And another thing from Spiegel's article. NSA routinely attacks targets and then makes it look as if someone else did it:

> But the loot isn't delivered directly to ROC's IP address. Rather, it is routed to a so-called Scapegoat Target. That means that stolen information could end up on someone else's servers, making it look as though they were the perpetrators.

So how do we really know it was North Korea, and not just NSA planting that evidence that NK hacked Sony in those two months? I mean other than "trusting NSA"?