Here’s Why the Trump Administration Called Out North Korea’s Cyberattacks

Trump Homeland Security officials put policy into practice Tuesday when they attributed a massive, transnational ransomware attack to the North Korean regime.

During a 30-minute press briefing, Homeland Security Adviser Tom Bossert and Homeland Security Department cyber official Jeanette Manfra repeatedly hammered on key pillars of the administration’s cybersecurity strategy and touted the administration's cyber priorities.

The argument, in short, was this: If you attack us, we’ll find out. We’ll work with allies and the private sector to do something about it. And we’ll make it harder for you to do it again.

Here’s a rundown:

Attribution Works

Like the Obama administration before it, the Trump administration wants to stress that its intelligence and national security officials are fully capable of determining who’s responsible for what in the once murky world of cyberspace.

Confidently attributing a cyber operation is the necessary, but not sufficient, first step for both administrations’ larger plans for stability in cyberspace—to establish norms of proper behavior for states and citizens and hold nations or groups that violate those norms accountable.

This is the second time a U.S. presidential administration has publicly attributed a major hacking operation to the North Korean state. The Obama administration attributed the 2014 Sony Pictures Entertainment breach to the rogue regime shortly before Christmas 2014.

Those are among only a handful of public nation-state cyber attributions stretching back to the middle of the Obama administration, however, including Chinese government hacks of company trade secrets, an Iranian hack of a New York state dam and of U.S. financial firms, and Russian breaches of Democratic political organizations during the 2016 election.  

When asked about the lag time between the rash of WannaCry ransomware attacks in May and the December attribution, Bossert replied: “As we move forward and attribution becomes part of our accountability pillar, we can’t do it wrong, we can’t get it wrong, we can’t try to rush it.”

He later added: “If we had gotten it wrong, it would have been more of a damage to our reputation and our national security than it would have been a boon.”

Critics, ranging from U.S. security researchers to Russian diplomats, have questioned the effectiveness of the U.S. government’s cyber attributions. Those charges are sometimes hard to answer because the data and analysis underlying the attributions are typically classified.

President Donald Trump himself has often questioned the intelligence community’s conclusion that Russian government-linked hackers were responsible for the 2016 election breaches, likely making Bossert’s job harder.

Bossert acknowledged part of the attribution was based on similarities between the WannaCry operation and other North Korean cyber operations as well as known elements of North Korean cyber tradecraft, not just technical signatures.

While those context clues are common in most cyber attributions—whether by a nation or a private threat tracker—they sometimes trouble skeptics who worry the trademarks might suggest a copycat or a false flag operation in which one adversary mimics another rather than the suspected adversary itself.

In this case, Bossert said, the government not only traced the attack back to the North Korean government but also to intermediaries outside North Korea that acted on the government’s behalf and have done so in the past.

Cooperation Is Important

International cooperation was another pillar of the announcement.

In advance of making the attribution public, the U.S. shared its analysis with officials in Britain, Australia, Canada, New Zealand and Japan, all of whom backed the analysis and “join us in denouncing North Korea for WannaCry,” Bossert said.

In advance of the announcement, “Microsoft and Facebook and other major tech companies acted to disable a number of North Korean cyber exploits and disrupt their operations as the North Koreans were still infecting computers across the globe,” Bossert said.

That included shutting down user accounts that North Korea had used to launch ransomware attacks, he said.

The focus on cooperation is important, in part, because it raises the possibility of collective action against North Korea or another cyber offender.

In the wake of the Sony breach, the Obama administration imposed additional sanctions against North Korea, though those sanctions may have had little actual effect on the already heavily sanctioned hermit kingdom.

Later, the administration created a new Treasury Department authority to sanction companies and individuals that were responsible for cyber wrongdoing.

In this case, Bossert pledged attributing the attack to North Korea would be “a step towards holding them accountable, but … not the last step.”

However, those future steps would be focused mostly on naming and shaming the nation and on improving U.S. cyber protections to make future North Korean hacking operations more costly, he acknowledged, not taking retaliatory actions against North Korea specifically for the ransomware attack.

“At this point … President Trump has used just about every lever you can use, short of starving the people of North Korea to death, to change their behavior,” he said. “And so we don’t have a lot of room left here to apply pressure to change their behavior.”

(The U.S. is involved in a much more serious and heated dispute with North Korea over the rogue state’s nuclear weapon and missile programs, which Trump has repeatedly suggested could lead to military conflict.)  

Defense Is Key

Finally, Bossert and Manfra both stressed that improving cyber defense will be far more important in the long run than identifying or punishing cyber adversaries.

Going forward, Homeland Security “plans to move beyond only offering voluntary assistance [after it discovers a company or organization has been hacked] to more proactively becoming the world leader in cyber risk analysis and intervening directly with companies when necessary,” Manfra said.

She added that the government is “calling on all companies to commit to the collective defense of our nation” and urged international partnerships to combat borderless cyber threats like WannaCry.

The goal, she said, “is a cyber environment where a given threat, such as a malicious email, can only be used once before it is blocked by all other potential victims.”