Russian hacking

Russian hacking crisis tests Obama's nerve

Demands for swift retaliation against Moscow grow, but all the options carry big risks.

By Bryan Bender and Michael Crowley

President Barack Obama came under immediate pressure Friday night to punish Russia for hacking into US political institutions — with calls to rally European allies behind sweeping new sanctions against Moscow.

The demands for swift action followed the administration's extraordinary public statement accusing the Russian government of targeting the Democratic National Committee and other political organizations, amounting to the most significant effort by a foreign power to interfere in U.S. domestic politics in American history.

"The first step comes with the public attribution. I think it was a powerful statement," said Rep. Adam Schiff of California, the ranking Democrat on the House Intelligence Committee. "But we are not the first to be affected by this. There has been far worse Russian meddling in Europe. We need to come up with our allies to find a concerted response. That could take the form of sanctions or it could take another form.”

Other political and military experts suggested actions ranged from disrupting sensitive Russian computer networks, exposing Russian emails or secrets to embarrass and undermine officials of President Vladimir Putin's government, to bringing criminal charges against the Russian individuals allegedly involved in the hacking.

The demands highlighted a larger dilemma facing the Obama administration: how best to retaliate against Russia without having the confrontation spin out of control. This could prove to be the thorniest challenge since the end of the Cold War, warned current and former officials.

"This is a big, big deal,” said Michael Morell, a former acting director and deputy director of the CIA. “I can’t remember another time in American history where we have publicly accused another country of trying to interfere in our elections."

While a tit-for-tat payback in the form of a U.S. exposure of Russian computers might be politically and viscerally satisfying, Obama officials are worried about the unintended consequences of escalation.

There is little doubt that the United States could go on the cyber offensive to demonstrate to Russia that it, too, can play at that game, as it reportedly did in attacking Iran's nuclear weapons program with a computer virus,

"No doubt the U.S. has the ability to reach into Russia networks," said Matthew Wallin, who runs the Project on U.S.-Russia Relationship at the American Security Project, a nonpartisan think tank. "Could you disable their capabilities to an extent? That is a possibility."

But he said the consequences would be wholly unpredictable.

"With every action, there will be set of consequences, and you have to calculate the positive and negative actions Russian might take," Wallin said. "We, as a country, haven’t decided what the proper path is. We know what we would do if they were pushing conventional or nuclear forces forces. We don’t have a system for escalating cyber conflict."

Rajesh De, former general counsel for the National Security Agency, said it was unlikely that the U.S. would exert revenge against Russian officials by, say, exposing their private emails or financial records.

“I don't think that’s the sort of thing that’s probably being thought about that seriously, and in the big picture, grand scheme is not that productive,” said De, who now leads the cyber practice at the Washington law firm Mayer Brown. “What we’re really talking about is trying to establish norms of behavior.”

"I would be reluctant to recommend we engage in a cyber response," added Schiff. " That would be the wrong road to go down."

The White House has been weighing such risks for months. “[T]he danger of escalation and misinterpretation is such that we have to be responsible about it,” White House homeland security advisor Lisa Monaco said at the Aspen Security Forum in July.

But in the most serious cases, she added, “we have to be very clear we will respond.”

After a meeting with Putin in China last month, in which he is believed to have raised the DNC email hack, Obama told reporters he was wary of “a cycle of escalation” in the cyber realm and that he hoped to “start instituting some norms so that everybody’s acting responsibly.”

“What we cannot do is have a situation in which suddenly, this becomes the wild, wild West, where countries that have significant cybercapacity start engaging in unhealthy competition or conflict through these means,” Obama said.

There is no evidence that Obama has taken punitive cyber action in response to several major cyber breaches in the past few years, although by its nature cyber war is often invisible to outsiders.

After the government of North Korea hacked Sony’s email servers in 2014, for instance, Obama issued a stern condemnation of North Korea’s actions but took no visible action beyond adding modestly to the long list of sanctions against that rogue state.

In May of 2014, the U.S. issued its first criminal charges against state actors for cyber activities when it indicted five Chinese military hackers for what it called economic espionage.

But Obama took no visible action against China after internally concluding—though not publicly announcing—that Beijing electronically stole personal information, including background check files, of more than 20 million Americans from the Office of Personnel Management.

The White House discussed such action, but concerns about the fragile U.S. relationship with China appear to have won out.

Obama officials would not say on Friday afternoon what steps the U.S. might take in response to the Russian hack.

“The President has made it clear that we will take action to protect our interests, including in cyberspace, and we will do so at a time and place of our choosing. Consistent with the practice we have adopted in the past, the public should not assume that they will necessarily know what actions have been taken or what actions we will take,” said a senior administration official.

“The American public and our democracy are resilient to foreign attempts to manipulate public opinion. The U.S. Government is committed to ensuring a secure election process and has robust capabilities to detect efforts to interfere with our elections,” the official added.

A number of government officials suggested the best path for punishment at this stage needs to be an economic one -- namely, tightening sanctions already in place over Russia's military foray into Ukraine.

Schiff called for engaging anew with European allies who are being similarly probed by Russian-directed hackers. "If they see us working together in the cyber realm, it may create a more powerful deterrent than the U.S. acting alone," he said. "That I think would be a good next step. The Russians have shown a real sensitivity to sanctions. I think they would be loathe to see new ones.”

Morell, who also thinks Friday's announcement is aimed in part at “drawing public attention to what Putin is doing -- to kind of name and shame to get him to stop, through global public opinion," believes sanctions or indictments against Russian officials are likely.

Still, others urged caution Friday on taking any dramatic action without fully considering the potential consequences, given the growing distrust between the nuclear powers whose militaries are already too close for comfort in the skies over Syria, where they are backing varying sides in that country's civil war.

They highlighted the need to initiate some form of dialogue with Russia of the sort that existed during the Cold War to guard against an escalation that neither side wants.

"If you put it in the context of Syria and the relationship deteriorating overall, there has to be some sort of menu in which a dialogue can be re-established," said retired marine Gen. James Cartwright, former vice chairman of the Joint Chiefs of Staff. "We need to find a way to communicate through actions in a way that doesn't let it get emotionally driven. People are starting to look at the tools we had in the Cold War.

"I still would regard Putin as a rational man,' he added. "The question is when does he reach a point where rationality steps in."