A good case example to showcase US actions in virtual warfare took place in 2014 with the alleged hacks by North Korea on the US companies Sony Pictures. Although not committed on the US government directly, the 2014 Sony Hack represents an indirect virtual attack on US interests. This episode of virtual conflict is one of many that the US has played a part in. An offensive example showcasing the US’s alleged engagement in virtual attacks against Iranian Nuclear facilities with the military grade Stuxnet virus.
Stuxnet had much more serious political implications, but the Sony Pictures Attack serves to exhibit how the US is limited in its available responses to certain virtual attacks, from the high threshold it sets based on its allegiance to international law. Other states that do not share the same perception take advantage of this difference to pursue their interests. In 2014, Sony Pictures Entertainment was the target of a major cyber attack by a hacker group operating under the name Guardians of Peace.
The hackers were able to gain access to the company’s networks, and collect data on its operations throughout several months. In November 2014, the group released many confidential virtual files stolen from the company’s computers, including a series of not released films, financial data, embarrassing emails between the company’s executives, and salary and social security numbers of thousands of Sony employees. They also implanted a software program designed to erase all data from the computers servers.
The attack was devastating to the company, and even led Amy Pascal, former Co-Chair of Sony Pictures Entertainment, to publically resign from her position following the publication of a series of leaked embarrassing private conversations. It was strongly suspected that North Korea as well as a group of the regime’s supporters in China committed the attacks. Although at first the US refused to name any country that was potentially involved, eventually the US came to formally accuse North Korea of orchestrating the attacks on Sony Pictures. North Korea denied all responsibility for the attack, but did praise it as a “righteous deed”.
A key reason these attacks were traced back to North Korea was because the state strongly objected to the release of Sony Picture’s satirical film, The Interview, which depicts the fictional killing of the North Korean leader, Kim Jong-Un. Around the expected release data in December 2014, this suspicion was raised when the group Guardians of Peace threatened on the Internet to commit “9/11 style” attacks on US cinemas showing the film. The threats led to the cancelation of many premiers and the eventual cancelation of the nation-wide screening.
The consequences of the attack and identification of North Korea as the perpetrator led to a series of hostile diplomatic engagements between North Korea and the US. Following the data breach the issue of “cyber security” became a central topic in Washington. This extended as far as reaching to President Obama’s state of union address, which marked the first time that any US President spoke about virtual conflict in a state of union address, where President Obama urged Congress to ‘pass the legislation to better meet the evolving threat of cyber attacks.
The challenge faced by the US is well explained by Jordan Wilson, ‘The Sony cyber attack represents a new type of event, as conducting cyber operations against a company for coercive purposes goes beyond traditionally subtle cyber espionage, yet falls short of an “act of war” that causes equivalent to a traditional military attack. ’ These two dynamics of this virtual conflict are extremely contradictory to the US interpretation. Especially since the attack falls short of “an act of war”, the US is very limited in its available responses.
Explained by Jun, Lafov and Sohn: “Part of the difficulty in finding ways to respond appropriately to the attack was in the considerable uncertainty surrounding international laws and norms regarding how states can legally respond to attacks that cause damage, but not enough to amount to the use of force or as an act of aggression. ” The intent and apparent state sponsorship behind the attack influenced the US to respond and frame the incident as a matter of national security.
The US Secretary of Homeland Security illustrates this US view: “The cyber attack against Sony Pictures Entertainment was not just an attack against a company and its employees. It was also an attack on our freedom of expression and way of life. ” Hitting chords the chords of the US liberal-market perspective of “cyber-space”, on December 19, 2014 the US Federal Bureau of Investigation (FBI) publically identified North Korea as the responsible agent for the Sony Pictures attacks – explicitly describing the hack as “destructive” and “coercive” in nature.
Immediately following the announcement of the Bureaus findings, President Obama publically declared that the US would respond “proportionately” and “in a place and time and manner that we choose. ” On 2 January 2015, President Obama issued an executive order enacting additional sanctions against the North Korean government, specifically citing the Sony hacks. According to the Treasury Secretary, these sanctions were meant to defend US businesses and interests from “attempts to undermine our values or threaten the national security of the United States” .
In a later statement the White House added: “We take seriously North Korea’s attack that aimed to create destructive financial effects on a US company and to threaten artists and other individuals with the goal of restricting their right to free expression. ” While the response was limited, the economic sanctions were meant to send a signal to North Korea (and other potential cyber-attackers) that similar attacks would not be tolerated.
It is important to note that at the same time of the implementation of additional sanctions, a series of mysterious Internet outages took place across North Korea. Many audiences believed this was another response to the virtual attack by the US, however, the US government refused to comment whether this was caused by any covert US retaliatory action. The Sony attack raised important questions nationally and internationally; about the feasibility of deterrence in cyber space, the protection of First Amendment values, and the responsibility of the US government to safeguard private networks.
The attacks highlighted the US’s increasing vulnerability to virtual attacks and marked a sharp escalation of virtual conflict. The reaction of the US government was also unprecedented, and resulted in a historical first of attribution of a cyber attack to a nation by a US president as well we modest retaliatory measures. The attack paints a useful picture for determining how the US government responds in virtual conflict, as well as the dynamics and consequences that are inherent in the states’ response.
Since US policy makers did not have an established arsenal of proportional response options to respond to the attacks, they chartered unbeknown territory to formulate a reaction. The Russian Federation Russia defines virtual space as an extension of the psychological. The Kremlin views this space as a platform for cognition and socialization, directly reflected in their domestic and foreign policy as well as their historical behavior in virtual attacks. Russia views virtual space as a performance of political and informational instruments.
The Russia definition of virtual space – or as it refers “information space” – is defined as: “The sphere of activity connected with the formation, creation, conversion, transfer, use and storage of information and which has an effect on individual and social consciousness, the information infrastructure, and information itself. ” The virtual actions of Russia is closely tied to this perception, and is reflected in their primary political-military focus to ensure information security by managing the flow of information to its citizens, as well as on securing its physical information infrastructure.
In this new ‘theater of war’, Russia defines its challenge to ‘balance the interests of the individual, society, and the state in the information sphere’ . While Russia perceives virtual attacks as more psychological than technical in impact, Russian sensitivity to the cognitive aspects of virtual space can be largely attributed to the views that some Russian policy makers hold, which believe the disintegration of the Soviet Union was caused by ‘cognitive attacks of deliberate information operations’.
Further described by Thomas: “Many Russian books discuss the “Third World War” as a war of information in which the West conquered the Soviet Union. ” Therefore, to defend their “civil-cyber” spaces from threats of cultural imperialism and ideological control, the Russian’s virtual strategic objective is to preserve the Russia cultural identity and state norms. In 2005, Konstantin Nikolskiy defined the principal objective of Russian “information warfare”. His description serves in close proximity to the general Russian consensus.
Nikolskiy held “information war” to consist of: “A disorganization of the structure of society and distortion of public consciousness, as a result of which society loses moral-psychological and scientific-technological potential and thereby is deprived of the capability to wage armed warfare. ” Articulated in one of Russia’s virtual warfare policies, the state views information security as extending to several features of society such as ‘economics, domestic policy, foreign policy, science and technology, spiritual life, information and telecommunication systems, defense, law enforcement, and emergency situations.
The Russians also focus on ‘the restraint of international laws that limit the use and development of “information weapons” – a term commonly used in Russia’. Russian academic and social activist Sergei Markov gives a good definition and exemplary Russian interpretation of “information weapons” as: ‘A specially selected piece of information capable of causing changes in the information processes of information systems in accordance with the intent of the entity using the weapon. ’
By the 1990s Russian military doctrine had already begun to differentiate between two forms of virtual “information” conflict, acts of “Information Technical” and acts of “Information Psychological”. Information technical was associated with concepts that are in parallel to the Western concept of “cyber war”. In contrast, Information Psychological was associated with the use of the mass media, and with the employment of “non-lethal weapons, psycho-tronic tools, and special pharmaceuticals.
By 1999, the newly centralized Russian Information Center (RIC) was filtering content from the ‘theater’ of operations and information from any foreign publications that were disseminated in Russia. Brose describes the Russian strategy as, “The use of military power as a means to shape perceptions of a target audient (either in concert with, or absent traditional acts of violence); use of economic levers; and use of mass media a-la Information Psychological, all integrated under a coherent strategy. ”