Do you just enjoy doing hot takes or trolling?
Nowhere did I imply that the DPRK’s practices justify the attack - that’s left to individuals to think about for themselves. I was saying that their tendency to engage in covert ops against individuals outside of their own borders means that, if I were the hacker, I wouldn’t want my name publicly known. The same goes for the US - even more so. I would expect that someone who managed to disable significant parts of the US internet infrastructure not to then immediately publish their identity.
I think we need to do two things:
The US government needs to take a more active role in coordinating hardening of infrastructure, including the networks of private companies. This is analogous to the safety regulations the USG puts on car and airplane manufacturers, chemical plants, etc. This is a case of technology outrunning regulation, plus a dash of Alan Greenspan’s “flaw in my model” thinking that the market will optimize around security.
Second, companies need to be held legally and financially responsible for the data breaches that occur. This would open up an insurance market, which would be motivated to audit the companies accurately in order to set rates.
Honestly, I think we’d be better served by having a department of cybersecurity than a Space Force, since right now there’s only spotty coverage divided among the various intelligence agencies.