President Obama on Friday formally blamed North Korea for the cyberattack against Sony Pictures that crippled the company's digital infrastructure and saw employees reduced to working with pen and paper even as some of their most embarrassing emails were leaked online. Some pundits called the hack "effectively an act of war.”
Obama said America’s response would come “proportionally, and in a place and time we choose,” but he did not elaborate. “We have been working out the range of options that will be presented to me,” he said while delivering his year-end message from the White House.
The question now is what the United States realistically can do to an impoverished, technologically stagnant nation that, despite its stature, remains a threat to stability on the Korean peninsula and East Asia more broadly.
The Federal Bureau of Investigation believes the hack was likely carried out by North Korea's "Unit 121," a cyberwarfare division of the North Korean military that operates out of China. It might fall to the United States Cyber Command, an armed forces unit based in Ft. Meade, Maryland, to devise a response.
USCC is secretive about that tools in its digital arsenal, but some experts believe the U.S. has in the past used computer malware as an offensive weapon. The Stuxnet virus, which infected Iran’s nuclear facilities in 2010, may have originated in part from USCC, though this has never been confirmed. Officials from U.S. Cyber Command did not respond to a request for comment.
Cyber Command could conceivably launch a Stuxnet-style attack against the servers that run North Korea’s critical infrastructure. But any strike would most likely be a symbolic effort, said Scott Snyder, director of the Program on U.S.-Korea Policy at the Council on Foreign Relations. "The challenge is going to be to explain clearly the rationale for doing that," said Snyder.
The United States could also hit financial institutions that do business with North Korea. It blocked a bank in Macao in 2005 from carrying out U.S. dollar-denominated transactions for trading with the rogue nation. "That might be another way of doing this kind of thing," said Snyder.
Observers say the U.S. would not necessarily limit its response to the digital realm, and that high-level officials will be sorting through a range of options in the days to come. The "cyber-area is simply one tool in a much larger toolbox," said one expert on the region. There is no historical precedent for U.S. military action in response to a solely digital attack.
The incident began late last month after Sony acknowledged it had been hacked by an outside organization that gained access to its email servers and other critical systems. The studio said this week that it would not release "The Interview," a comedy whose plot pivots around an attempt to assassinate North Korean leader Kim Jong Un, in light of threats against cinemas slated to screen the film.
Some theaters opted to show "Team America: World Police," the political comedy about North Korea that features marionettes, but distributor Paramount put an end to those plans as well.