Late last night, Sony revealed that it would pull The Interview from its release schedule. This decision was made in response to the step taken by the major theater chains, all agreeing that they would not screen the movie on its release day. The unprecedented decision is causing consternation among entertainment media types who feel that Sony has put the right of free speech in jeopardy. That's a conversation worth having, and I'm glad it's happening. But there is an entirely new question that this situation brings into dramatic relief, one that didn't exist before and one that our premeditations won't help us resolve. The question is this:
Can companies participate in cyber war?
Up until now, companies have prepared to defend themselves against cyber attacks as one-off nuisances. Such attacks are now so common that they no longer make the news. Even massive breaches where millions of customer data points are compromised tend to give us pause for only a few moments, perhaps a few days, and then we move on. But what Sony experienced was not just a security breach. This hack was a declaration of cyber war intended to bring Sony to its digital knees: a low-cost digitally effective cyber war that puts none of the hackers' assets in harm's way. And given yesterday's announcement, it appears to have worked.
Some insist Sony should fight back by distributing the film anyway. While this sentiment is based on noble principles, it essentially encourages Sony to fight back using the economic tools of the last century ("Damn the cyber torpedoes, full speed ahead!"), telling Sony to fight a sophisticated Internet attack with the equivalent of bayonets and muskets drawn. The enemy is using a superior arsenal, and the only way to respond is with the same armaments.
It's not a stretch to say that this is the same problem that every industry faces when a superior new combatant uses digital tools to attack an incumbent player. From Napster to iTunes to Spotify, the music business has been under continual digital attack for over a decade, and the only correct answer ever has been to fight fire with fire, to do a better job fighting with the weapons the advancing enemy has introduced. Sure, in this case, the hackers are not competitors in the traditional sense. They aren't using this stunt to become the North Korean Netflix. But they are bent on disruption, with a winner-take-all (or winner-break-all in this case) attitude seen in Silicon Valley firms like Uber. In short, they have declared a focused cyber war. The only answer is to fight back on equal footing.
Companies can and should engage in cyber war. Sony has the perfect opportunity to do it, fighting back not with PR, appeals to regulatory and law enforcement officials, and such, but with the same tools that the attackers used: widespread dissemination of information that the hackers don't want to see revealed.
Sony's attackers revealed sensitive communications, salaries, and intellectual property on the open Internet. Sony can turn that around by releasing similarly damning information to the open Internet. What information does Sony have that the enemy doesn't want released? The Interview, the movie that started it all. The sole pretext for declaring cyber war on Sony appears to have been to prohibit distribution of the film today and give Sony and others pause when considering the production of other embarrassing movies in the future. If that's the one thing the hackers most want to prevent from spreading, then Sony's only leverage in this war is to freely distribute that movie to any site in the world that will host it. For free, in HD.
I proposed this on Twitter yesterday morning and then again on CNN last night. Some people didn't take me seriously. Certainly Sony wouldn't want to forgo the possible revenue from legal distribution of the film, it said. But once you realize that the distribution battle has already been lost, then you can look beyond that to the bigger war. Want to strike a blow to the enemy? Release the film for free. Want to sound a strong note in favor of free speech? Release the film for free. Want to give hackers a reason to think twice in the future about such actions? Release the film for free.
Yes, it will be a multimillion-dollar loss for Sony, at least for now. But it will be a massive victory for Sony, for free speech and for digital disruption. It will tell the hackers that companies will not shrink in the face of cyber war, that they are not content to merely play defense but can go on the offensive.
One thing it does not do is end this war once and for all — because this is just the first round in a new kind of warfare. It used to be that only countries fought wars and companies provided aid and/or suffered collateral damage. Now that warfare is moving into the digital arena, the Geneva Convention doesn't apply. Combatants feel less compunction about launching a digital missile because it won't kill anyone, it won't cause an international military response, and it won't cost as much in people and money. So they'll be more willing to declare cyber war for slight provocations, targeting institutions rather than states. Sony was the first but will not be the last. But if Sony stands up and responds in kind, it will set a precedent that other companies can look to for their defense in the future.
The implications of this are vast. Will companies have cyber generals and lieutenants? And where will they report — to the CFO, chief legal counsel, the COO? How long until cyber-security firms create divisions designed to run counterattack scenarios and suggest responses to attacks. And since it is so often asserted that you can't simultaneously prepare for peace and war, will a warring corporate culture lead companies to engage in this kind of warfare proactively, company to company, rather than merely against hackers and terrorists? It's a good thing William Gibson is writing novels again because he or Neal Stephenson will be needed to help us imagine what this will look like in the near future.
James McQuivey, Ph.D., is a vice president and principal analyst at Forrester Research and the author of the book Digital Disruption. He earned his undergraduate degree in international relations when global communism was still a thing and so is a bit rusty on geopolitics, but fighting digital disruption is a topic he knows well.