The 2014 Sony Hack and the Role of International Law (2016)

Introduction2014 has been dubbed year of the because of the number of hacks reported by the U.S. federal government and major U.S. corporations in businesses ranging from retail to banking and communications. According to one report there were 1,541 incidents resulting in the breach of 1,023,108,267 records, 78 percent increase in the number of personal data records compromised compared to 2013.1 However, the 2014 hack of Sony Pictures Entertainment Inc. (Sony) was unique in nature and in the way it was orchestrated and its effects.Based in Culver City, California, Sony is the movie making and entertainment unit of Sony Corporation of America,2 the U.S. arm of Japanese electronics company Sony Corporation.3 The hack, discovered in November 2014, did not follow the usual pattern of hackers attempting illicit activities against business. It did not specifically target credit card and banking information, nor did the hackers appear to have the usual motive of personal financial gain. The nature of the wrong and the harm inflicted was more wide ranging and their motivation was apparently ideological.Identifying the source and nature of the wrong and harm is crucial for the allocation of legal consequences. Analysis of the wrong and the harm show that the 2014 Sony hack4 was more than breach of privacy and criminal act. If, as the United States maintains, the Democratic People's Republic of Korea (hereinafter North Korea) was behind the Sony hack, the incident is governed by international law.The argument presented in this paper is that assuming North Korea is responsible, the 2014 Sony hack at least breached U.S. sovereignty. When viewed in its entirety, arguably it constituted an orchestrated attack on the United States, although the target, adversary, method of attack and the notions of territory and damage appear very different from those in traditional warfare. This article raises the question whether this type of cyber operation is the next evolution of modern warfare. The author asserts that new thinking is needed on these issues so that countries like the United States, and the international community generally, can adequately defend and deter attacks of this nature.I. The Sony Hack - The Summarized Sequence of EventsThe 2014 Sony hack has been described as the most devastating attack on U.S. company to date.5 It was deliberate, sustained attack against the corporation and individuals, primarily employees and contractors - civilian targets. It involved threats, unauthorized obtaining of data including data relating to individuals, and operational damage to Sony systems. The intrusion may have begun more than year before it was discovered in November 2014.6 Its origins have been traced back to June that year.7On June 11, 2014 in letter to UN Secretary-General Ban Ki-moon, the North Korean government denounced the Sony The Interview, comedy about fictional CIA plot to assassinate Kim Jong Un, as undisguised sponsoring of as well as an act of war.8 The letter promised and merciless countermeasure [if] the U.S. administration tacitly approves or supports the movie.9 On June 27, the North Korean ambassador to the United Nations, Ja Song-nam, unsuccessfully requested that the Security Council adopt the statement of the Democratic People's Republic of Korea against the film.10On June 25, the Korean Central News Agency posted statement from the country's foreign minister criticizing the U.S. for bribing rogue movie maker to produce film on insulting and assassinating the supreme leadership. The release of the movie was described as intolerable, terrorism, and a war action. The minister threatened decisive and merciless countermeasures if the movie was released.11On November 21, God'sApstls sent an email to Michael Lynton and Amy Pascal, co-chairs of Sony stating, [W]e've got great damage by Sony Pictures. …