Is it illegal to hack North Korea?

Any retaliation by the U.S. government for the Sony hack would be significantly constrained by some very tricky and nuanced aspects of international law, according to former officials at the National Security Agency and U.S. Cyber Command. Hacking the computers of an American company and stealing and erasing confidential information likely doesn’t rise to the level of an “armed attack” against the United States.

That means any response that could result in physical damage inside North Korea is off the table. Obama can’t bomb Pyongyang for hacking a movie studio. Nor can he order a cyber attack that cripples the country’s infrastructure—causing a blackout, say.

“The doctrine now is that if a cyber attack has effects, like those of a kinetic attack, we may treat it as an act of armed conflict,” said Joel Brenner, a former senior official with the National Security Agency whose last job in government was combating the proliferation of cyber espionage directed at U.S. corporations. “It’s unclear whether that’s exactly what’s happened here [in the Sony hack]. I think that’d be a difficult case to make.”