In short, until the Sony attack Obama believed corporate America should take responsibility for defending its own networks, just as they take responsibility for locking their office doors at night. That approach made sense most of the time: Washington could not go to DEFCON 4 every time someone—even a state—went after part of the private sector. Clearly, the government could not protect against every cyberattack, just as it could not protect against every car theft or house burglary.
