North Korean leader Kim Jong-un, waves as North Korean military officers clap during a mass meeting of North Korea's ruling party at a stadium in Pyongyang, on April 14, 2012.
What seemed an unlikely twist in a cheap Hollywood thriller is now reality: the U.S. government has publicly accused North Korea of hacking Sony.
Uncle Sam's finger has been pointed, and President Barack Obama has made a promise to respond "proportionately" sometime in the future. Meanwhile, North Korea has denied any responsibility and even offered to help in a joint investigation.
But what can the U.S. actually do to retaliate or answer the cyberattack that led to the destruction of various Sony Pictures computers as well as the leak of around 200 gigabytes of internal data, which exposed salacious private emails, corporate secrets, as well as Sony's embarassing security practices?
If there's one thing experts agree on, it's that the answer to that question is very complicated.
"When it comes to North Korea, there are no good options,"Jason Healey, a founding member of the Pentagon's first joint cyberwar unit and now director of the Atlantic Council's Statecraft Initiative, told HDT.
And it's not just about cybersecurity. It's about how to punish and deter what's pretty much a pariah state whom the U.S. has struggled to punish and deter for decades, "long before James Franco and Seth Rogen were in Freaks and Geeks," said Peter W. Singer, the author of Cybersecurity and Cyberwar: What Everyone Needs to Know, and the strategist and senior fellow at New America foundation.
With that in mind, here's what the Obama administration can do.
By fetishizing 'attribution' for years, US ignored real issue: What do you actually do against China, Norks, Iran, Russia when you catch 'em— Jason Healey (@Jason_Healey) December 18, 2014
The cyber option
The most predictable solution would be to strike back in the same realm where North Korea struck. But there are many problems with this.
Firstly, the regime of Kim Jong-un, as Singer puts it, it's not "a highly wired kingdom." Its Internet infrastructure is very limited, and there just aren't that many targets you can actually hit, according to many experts.
Moreover, Obama talked about a "proportional" response. What would that be in this case? North Korea hit a private company and exposed its internal secrets, it didn't hit the American military or its critical infrastructure, contrary to what Richard Haass, the president of the Council on Foreign relations, suggested on Friday.
how to respond to #NorthKorea: 1 idea: response in kind, ie, a cyber assault, that would target political, military pillars of the regime— Richard N. Haass (@RichardHaass) December 19, 2014
"A response in kind would be releasing something embarrassing about them, like, oh, I don't know, a silly movie about their leader," Singer told HDT, laughing.
If the attack was still ongoing, Healey explained, then the U.S. could probably do something to stop it in cyberspace. But that's not the case here, the damage is done, and the hacking operation is complete.
The options, thus, are very limited. And there's the added complication that the NSA might have a foothold inside North Korean networks for surveillance purposes. If the U.S. exploits that for a cyberattack, it risks exposing the NSA's reach, potentially preventing it from conducting further espionage activities, according to experts.
But there's yet another possibility in cyberspace. Instead of going after North Korea, go after the black market that provided the hackers with the tools they used to hack Sony. The hackers used off-the-shelf malware to wipe Sony's computers, a cyberweapon they probably bought on the Internet black market. Go after these illicit cyber weapon bazaars, Singer argued, and you can stop some future attacks from happening.
The military option
On Friday, President Obama was asked specifically if he would rule out a military response to the Sony hack, but he declined to answer. Despite his non-answer, we can probably rule out a strikeback in real life — as that would hardly be a proportional response to North Korea's actions in cyberspace. (Remember, we're still talking about just a hack on a private corporation.)
The economic options
Increasing sanctions would be another obvious response. The problem is, the United States already has extensive economic sanctions against the regime, and a practically non-existent commercial relationship with it. Last year, U.S. exports to North Korea amounted to $21.9 million, a risible amount. (For comparison, U.S. exports to South Korea amounted to $37.2 billion.)
Moreover, all the sanctions in the past few decades have hardly deterred the country from making defiant threats, or launching illegal nuclear tests. Why would that change now?
For Joshua Stanton, a lawyer and blogger who has advised the U.S. House of Representatives’ Foreign Affairs Committee on North Korea sanctions legislation, there are other options, though, such as blocking the financial assets of North Korean officials and the government itself.
"The single biggest thing that we can do is to designate the country as a primary money-laundering concern," Stanton told The Wall Street Journal. That would push banks around the world to limit their transactions with the country.
The legal option
Earlier this year, after months of high-profile cyberattacks allegedly conducted by Chinese state-sponsored hackers, the U.S. charged five members of China's People Liberation Army with hacking and cyberspying — an unprecedented step to deter China.
If the FBI was able to identify the actual people behind the attack on Sony, it could do the same. The problem is, it's unclear whether the FBI has that much evidence even linking North Korea to the attack, let alone individual people.
Plus, even if the FBI did know who they were, "it's not like you're going to get these individuals," Singer said. The U.S. would have to get North Korea or perhaps China (if the hackers were based there) to extradite them, which is an unlikely scenario.
"They are not going to ever see a courtroom," Singer said.
The diplomatic option
As we've already pointed out, the U.S. and North Korea have almost non-existent diplomatic relations. But there is something the U.S. can do, as Healey explained in an article on Friday.
The idea is to get China, a key ally of Kim Jong-un, to condemn the attacks publicly and push North Korea behind the scenes to put an end to these kinds of activities. China has some leverage with North Korea and could even stop them themselves, Healey said, since most North Korean hackers are believed to operate inside China's boundaries.
Another option would be to get the United Nations to issue a resolution condemning this attack. But, according to Singer, this would hardly have any effect. Otherwise, the U.S. could designate North Korea as a nation sponsoring terrorism, another option that experts doubt will change much.
So what's gonna happen?
At this point, it's too early to tell. Obama didn't want to commit to anything, but after his press conference, officials reportedly delivered a series of potential responses the president.
Experts aren't too sure, however, that we're actually going to see any meaningful action.
"Other than some type of 'shame on you North Korea' and 'we don't like you for doing this,'" Jeffrey Carr, a cybersecurity expert and CEO of Taia Global, told HDT, "I frankly don't know what other options there are."
Healey noted that the U.S. didn't go much farther than that after North Korea sunk a South Korean ship killing 46 sailors in 2010. At the time, the U.S., a military ally of South Korea, simply condemned the attack.
"And that was for dead people," Healey said, adding that the U.S. can't afford to go too far in its response and risk provoking an "unstable" country.
"Right now, all we've got is an attack on freedom of expression. So I don't see us being more muscular now than we had been."
In Carr's view, a response from the U.S. may not even be necessary.
"Respond to what?" he asked rhetorically. "Respond to the fact that a U.S. company got its network completely owned by hackers? That happens every day."
(Note: Although Sony Pictures is based in the U.S., largely run by American staffers, it is a Japanese-owned company, whose headquarters are in Tokyo, Japan.)
In fact, as Motherboard's Jason Koebler rightfully noted, the U.S. barely did anything in response to China's many hacks, including one in which the hackers stole sensitive U.S. military blueprints.
Remember, China stole a goddamn stealth fighter from us & no one cared.http://t.co/KXcKY8cv7C pic.twitter.com/bf5KTojZ09— Jason Koebler (@jason_koebler) December 19, 2014
Further complicating any response, there's the elephant in the room of the NSA, an agency which, along with its British ally the GCHQ, has carried out dozens of hacking operations around the world, even against private companies like Huawei and the Belgian telecom provider Belgacom. How can the U.S. condemn another country for a similar action?
What idiot government set the precedent that nation states can attack companies? Wait, no, don't answer that.— Jack Daniel (@jack_daniel) December 19, 2014
But in Healey's view, past precedents don't matter. He feels the attack deserves an answer.
"We have no fucking moral standing to come out and really start talking about what you ought and ought not do," he said. "But you know what? We have to."
Tags: FILM, HACKERS, HACKING, NORTH KOREA, SONY, SONY HACK, SONY PICTURES, U.S., US & World, WORLD