According to U.S. law, the North Korean hack attack on Sony, and subsequent threats against Sony and its distributors (and moviegoers), were acts of “international terrorism” within the meaning of 18 U.S.C. Sec. 2331, which defines the term for purposes of the terrorism statute:
As used in this chapter—(1) the term “international terrorism” means activities that—
(A) involve violent acts or acts dangerous to human life that are a violation of the criminal laws of the United States or of any State, or that would be a criminal violation if committed within the jurisdiction of the United States or of any State;(B) appear to be intended—
(i) to intimidate or coerce a civilian population;(ii) to influence the policy of a government by intimidation or coercion; or(iii) to affect the conduct of a government by mass destruction, assassination, or kidnapping; and(C) occur primarily outside the territorial jurisdiction of the United States, or transcend national boundaries in terms of the means by which they are accomplished, the persons they appear intended to intimidate or coerce, or the locale in which their perpetrators operate or seek asylum.
I’ve highlighted the key terms. Cyber-attacks on critical infrastructure, to make no mention of threats of violence, are “violent acts” or “acts dangerous to human life” and “a violation of the criminal laws of the United States”; North Korea’s actions were explicitly “intended . . . to intimidate or coerce a civilian population”; and these “transcend[ed] national boundaries in terms of the means by which they are accomplished.” This wasn’t like normal hacking for the purpose of theft of intellectual property or espionage. It wasn’t vandalism. North Korea intended to intimate and coerce U.S. citizens, and it succeeded.
The only element of the legal definition that is even potentially subject to doubt is the first, namely whether the Sony hacks would be deemed “dangerous to human life.” The answer is categorical: Hack attacks on critical infrastructure are dangerous as a category, whether these specific attacks endangered anybody. Detonating a bomb in the middle of nowhere may not endanger anybody, but it’s still a dangerous act. Plus there’s no doubt that threatening moviegoers is a violent act. But if the administration thinks there is any doubt on that score, Congress should act immediately to amend the terrorism statute so as to remove any doubt that this is “terrorism” and not just “vandalism.”
And while it’s amending that law, Congress should explore ways of providing companies like Sony the cyber-equivalent of “Letters of Marque and Reprisal” to authorize them to act directly against North Korea and its agents through cyber warfare. If you think that’s idle bluster, consider the problem from an international-law point of view: The territorial protection of a sovereign state is largely useless to protecting legitimate global networks (such as multinational corporations) from the cyber-attacks of global terrorists networks, and international law hasn’t even begun to develop the necessary rules of the road.
The North Korea attack is a harbinger of things to come. It could be just the start of a tsunami that might quickly make our public discourse subservient to rules imposed by terrorists and tyrants. Transnational institutions such as multinational corporations need to be able to defend themselves, including through the use of hack-back counter-attacks.
Meanwhile, Obama’s decision to call this “vandalism” rather than “terrorism” appears to imply that, while he might have some sort of response, we’re basically on our own in terms of self-defense against cyber-terrorism. And while we figure that out, he will apparently be lecturing us on how we should conduct our private behavior in response to international terrorism that he refuses to defend us against, or even call by its proper name.
There is a silver lining, however. At least he didn’t blame North Korea’s attack on Sony’s movie, like his administration blamed the 2010 Benghazi and Cairo attacks on an anti-Mohammed video. Thank God that North Korea’s sensibilities don’t carry the same weight with this administration as the sensibilities of Islamist extremists.