The only element of the legal definition that is even potentially subject to doubt is the first, namely whether the Sony hacks would be deemed “dangerous to human life.” The answer is categorical: Hack attacks on critical infrastructure are dangerous as a category, whether these specific attacks endangered anybody. Detonating a bomb in the middle of nowhere may not endanger anybody, but it’s still a dangerous act. Plus there’s no doubt that threatening moviegoers is a violent act. But if the administration thinks there is any doubt on that score, Congress should act immediately to amend the terrorism statute so as to remove any doubt that this is “terrorism” and not just “vandalism.”
And while it’s amending that law, Congress should explore ways of providing companies like Sony the cyber-equivalent of “Letters of Marque and Reprisal” to authorize them to act directly against North Korea and its agents through cyber warfare. If you think that’s idle bluster, consider the problem from an international-law point of view: The territorial protection of a sovereign state is largely useless to protecting legitimate global networks (such as multinational corporations) from the cyber-attacks of global terrorists networks, and international law hasn’t even begun to develop the necessary rules of the road.
The North Korea attack is a harbinger of things to come. It could be just the start of a tsunami that might quickly make our public discourse subservient to rules imposed by terrorists and tyrants. Transnational institutions such as multinational corporations need to be able to defend themselves, including through the use of hack-back counter-attacks.
Join the conversation as a VIP Member