I think the question is about foreign government operations. If North Korean agents threw up some graffiti on a Wal-Mart and stole some soda, the private security would not be expected to handle the situation on their own. Even if the stakes seem low, that's an international incident.

I think a somewhat comparable scenario could be: it's reasonable to expect that Walmart should defend against most counterfeit currency on their own. But should they be expected to defend against counterfeit currency made with state-level resources, such as supernotes with the same paper, ink, printing process and security features, where there's no guarantee that any reasonable detection method will work? This is, interestingly, something that has been linked to North Korea as well (https://en.wikipedia.org/wiki/Superdollar).

That's... a very weird, reaching argument to make. And also not an international incident, since it's just some graffiti, not espionage or assassination or whatever. I'm not sure what point you're trying to make here.

It doesn't seem that far reaching. There's a difference between "foreign citizen action" and "foreign government action". If another government comes to your territory, to break your laws and deprive one of your businesses of their property or rights, that's a big deal. But because it happens online, it's given a pass and pushed on to private individuals to deal with.

The original argument is that it's weird private businesses have to protect themselves against state actors such as foreign governments. The equivalent would be if Walmart was expected to protect itself while a foreign governments special forces raided their stores.

Of course I'm not sure that's how it's playing out anyway, as I'm certain that the relevant three letter agencies are interested in foreign state actors digital incursions, it's just a very delicate situation and not as simple or clear cut as the Walmart example.

Honestly, ignoring the state actor part of this, even if a bunch of local kids run up and graffiti the outside of a Walmart, I don't think we tend to regard it as a fundamental failure of Walmart's duty to secure their business, or a failure of their architects and security staff to do basic diligence or follow best practices to allow it to happen.

It's just a criminal act, of which Walmart are the victim, and it's the state's job to find and prosecute and deter that kind of thing from happening again.

I am pretty sure that it does not matter who stole the soda - North Koreans or locals. Either way it is up to store security to catch them and hand over to police. Police may then hand NKs over to someone else, but this doesn't change what store security must do.

> this doesn't change what store security must do.

There is no _must_ here. The police _must_ deter and punish crime. A private entity _may_ hire security if they find the police to be ineffective at stopping certain crimes. If walmart was robed while the security guard was off duty, it is still the police's job to investigate and arrest the criminal.

You're missing one thing though: North Korea doesn't rob Walmarts. Expecting private entities to be able to stand up to the kind of attack a hostile nation state can muster is unrealistic, and, quite frankly, probably a drag on the economy.

Besides, what ever happened to "provid[ing] for the common defense?"

How can Walmart defend itself from foreign government's attack, with cameras, guards, and most importantly locked windows and doors?

Defending internet infrastructure from foreign government's attack is not "basic security".

The correct equivalency would be the roads leading to the Walmart. If a Walmart were blocked by people pointlessly driving on the road to make the Walmart effectively unreachable, police would intervene and clear the road of the noise.

There is no such thing as a "correct equivalency".