Park Jin Hyok

On September 6, 2018, the US Department of Justice unsealed a 179-page criminal complaint, filed on June 8, naming Park Jin Hyok, a North Korean national, in connection with three of the most consequential cyber operations of the decade: the Sony Pictures attack of 2014, the Bangladesh Bank SWIFT heist of 2016, and the global WannaCry ransomware event of 2017.

The Sony Pictures attack (November 2014): Sony's network was compromised; large volumes of data including unreleased films, employee personal information, and confidential business communications were exfiltrated and published. The attack caused significant financial and reputational damage. [SOURCE: DOJ indictment]

The Bangladesh Bank SWIFT heist (February 2016): fraudulent transfer orders were submitted through the SWIFT international banking messaging network on behalf of Bangladesh Bank — the country's central bank — targeting funds held at the Federal Reserve Bank of New York. Approximately $81 million was successfully transferred to accounts in the Philippines before the attempted $1 billion total was partially blocked. [SOURCE: DOJ; Federal Reserve Bank of New York records]

WannaCry (May 2017): a global ransomware event that affected approximately 200,000 computers across 150 countries, including the UK's National Health Service, businesses, and government systems. The US government attributed WannaCry to the North Korean Lazarus Group; the DOJ included it in Park's indictment. [SOURCE: DOJ indictment; US-CERT]

Park is at large in North Korea. He has never been tried. The indictment is the US government's most detailed public statement of the attribution — and it is a legal document, not a conviction. [SOURCE: DOJ, September 6, 2018]

Attribution in state-sponsored hacking cases works differently from attribution in conventional criminal cases. In a conventional case, the government must prove beyond reasonable doubt that a specific individual committed a specific act. In an attribution assessment, agencies compile technical indicators — code similarities, infrastructure reuse, timing, methodology — with human intelligence to conclude that an attack was likely conducted by a specific actor.

The DOJ's indictment against Park reflects this: it presents the government's attribution findings as criminal charges, using the technical and circumstantial evidence that connects Park to a front company in Dalian, China, to the development of identified malware, and to specific intrusion activity. The indictment is more detailed than a typical intelligence assessment, but its effectiveness as law enforcement is limited by jurisdiction.

Park is in North Korea. There is no extradition treaty. No arrest is plausible. The indictment serves other purposes: it names him, it forces the attribution into a public record, and it allows other countries to act on the information. It does not end in a courtroom — and the series' 'charged is not convicted' rule is not pedantry here. It is the accurate legal description of the situation.