On Dec. 16, the Guardians of Peace threatened terrorist attacks on theaters that decided to show “The Interview.” Several major theater chains then cancelled their plans. On Dec. 17, Sony cancelled the release, a decision that was criticized not only in the entertainment industry and the media, but also by the Obama Administration.
On Dec. 18, the FBI announced that North Korea was responsible for the Sony hack as well as the threat of terrorist attacks on theaters. During the weekend of Dec. 20, North Korea experienced a cyber disruption that crippled its Internet infrastructure.
On Dec. 24, Sony made “The Interview” available for online rental on Christmas Eve, with a limited release in theaters on Christmas Day. Since Christmas Eve, “The Interview” has earned more than $31 million in online rentals, which is more than any other Sony online movie. At the box office, it’s grossed more than $5.4 million.
The United States alleges that the cyberhacking of Sony was orchestrated by the government of North Korea, an allegation that North Korea flatly denies. The U.S. also maintains that it was not behind the pre-Christmas attack on North Korea’s Internet.
The threat of cyberattacks extends far beyond the Sony hack, and the issue grows broader.
After Islamic terrorists killed a dozen people at the satirical newspaper Charlie Hebdo in Paris on Jan. 7, cyberattacks have escalated, with more than 19,000 French websites having been hacked. France’s cyberdefense department claims that the “unprecedented” wave of assaults on sites ranging from tourism and business to education and religion were committed by groups tied to the radical Islamic terrorist group ISIS.
In addition, the U.S. Central Command Twitter account was temporarily suspended after it was hacked Jan. 12. An unauthorized tweet warned: “AMERICAN SOLDIERS, WE ARE COMING, WATCH YOUR BACK. ISIS.” Central Command’s YouTube channel was also hacked and contained videos showing ISIS militants.
President Obama has called for new cybersecurity legislation — a topic he will bring up during his State of the Union address Tuesday.
We asked local scholars from Cedarville University and the University of Dayton to share their insights into cyberhacking and the larger threat of cyberterrorism. — Connie Post
Obama Administration should have backed up Sony
The United States’ response to the Sony movie situation was reasonable, but significant missteps were made.
U.S. government officials took a fairly robust stand against the North Korean government by critiquing the attack, responding through several diplomatic channels, and allegedly knocking out internet connections for almost 10 hours across the small East Asian country. However, North Korea’s statements and actions panicked many Americans, including major business owners without an obvious, overt punishment in return — with the exception of potentially placing Pyongyang back on the list of state sponsors of terrorism.
The cyber-attack also threatened aspects of freedom of speech, which, if a similar threat is levied again in the future, challenges a foundational principle of American governance and society, and liberal democracy worldwide. One of the challenges in assessing the U.S. response, though, is full disclosure — in cyber-warfare, some of the information is classified and some of the information is unknown, so only limited assessments can be made.
Relations between the United States and North Korea have been heavily strained since the outbreak of the Korean War in 1950, so this type of confrontation is not really new. What is new, or at least newer, is the cyber-vandalism element of the attack on a private company, Sony, a Japanese conglomerate that has subsidiary groups in the United States, including Sony Pictures Entertainment.
After a breach of sensitive information on Nov. 22, 2014, Sony was then hacked and attacked more forcefully on Dec. 16 in the lead-up to the release of a satirical movie, “The Interview,” wherein the plot line leads to the assassination of North Korea’s leader, Kim Jong-un.
Even though the film is entirely fictional, the Korean Central News Agency, which is the mouthpiece of the regime, called the movie “an act of war.” When North Korean government hackers committed their cyber-attack on Sony Pictures Entertainment, they threatened to attack moviegoers and urged citizens to “remember the 11th of September 2001”—in essence an overt reference that a 9/11-type attack would be repeated by North Korea if the movie was released.
After the cyber-attack, several major movie theater chains refused to show the movie, leading Sony to announce its cancellation (the movie was, however, released online, and in a small number of theaters). President Obama lambasted Sony for its decision — although not the movie theater chains that refused to show the movie — and made initial moves to put North Korean back on the list of state sponsors of terrorism. (As of Jan. 14, the State Department’s website still lists four state sponsors of terrorism, but the list does not include North Korea.) North Korea had previously been on the list of the list of state sponsors of terrorism, but was removed in 2008 in the aftermath of Six-Party talks on Pyongyang’s nuclear sites — North Korea agreed to inspections of key nuclear sites.
In the aftermath of the cyber-attack, former Speaker of the House of Representatives, and 2012 Republican presidential contender, Newt Gingrich, asserted that the U.S. has “just lost its first cyberwar.” This statement overreaches, but it does highlight the point that a much weaker country, North Korea, has the ability to hack and intimidate American-based businesses and American citizens. Moreover, the U.S. response to the attack did not take into account the public-private dimension of this situation.
Since Sony Pictures Entertainment and the various major movie theater chains are private businesses, the role of the U.S. government is to stand up for these interests, rather than criticize them for not wanting to provoke a major attack on the American homeland. Privately owned businesses, even if they are traded publicly on various stock markets, aren’t responsible for foreign policy.
A more robust U.S. government response should have backed these private businesses, and pledged governmental support to Sony while simultaneously confronting North Korea. Only one of these two objectives was accomplished.
Glen Duerr, Ph.D., is an assistant professor of international studies in the Department of History and Government at Cedarville University.
Cyberthreats: A primer
One of the key issues in the wake of the Sony cyberattack is, “How big is the threat?”
That is difficult to answer because cyberattacks tend to be covert — i.e., they are not inevitably “public” in the way a bank robbery is.
A few years ago, in Bullitt County, Ky., the County Treasurer used wire transfers from a local bank to pay the County’s bills. At some point the Treasurer clicked on a link he should have ignored, which resulted in Ukrainian cybercriminals’ installing a Zeus Trojan Horse program on his computers. Zeus Trojans transfer money from a computer to the cybercriminals who installed it, which is what happened here.
Over a long weekend, the Ukrainians extracted $435,000 – the entire contents of the account – from the bank. When the Treasurer discovered the theft, he contacted local law enforcement — who were understandably out of their depth — and the FBI, which tracked the theft to Ukraine. But since Ukraine does not extradite its citizens for prosecution in this country, that was the end of it.
Around the same time, some cybercriminals used the same Zeus Trojan to extract $1.1 million from a Seattle hospital’s account … and went scot-free.
Things like that happen all the time, to individuals and institutions. Last summer, the Center for Strategic and International Studies reported that the annual cost to the global economy from cybercrime then ranged between $357 billion and $575 billion, much of which involves losses to U.S. civilians, individuals and corporate. And no one will ever be prosecuted and punished for those crimes.
Our governments, and therefore our security systems — law enforcement and militaries — are creatures of the nation-states that make up global governance. Nation-states are very effective in controlling crime when it occurs “in” their territory; traditional bank robbers are usually caught, for example.
Cybercrime — and cyberwar, if and when it happens — transcends national boundaries, so someone in Ukraine or Russia can “rob” a U.S. bank covertly from their own country. Since there is literally no chance of their being apprehended and punished, there is no disincentive to commit such crimes.
Cybercrime emerged in the 1990s and has been expanding, almost exponentially, since then. If you are intelligent, adept at using computers and not terribly scrupulous, you can commit crimes online and become affluent, if not wealthy. If you are too honest to steal, you are likely to be, at least by our standards, poor and probably destitute by the time you are older.
What can we do to defend against cybercrimes (and cyberwar, when it comes)?
Our borders are irrelevant. Our law enforcement officers and military cannot protect civilians in cyberspace, since they directly interface with whatever is out there. Cybercrime is a distributed threat, which means it is up to each of us — individuals and entities alike — to defend ourselves, and our country, by doing our best to defeat cyberattacks, of whatever kind. For a cyberattack — war or crime — to succeed, our “borders” with cyberspace must be secured, because every unsecured computer linked to the Internet is an open point — a point of access — on our virtual “border” with the rest of the world.
We are the only ones who can secure the different points of access on that virtual border.
Susan W. Brenner is the Samuel A. McCray Chair in Law at the University of Dayton School of Law. Her areas of specialization include cybercrime, cyberterrorism and cyberwarefare.
About the Author