Sony hacking shows all’s fair in a cyberwar

David E Sanger

Dec 25, 2014

WASHINGTON: For years now, the Obama administration has warned of the risks of a "cyber-Pearl Harbor", a nightmare attack that takes out America's power grids and cellphone networks and looks like the opening battle in a full-scale digital war. 

Such predictions go back at least 20 years, and perhaps that day will come. But over the past week, a far more immediate scenario has come into focus, first on the back lots of Sony Pictures and then in back-to-back strategy sessions in the White House situation room: a shadow war of nearly constant, low-level digital conflict, somewhere in the netherworld between what President Obama called "cybervandalism" and what others might call digital terrorism. 

In that murky world, the attacks are carefully calibrated to be well short of war. The attackers are hard to identify with certainty, and the evidence cannot be made public. The counterstrike, if there is one, is equally hard to discern and often unsatisfying. The damage is largely economic and psychological. Deterrence is hard to establish. And because there are no international treaties or norms about how to use digital weapons — indeed, no acknowledgment by the US government that it has ever used them itself — there are no rules about how to fight this kind of conflict. 

"Until now, we've been pretty ad hoc in figuring out what's an annoyance and what's an attack," James Lewis, a cyberexpert at the Center for Strategic and International Studies, said last week. "If there's a lesson from this, it's that we're long overdue" for a national discussion about how to respond to cyberattacks — and how to use America's own growing, if unacknowledged, arsenal of digital weaponry. 

All those issues have been swirling in the background in the drama of North Korea's effort to intimidate Sony Pictures, and the retaliation by the US — if that was the case — against one of its oldest Cold War adversaries. 

"If you'd told me it would take a Seth Rogen movie to get our government to really confront these issues, I would have said you are crazy," one senior defense official said a few days ago, referring to the Sony Pictures film 'The Interview'. "But then again, this whole thing has been crazy." 

Like most cyberattacks, it started with a simple question: Who did it? But this was no ordinary effort to steal credit card data. What made it different was its destructive nature. By some accounts, it wiped out roughly two-thirds of the studio's computer systems and servers — one of the most destructive cyberattacks on US soil. 

It took three weeks for Mr. Obama to take the extraordinarily rare step of publicly identifying North Korea, and its leadership, as the culprit. But Washington's declaration came paired with Obama's warning of a "proportionate response". But that leaves him with a "short of war" conundrum. How much American power should be deployed to stop a cybervandal from becoming a cyberterrorist? The mystery now is whether the young, untested Kim will back off, or whether he will push ahead, figuring that an unpredictable North Korea has kept enemies at bay for 60 years, and that his new weapon may extend the streak.