US denies cyber retaliation against North Korea

The Obama administration has been deliberately coy about whether it caused North Korea’s outage, which affected all the nation’s internet connections starting on the weekend of December 20.

But the two officials acknowledged to reporters that it was not a US operation.

It was not immediately clear even within the administration whether rogue hackers or other governments disrupted North Korea’s networks. The networks are not considered especially robust since they rely on a single provider, China United Network Communications Group Co, the state-owned provider in neighbouring China.

North Korea’s service was sporadic starting on Saturday December 20, then collapsed entirely for nearly 10 hours two days later in what has remained an enduring whodunit.

“It looks more like the result of an infrastructure attack than an infrastructure failure,” said James Cowie, chief scientist at Dynamic Network Services of Manchester, New Hampshire, who studied the outages. “There’s nothing you can point to that says it has all the hallmarks of an attack by a nation state. It could have been anybody.”

Within the US government, contingents have debated privately whether to acknowledge that the US played no role in North Korea’s disruptions or remain silent to avoid detailed conversations about US capabilities and policy on offensive cyber operations, which are considered highly classified.

The disclosure denying US involvement was intended to convey how seriously the administration considers offensive cyber attacks, intended to be used only in the most serious cases and consistent with the state department’s admonitions for foreign governments to always preserve access to the internet for all citizens, one of the officials said.

Sony Pictures chief executive Michael Lynton told the press in a new interview that he never knew whether the US government electronically attacked North Korea as retaliation for the break-in at his company.

The government hinted earlier this year, on January 2, that it was not involved in the North Korea outages but its intended message was too understated to be recognised as an outright denial.

When the White House announced new economic sanctions against North Korea for what it called a “destructive and coercive cyber attack” against Sony, Obama spokesman Josh Earnest described the sanctions as “the first aspect of our response”. In other words, the government was saying its initial response was coming 11 days after the mysterious attacks crippled North Korea’s networks.

As late as Thursday, Mr Obama’s homeland security adviser, Lisa Monaco, declined to say whether the US was behind the North Korea outages. Speaking at a cybersecurity conference in New York, Ms Monaco would not answer a question from the US attorney for the Southern District of New York, Preet Bharara, on whether the administration was responsible and agreed it could be helpful to be ambiguous about the consequences of hacking American targets.

“I’m not going to comment, and I never would, on operational capabilities,” she said. “But you want to be able to have a number of tools in your toolbox and reserve them for use.”

FBI assistant director Joseph Demarest, head of the cyber division, added: “You have to be able to reserve some ability for your capabilities, your methods, in a way that protects that capability going forward.”

At the time of the North Korea outages, the White House and the state department also declined to say whether the US government was responsible. North Korea’s four principal connections to the internet began having serious problems just hours after Mr Obama blamed North Korea for hacking into Sony, which included disclosure of confidential company emails and business files and threats of terror attacks against US cinemas until Sony agreed to cancel the Christmas Day release of its film The Interview.

Sony eventually decided to release the profane comedy that pokes fun at North Korea leader Kim Jong Un and depicts an assassination plot against him, offering it online and in a relatively small number of cinemas.

Mr Obama promised on December 19 to retaliate against North Korea but pointedly did not indicate what he had planned. “We will respond proportionally,” he said, “and we’ll respond in a place and time and manner that we choose. It’s not something that I will announce here today at a press conference.” But Mr Obama later described the Sony hacking as “an act of cyber vandalism”, not an act of war.

As North Korea’s networks sputtered, on December 22, state department spokeswoman Marie Harf would not say whether US fingerprints were involved, but her answer was widely interpreted as confirming a US role: “As we implement our responses, some will be seen, some may not be seen.”

One day later, Ms Harf clarified. “I don’t think I actually winked or nudged,” she said. “I said I can’t comment on those reports one way or the other. I can’t confirm them one way or the other. I don’t actually know that their internet was out, and it’s not for me to speak to. I was broadly speaking about what the president has said but in no way was trying to link it to yesterday’s activity.”

She added: “I understand it was sort of interpreted that way and did not mean to be.”