I am not suggesting that we should go to war with North Korea over the Sony cyberattack. Nor am I suggesting traditional military action — though I believe that we should send the message that it is always an option that we will consider when it is essential to our national defense. But I do believe that if we do not demonstrate to the hackers and cybergenerals of this world that there are very real consequences to attacking the United States, be it a public or private target, then for all the reasons cited above, such attackers might think they can act with impunity, and we may well enter a period of war without end and permanent national insecurity.
In the New York Times piece, it is reported that the White House has ruled out a “demonstration strike” on a North Korean target that would clearly signal our willingness and capability of responding in kind. That is, I believe, an error. For example, one potential target described in the article is Yongbyon — “the center of North Korea’s nuclear program, where the state has invested huge sums to produce plutonium and uranium fuel for its small arsenal of nuclear weapons.” It is noted that a potential attack on the Yongbyon facility would be more difficult for U.S. cyberwarriors than the one conducted against Iran as part of the Stuxnet operation. But that does not mean it should not be considered, especially since it would be a twofer: It would set North Korea’s nuclear program back and would do so in a way unlikely to affect North Korean civilians.
Whether the target were Yongbyon or some other facility, sooner rather than later it is important for cyberadversaries to get the message that the United States is going to do more than hurl the expected “we’re considering all options” book at them — when they know how little that means. And while it is true that the United States has many more vulnerable targets, that vulnerability should not be allowed to cow us into inaction — a measure that only compounds the risk of further attacks.
The United States needs to accept that we are in a new era and that future such attacks – high-profile attacks with significant social, economic, and political consequences — are inevitable. The president and his team should seize this moment to develop in advance not only cybercapabilities but an array of public, diplomatic, military, and other responses that will actually create the most effective deterrent to future attacks that is possible. And then, beyond that, it is time the United States considered something like the big Civil Defense push of the early nuclear era in which the U.S. government launched a major effort to work with the private sector to increase awareness of risks and to promote hardening our assets and honing our responses to future attacks in a far more comprehensive way than we had done to date. (Some sectors, particularly those associated with critical infrastructure, have been working with the government. But as the Sony situation indicated, the best preventive work has been done in only a few sectors — like finance — and even in these, much more needs to be done.)
This should be a big initiative of the White House, the Department of Homeland Security, the Justice Department, and the rest of the government. Further, its effectiveness would be enhanced greatly if key allies were enlisted within the private-sector community. For example, insurance companies, institutional investors, and others should be encouraged to weigh cyberpreparedness as they evaluate the risks of individual companies — creating incentives for them to move faster and to be smarter. Boards should get the clear message that lack of cyberpreparedness will invite liability that no company should tolerate. The program should build on existing efforts, but the events of the past week should underscore that much more can and should be done.
These are the early days of the cyber era. This administration could not be expected to have fully formed ideas on these issues, and indeed, they have made some important initiatives in this area. But it is clear that much work still needs to be done. Just as we belatedly closed the book on one of the last vestiges of our Cold War policy, yet another relationship that is a throwback to that era reminded us that it is time to start writing a new playbook and that the longer we delay, the more likely it is that further and more damaging illustrations of our lack of preparation will manifest themselves.
Chip Somodevilla/Getty Images News