How To Win The Cyberwar Against Russia

The basic facts about Russia’s election-year hacking of the American political system are clear. For more than a year, the Russian government has repeatedly infiltrated the computers of both parties’ presidential campaigns to steal data and emails to influence the outcome of the election.

In response, the Obama administration has promised a “proportional” response against Russia.

What’s much less clear is what a “proportional” response could mean. This is an unprecedented situation for the American national security establishment — which means the Obama administration’s response will set a precedent for future foreign-directed cyber-plots.

The first thing the US government will have to determine is whether the Russian actions rise to the level of an attack, something that would require a direct US response. There are many examples of cyber-infiltration that fall short of that designation, qualifying rather as nuisance activities or even garden-variety espionage. The activities in question, however, cross an important political and operational threshold by attempting to influence the American public on behalf of one of the candidates for the presidency. Most egregiously, the release of internal Clinton campaign emails violates a wide variety of US laws, and the potential release of material related to her email server investigation late in the campaign season could have extraordinary impact on the election.

These are actions that affect the heart of the US democratic process. They may not exhibit physical damage of the sort that we saw in North Korea’s attack on Sony Pictures, which did millions of dollars of damage to hardware. But the political and symbolic meaning of Russia’s actions nonetheless elevate them to something requiring a response.

When an attack has been identified, the next step is to attribute it, to determine whom to hold responsible. US intelligence officials seem to have already done this, at least to the satisfaction of the White House. But it’s worth remembering that attribution is especially challenging in the world of cyber-conflict. 

The Russians have managed to cling to a veneer of deniability, at least in public, by relying on a clever pattern of cut-out agents, ranging from Russian cyber-criminals to WikiLeaks founder Julian Assange. This is a version of the hybrid warfare we’ve seen used so effectively in the attacks in Ukraine and the annexation of Crimea, essentially using the cyber-equivalent of the unmarked soldiers (so-called little green men) that led the fight into Ukraine.

After attribution, the final step is to craft a response. The cyber-sphere is not immune to the universal legal norms that require a nation to respond to an attack in proportional fashion. In other words, you can’t destroy the Russian electric grid in response to email hacks. From a strategic perspective, the response should also be timely (although at a time and place of the responder’s choice) and distinctive, that is, it should bear a clear and specific relationship to the original attack that is recognizable to all.

With all this in mind, there are a variety of responses that the Obama administration should be considering against Russia. The first response should be a definitive exposure of the Russian government’s presumably high-level involvement in the attacks. The US case against Russia may be convincing, but the White House has chosen so far to keep parts of it classified.

Revealing the names of the officials who authorized the cyberattacks against the United States would put Moscow in an extremely uncomfortable position. Ideally, the United States could reveal emails or conversations between Russian officials that demonstrated their intent to undermine the US electoral process. Such revelations would likely lead to UN condemnations and further economic sanctions against Russia, inflicting additional damage to its economy. They would also potentially expose US intelligence sources and methods, but there are ways to sanitize the material to minimize those risks.

Second, the United States could undermine the Russian government’s reliance on a wide variety of cyber tools to censor the web within its own country by exposing them to the public. While not actively manipulating the Russian web, the National Security Agency could “out” the code and tool sets used by the Kremlin, thus permitting activists (and citizens) to avoid the manipulation and censorship more effectively. As a response to the Russian attacks on the US democratic system, this would be both proportional and distinctive.

A third and more aggressive approach would be to use US cyber-capabilities to expose the overseas banking accounts and financial resources of high-level Russian government officials, up to and including President Vladimir Putin, who is widely rumored to hold billions of dollars in offshore accounts shielded from his public. While Washington should refrain from destroying or manipulating financial records, which would be an escalation, simply exposing the level of corruption among the officials who authorized the political cyberattacks in the United States would be strategically and morally sound.

Fourth, the United States could use its own offensive cyber-tools to punish Russian hackers by knocking them off-line or even damaging their hardware. This response would be open to objections that it represents an unwarranted escalation. But under prevailing international law, if a nation has information of a nexus of offensive activity, has requested it to stop, and the offending nation declines to do so, that offensive center is liable for attack. The burden of proof for attribution would be higher in crafting such a response; it would be viable only if Washington had definitive information on the command and control centers that launched the hacking activity. But given the brazen level of Russian activity, this at least warrants a serious discussion by the US government.

Fifth, and finally, the United States should think about how our allies can be helpful in this situation. NATO partners have significant capability and could be helpful in much of this.

All democratic nations have a stake in pushing back against this blatant interference in the democratic political process.

All of this should be done in a very careful, measured fashion. The potential for miscalculation and escalation is high. But that potential pertains both to a possible overreaction as well as an under-reaction by the US government. 

The president and his senior national security and economic teams will have to seriously deliberate on a course of action. And the NSA and US Cyber Command should prepare to carry out whatever actions they settle on. (Whatever else happens, these events have already proved why it’s to everyone’s benefit that Cyber Command will soon be elevated by the military to the status of a full combatant command.)

An old Russian saying is: “Probe with bayonets. If you encounter steel, withdraw. If you encounter mush, continue.” The bayonets of today are the bits of the cyber-sphere.

The United States needs to show some steel or face much worse to come.

Foreign Policy

 

« Meet The Fancy Bears
Europol Warning: Crypto-Ransomware Threat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ComTrue Technologies

ComTrue Technologies

ComTrue Technologies provides artificial intelligence solutions and information security solutions.

SAI360

SAI360

SAI360 (formerly SAI Global) provide products and services for enterprise risk management including Governance, Risk & Compliance and Digital Risk solutions.

PrimeKey

PrimeKey

PrimeKey provides organisations with the ability to implement security solutions such as e-ID, e-Passports, authentication, digital signatures, unified digital identities and validation.

Signal Sciences

Signal Sciences

Signal Sciences Web Protection Platform (WPP) provides comprehensive threat protection and security visibility for web applications, microservices, and APIs on any platform.

Secudos

Secudos

SECUDOS is an innovative appliance technology and services provider focused on IT security and compliance.

ACM-CCAS

ACM-CCAS

ACM is a UKAS-accredited certification body helping businesses around the world perform to a higher standard. Our certifications include ISO 27001 and ISO 22301.

Outsource UK

Outsource UK

Outsource UK is an independent recruitment company supplying highly-skilled technology, change and engineering talent to clients within a range of specialist sectors including Cyber Security.

Secure Diversity

Secure Diversity

Secure Diversity is an innovative non-profit organization with leaders that think out of the box to create strategies & solutions to increase diversity in the cybersecurity industry.

Oman Technology Fund (OTF)

Oman Technology Fund (OTF)

Oman Technology Fund aims to make Oman the preferred destination for emerging tech companies in the region, and an attractive and stimulating destination for venture capital.

Ballistic Ventures

Ballistic Ventures

Ballistic Ventures is a new kind of venture capital firm, built by and for cybersecurity entrepreneurs and investors.

Orro Group

Orro Group

Orro create 'future now' solutions that make it faster, simpler and safer for you to access, store and share information. Wherever, whenever and with whomever you want.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Information Systems Security Association (ISSA)

Information Systems Security Association (ISSA)

ISSA is the community of choice for international cybersecurity professionals dedicated to advancing individual growth, managing technology risk and protecting critical information and infrastructure.

The Cyber Scheme

The Cyber Scheme

The Cyber Scheme provides NCSC certified and assured assessments, training and career support for security testers & technical cyber professionals.

Airlock Digital

Airlock Digital

Airlock Digital was created after many years of experience in implementing whitelisting/ allowlisting solutions in Federal Government and various enterprises in Australia.

DataPatrol

DataPatrol

DataPatrol is a software company, specialized in providing Security and Privacy of company’s data and information in an evolved way.