North Korea's rapidly advancing nuclear program and potential capacity to strike the U.S. mainland with a nuclear weapon have captured much of the international community's attention in recent weeks. In less than six weeks, North Korea has launched two missiles over Japan and conducted its sixth nuclear test. In response, the United Nations Security Council has passed two resolutions banning much of North Korea's international trade. However, too little attention has been paid to one tool North Korea already uses to intimidate its neighbors and evade sanctions – its growing cyber operations.
Cyber is particularly appealing for North Korea. While Pyongyang has poured significant resources into its nuclear weapons and missile programs at the expense of its conventional forces, the relatively inexpensive nature of cyber development has provided North Korea with the means to level the playing field against more powerful states. By growing its cyber operations, Pyongyang is able to exploit its asymmetrical advantage against more wired states such as South Korea and the United States, as the limited nature of North Korea's own domestic networks leaves it significantly less vulnerable to retaliatory cyberattacks.
With speculation that the United States could at some point use preventative strikes to preclude North Korea from being able to use its nuclear weapons against the United States, South Korea, or Japan, much of the conjecture on North Korea's potential response has been premised on the idea that Seoul's proximity to North Korean artillery mean it would bear the brunt of any North Korean retaliation. Any conflict, some have said, would be over there rather than over here. In fact, that logic is faulty.
In the case of a conflict, North Korea's leader, Kim Jong Un, could very well calculate that attacking South Korea or Japan might escalate into a war that it could not win, especially if the United States successfully eliminated most of Pyongyang's nuclear weapons and delivery systems. For a regime that has spent decades working to ensure its own survival, responding with force would be a grave risk, especially given other options that would continue to ensure the regime's survival – such as cyber operations against the United States. Cyber attacks against U.S. financial institutions or critical infrastructure would not only cause significant financial damage to the United States, it could be seen as a proportional, if not restrained, response on the part of Pyongyang. This would also potentially limit the United States' ability to continue to respond.
How successful might North Korea be if it chooses to utilize cyber attacks against the United States? North Korea has spent years honing its team of cyber warriors through attacks against South Korean government, financial, and media outlets -- they are perhaps most well-known for the attack against Sony Pictures in response to The Interview. And while no one has suggested that North Korea was responsible for the recent Equifax hack, the attack highlights the United States' potential vulnerability.
Even in the absence of military action by the United States against North Korea, cyber attacks by Pyongyang are likely to become more common. In recent years, North Korea has demonstrated a willingness to use a combination of cyber attacks on banks and ransomware to obtain hard currency, especially as U.S. financial sanctions and UN sanctions have limited North Korea's ability to earn and move hard currency.
North Korea is believed to have been behind the theft of $81 million from the Bangladesh central bank, attacks on banks in 17 other countries, and recent attacks on Bitcoin exchanges in South Korea. The regime is also suspected in the WannaCry ransomware attacks earlier this year.
As new UN sanctions limit North Korea's ability earn hard currency, cyber attacks similar to the one on Bitcoin will become increasingly attractive to decision makers in Pyongyang as they search for ways to fund further weapons development.
While North Korea will likely continue to target financial institutions in countries with lax standards in an effort to evade sanctions and avoid stronger responses by the United States, we shouldn't assume that the United States would be safe from a harsh response to a preventative action on North Korea's weapons programs. The attack may just be from cyberspace rather than missiles.
Commentary by Troy Stangarone, the senior director for Congressional Affairs and Trade at the Korea Economic Institute of America. The views expressed here are the author's alone.
For more insight from CNBC contributors, follow @CNBCopinion on Twitter.
