Deterrence & Cyber Attacks On The US Electoral System

 

The sanctions and expulsions announced recently against Russia raise important questions about how the United States can effectively deter cyberattacks of this kind in the future, and how effective the measures announced will likely be in doing so.

 

Deterring future cyber-meddling in US elections will require convincing adversaries, Russia and others, that any future such meddling will either be:

A. Ineffective and/or

B. Too costly to be worthwhile.

There are at least two ways to make such operations ineffective:

  • First, the United States could seek to dampen or counter the influence on the actual electoral debate, for example, by swiftly exposing them, a resilience strategy akin to what was sometimes called passive defense during the Cold War.​
  • Second, the United States could seek simply to make such operations impossible by developing highly effective cyber-network defenses, a strategy akin to what was sometimes called active defense.

To make it clear that cyber operations against future elections will be costly, the United States must also demonstrate both a capability and a will to strike back in the future, in other words to punish those states and actors that might contemplate using their cyber capabilities in this way.

Demonstrating a capability to punish is relatively easy, indeed almost unnecessary. The United States has a broad arsenal of military, diplomatic, financial and other means at its disposal to inflict costs on any country that might seek to use cyber tools to interfere in its elections.

Demonstrating the will to do so is much, much more difficult. It requires making clear that the United States judges the stakes at hand to be so important that it would be willing to make use a broad range of tools from its arsenal, even if the costs of doing so were high, to punish future leaders who conducted cyberattacks against US elections.

Given these requirements, how much will the US response help deter future attacks?

On the helpful side, the measures should help make future enemy cyber operations easier to detect and thus riskier and more likely to fail. The Department of Homeland Security and the Federal Bureau of Investigations will now make certain information about Russian cyber capabilities available to the private sector. How much of an effect this will have, however, remains to be seen.

Also on the helpful side, the expulsions and the sanctions impose some cost on the perpetrators while also demonstrating some will on the part of the United States to make some sacrifices because expulsions may eventually be met with reprisals in kind from Moscow, not-with-standing President Vladimir Putin's announcement that he won't retaliate in kind to the expulsions.

Yet whether accepting this cost is enough to impress the Kremlin and deter future action is debatable.

If it truly wishes to deter future action, the United States may thus move toward a stronger declaratory posture by going further in emphasising (publicly and privately to the Kremlin) the very high importance of the integrity of the US democratic process in the future.

The recent White House statement refers to international law and harm to US interests, but it might have stated more forcefully that attacks on the US democratic process are utterly unacceptable and will not be tolerated.

Criticisms of the response on the basis that it does not use existing cyber tools to retaliate are misplaced.

First of all, the US response leaves that possibility open by stating that “we will continue to take a variety of actions at a time and place of our choosing, some of which will not be publicised.” So the United States might still exercise the cyber options it has.

There is no reason to assume that a cyber response is necessarily the best deterrent against cyber-attacks.

If it doesn't, however, that's not necessarily a mistake. There is no reason to assume that a cyber response is necessarily the best deterrent against cyber-attacks. Meanwhile, using existing military cyber tools would have been escalatory while removing options that the United States would better reserve for wartime. Some cyber weapons, once used, can't be used again.

A US cyber operation that exposed corruption within the regime now or later might have some deterrent effect. However, exposing corruption would be mostly cost-free for the United States, so it doesn't underscore US will or stake. It's also difficult to repeat.

A better option would perhaps be to demonstrate a capability to expose corruption, perhaps by exposing the tip of the iceberg, while leaving much of the capability in reserve, to keep the proverbial powder dry so that it can deter future attacks.

A single response does not need to constitute a complete cyber deterrence posture and the measures announced recently should not be judged as such. Effective deterrence in the cyber domain can only emerge out of a consistent set of actions, policies, and declarations over time.

Looking ahead, however, the United States will need to emphasize consistently the importance of the integrity of the electoral process. The time may soon come when the United States needs to demonstrate its willingness to sacrifice to protect it.

Rand:    

Electoral Influence: 40yrs Of Kremlin Interference:       German Spy Chief Fears Russian Interference In 2017 Elections:

 

« Uber Wants Self-Flying Vertical Takeoff Cars
How To Automate Cyber Defense »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Radware

Radware

Radware is a global leader of application delivery and cyber security solutions for virtual, cloud and software defined data centers.

Marsh

Marsh

Marsh is a global leader in insurance broking and risk management and has been a leader in combatting cyber threats since their emergence.

CERT.BY

CERT.BY

The National Computer Emergency Response Team of the Republic of Belarus.

evoila

evoila

evoila GmbH is one of the leading providers in consulting, analysis, implementation and management of cloud infrastructure.

French Expert Center Against Cybercrime (CECyF)

French Expert Center Against Cybercrime (CECyF)

CECyF is a centre of excellence for countering cybercrime in France.

The Data Privacy Group

The Data Privacy Group

The Data Privacy Group provide expert professional services underpinned by world leading automation tools and a consulting team specialized in privacy and data protection.

The Media Trust

The Media Trust

The Media Trust continuously scans websites, ad tags and mobile apps and alerts on anomalies affecting websites and visitors.

ExpressVPN

ExpressVPN

ExpressVPN is a Virtual Private Network services provider offering secure encrypted access to the internet.

GreyCortex

GreyCortex

GreyCortex uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

Romanian Accreditation Association (RENAR)

Romanian Accreditation Association (RENAR)

RENAR is the national accreditation body for Romania. The directory of members provides details of organisations offering certification services for ISO 27001.

Cysiv

Cysiv

Cysiv SOC-as-a-Service combines all the elements of an advanced, proactive, threat hunting SOC, with a managed security stack for hybrid cloud, network, and endpoint security.

Neosecure

Neosecure

NeoSecure is a specialist Cybersecurity Solutions and Managed Services provider in Latin America.

CYMOTIVE Technologies

CYMOTIVE Technologies

Combining Israeli cyber innovation with a century of German automotive engineering. CYMOTIVE operates under the assumption that connectivity is a game changer for the automotive industry.

ActiveFence

ActiveFence

ActiveFence enables Trust & Safety teams to be proactive about online integrity so they can keep their users safe from online harm – across content formats, languages, and abuse areas.

US Department of State - Bureau of Cyberspace & Digital Policy

US Department of State - Bureau of Cyberspace & Digital Policy

The Bureau of Cyberspace and Digital Policy leads and coordinates the Department’s work on cyberspace and digital diplomacy to encourage responsible state behavior in cyberspace.

Applied Connective Technologies

Applied Connective Technologies

Applied Connective is one team for all your technology needs, from IT to phones, cyber security to physical security, audio/video and the infrastructure to support it.