U.S. officials: Sony investigation was thorough

Several senior Obama administration officials went on the offensive this week to counter suggestions by outside experts that the FBI's publicly presented evidence for accusing North Korea of being behind the hack of Sony Pictures Entertainment is weak. The officials say the administration would not do something as serious as accuse another nation state of destructive hacking without proof or careful consideration of the diplomatic implications.

How the investigation of the Sony hack is perceived by cybersecurity experts and myriad state and non-state actors affects U.S. credibility in cyberspace, and administration officials say they are well aware of the stakes.

In deciding to name a country a culprit in a big cyberattack, "a) you better be right and b) you want to be able to do so with confidence and have people have confidence in your judgment," said Lisa Monaco, a top homeland security adviser at the White House. Diplomatic consequences "absolutely" factor into a decision to publicly accuse a country of hacking, she added during a Jan. 8 cybersecurity conference at Fordham University.

In an interview, an Obama administration official rejected any suggestion that there are reasons to doubt the investigation's findings. "We have every confidence of our attribution," the official said.

At the conference, Monaco said suggestions by outside experts that the FBI might have gotten it wrong were "counterproductive to our efforts to make very clear to both [North Korea] and other state and non-state actors who would engage in destructive and coercive activity like this that there will be consequences."

The FBI has also made it clear that investigators considered multiple competing theories about the Sony hack. Joe Demarest, assistant director of the FBI's Cyber Division, told reporters Jan. 8 that a multi-agency team of about a dozen officials considered various hypotheses about who was responsible for the hack, including nation states, criminal organizations and hacktivists. But they ultimately concluded that "it was clearly North Korea or a proxy put up by North Korea" that was responsible for the attack, Demarest said.

Chris Cummiskey, who until November was acting undersecretary for management at the Department of Homeland Security, said the FBI's certainty makes sense given the recent progress agencies have made in investigating cyberattacks.

"I think the FBI should have a pretty good sense, based on the investments they've made in cyber forensics, to know the origins of where the attack came from," he told FCW.