I find it more than a little ironic that as we wring our collective hands over the interrogation tactics used by the U.S. intelligence community, we are sitting idly by while attackers unknown are torturing and holding hostage an American company.
I am of course referring to the massive hack of Sony Pictures Entertainment. That hack is one of the more devastating cyber-attacks the world has witnessed. It has all the hallmarks of, well, a movie: embarrassing emails, destruction of computer systems, blackmail, disruption of business operations, and now even terrorist threats aimed at movie theaters. You cannot make that up.
Sony's response has been fairly consistent with that of your typical data breach. It has hired crisis communications teams, cooperated with law enforcement, offered credit monitoring to individuals affected by the attack, and even done its best to control the publication of stolen information.
However, the fact that the attackers used incredibly sophisticated malware and are continuing to twist the knife in Sony's belly makes this no ordinary breach. Even more relevant is that this attack was apparently conducted by a foreign government.
In other words, Sony - you just were subjected to extraordinary criminal acts, if not aggressive military action. React accordingly. Go on the offensive. You have every right to do so.
No, I'm not talking about hacking back at whoever did this. I'm talking about screaming at the top of your lungs saying things like:
•"Hey, we're victims! Help us out!!!"
•"How could you possibly expect us to stop something the government said it couldn't protect against?"
•"Since when are private companies expected to stop attacks by foreign agents or governments?!"
•"Hey White House and Congress: a rogue country or its supporters are on the verge of destroying an American business. How about a few words of support for us?!?!?"
As you can guess, to me it is entirely unacceptable that the U.S. Government is mostly sitting on the sidelines. I consider the hesitancy to call out North Korea because of diplomatic concerns or our limited ability to impose consequences to be misguided. A bully has punched us in the nose, and we cannot just stand there.
If I were in charge of Sony's response, I'd be charging the Hill and pounding on the Administration to do more than simply help figure out what happened or how to stop further damage. I would demand a statement from political leadership along these lines:
"Today an American company suffered an unprecedented cyber-attack, one that could threaten its very survival.
This attack is unacceptable, pure and simple. The sanctity of our digital borders has been irretrievably violated, and we consider this event no different than if agents of a foreign government or terrorists had perpetrated the same crimes.
This attack will not be swept under the rug, nor will it turn into a 'blame the victim' scenario. It is nothing less than an attack on America itself, and it will be treated as such. The resources of our law enforcement and national security system will be made available to identify the perpetrators and as appropriate respond to their unlawful behavior.
Make no mistake, this act will not go unpunished. If individuals are responsible, we will ensure that they are brought to justice. If a country has committed this attack, then they will suffer grave consequences for attempting to undermine our economic well-being.
We will not rest until justice is done and the world realizes that the United States will not sit idly by as its economic might is undermined."
Sony, don't just sit back and treat this like some embarrassing emails and credit cards were stolen. Stand up and call this what it really is - an assault on America that demands an official response.