Lessons in Terrorism from Sony: We Need Government on Our Backs

January 11, 2015

The cyberterrorism[i] attack on Sony by either North Korean government hackers or an undisclosed non-government group of hackers raises the issue of to what degree a company or industry can be expected to repel such attacks without government assistance.  Ronald Reagan famously said “get government off our backs.”  This dictum reinforced other political and business leaders who were also advocating for a smaller federal government and fewer regulations affecting business.  By the September 11 terror attacks, social and business admonitions eventually became governing policies that affected U.S. government response to terrorism.  

Specifically, following September 11, various government agencies conducted risk assessments of potential terrorist targets that included privately owned chemical plants.  These risk assessments found that most of these chemical plants would be quite vulnerable to terrorist attack.  The chemicals contained in these plants could be ignited devastating surrounding areas and killing or harming the inhabitants of those areas or deadly chemicals could be stolen by terrorists and used to construct explosive devices in other locations. 

Despite the warnings from these assessments, the industry itself did little to address these potential risks, including not providing adequate perimeter security or carefully screening employees.  In addition, for several reasons little was done to allow the federal government to address these potential danger over the next 4 years.  First, the chemical industry was reluctant to support additional government regulation of their industry because of concerns about costs and government incompetence.  Second, once the Chemical Facility Anti-Terrorism Standards (CFATS) regulations took effect in 2007, some chemical industry and critics of government regulation observers complained that they were too complicated and overly burdensome.  While most, if not all regulations, will always require adjustment to meet changing situations, the current political polarization promises that any future regulation will meet opposition and be subject to severe criticism. 

Nonetheless, when industries like the chemical or companies like Sony are attacked by dedicated and ruthless groups, they will usually not have the information, expertise, or other resources needed to counter those attacks.  For example, while associations of private organizations can share information and avoid running afoul of anti-trust laws, many private companies are reluctant to share proprietary information for fear of market disadvantage.  The federal government can thus play an important role in brokering information from all affected or potentially affected companies about any attempted breeches as an especially important consideration in fighting cyberterrorism.  More importantly, only the federal government has information from its own intelligence sources as well as those from other governments who share their intelligence with the U.S.  

The federal government not only has some of the most knowledgeable experts in a variety of what could be considered arcane topics until that knowledge is needed to combat terrorism.  In addition, knowledge that the federal government does not have, it is able to draw on many of the world’s leading experts through consultation.  Thus, the federal government often has access to expertise that few private companies can muster.  Finally, the federal government has unlimited resources to combat groups attacking U.S industries and companies.

As is the case of the chemical industry, the federal government cannot be expected to intercede only when terrorist attacks are manifest.  To make full use of the resources the federal government can bring to bear, it must conduct advanced planning and take precautionary measures through regulatory oversight.  It is doing this advanced planning stage when complaints about government interference and heavy-handedness can be expected to be loudest, especially if the government undertakes activities that have never before been conducted.  Nonetheless, the federal government must implement trial and error precautions and intelligence gathering activities to prevent disasters arising from terrorism; it is the only and best entity to fight terrorism.  To effectively fight terrorism, however, it must expand both the type and scope of its activities.  

Thus, the [global] war on terrorism and cyberterrorism will trump calls for “states’ rights” and limited government.  Only the federal government has the resources to effectively counter the attacks and potential attacks that companies face.  As with Sony conservatives will call for expanded government actions, a call that would have shocked Ronald Reagan.  But, as we have seen, adherents of Mr. Reagan are quite flexible in what they believe he said or meant to say.

[1] According to the U.S. Federal Bureau of Investigation, cyberterrorism is any "premeditated, politically motivated attack against information, computer systems, computer programs, and data which results in violence against non-combatant targets by sub-national groups or clandestine agents.