Obama: Sony Attack ‘Vandalism’ Not War

President Obama believes the North Korean attack on Sony was "an act of cyber vandalism" rather than "an act of war."

computerlaugh

President Obama believes the North Korean attack on Sony was “an act of cyber vandalism” rather than “an act of war.”

CNN (“Obama: North Korea’s hack not ‘war,’ but ‘cyber vandalism’“):

President Barack Obama says he doesn’t consider North Korea’s Sony hack “an act of war.”

“It was an act of cyber vandalism,” Obama said in an interview with CNN’s Candy Crowley that airs Sunday on “State of the Union.”

But he stuck by his criticism of Sony’s decision to cancel its plans to release the movie “The Interview,” which depicts the cartoonish assassination of North Korean leader Kim Jong Un, after the country threatened attacks against theaters that showed it.

Obama said in a Friday news conference that Sony made “a mistake,” and that he wished the company had called him first. That led Sony executive Michael Lynton to tell CNN that Obama and the public “are mistaken as to what actually happened.” He blamed movie theater companies that opted not to show the film, saying they forced Sony’s hand.

Obama shot back, saying: “I was pretty sympathetic to the fact that they have business considerations that they got to make. Had they talked to me directly about this decision, I might have called the movie theater chains and distributors and asked them what the story was.”

The President told Crowley that his problem wasn’t with Sony specifically, but with the precedent the company’s decision set.

The FBI on Friday pinned blame for a hack into Sony’s computer systems on North Korea. Obama said both foreign governments and hackers outside government present cyber threats that are part of the modern business landscape.

“If we set a precedent in which a dictator in another country can disrupt through cyber, a company’s distribution chain or its products, and as a consequence we start censoring ourselves, that’s a problem,” Obama said.

“And it’s a problem not just for the entertainment industry, it’s a problem for the news industry,” he said. “CNN has done critical stories about North Korea. What happens if in fact there is a breach in CNN’s cyberspace? Are we going to suddenly say, are we not going to report on North Korea?

“So the key here is not to suggest that Sony was a bad actor. It’s making a broader point that all of us have to adapt to the possibility of cyber-attacks, we have to do a lot more to guard against them.”

I may be stunningly naive about how American politics works in our increasingly bifurcated economy. Does the president of Sony really have the president of the United States on speed dial? Is it customary for corporate executives to call up the leader of the free world for advice on product releases? For that matter, given that the story was playing out in real time through the mass media, couldn’t Obama have had someone on his staff ring up Lynton and say, “Hold for the president of the United States, please”? I’m guessing he’d have taken the call. I mean, Obama apparently has time to call up all the theater owners and distributors; why not call Sony first?

But that’s a trifling matter compared to the real public policy matter here: drawing a line between “cyber vandalism” and “cyber war.”

I’ll have to read the full interview transcript but I gather the president is talking here only about the initial server hack. If so, I’d quibble only a bit. While I wouldn’t call a state-supported effort to hack into corporate servers in an attempt to subvert the release of a politically sensitive motion picture an act of war, I’d say it goes well beyond mere “vandalism.” It’s a major crime, but not one that calls for a kinetic military response. To rise to the level of an act of war, a cyber attack would have to be aimed at critical infrastructure (power grids, transportation systems, and the like) or major military systems.

Combining the initial hack with terrorist threats against movie theaters, however, would certainly constitute an act of war if the two are coordinated. If the North Korean government is reasonably believed to be behind the threats against theaters, then I’m absolutely in support of major retaliation from the US government, to include targeted military action if deemed feasible, for precisely the reasons the president laid out.  We simply can’t set a precedent to allow governments of other countries to hack into American systems—even broadly defined to include those whose corporate headquarters are actually Japanese—and hold us hostage with terroristic threats. And it’s not up to our corporations to fight that battle; international relations are fundamentally a government-to-government enterprise.

Yes, our government should urge—if not mandate—higher levels of cyber security for businesses holding sensitive information. Cyber defense is an incredibly complicated and expensive endeavor and requires public-private partnership given that the implications go far beyond the bottom line and reputation of individual corporations. But what’s happened here goes well beyond corporate espionage, much less “vandalism.” Indeed, even if Sony’s servers had remained secure, it’s probable that the terrorist threats against theaters would have been enough to stop the release of “The Interview.” And, again, it’s not up to our movie companies and theater chains to take on that fight.

FILED UNDER: National Security, Science & Technology, , , , , , , ,
James Joyner
About James Joyner
James Joyner is Professor and Department Head of Security Studies at Marine Corps University's Command and Staff College. He's a former Army officer and Desert Storm veteran. Views expressed here are his own. Follow James on Twitter @DrJJoyner.

Comments

  1. Cheryl Rofer says:

    I haven’t read the full transcript either, but this is a good corrective to the heavy-breathing headlines about “Obama Vows” retaliation for the attack in some form.

    “Vows” is a nice short word for headlines, which is a big part of the reason it gets used. And North Korea would love to rise to the importance of having an American president “vow” “war” against it. So Kim Jong Un thanks the American media.

    But I didn’t hear a vow in Obama’s press conference. He did say the US would respond in some way at some time, which seems reasonable. He didn’t hold up his right hand and say “As God is my witness…” It was pretty low-key. And I suspect he’d like to keep it that way.

    A number of years ago, before the word was fashionable, a publisher asked me and another strategist if we could write a book on cyberwar. We looked at it for a month or two, tried to develop an outline, and wound up telling the publisher that there was no such thing as cyberwar and never would be. I’ll stand by that. Vandalism sounds right.

  2. James Joyner says:

    @Cheryl Rofer:

    We looked at it for a month or two, tried to develop an outline, and wound up telling the publisher that there was no such thing as cyberwar and never would be. I’ll stand by that. Vandalism sounds right.

    Jason Healey, who runs the Atlantic Council’s Cyber Statecraft Initiative and was previously the top White House official on cyber matters, says much the same thing, pointing out that nobody has yet died in a cyber war. But he and another cyber expert at the Council, Frank Kramer (a DOD undersecretary in the Clinton administration) make the distinction that I’ve cribbed from in the OP: that it’s possible that we’ll have a cyber war in the future because there are ways to kill people by hacking critical infrastructure, etc.

    But, as noted above, the possible “act of war” here isn’t the hacking but the threats to blow up theaters. And they’re only an act of war if they’re state-sponsored.

  3. C. Clavin says:

    Reprehensible cop assassination in NYC.
    http://m.huffpost.com/us/entry/6360434

  4. C. Clavin says:

    We should take away their internet for a week. Treat the child-king like a child.
    Or drop a bunker-buster on his head.
    Either one.

  5. Ben Wolf says:

    If North Korea hacked a coffee shop in Tampa, is thst sufficient cause for a “major response?”

  6. James Joyner says:

    @Ben Wolf: No. As the post should make clear, I agree with the president that the hacking of Sony’s servers is not an act of war and therefore does not warrant a military response. Threatening acts of terrorism, however, may well warrant a military response.

  7. Dave Schuler says:

    Returning to what I wrote in a previous comment, I think we should consider carefully what we consider to be an act of war.

    1. Will we limit “acts of war” to attacks on government property with attendant loss of life by a foreign government?
    2. Is an attack on private property by a foreign government without attendant loss of life an act of war?
    3. Are attacks that issue from totalitarian states “by foreign states”?

    I think that if we can confidently assign a North Korean origin to the hacking itself, it constitutes an act of war. However, since to the best of my ability to determine all of North Korea’s communications links that connect the country to the Internet go through China, our first responses should be intended to raise the cost of China’s sponsorship of North Korea. That’s something short of a military response or even a cyber counter-attack.

  8. Ben Wolf says:

    @James Joyner: You did make yourself clear: my question is directed at those commenters eager to blow something up, although I suppose I could have specified that.

  9. Dave Schuler says:

    Not all acts of war deserve a military response. To use the example of a North Korean hacking attack on a coffee shop, no, it would not warrant a military response.

    The estimates I’ve seen of the cost of the hacking attack to Sony Pictures Entertainment (an American company incorporated in the state of Delaware) are in the hundreds of millions of dollars. That’s clearly in a different category.

  10. edmondo says:

    Cyber defense is an incredibly complicated and expensive endeavor and requires public-private partnership

    We already have that. It’s called the NSA. And there doesn’t seem to be much of a defense against it.

  11. Ben Wolf says:

    @Dave Schuler: This event may well be the result of someone in cyberspace cracking Sony, then offeringg access to North Korea and other “customers” afterward. So far all the FBI has is an IP address.

  12. C. Clavin says:

    @Ben Wolf:
    Sorry…the bunker buster comment was in jest.
    I thought that was obvious.
    My bad.

  13. edmondo says:

    @Dave Schuler:

    That’s clearly in a different category.

    I understand that America is now the world’s Hessian Army, available for pick up wars to whomever is the highest bidder, but can we draw the line that we aren’t going to war to keep a company’s bottom line fattened – unless it’s one of the Wall Street banks or one of the for-profit insurance companies (They are systemic and worth every drop of spilled American blood, after all.)

    Can we save the war mongering for something important, not just to defend the Sony shareholders’ dividend check?

  14. Dave Schuler says:

    @Ben Wolf:

    That’s why I qualified my remarks as I did. I don’t know what evidence the FBI or any other government agency has.

    I also think that North Korea’s proposal of a joint U. S.-Chinese-North Korean investigation is risible. When your neighbor’s dog bites your kid, you don’t include the dog as a participant in the ensuing discussion.

  15. Dave Schuler says:

    @edmondo:

    Go back and read what I’ve written. I’m not proposing war. I’m proposing diplomacy.

    From your comment I gather that you have no problem with state-sponsored piracy. Is that correct?

  16. Cheryl Rofer says:

    @James Joyner: I still think the hacking infrastructure threat is vastly overblown, but if corporations don’t get their cybersecurity act together, some damage might be done.

  17. OzarkHillbilly says:

    I would think it obvious that this rises well above a mere act of vandalism and well short of an act of war. As to what a proportional response would be, I haven’t a clue. There probably aren’t more than a few dozen computers in the whole country, and it isn’t even possible to bomb them back to the stone age as most of them are already there.

  18. James Joyner says:

    @edmondo: Their activities are highly classified, so I don’t have a firm handle on what NSA does. That said, I don’t think they’re more than tangentially involved in cyber security for the private sector. Even US Cyber Command–which is commanded by the same guy who runs NSA–is mostly engaged in offensive operations and defending the .mil domain rather. I’d presume most US Government responsibility for such things as the Sony hacking falls under DHS.

  19. I have to agree that this goes well beyond vandalism but stops short of war. Of course, in this case I will actually give Obama the benefit of the doubt in that the POTUS needs to be very careful with his language in accusing another country at times, this being one of those.

    Could we call this cyber-terrorism? It was certainly meant to change the policies of the US and Sony, scaring people.

    But, what can be done? Sanctions have little effect on NK’s economy, such as it is. And the biggest danger lies in the fact that Seoul lies 30 miles south of the DMZ, well within range of NK’s nuclear, chemical, biological, and standard arms.

  20. gVOR08 says:

    “No Drama Obama” is not going to draw a line in the sand and strut around proclaiming that he’s gonna show those Commies who’s boss. As with Putin, it’s so much easier for them to back down if they can do so quietly. It works better if we don’t brag about it. If Obama does something, KIm Jong Un and the NK hackers will know about it. We probably won’t.

    All politicians lie. Powerful people, Presidents especially, need to be very careful about what they say as their words carry weight. James treads on a pet peeve of mine. The available facts warrant reporting “Obama said” thus and so, they don’t warrant saying “Obama thinks” thus and so.

  21. gVOR08 says:

    Caption contest entry – You’re right, Sony should have used Macs.

  22. James Joyner says:

    @gVOR08:

    The available facts warrant reporting “Obama said” thus and so, they don’t warrant saying “Obama thinks” thus and so.

    True. I’m taking the president at his word here. I get that he has to be careful. But “vandalism” is a very odd choice of words and I hope he actually “thinks” that it’s more than vandalism. But, again, all I have to go on is what he says unless and until he does something that’s in contradiction.