Is It Wise to Foil North Korea’s Nuclear Tests With Cyberattacks?

“This could set off very serious alarm bells in Beijing and Moscow.”

Last year, North Korea’s missile tests started having major problems: Tests of the Musudan, a medium-range missile, failed nearly nine times out of ten, surprising some experts. The country had pushed its nuclear program forward relatively quickly, and avoided some key errors. What had changed?

According to a detailed new report from The New York Times, creaky parts and bad engineering probably played a role—but those problems may have been compounded by an American campaign of cyberattacks on the missile launches, ramped up under President Obama.

Attacking another country’s military arsenal, whether by bomb or by malicious code, always comes with the potential of escalation. Targeting North Korea’s nuclear program—the pride and joy of the country’s volatile supreme leader, Kim Jong Un—is especially dicey.

For one, it could prompt North Korea to retaliate. The pariah state showed its willingness to launch cyberattacks on the U.S. when its state-sponsored hackers obtained and published private emails and information from Sony Entertainment in 2014. Leaking information from a movie studio is a far cry from a cyberattack on, say, a piece of critical infrastructure like the U.S. electrical grid—a feat the U.S. military fears North Korea may one day be capable of—but the Sony hack may have been something of a warning shot.

Attacking another country’s nuclear arsenal risks disrupting the delicate balance of deterrence that generally keeps powerful militaries from lobbing nukes at one another. The prospect of mutually assured destruction that has thus far staved off nuclear war could be thrown into jeopardy.

If a nation expects its valuable warheads to be destroyed at any moment, it could develop a “use it or lose it” mentality, said Vince Houghton, the historian and curator at the International Spy Museum in Washington, D.C. That could encourage an unpredictable leader like Kim to launch a working missile before it’s too late and it’s remotely disabled. What’s more, a country that thought it had disabled an adversary’s nuclear arsenal “might be more tempted to take the risk of launching a preemptive attack,” wrote David Sanger and William Broad in the Times.

The last known time the U.S. military trained a cyber-weapon on another country’s nuclear program was when it infected nuclear control systems in Iran with Stuxnet, a sophisticated piece of malware that was co-developed with Israeli forces, nearly a decade ago.

But that strike, which set back Iran’s nuclear program by years, isn’t the same as meddling in North Korea’s nuclear program, Houghton said. “Stuxnet was an attack on a country that didn’t yet have weapons, so the idea was to avoid a shooting war while still slowing down progress toward a deliverable warhead,” he said. “When you have a country that is already a nuclear power, the dynamic is somewhat different.”

Launching targeted cyberattacks is just one in a host of options available to the president for disrupting North Korea’s nuclear development. Houghton said China, North Korea’s friendly neighbor and political benefactor, may be more willing to tolerate a cyberattack on its client state than a conventional attack. But if it’s all the same to Beijing, Houghton said, a straightforward military strike could be just as effective—if, of course, it were able to hit all of the sensitive targets at once, including some that may be hidden underground or in caves.

“In my opinion, if you are taking the risk of a country responding to a cyberattack with a nuclear response, why use something as touch and go as cyber?” he said. “Just drop a JDAM”—a computer-guided bomb—“on their nuke sites, or command and control facilities. Why get cute?”

A conventional attack could, of course, provoke a dangerous, immediate response from North Korea. But a cyberattack might set off dangerous longer-term consequences, said James Acton, the co-director of the Nuclear Policy Program at the Carnegie Endowment for International Peace.

China and Russia have long been worried that the U.S. would use its cyberweapons to disrupt their nuclear arsenals, Acton said, even though the U.S. has assured the countries that it’s not developing technology to undermine their nuclear deterrence. “To actually see the U.S. exercise its capability will be pretty concerning to them,” Acton said. “In the longer term, this could set off very serious alarm bells in Beijing and Moscow.”

The fear that the next Stuxnet could be aimed at them might prod Russia and China into taking drastic steps to protect their nuclear programs. China could decentralize its nuclear arsenal, for example, to prevent the U.S. from being able to eavesdrop on or scramble launch orders sent to commanders in the field. Or Russia could press on with risky ideas like its nuclear-armed unmanned underwater drone, which could carry out a mission with little human intervention once it’s been set along its path.

It’s hard to know just how successful the cyberattacks on North Korea were. Missile tests have high failure rates, and the recent ones could have just been the result of human error, a faulty batch of parts, or just bad luck. The cyberattacks could be justified if they really made a difference, Acton said. “I could make an argument, in principle, that if it were effective at slowing down the program, it might be worth doing—even at the risk of pissing off the Russians and the Chinese.”