The fallout from the hack on Sony continues.

North Korea's cyber team dubbing themselves the "Guardians of the Peace" vowed to make Sony "Remember the 11th of September 2001". This threat appears to have motivated Sony to remove The Interview from circulation on Christmas Day, capitulating to demands. This might be the first example of effective use of cyber coercion, ever.

This is a big statement; until now, there has never been a cyber action that has led to a change in perspective by the target given coercion by the aggressor. For various reasons, cyber actions are almost never effective in changing behaviour. They either are too muted (Russia towards Estonia); the target is too hardened (almost any attack against US or Israeli Government sites); or the actions are just not effective enough to push opponent to give in (Stuxnet and Iran).

If we accept this is the first effective use of cyber technology to make a target to change behaviour, there is a deeper question of why this action was effective. The real reason seems to be a combination of the motivation and skill of the attacker but also the weakness in the target. Sony was a soft target; they have been hacked before and warned recently that their networks were vulnerable. No network is ever safe but a network with a directory listed as "passwords" is probably a ripe target for attackers. This event did not happen because the United States was weak, but because Sony itself was weak.

Even more problematic for the coercion narrative is that Sony did not change because of what North Korea did in cyberspace, but because the distributors and chains that would put the movie out gave in and capitulated. Sony's internal errors were important in the chain of events that led us here, but more importantly distributors such as Regal, AMC and Carmike feared retaliation by North Korea.

Why shouldn't a chain distributing the movie be fearful? If Sony cannot protect itself, who can? For one, this was a prompt cave-in by the retailers. They could have waited and prepared. More importantly, there is strength in numbers. If multiple chains and theatres released the movie to more than 2,000 screens, North Korea would have a lot of targets to go after. The companies that gave in are admitting their own weakness and insecurity in their networks. They didn't just wave the white flag; the gates are down.

The effectiveness of the attack has more to do with the nature of the target rather than the nature of coercion. We really need to understand the dynamics of possible effective uses of cyber tactics. My conclusion would be that this attack was successful in changing behaviour because the target was not a government organization, not prepared, and completely decentralised. While combined they might be powerful, these distributors felt isolated and vulnerable.

There are two clear tasks for governments, including the United Kingdom. First, the need to develop more effective means of collaboration among private industry. Private companies have been hesitant to share information and resources. It is to be hoped this attack will push private companies to realize that it is in their interest to work together. Secondly, there is the response; the action cannot go forward without a response. Permitting this action only reinforces the idea that there is a spot just below massive attacks that is condoned by governments.

Will The Interview go down as one of the biggest failures in Hollywood history all because the movie was never released? Outraged Americans will buy the movie OnDemand on principle alone. Sony still might come out as the winner by cutting out the middle man and distributing the movie itself, if it dares ...