The Silent Attack: North Korea’s Digital Retaliation After “The Interview”
In 2014, Sony Pictures Entertainment (“Sony”) released The Interview, a film starring Seth Rogen and James Franco that centers around the assassination of North Korea’s Supreme Leader, Kim Jong-un. Unsurprisingly, North Korea did not react well to the premise. After repeated threats and warnings, hackers acted on orders from the country and infiltrated Sony’s database, stealing and releasing dozens of terabytes of data, including unreleased films and celebrities’ personal identifying information. By hacking into Sony, North Korea violated longstanding treaties and broke state privacy laws. There is no legal conclusion as to whether the country’s actions constituted a use of force and broke international law, so the United States had limited legal options when it came to retaliation, including extraditing the main perpetrator. Soon after the Justice Department traced source of the breach to North Korea, the Obama Administration sanctioned North Korea and was linked to a blackout in the elusive country. The administration also proposed new legislation to strengthen the relationship between private companies and reporting breaches to the appropriate Federal entities. The Sony hack showed the holes in Sony’s cybersecurity system and demonstrated that even the biggest companies are susceptible to cyberattacks from foreign entities, and that nobody is safe unless international cooperation exists with strict, legal standards.
I. Kim Jong-un’s North Korea and How “The Interview” Came to Fruition
Kim Jong-un came to power as the Supreme Leader of North Korea in 2011 after the death of his father, Kim Jong-il.[i] Over the last nine years, Kim Jong-un has garnered a reputation of being a cruel dictator whose nation’s defectors say they were taught that he could read minds to prevent negative thoughts of him.[ii] For example, this past July he ordered the shooting of five Economic Ministry employees after “details of their conversations … at a dinner party … were reported back to [Kim Jong-un].”[iii] Defectors also describe life under him as a “modern-day Holocaust”, a notion supported by a Holocaust survivor and member of the International Bar Association War Crimes Committee who described the North Korean gulags as “‘as terrible, or even worse’ than the Nazi camps he experienced as a child.”[iv] In short, the gulags are places of “[d]eliberately below-subsistence level food rations…routine beatings and systematic torture, and onerous forced labor.”[v] The cruelty, however, does not stop at the gates of the gulags. In 2019, a U.S. State Department spokeswoman observed the starvation from which millions of citizens suffer. She “accurately criticized Pyongyang for exploiting and neglecting its own people ‘in order to advance its unlawful nuclear and weapons program,’ [adding] that North Korea could feed its people if it chose.”[vi] Thus, the reasons behind the creation of The Interview are not completely baseless — Kim Jong-un is a cruel dictator who conspicuously puts his desire for [nuclear] power above the wellbeing of his citizens, and many foreign entities believe he should not be in power.
Though the film does not dwell on the gulags, James Franco’s character mentions them when speaking with a propaganda minister about the rumors surrounding Kim Jong-un’s rule. Franco’s character asks about the country’s 200,000 imprisoned citizens and its 16 million malnourished citizens, to which the secretary addresses the latter as a “common misconception” before their car conveniently stops right in front of a supermarket that is later revealed to be a façade to promote the idea that the country has a surplus of food.[vii] Though the film addresses the rumored atrocities perpetrated by North Korea, it also depicts Kim Jong-un as a “normal guy” who likes to party, listen to music, and play basketball.[viii] This portrayal is probably also part of what upset North Korea; the country wants Kim Jong-un to be viewed as a ruthless dictator with no weaknesses, but scenes such as one that shows him crying to Katy Perry’s “Firework” do not help advance North Korean propaganda that depicts him as merciless to those who defy him.[ix] For the aforementioned reasons detailing desire for complete control over its citizens, this paper operates under the assumption that the North Korean government ordered the infiltration of Sony (not a private citizen acting on his own), and is therefore legally responsible for the hack.
II. North Korea’s Initial Attempts to Prevent the Release
When the trailer for The Interview first aired in June 2014, North Korea immediately sought to stop the movie’s release because the secretive country thought “the film would ‘hurt the dignity of the supreme leadership of’ North Korea.”[x] Several months before the infamous cyber-attack, North Korea lodged a complaint with the United Nations (“U.N.”) accusing the United States of “sponsoring terrorism and committing an act of war” by allowing the production of a film that supports the assassination of its leader.[xi] In late November 2014, Sony employees turned on their computers to find a popup that read, “Hacked By #GOP. We’ve already warned you, and this is just a beginning … We’ve obtained all your internal data including your … top secrets. If you don’t obey us, we’ll release data shown below to the world.”[xii] The acronym “GOP” stands for Guardians of the Peace and the “data shown below” was a list of all the files stored on Sony’s servers.[xiii]
III. Investigation and Legal Consequences of the Hack
After investigating the hack, the assistant director of the FBI’s cyber division concluded that “[t]he malware that was used would have slipped and gotten past 90 percent of the net defenses that are out there today in private industry and been a challenge to state governments.”[xiv] The CEO of Sony corroborated a finding by the FBI that stated the hack was “likely the product of a period of sustained covert reconnaissance by the subjects within [Sony’s] network before they launched the attack…”[xv] The hackers broke into Sony’s systems and spent weeks inside undetected simply examining the hardware to find out how to do maximum damage, finally striking around Thanksgiving 2014.[xvi] The hackers had no problem accessing all of the information on Sony’s system, leading one to believe Sony did not employ the use of encryption at rest, which keeps any information stored in a computer undecipherable.[xvii] Only authorized users would have had the decryption key necessary to de-scramble the information, and regardless of the fact that the hackers would probably have found some way of obtaining the key, they were not authorized to access, view, and steal the information stored on Sony’s computers.
It can be argued that North Korea’s act of accessing, stealing, and leaking Sony’s files without authorization constituted a breach in California state law, specifically California Penal Code §594.[xviii] North Korea’s use of malware that was wired to destroy Sony’s files is a breach of “malicious mischief” as described in California Penal Code §594(a)(3), which reads, “(a) Every person who maliciously commits any of the following acts with respect to any real or personal property not his or her own, in cases other than those specified by state law, is guilty of vandalism: … (3) Destroys.”[xix] The malware that infected Sony’s computers was designed to and succeeded in erasing the contents on Sony’s network, which can undoubtedly be classified as “real property,” albeit virtual.[xx] The criminal complaint stated that “once inside SPE’s network, the subjects stole movies and other confidential information, and then effectively rendered thousands of computers inoperable.”[xxi] Stealing films and rendering thousands of computers inoperable could reasonably be characterized as destroying real property. One could also try to argue that by creating a popup message that displayed without authorization on dozens of Sony computers, the hackers also breached §594(a)(1), “Defaces with graffiti or other inscribed material” where graffiti means “(e)…any unauthorized inscription, word, figure, mark, or design, that is written, marked, etched, scratched, drawn, or painted on real or personal property.”[xxii] The computers were property of Sony, and the popups could be argued to any of the aforementioned categories. The challenge, however, would be arguing how the popups actually defaced the computers — there is a chance the argument would be successful if a court agrees that definitions of vandalism should change as technology advances to encompass cyber-attacks.
IV. Methods to Obtain Evidence
The Justice Department (“department”) used many methods to collect evidence, including open-source information, search warrants, and possibly Mutual Legal Assistance Treaties (“MLATs”). By utilizing open-source information, the department examined the publicly available leaked data in order to determine to what extent the hackers infiltrated Sony’s network.[xxiii] To delve deeper into the investigation, the department not only obtained 100 search warrants to gain access to over 1,000 email and social media accounts utilized by the hackers, but also likely used MLATs to broaden their investigation to cooperating foreign nations.[xxiv] The department filed “85 formal requests for evidence to foreign countries and additional requests for evidence and information to foreign investigating agencies,” likely well aware that when filing an MLAT with foreign nations, “the crimes must be serious and prohibited in both countries” in order to receive the desired evidence.[xxv],[xxvi] The department would not reasonably send MLATs to countries they anticipate would refuse to honor their requests.[xxvii] However, members of the U.N. likely classify and prosecute crimes similarly to help one another investigate in potential international law violations and prevent war, and because there are so many countries who are part of the U.N., its 1945 charter is a good source from which to obtain standards for international law.
V. What Constitutes as a “Use of Force” in terms of International Law?
International law is customary; it forms from treaties or principles that have been followed for long periods of time, which means that deciding whether international cyberattacks violate international law falls into a grey area.[xxviii] In joining the U.N., countries agree that “[their] respective Governments … have agreed to the present Charter of the United Nations”, meaning they will abide by the rules set within the charter and will recognize the International Court of Justice’s interpretation of a treaty or issue of international law.[xxix], [xxx] Article 2, Section 4 of The Charter of the United Nations and Statute of the International Court of Justice (“U.N. Charter”) states that “[a]ll Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations.”[xxxi] Use of force in cyberspace does not yet have a single, agreed-upon definition. However, if there is a general consensus among nations that North Korea’s actions constituted a use of force, then the United States would have cause to retaliate on the grounds that the country’s actions violated international law.
Despite there not being a synthesized legal definition of “use of force,” there seems to be consensus in the national security/defense sector. Matthew Waxman, a professor at Columbia Law School and Member of the Hoover Task Force on National Security and Law wrote that to decide what acts constitute a use of force, “the United States [might] take the position that the magnitude of threat or damage from a cyber-attack must be high to trigger armed self-defense (or even constitute prohibited force).”[xxxii] Furthermore, H.H. Koh, a legal advisor to the U.S. Department of State, gave a speech at the USCYBERCOM Inter-Agency Legal Conference on the Roles of Cyber in National Defense in 2012. When asked about what type of cyber-attacks are considered a use of force, Koh stated that acts which “proximately result in death, injury, or significant destruction” qualify.[xxxiii] He further elaborated upon the standards for assessing a contested use of force act, saying one must evaluate the context of the event, the actor behind the event (if attribution is possible), the target, location, intent, and the act’s effects.[xxxiv] To date, the Sony hack has not resulted in death, injury, or significant destruction that one could reasonably attribute to North Korea’s actions. However, North Korea did make threats that insinuated the country was contemplating an attack that would likely result in death, injury, and significant destruction if Sony did not rescind The Interview.
VI. Threats Could Have Posed Legal Ramifications for Sony and Continued Use of Force Discussion
Sony’s continued refusal to cancel the premiere of The Interview led to incessant threats from North Korea. On December 8, 2014, the GOP sent out an email claiming responsibility for the hack, which read: “Stop immediately showing the movie of terrorism which can … cause the War!”[xxxv] On December 16th, nine days before the film’s official release, the GOP posted the following message on pastebin[dot]com:
Warning[:] We will clearly show it to you at the very time and places “The Interview” be shown, including the premiere, how bitter fate those who seek fun in terror should be doomed to … The world will be full of fear. Remember the 11th of September 2001. We recommend you to keep yourself distant from the places at that time. (If your house is nearby, you’d better leave.)[xxxvi]
Although Sony responded by postponing the release of The Interview the day after receiving that message, this threat could have posed significant legal ramifications had Sony not taken the proper precautions and patrons were harmed.[xxxvii]
Worst-case scenario, Sony could have been charged with manslaughter had they acted negligently in handling threats from North Korea. The Wolters Kluwer Bouvier Law Dictionary (“the dictionary”) states that “[t]he Model Penal Code … distinguishes negligent homicide from manslaughter on the basis of the defendant’s awareness of the risks of the defendant’s behavior.”[xxxviii] The dictionary goes on to say that “if the defendant had done the same thing, aware of the risk it posed for another person but doing so nonetheless, the defendant acts recklessly, and the death that results is manslaughter” [xxxix] (emphasis added). The standard for negligence is duty, breach, causation, and harm/damages. If Sony received threats that North Korea was planning an attack at a magnitude comparable to 9/11, they had a duty to report it to the appropriate authorities. If they failed to do so, they breached their duty. As a result of failing to warn authorities (and by extension, the public) and members of the public died or were harmed, Sony would likely be found to be the proximate cause and be liable for damages. Sony’s CEO, however, stated that he spoke to someone at the State Department who assured him that it was highly unlikely that North Korea would actually carry out an attack on U.S. soil, but hypothetically speaking, had he not reached out and something did happen, he (or the company) would likely have faced criminal charges.[xl] Legally, however, any action taken by North Korea that resulted in death, injury, and/or destruction likely would have constituted a use of force, therefore violating the principles of the U.N. Charter.
A final example demonstrating that North Korea’s actions do not constitute a use of force is the fact that it has maintained membership in the U.N. despite its continued cyber-attacks around the world. The U.N. Charter stipulates that “[a] Member of the United Nations which has persistently violated the Principles contained in the present Charter may be expelled from the Organization by the General Assembly upon the recommendation of the Security Council.”[xli] Because North Korea still maintains membership in the U.N., it is reasonable to assume that other nations do not believe any of the hacks the country has been involved in constitute a use of force, not only warranting the country’s expulsion, but also violating customary international law, as described in the U.N. Charter.[xlii]
Contrary to the points of view that a use of force must result in actual damage to permit retaliation, Professor of International Law and member of the Department of State’s Advisory Committee on International Law Michael Schmitt believes otherwise. He believes it is “reasonable to characterize a cyber operation involving a State’s manipulation of cyber infrastructure in another State’s territory, or the emplacement of malware within systems located there, as a violation of the latter’s sovereignty,” permitting responses such as hack-backs.[xliii] However, Article 51 of the U.N. Charter stipulates that a country may retaliate if an “armed attack” occurs against a member of the U.N.[xliv] Because North Korea’s actions were neither physical nor proximately resulted in death/injury/destruction, the hack cannot be considered an armed attack, thus the United States cannot retaliate. The U.S. cannot even extradite the named perpetrator, Park, because there is no existing extradition treaty with North Korea (only South Korea), so Park is still listed on the FBI’s Most Wanted list. The charges against him are still pending, and will be until he is apprehended in either the United States, or a nation with which the U.S. has an extradition treaty.[xlv],[xlvi] Though North Korea’s actions did not warrant militarized retaliation, the United States was within its limits to issue sanctions against the country for its actions in November 2014.
VII. Sanctions Imposed and American Response Post-Hack
In January 2015, President Obama issued an Executive Order that expanded sanctions on the North Korean government as a result of the 2014 Sony hack. Obama said North Korea’s actions “constitute a continuing threat to the national security, foreign policy, and economy of the United States” and barred North Korean government officials, members of its intelligence agency, and three organizations linked to the hack from accessing U.S. financial systems.[xlvii],[xlviii] Then-Treasury Secretary Jack Lew stated that the “Executive Order will further isolate key North Korean entities and disrupt the activities of close to a dozen critical North Korean operatives.”[xlix] There is no more information available regarding the extent of the United States’ response to the hacks, but the United States was purportedly linked to a nine-and-a-half-hour blackout in North Korea in late December. A State Department official responded to questions regarding American culpability with: “As we implement our responses, some will be seen, some will not be seen.”[l] Additionally, Professor Schmitt believes that the North Korea violated U.S. sovereignty and therefore the United States is free to hack back.[li] Hacking back, however, is “likely to expose the victim (U.S.) to civil and criminal liability” and is therefore recommended against, and there is no evidence the U.S. hacked North Korean networks as retaliation.[lii]
VIII. Proposed Cybersecurity Legislation
In 2011, President Obama issued two proposals calling for stronger cybersecurity legislation. The “Cybersecurity Legislative Proposal” aimed to “give the private sector and government the tools they need to combat cyber threats at home and abroad”, while the “International Strategy for Cyberspace” called for international cooperation to prioritize cybersecurity issues; specifically naming energy, transportation, financial, and defense as sectors to which foreign agencies could do the most damage and acknowledging that damage to one country’s infrastructure could “compoun[d] the risk to others.” [liii],[liv] Obama understood that cybersecurity would become a bigger issue in the future. Congress failed to implement either of his proposals, prompting his Executive Order on Improving Critical Infrastructure Cybersecurity (“order”) in February 2013 that established baseline cybersecurity standards. [lv] The order aimed to increase information sharing, mandated that Federal agencies have to share unclassified reports regarding threats to U.S. companies in a timely manner, and called for a review of existing cybersecurity regulations.[lvi] The Obama Administration acknowledged that the Executive Order is not enough to fully address the threats that cybercrime poses, and that legislation is needed because “[e]xisting laws do not permit the government to do all that is necessary to better protect our country.” Obama called the order a “down payment on expected further legislative action” as a call for action on Congress.[lvii]
Congress clearly failed to act. In January 2015, the White House again proposed new legislation regarding cybersecurity after the Sony hack backlash died down a bit. President Obama acknowledged that as countries improve their cybersecurity infrastructures, the hackers will also become more sophisticated and could begin targeting “our entire economy in ways that are extraordinarily significant.”[lviii] The Administration then announced new guidelines that the President once again hoped Congress would enact into law. He suggested “better cybersecurity information sharing between the private sector and government” and “enhance[d] collaboration and information sharing amongst the private sector.”[lix]
IX. Conclusion
The Sony hack demonstrated that even the biggest companies are susceptible to cyberattacks from foreign entities. The hackers stole dozens of terabytes of data from private citizens, prompting lawsuits against Sony[lx] and motivated other large film companies to hire outside firms to vamp up their security systems. Sony even had the FBI come to its headquarters to hold a cybersecurity awareness briefing for employees.[lxi] One unnamed executive said the Sony hack “[made] people seriously question what they put in email … we’ve all had a tendency to communicate via email and text, now, I better say it verbally.”[lxii] The Sony hack made people of all walks of life question network security. Even six years after the hack, there is no reasonable expectation that foreign nations will not try to infiltrate and undermine other trusted American processes, like elections and banking systems. In order to prevent future hacks, the U.N. should codify a set of agreed upon standards that constitute an international use of force in cyberspace and reasonable responses to such acts.
[i] Britannica, https://www.britannica.com/biography/Kim-Jong-Eun (Last visited November 6, 2020)
[ii] Interview by SBS News with Yeonmi Park, in Australia, (Aug.8 2013), https://www.independent.co.uk/news/north-korean-defector-says-she-believed-kim-jong-il-was-god-who-could-read-her-mind-9251983.html The original link does not work, but it is the source of this article.
[iii] NZ Herald, Kim Jong-un Photographed After ‘five of his critics executed’ (12 Sep, 2020 10:50 PM), https://www.nzherald.co.nz/world/kim-jong-un-photographed-after-five-of-his-critics-executed/FHWZGPBF3M3S6NQWS363DNGABA/
[iv] Alexander Smith, North Korean Gulags ‘as terrible, or even worse’ than Nazi camps, Auschwitz survivor says, NBC News, (Dec. 12, 2017 12:27 PM) https://www.nbcnews.com/news/north-korea/north-korean-gulags-terrible-or-even-worse-nazi-camps-auschwitz-n828751
[v] David Hawk, The Hidden Gulag: The Lives and Voices of “Those Who are Sent to the Mountains” 9, (Committee for Human Rights in North Korea, 2nd ed. 2012). https://www.hrnk.org/uploads/pdfs/HRNK_HiddenGulag2_Web_5-18.pdf
[vi] Isaac Stone Fish, North Koreans Are Starving, Shouldn’t we do Something? The Washington Post, (May 6, 2019, 2:46 PM) https://www.washingtonpost.com/opinions/2019/05/06/north-korean-lives-matter/
[vii] The Interview (Sony, 2014)
[viii] Id.
[ix] Id.
[x] Complaint at 31, United States of America v. Park Jin Hyok (June 8 2018) (No. MJ18–1479) https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xi] Reuters, North Korea complains to UN about film starring Rogen, Franco (July 9, 2014 1:37 PM) https://uk.reuters.com/article/idUKL2N0PK1FX20140709
[xii] Complaint at 25, United States of America v. Park Jin Hyok (June 8 2018) (No. MJ18–1479) https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xiii] Id.
[xiv] Ira Teinowitz, Sony Hack: FBI Says Attack So Sophisticated, Would Have Gotten Past ‘90%’ of Firms, Business Insider (Dec. 11 2014 10:29 AM) https://www.businessinsider.com/sony-hack-fbi-so-sophisticated-2014-12
[xv] Id. at 29. https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xvi] The Perfect Weapon (HBO, 2020)
[xvii] John Bandler and Antonia Merzon, Cybercrime Investigations: A Comprehensive Resource for Everyone 43 (Taylor & Francis Group, 1st Ed. 2020)
[xviii] Claire Sullivan, The 2014 Sony Hack and the Role of International Law, 8 Journal of National Security Law & Policy 437, 446 (2016).
[xix] Cal. Penal Code §594 (2011) https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=594.
[xx] The Perfect Weapon (HBO, 2020) Lots of intellectual property (films and scripts) were stolen and erased from the network.
[xxi] Complaint at 3, United States of America v. Park Jin Hyok (June 8 2018) (No. MJ18–1479) https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xxii] Cal. Penal Code §594 (2011) https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=594.
[xxiii] Complaint at 2, United States of America v. Park Jin Hyok (June 8 2018) (No. MJ18–1479) https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xxiv] Id., https://www.justice.gov/usao-cdca/press-release/file/1091951/download The Complaint does not label them directly as MLATs, but one can infer.
[xxv] Id. https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xxvi] John Bandler and Antonia Merzon, Cybercrime Investigations: A Comprehensive Resource for Everyone 133 (Taylor & Francis Group, 1st Ed. 2020).
[xxvii] In an effort to save space, I did not touch upon Letters Rogatory, but the department might have used those too.
[xxviii] TALLINN MANUAL ON THE INTERNATIONAL LAW APPLICABLE TO CYBER WARFARE 5 (Michael N. Schmitt gen. ed., 2013).
[xxix] Id., at 2 https://treaties.un.org/doc/publication/ctc/uncharter.pdf
[xxx] U.N. Charter, art. 36, 26 https://treaties.un.org/doc/publication/ctc/uncharter.pdf (1945).
[xxxi] Id., at art. 2, ¶ 4. 3 https://treaties.un.org/doc/publication/ctc/uncharter.pdf
[xxxii] Matthew C. Waxman,Cyber-Attacks and the Use of Force, 36 Yale L.J of International Law 421, 439 (2011) https://digitalcommons.law.yale.edu/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1403&context=yjil
[xxxiii] Harold Hongju Koh, “International Law in Cyberspace” (2012) 54 Harvard International Law Journal Online 1, 4
[xxxiv] Id.,
[xxxv] Complaint at 31, United States of America v. Park Jin Hyok (June 8 2018) (No. MJ18–1479) https://www.justice.gov/usao-cdca/press-release/file/1091951/download
[xxxvi] Id. at 32 (Fun fact! I actually won tickets to one of the early showings of The Interview in NYC before Sony cancelled them and I was slightly afraid of an attack because there were rumors about them, but I still went anyway.)
[xxxvii] The Interview (Sony, 2014)
[xxxviii] Negligent Homicide, Bouvier Law Dictionary (2012) https://plus.lexis.com/api/permalink/b6472381-ba20-4ee2-9132-f1e4878a9ead/?context=1530671
[xxxix] Id.
[xl] The Perfect Weapon (HBO, 2020)
[xli] U.N. Charter art. 6. 4 https://treaties.un.org/doc/publication/ctc/uncharter.pdf (1945).
[xlii] North Korea is also linked to a 2016 bank heist in which they stole $81 million from a Bangladesh bank: https://www.reuters.com/article/us-cyber-heist-bangladesh-northkorea-idUSKBN16T2Z3 and the “2015 thefts of $12 million and $1 million, respectively, from the Banco del Austro in Ecuador and the Tien Phong Bank in Vietnam”: https://www.courthousenews.com/n-korea-implicated-as-justice-dept-readies-charges-for-sony-hack/
[xliii] Michael Schmitt, International Law and Cyber Attacks: Sony v. North Korea, JUST SECURITY (Dec. 17, 2014), https://www.justsecurity.org/18460/international-humanitarian-law-cyber-attacks-sonyv-north-korea.
[xliv] U.N. Charter art. 51. 10 https://treaties.un.org/doc/publication/ctc/uncharter.pdf (1945).
[xlv] U.S. Department of State, Treaties in Force (Jan. 1 2020) https://www.state.gov/treaties-in-force/
[xlvi] Memorandum from the FBI on Warrant for Park Jin Hyok (2018) https://www.fbi.gov/wanted/cyber/park-jin-hyok/@@download.pdf
[xlvii] Exec. Order No . 13687, Letter — Imposing Additional Sanctions with Respect to North Korea (Jan. 2, 2015) https://obamawhitehouse.archives.gov/the-press-office/2015/01/02/letter-imposing-additional-sanctions-respect-north-korea
[xlviii] Zeke J. Miller, U.S. Sanctions North Korea Over Sony Hack, TIME (Jan. 2, 2015), http://time.com/3652479/sony-hack-north-korea-the-interview-obama-sanctions/.
[xlix] Press Release, Department of the Treasury, Treasury Imposes Sanctions Against the Government of The Democratic People’s Republic of Korea (Jan. 2, 2015) https://www.treasury.gov/press-center/press-releases/Pages/jl9733.aspx
[l] The Washington Post, North Korean Web goes dark days after Obama pledges response to Sony hack (Dec. 22 2014) https://www.washingtonpost.com/business/economy/north-korean-web-goes-dark-days-after-obama-pledges-response-to-sony-hack/2014/12/22/b76fa0a0-8a1d-11e4-9e8d-0c687bc18da4_story.html
[li] Michael Schmitt, International Law and Cyber Attacks: Sony v. North Korea, JUST SECURITY (Dec. 17, 2014), https://www.justsecurity.org/18460/international-humanitarian-law-cyber-attacks-sonyv-north-korea.
[lii] John Bandler and Antonia Merzon, Cybercrime Investigations: A Comprehensive Resource for Everyone 156 (Taylor & Francis Group, 1st Ed. 2020)
[liii] Press Release, The White House, SECURING CYBERSPACE — President Obama Announces New Cybersecurity Legislative Proposal and Other Cybersecurity Efforts (Jan. 13, 2015) https://obamawhitehouse.archives.gov/the-press-office/2015/01/13/securing-cyberspace-president-obama-announces-new-cybersecurity-legislat
[liv] POTUS, International Strategy for Cyberspace: Prosperity, Security, and Openness in a Networked World, 19 (2011)
https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.pdf
[lv] Id.
[lvi] Press Release, The White House, Executive Order on Improving Critical Infrastructure Cybersecurity (Feb. 12 2013) https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity-0
[lvii] Id.
[lviii] Press Release, The White House, SECURING CYBERSPACE — President Obama Announces New Cybersecurity Legislative Proposal and Other Cybersecurity Efforts (Jan. 13, 2015) https://obamawhitehouse.archives.gov/the-press-office/2015/01/13/securing-cyberspace-president-obama-announces-new-cybersecurity-legislat
[lix] Press Release, The White House, SECURING CYBERSPACE — President Obama Announces New Cybersecurity Legislative Proposal and Other Cybersecurity Efforts (Jan. 13, 2015) https://obamawhitehouse.archives.gov/the-press-office/2015/01/13/securing-cyberspace-president-obama-announces-new-cybersecurity-legislat
[lx] Sony settled a class action lawsuit in 2015 for $8 million after employees alleged the company was negligent in protecting their personal identifying information: Nate Raymond, Sony Settles Employees’ Suit Over ‘The Interview’ Data Breach for $8 Million, Reuters (Oct. 21 2015) https://www.insurancejournal.com/news/national/2015/10/21/385672.htm
[lxi] USA Today, Hollywood studios boost security after Sony hack (Dec. 4 2014 12:13 PM) https://www.usatoday.com/story/money/business/2014/12/04/the-wrap-sony-cyber-security/19886429/, Linda Ge, Sony Hack Attack: FBI to Hold Employee Cybersecurity Awareness Briefings on Studio Lot, The Wrap (Dec. 8 2014 3:25 PM) https://www.thewrap.com/fbi-to-hold-employee-cybersecurity-awareness-briefings-on-sony-lot/
[lxii] USA Today, Hollywood studios boost security after Sony hack (Dec. 4 2014 12:13 PM) https://www.usatoday.com/story/money/business/2014/12/04/the-wrap-sony-cyber-security/19886429/å
