[BreachExchange] THE UNTOLD STORY OF THE SONY HACK: HOW NORTH KOREA’S BATTLE WITH SETH ROGEN AND GEORGE CLOONEY FORESHADOWED RUSSIAN ELECTION MEDDLING IN 2016

[Destry Winant]

https://www.vanityfair.com/news/2019/10/the-untold-story-of-the-sony-hack

Sony employees who logged on to their desktops early on Monday
morning, November 24, 2014, were greeted with the sound of digital
gunfire and the image of an ominous red skeleton under the title
“Hacked By #GOP,” which stood not for the Grand Old Party, but for a
shadowy organization called Guardians of Peace. Below was a message
that read, in not very good English, “We’ve already warned you, and
this is just a beginning. We continue till our request be met. We’ve
obtained all your Internal data Including your secrets and top
secrets. If you don’t obey us, we’ll release [that] data.” It read
like the opening of a bad script for a cyber-thriller.

But for Sony, the horror movie was just the beginning. Before the
entire system went dark, the malware wiped out half of Sony’s global
digital network. It junked 3,262 of Sony’s 6,797 personal computers
and 837 of its 1,555 servers. Within hours, the global media giant was
back in the 1980s, its employees using fax machines and pens and
paper. The studio shop would only accept cash.

And it got worse. The hackers had actually been inside Sony’s system
for weeks, and stolen all of Sony’s data before deleting it. Over the
next month, they released nine batches of confidential files onto the
public internet: everything from executives’ salaries to embarrassing
emails about “no-talent” movie stars, to unfinished film scripts to
actual unreleased films like Annie and Fury. Eventually all of the
hacked emails were published by WikiLeaks.

Does that sound familiar? Two years later, in 2016, after we learned
of Russia’s hack of the Democratic National Committee and Clinton
campaign chairman John Podesta and their dark bargain with WikiLeaks
to release that stolen information, it’s clear that the Sony hack
foreshadowed not only the Russian attack on our election, but provided
a panoramic vista of the modern, global information war. It’s all
there. The vulnerability of major American institutions, the late and
inept response of government, the press’s obsession with gossip that
blinded them to a national-security threat, and a trampling of the
First Amendment. Well, we were certainly unready when it happened in
2014. We were unready in 2016. And we seem barely more ready for 2020.
Once again we have a candidate for president encouraging a foreign
power to help him in his election campaign. Only now he’s president.
The story of the Sony hack is worth reexamining as a model of modern
information war, how we got it so wrong, and what we might do to
prevent it from happening again.


Within weeks, U.S. intelligence agencies were pointing the finger at
North Korea. Their motivation seemed to be a dark comedy called The
Interview. The movie starred Seth Rogen and James Franco as a pair of
bumbling journalists who go to North Korea to interview Kim Jong Un
and eventually assassinate him. For months, North Korea had complained
about the pending film. In June, a government spokesperson warned that
the movie was “the most blatant act of terrorism and war” and
threatened “a merciless countermeasure.” A couple of months earlier,
North Korea had sent a letter to the secretary-general of the U.N.,
saying that unless the U.S. government banned the film, “it [would] be
fully responsible for encouraging and sponsoring terrorism.” (That
same day, Rogen tweeted: “People don’t usually wanna kill me for one
of my movies until after they’ve paid 12 bucks for it.”)

Ten days after the initial hack, the “Guardians of Peace” released a
message saying that Sony had “refused to accept” its terms and must
“stop immediately showing the movie of terrorism.” A week later, they
released another message saying that anyone who went to The Interview
would suffer a “bitter fate.”

Soon all the world will see what an awful movie Sony Pictures
Entertainment has made.

The world will be full of fear.

Remember the 11th of September 2001.

We recommend you to keep yourself distant from the places at that time.

(If your house is nearby, you’d better leave.)

Whatever comes in the coming days is called by the greed of Sony
Pictures Entertainment.

All the world will denounce the SONY.

The FBI had now formally attributed the attack to North Korea and
declared it one of the largest cyberattacks ever perpetrated in the
U.S. I was then the undersecretary for public diplomacy and public
affairs at the State Department, and my job was in part to worry about
how America’s image around the world was affected by communications
issues like this one. But this was more than a communications issue.
>From the moment that North Korea was identified as the source of the
attack, I considered this an example of information warfare. An
American media company had been attacked by a hostile foreign power.
How was this different than Russia cyber-hacking the Ukrainian
government? Or ISIS hacking Iraq’s government servers? It was also, I
thought, a free speech issue. A despotic foreign state had attacked a
company on U.S. soil and was trying to prevent it from releasing a
silly comedy.

I brought this up in our weekly public-diplomacy meeting at the State
Department. I brought it up at the assistant secretaries’ meeting that
happened every Tuesday. I mentioned it at the small daily 8:30 a.m.
meeting hosted by the secretary of State. I talked to the public
affairs department about it. I said we needed to make a statement
defending Sony, criticizing the attacks, and supporting the release of
the film. The collective reaction by everyone at the State Department
was a yawn. Responses ranged from, It’s not our problem, to Sony was
stupid to use Kim’s actual name, to What do you expect when you insult
a head of state and threaten another country? Really? I was
dumbfounded. We’re always on the side of protecting free speech in
every country where we have a post—how about protecting free speech
here at home from the predations of a foreign power? Calm down, I was
told; it’s a comedy starring Seth Rogen, for Chrissake.

Folks outside the government weren’t much more receptive. I called my
friend Jeff Shell, the chairman of the Broadcasting Board of
Governors, and, more importantly, the head of Universal Pictures. Jeff
agreed with me, but wasn’t yet ready to speak up. Almost no one in
Hollywood was. Even the Motion Picture Association of America kept
mum.

The press was completely suckered and abdicated its real
responsibility. As the Guardians of Peace had released the hacked
emails of Sony executives, a scrum of journalists gleefully reported
on the embarrassing, and sometimes salacious, emails of Sony execs,
big-time producers, and actual movie stars. In particular, an exchange
between Sony’s cochair Amy Pascal and producer Scott Rudin about
President Barack Obama’s taste in movies seemed to get more attention
than the whole act of cyberterrorism. Pascal had emailed Rudin asking
for advice before going to an Obama fundraiser hosed by Jeffrey
Katzenberg. What should she ask President Obama “at this stupid
Jeffrey breakfast?”

Rudin: Would he like to finance some movies?

Pascal: I doubt it. Should I ask him if he liked DJANGO

Rudin: 12 YEARS.

Pascal: Or the butler. Or think like a man?

Rudin: Ride-along. I bet he likes Kevin Hart.

Both Pascal and Rudin were Democratic and Obama donors, and the
stories focused on their contemptible interchange about Obama and a
range of African American–centric films.

Now that I was in government, I saw things from the other side: Why
was the press publishing what was in effect stolen property—that is,
emails hacked and leaked by a hostile foreign power? Why was that
acceptable behavior? Shouldn’t you consider the origin of the
information before deciding to use it? If you don’t, aren’t you
incentivizing other attacks? You could still report on the hack, but
without using the poisoned fruit of the hack. By publishing the
emails, the press was making itself complicit not only in North
Korea’s crime, but in its goal of censoring Sony. What exactly was the
public interest in Scott Rudin speculating that President Obama likes
Kevin Hart movies compared to a foreign power assaulting free
expression in America?

I also had a personal interest. Michael Lynton, the chairman of Sony,
was a good friend of mine, and, while I was in office, I had asked him
to help me with what had become the focus of my job: countering ISIS
messaging and countering Russian disinformation and propaganda. Sony,
it turned out, was one of the largest sellers of content for the
Russian periphery. A few days into the attack, I had reached out to
Michael to see if there was anything I could do at State to help him.
He was frustrated. The press, he said, was focused on “a movie
studio’s dirty laundry being exposed to the world, with no discussion
of the damage itself and the larger threat.” He added, “They think
because a movie star is involved, it’s less serious.” Michael told me
that he had been in touch with Valerie Jarrett at the White House, but
that was mainly to allow Amy and Scott to apologize to President
Obama. He said, “Just speak out about it.”

There was one profile in courage during this whole story, one person
in Hollywood and Washington who stood up for freedom of speech and
expression, though he was not a senator, or the head of a studio, or
the publisher of a newspaper: George Clooney. Clooney had immediately
recognized the threat of the hack against Hollywood and the media
business, and had drawn up a letter that he and his agent, Bryan
Lourd, sent to all the heads of all the studios and big Hollywood
production companies, asking them to support Sony. “We know that to
give in to these criminals now,” they wrote, “will open the door for
any group that would threaten freedom of expression, privacy and
personal liberty.”

Clooney was appealing to values all of the studios stood for: freedom
of expression and personal liberty. Let’s all resist this collective
threat to what we stand for.

No one signed. Not one Hollywood executive was willing to lend his or
her name to Clooney’s letter.

Here’s what Clooney said to Deadline Hollywood, who interviewed him a
few weeks later, after the letter had gone nowhere.

We have a new paradigm, a new reality, and we’re going to have to come
to real terms with it all the way down the line. This was a dumb
comedy that was about to come out. With the First Amendment, you’re
never protecting Jefferson; it’s usually protecting some guy who’s
burning a flag or doing something stupid. This is a silly comedy, but
the truth is, what it now says about us is a whole lot. We have a
responsibility to stand up against this. That’s not just Sony, but all
of us, including my good friends in the press who have the
responsibility to be asking themselves: What was important? What was
the important story to be covering here?…. I understand that someone
looks at a story with famous people in it and you want to put it out.
The problem is that what happened was, while all of that was going on,
there was a huge news story that no one was really tracking. They were
just enjoying all the salacious sh*t instead of saying, “Wait a
minute, is this really North Korea? And if it is, are we really going
to bow to that?”

Within hours of North Korea’s last threat, America’s four largest
theater chains, as well as several smaller ones, told Sony that they
would not show the movie in their theaters. Sony then had basically
little choice but to cancel the Christmas release of the movie. Even
the video-on-demand distributors had turned Sony down. Sony then
suspended all of its promotion, advertising, screening, and digital
ads on Facebook and Twitter.

On the day that Sony basically scrapped the movie, I got this email
from Jeff Shell:

Subject: Fwd: It’s Official: Sony Scraps ‘The Interview’
To: Richard Stengel

Terrorism wins.

Jeff

It was only then, after the theaters refused to show the film and Sony
paused the release, that the White House seemed to get engaged—and not
in a terribly helpful way. At a press conference, when President Obama
was asked about Sony, he criticized the studio, saying it had “made a
mistake.” He added: “We cannot have a society in which some dictator
someplace can start imposing censorship here in the United States.”
Lynton was upset about this and decided he needed to fire back. He was
scheduled to talk to Fareed Zakaria on CNN, and the White House asked
him to pull the interview. He did it anyway. “I think, actually, the
unfortunate part is, in this instance, the president, the press, and
the public are mistaken as to what actually happened. We do not own
movie theaters. We cannot determine whether or not a movie will be
played in movie theaters.” Lynton said when theaters say they will not
show the movie, they had no alternative but to halt the theatrical
release. “We have persevered, and we have not backed down.” In fact,
after the chains refused to show it, Sony worked behind the scenes to
have other platforms get the movie out. Almost everybody
refused—Netflix, Facebook, Apple, Comcast—all of whom were concerned
about getting hacked. Only Google and Stripe were willing to help to
get the movie out.

But there was another shoe to drop, and it affected me and what I was
trying to do at State: the leaking of emails between myself and
Lynton. In the early months of my job, I had reached out to Lynton for
help in the counter-ISIS fight and countering Russian disinformation.
The WikiLeaks release contained a number of emails between Lynton and
me.

This was the email that got the most attention:

Date: October 15, 2014 at 11:44:44 AM EDT
To: Michael Lynton
Subject: Thanks and Moving Forward

Michael: It was great to see you yesterday. As you could see, we have
plenty of challenges in countering ISIL narratives in the Middle East
and Russian narratives in central and eastern Europe. In both cases,
there are millions and millions of people in those regions who are
getting a skewed version of reality. And it’s not something that the
State Department can do on its own ny [sic] any means. Following up on
our conversation, I’d love to convene a group of media executives who
can help us think about better ways to respond to both of these large
challenges. This is a conversation about ideas, about content and
production, about commercial possibilities. I promise you it will be
interesting, fun, and rewarding.

Best, Rick

Many publications in their story about the Sony hack made passing
references to the email and our dialogue, including New York magazine
and Gawker. But the one publication that did the most with it was
Russia Today. It was as though they were practicing for 2016. They
were particularly exercised that a “senior State Department official”
was enlisting help “countering...Russian narratives.”

Even before the print article was published, the correspondent for RT,
who was a regular attendee at the State Department’s daily briefings,
began to pester the State Department spokesperson about the emails.
The RT correspondents were well-known for haranguing the State
Department spokespeople and trying to trip them up on policies
regarding Russia. RT’s Gayane Chichakyan, who had already accused me
of being a propagandist, had asked State spokesperson Marie Harf about
the significance of me trying to “counter” Russian narratives.

Conventional Russian media outlets, particularly Russia Today and
Sputnik, were always on top of what they invariably criticized as
anti-Russian bias. They then responded in the characteristic Russian
way: They accused you of what they were doing. They always accused
America and the West of being hypocrites, propagandists, and treating
Russia like a junior partner. I had started watching RT in my State
office and found it to be a low-rent version of Fox News featuring
“experts” without expertise, pundits and academics from organizations
and universities you’ve never heard of spouting conspiracy theories
that you only expected to see on the dark web.

The references in my emails to Russian disinformation and propaganda
had obviously gotten their attention. Their strategy was always to try
to punch back harder. In addition to their online story, RT also did
an on-air story that was broadcast the same day as the digital one
posted. It was done by the correspondent cited in the online piece,
who, after a dramatic on-air reading of the emails, says, “So the
State Department response to allegations that the government is in
talks with entertainment giants to promote U.S. foreign policy could
be summarized in two words: So what? We reached out to Sony, and they
refused to comment.”

Then the RT anchor came back on air and introduced a middle-aged
fellow with rimless glasses who was chyroned as a representative of
the “anti-war Answer coalition.” He asserted that “this is really a
revival of whatever was allowed to die after the Cold War…. This
collaboration was intensified exponentially to turn the big
corporations into arms of the government,” adding that all of this
“propaganda” was “deeply controlled by the White House and the
Pentagon.”

The Russians were trying to shape the story to their master narrative
of anti-Russia bias by the U.S. They didn’t have any special sympathy
for Kim Jong Un, but they liked showing corporate America and the
American government at the mercy of a tin-pot dictator. Going back to
the Cold War days, there is nothing the Russian media likes more than
exposing what it considers to be American hypocrisy and
ineffectiveness, in this case the U.S. government not standing up for
the values of free speech.

This also proved to be RT’s strategy during the 2016 election: to
focus on American disunity and hypocrisy, to exaggerate the dangers of
immigration, and play up the grievances of Trump voters, in general to
show the U.S. as something akin to a failed state.

In the end, in addition to a digital release, Sony managed to cobble
together a limited number of independent theaters and show the movie
around the time they had originally planned. Some months after the
whole episode had receded from the news, I spoke to Michael. He told
me that President Obama had reached out to apologize. Michael was
grateful for that. Reflecting on the whole episode, he said, “Cyber
can be as destructive as anything physical, but because it’s
invisible, people who haven’t experienced it don’t seem to understand
it. There still isn’t a way to combat this.”

He also recalled that in the middle of the crisis, Sony’s general
counsel, Nicole Seligman, said she wanted to bring in outside counsel
to help navigate the legal and national-security terrain in
Washington. After all, they were in California. She retained a partner
from the Washington law firm WilmerHale, a former director of the FBI
named Robert Mueller. Michael said Mueller acted as a sounding board
for them. He was familiar with state actors hacking into U.S. systems
from his time at the bureau.

For me, the whole episode was frustrating and dispiriting. An American
company had been attacked by a foreign adversary bent on suppressing
free speech, and we had done almost nothing. The press had mostly
missed the real story, focusing on Hollywood drivel. It was as though,
because the attack was not physical or traditional, that it was
somehow less real, less threatening, less dangerous. In actuality it
was more insidious, and probably more dangerous. It was clear that for
countries like Russia, China, and North Korea, and entities like ISIS,
there was much less downside risk in this kind of asymmetric warfare.
No missiles were fired; no soldiers were wounded; and it was a lot
cheaper than an F-35.

The Sony hack proved to be an object lesson in how so many of us would
either miss or mishandle the Russian attack in the 2016 election.
That, too, began with a cyber-hacking, and was accompanied by a
tsunami of disinformation. After watching our lackluster response to
the Sony hack, Russia may well have concluded that there was a very
little price to pay for attacking American institutions. And they were
right.