No one should underestimate the historic importance of the North Korean cyberwar against America and the collapse of American defenses in the Sony Pictures attack.
This was not some amusing pop culture event in which a few “hackers” played games with celebrities.
This was not an entertaining series of embarrassing leaks that allowed us to learn how viciously and nastily some senior Hollywood bosses write about famous movie stars in internal emails.
This was a deliberate assault on sovereign American soil against an American company, costing it millions of dollars in direct damages and hundreds of millions in reputational damages while blocking most of its employees from using their internal systems to get routine work done.
This was a threatened physical assault against moviegoers and movie theaters nationwide if they ignored the cyberattack and dared to laugh at the North Korean dictator Kim Jong Un.
Some commentators criticized the movie theaters for their “cowardice” in not standing up to the threats. Others criticized the rest of the movie industry for not coming to the defense of Sony.
Both critiques miss the core reality.
Private companies can’t fight sovereign nations.
Private companies cannot be asked to risk the lives of their employees and their customers because of an unanswered foreign threat of violence.
Defending America against foreign enemies is the duty of the United States government. To “provide for the common defense” is one of the reasons given in the preamble to the Constitution for forming a government.
This attack on American interests began on November 24 when there was a massive hacking assault on Sony. After 24 days of government passivity and ineffectiveness, the theaters caved to the threat of terrorist attacks.
Thus with more than three weeks to find and defeat the attackers, the American government proved to be impotent.
This attack is pure cyberwarfare.
There is a big difference between hacking for intellectual property theft and hacking to coerce a change in behavior.
The former is a crime. The second is an act of war.
The real danger is that this incident will become a precedent. Other countries and other terrorist groups will conclude that it is open season on American interests and even American lives. American companies will begin (in fact have already begun) self-censoring to avoid offending dictators and terrorists. The enemies of our freedoms will have won.
We need three decisive steps to react to this defeat in a cyberwar.
First, we have to go on the offense in this campaign and refuse to accept that the fight is over. North Korea must be made to pay an extraordinary price for this attack. One step might be to simply confiscate North Korean ships until the dictatorship pays triple damages to Sony and the theaters for the cost of its attack. What must not happen is for the American people to be told it is too hard or too dangerous to defend America against an out-of-control dictatorship. That could lead to anarchy and chaos, with every predator on the planet feeling they have the right to wage cyberwar against Americans.
Second, we should develop an immediate response capability to defend American interests and crush cyberopponents immediately. The time to hit back hardest was November 24, the day the attack began. We need protocols to enable companies and the federal government to spot an assault, report it and respond to it in virtually real time. This will require the creation of a command center — comparable to the air traffic control system in its speed of response — for the government and private companies to cooperate on cyberattacks
Third, we must develop vastly better defensive and offensive capabilities. This will require considerable congressional involvement in thinking through the realities of the emerging permanent cyberdangers and the patterns of cyberwar.
No one should kid themselves.
We have now entered the age of cyberwar and we lost a major round in that war. The longer it takes us to confront this fact and take the necessary corrective actions, the greater our vulnerability to another defeat will be.