The Best Way for the U.S. to Retaliate Against Russia’s Cyber Attacks

Russia doxxed us. What’s our next step?

By Rhonda FanningOctober 18, 2016 11:46 am|

Late last week, NBC News and others reported that the Obama Administration is preparing a cyber action against Russia to retaliate for spreading hacked confidential information to the American public.

Intelligence officials have publicly accused the Russian government of directing hacker attacks against U.S. political organizations, with the intent of interfering in the U.S. election process. The FBI alerted election officials nationwide over suspected attempts to hack voter databases and related systems.

Vice President Joe Biden told NBC on Friday that retaliation for Russia’s hacking attacks will be “at the time of our choosing, and under the circumstances that will have the greatest impact.”

Russian President Vladimir Putin shrugged off the statement.

But Monday, Russian propaganda media outlet Russia Today reported that its bank accounts in the U.K. have been frozen. Also Monday, Julian Assange – the WikiLeaks chief holed up in London’s Ecuadorian embassy – had his internet connection cut off by what WikiLeaks called a state actor. WikiLeaks has been alleged to be colluding with Russia to affect the U.S. presidential race. Both events raised the possibility of shots fired in a bonafide cyber war.

Robert Chesney, director of the Robert Strauss Center for International Security at the University of Texas School of Law, says that before we think about what the U.S. response will be to Russia, we first have to clarify what we’re upset about.

Chesney says Russia has done two specific things to raise our ire. One is cyber espionage – breaking into systems and stealing documents. He says that’s to be expected, and is possibly parallel to our own government’s efforts in Russia. But the other part goes a step beyond.

“[It’s] the doxxing, or taking those stolen files, the emails, and putting them out there into the public sphere,” Chesney says. “The idea is that this isn’t espionage – this is an influence operation to impact both possibly the course of our election … and then, secondly, to more generally destabilize our political culture.”

Chesney says though the attacks have been harmful, U.S. retaliation against the effort is difficult and isn’t something that should be decided quickly.

“There are multiple audiences that the U.S. government needs to speak to here,” Chesney says. “First of all, there’s deterrence to the Russians. Second of all, there’s the impression being created for other outside observers – like the Chinese, the North Koreans and the Iranians – and making sure that they take away the right message in the end for what’ll happen if you take these sorts of steps.., Thirdly, there’s the American public. You both need to counteract the effect of the information operation – the influence aspect of this – and you need to convince the American public that someone is, in fact, minding the store.”

The least effective step of retribution is the naming and shaming that comes with publicly announcing that Russia is the perpetrator of the cyber attacks and release of information, Chesney says. The statement issued by top U.S. officials was unprecedented, he says, and it did help to counteract the influence this had on the American public, but it’s not enough to deter future attacks.

A next step could be responding in kind to Russia – hacking and spreading embarrassing information about public officials there, Chesney says.

“There’s a symmetry there, and there’s a proportionality there,” he says. “Will that be enough to have a good deterrent effect on the Russians and the others? Perhaps so. The thing is we, as the United States, we’re a little more vulnerable than most other countries to cyber activities because we live so much of our life – economically, socially, politically – online.”

So it might be wiser to look away from cyber espionage and respond in a different domain where we have more leverage and less vulnerability, Chesney says – something in the realm of sanctions. The U.S. already sanctions Russia with a focus on energy, defense and financial services, but Chesney says the sanctions are targeted and individualized. The U.S. could expand those.

“I would find out where there is still room to expand our list of target sanctions to people that matter for the Putin regime,” Chesney says. “Hit them where it really hurts – in their pocketbooks. And I would issue a public statement making clear that as we sanction these individuals we’re doing it specifically in response to this particular set of activities.

“At the same time, I would have computer network operations underway to do our level best to get our hands on what I don’t doubt a lot of is out there – that is compromising information about the corruption and so forth that would be a very painful embarrassment for the Putin regime to have public.”

Post by Beth Cortez-Neavel.