Who Was Behind the Cyberattack on Sony?

The cyberattack on Sony Pictures unleashed a torrent of alarmist media reports, evoking the image of North Korean perfidy. Within a month, the FBI issued a statement declaring the North Korean government “responsible for these actions.” Amid the media frenzy, several senators and congresspersons called for tough action. Arizona Senator John McCain blustered, “It’s a new form of warfare that we’re involved in, and we need to react and react vigorously.” President Barack Obama announced his administration planned to review the possibility of placing North Korea on the list of states sponsoring terrorism, a move that would further tighten the already harsh sanctions on North Korea. “They caused a lot of damage, and we will respond,” Obama warned darkly. “We will respond proportionally, and we’ll respond in a place and time and manner that we choose.”

In the rush to judgment, few were asking for evidence, and none was provided. Computer security analysts, however, were vocal in their skepticism.

In its statement, the FBI offered only a few comments to back its attribution of North Korean responsibility. “Technical analysis of the data deletion malware used in the attack revealed links to other malware that the FBI knows North Korean actors previously developed,” it reported, including “similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.” The FBI went on to mention that the IP addresses used in the Sony hack were associated with “known North Korean infrastructure.” Tools used in the attack “have similarities to a cyberattack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.”

The major problem with the evidence offered by the FBI is that it is self-referential, all of it pointing back to the 2013 attack on South Korean banks and media that was carried out by the DarkSeoul gang. At that time, without supplying any supporting evidence, the United States accused North Korea of being behind DarkSeoul. In effect, the FBI argues that because the U.S. spread the rumor of North Korean involvement in the earlier attack, and some of the code is related, this proves that North Korea is also responsible for the Sony hack. One rumor points to another rumor as ‘proof,’ rendering the argument meaningless.

The logical fallacies are many. To date, no investigation has uncovered the identity of DarkSeoul, and nothing is known about the group. The linking of DarkSeoul to North Korea is purely speculative. “One point that can’t be said enough,” emphasizes Risk Based Security, “is that ‘attribution is hard’ given the nature of computer intrusions and how hard it is to ultimately trace an attack back to a given individual or group. Past attacks on Sony have not...