found that Private Clegg could not have been firing in defence of himself or Private Aindow, since, once the car had passed, they were no longer in danger.

The situation involved soldiers on patrol who ordered a car to stop. When the car failed to follow orders it was fired upon. The soldiers’ claims were evaluated against scientific proof that a fourth shot hit the threatening vehicle after it had passed (entered it from the rear) and was more than 50 feet away. This contradicted Clegg’s testimony that he fired three shots through the front and the fourth shot through the side door as the car passed nearby. The judge thus ruled a fourth bullet was fired “with the intention of causing death or serious bodily harm” and Clegg was found guilty of murder.

YouTube has this archival video of the news with more detail, including an attempt by the soldiers to falsify proof of motive.

In a somewhat related news story of today, several Royal Marines have been arrested for how they handled a captured combatant. The arrests were based on video of the incident found on a laptop during a civilian investigation of one of the soldiers.

Footage discovered on a serviceman’s laptop prompted the arrest of seven Royal Marines on suspicion of murder over an incident in Afghanistan, Sky News has learned.

The Ministry of Defence (MoD) said the arrests by the Royal Military Police relate to an incident that happened after an engagement with an insurgent.

Sky sources revealed it only came to light following an arrest last week by civilian police – for a separate matter – of a man who had been serving in Afghanistan.

During that investigation, they had to look at his laptop – where they discovered a video that showed what were allegedly Royal Marines in a compound in Helmand Province with what appears to be an injured Taliban insurgent.

Sources say the clip contains a conversation about what to do with the injured man and whether to administer first aid.

Five soldiers have now been charged with murder.

Defense Secretary Philip Hammond pledged that any abuse would “be dealt with through the normal processes” of military justice.

“Everybody serving in theater knows the rules of engagement. They carry cards in their uniforms with the rules on them in case they should need to remind themselves,” Hammond told the BBC on Sunday.

These cases bring two points to mind.

First, defensive acts have to be measured and proportionate. Preparation and training are essential so action in the heat of the moment can be found reasonable. Some may see these as prohibitively costly calculations but let’s face it, organizations already are working on disaster recovery policy and procedures that do the same thing.

It is a cost relative to threats; a company that wants to stay in business simply has to do the math and make a business decision.

Second, even trained professional soldiers obviously can violate codes of conduct or rules of engagement. That is why formal documentation and verification of procedures are essential to the success of a defensive action.