The suspected North Korean cyber attack on Sony Pictures computers this month has left the Obama administration scrambling to come up with a response to the massive data beach carried out against a multinational company by a foreign government. While no one is seriously contemplating war with the heavily armed nation, the White House says it's determined to punish North Korean leader Kim Jong Un in a way that deters future attacks by him and others. Yet the administration has been notably tight-lipped about what steps it is contemplating — or may already have taken — to achieve those goals.
Part of Mr. Obama's reticence undoubtedly has to do with the constraints imposed by the unprecedented nature of the attack. The hackers targeted a private company in the entertainment business rather than critical national infrastructure such as the defense, energy or banking sectors. No government agencies were affected, nor were any American lives lost or put at risk. The U.S. has a fairly clear policy on attacks that rise to the level of national security threats, but when the target is a record label or movie studio, the most effective response is less obvious.
Perhaps that's why most foreign policy experts say they have yet to hear a really good idea about what to do next. Officials bandy about terms like "appropriate," "measured" and "proportional" to describe the type of responses the administration is considering, but no one seems to know exactly what they mean. A truly in-kind response is difficult to imagine because the North Koreans have so few assets to attack, whereas the U.S. represents a target-rich environment for any would-be cyber foe.
Given the asymmetry of such a conflict, wags have suggested the U.S. might do better waging a war of insults instead. For example, Mr. Obama could one-up Mr. Kim by showing "The Interview" at the White House and inviting other world leaders to laugh at it. Or he could screen it for free on the Mall for a year. Such schemes suggest more than a hint of the absurd, alas, including the idea of bombing North Korea with Sony DVD players and discs of the movie — notwithstanding the scarcity of working electrical outlets in that country.
A more serious scenario might be one in which the U.S. picks and chooses specific aspects of the North Korean attack it wishes to address and then responds with a combination of public statements to put pressure on the regime, such as returning North Korea to the list of state sponsors of terrorism, while conducting covert actions behind the scenes.
If, for example, the president decided that the chilling effect on free speech is overall a graver threat than the economic losses suffered by Sony — which is now attempting a limited release of the film — he might combine public insults with covert actions aimed at weakening North Korea's control over the Internet. Given that only that country's elites enjoy access to computers, a covert operation that encrypted or wiped data off their machines would certainly grab their attention, as would malware that brought the whole system down.
Indeed, earlier this week North Korea's Internet did go offline for several hours. Whether that was the U.S.'s doing, whether the North Koreans shut it down themselves or whether it was merely the result of a technical glitch or power outage, no one is saying. But it wouldn't be surprising if the U.S. damaged or destroyed computers and servers in the hackers' network away from public view.
The U.S. is constrained by the still real possibility that an escalation in cyberspace could lead to a shooting war on the peninsula. There have been any number of incidents over the years where the U.S. declined to ratchet up tensions after officials decided it wasn't worth the risk, even when the north's provocations resulted in the deaths of South Korean soldiers, sailors and civilians.
A similar calculation has got to be going through the minds of U.S. policymakers now. In the best-case scenario this latest episode will play itself out mostly behind the scenes before gradually fading from public consciousness. The U.S. government's primary interest must remain the defense of this country's critical infrastructure. It has a much stake smaller in defending Sony.
This should have been a wake-up call for the company in any case to tighten up its online defenses, which some have described as laughably inadequate. Meanwhile, Mr. Obama is right to keep his options close to his vest. We are likely to have live with North Korea and its dangerously unstable leader for some time to come, and for that patience is a virtue.