The Problem With Calling Cyber Attacks 'Terrorism'

Yesterday, Sen. Robert Menendez (D-NJ), the ranking member of the Senate Foreign Relations Committee, appeared on CNN’s State of the Union where he proposed placing North Korea on the State Department’s State Sponsors of Terrorism list. Menendez contended that the additional sanctions announced by the White House last week were insufficient, and that “we need to look at putting North Korea back on the list of state sponsors of terrorism, which would have far more pervasive consequences.” Beyond claiming this would have additional consequences for North Korea, he disagreed with President Obama’s characterization of the alleged Sony hack as “an act of cyber vandalism”:

“Vandalism is when you break a window. Terrorism is when you destroy a building. And what happened here is that North Korea landed a virtual bomb on Sony’s parking lot, and ultimately had real consequences to it as a company and to many individuals who work there.”

I recently wrote a piece that questioned the wisdom of placing North Korea on the State Sponsors of Terrorism list, given that—according to the State Department—the “The Democratic People’s Republic of Korea (DPRK) is not known to have sponsored any terrorist acts since the bombing of a Korean Airlines flight in 1987.” There is no question that North Korean agents engage in any number of malicious and even violent actions in South Korea and beyond, which might be labeled by some as acts of “terrorism.” However, the U.S. Secretary of State, who is empowered under the 1979 legislation to determine which countries should be included on the list, concluded that North Korea should not be on the list, and, in fact, the Bush administration removed the country in 2008. Moreover, just as removing North Korea from the list did not open up the country to U.S. exports given the multitude of overlapping sanctions and restrictions, placing them back on it will not have any demonstrable impact.

There are two other points worth mentioning. First, the State Sponsors of Terrorism list was explicitly intended to deal with countries that “aid, encourage, or give sanctuary to those persons involved in directing, supporting, or participating in acts of international terrorism.” The list was not supposed to cover what could be considered “state terrorism,” which was then a common charge leveled against countries like the United States, Israel, and South Africa at the time. Rather, it was to prevent the sale of weapons to those governments that—over a sustained period of time—had sponsored international terrorism committed by non-nationals. If Menendez believes North Korea belongs on the State Sponsors of Terrorism list, then the original legislation should be re-written to cover all acts of international terrorism conducted by state agents. Or, there should be two lists: one for state sponsors of terrorism, and one for state terrorism.

Second, the Sony hack does not meet the Code of Federal Regulations definition of “terrorism:”

“Terrorism includes the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.”

If cyberattacks—whether designed to steal, corrupt, disrupt, degrade, or destroy—are considered the equivalent of a “use of force” or “violence” as the definition of terrorism suggests, then there any number of countries that and individuals who should be labeled as terrorists.

In fact, North Korea is not a leading source of malicious cyber activity—the United States is consistently ranked first, and other top sources remain debated. Symantec reported that the top three country sources of malware in 2013 were the United States (17 percent), China (9 percent) and India (5 percent). Alternatively, though Kapersky also estimates that the United States is the leading source of malicious activity (25 percent), it ranks Russia second (19 percent), followed by the Netherlands (12 percent).

Rather than misapplying the existing policy tools or diminishing the physical harm and psychological toll of terrorism, Congress should reexamine what new legislation is required to prevent or counter significant costly or damaging cyberattacks. If malicious cyberattacks are considered terrorism, this will result in a default categorization of the United States and many of its allies as sponsors of terrorism. Obviously, it’s highly unlikely that the Secretary of State would designate the United States or its allies as such.

This post appears courtesy of CFR.org.