(CNN) – The most troubling takeaway from President Joe Biden’s warning that there is “evolving intelligence” that Russia is exploring options for cyberattacks is that US spy agencies have been spot on so far in predicting Vladimir Putin’s moves.
It was always possible that the Russian leader could seek to impose direct reprisals on the US government and Americans for their support of Ukrainians and crippling sanctions on Russia after his brutal invasion.
Putin could turn his intelligence agencies or related criminal gangs against US government departments, hospitals, critical infrastructure and utilities. Opening a cyber front, or at least hinting at one, would be consistent with Putin’s strategy of escalation, which has seen him rattle nuclear sabers, turn fearsome fire on Ukrainian civilians and use new generation hypersonic missiles.
But the key question is whether the Russian leader would risk a full-bore cyber conflict with Washington, which, as CNN reported last week, has fearsome capabilities of its own that may outmatch Russia’s arsenal and could quickly deliver devastating hits against Russian critical infrastructure.
Biden first warned on Monday in a written statement that it was time for the private sector, which owns much of the nation’s critical infrastructure and hasn’t always heeded government warnings, to immediately harden its online defenses.
Then he took an even more chilling message in person to a Business Roundtable meeting in Washington.
“The magnitude of Russia’s cyber capacity is fairly consequential, and it’s coming,” the President warned. “He hasn’t used it yet, but it’s part of his playbook,” Biden said of Putin.
Anne Neuberger, White House deputy national security adviser for cyber and emerging technology, said Monday that after detecting “preparatory activity” by Russia, the administration had held classified briefings with companies and sectors that could be vulnerable to cyberattacks. But she also said that there was currently no evidence of any specific threat. The White House has consistently warned of a potential cyber front of the Russian war on Ukraine ever since the invasion more than three weeks ago, over and above its regular guidance to state and local governments and big businesses and industry.
Putin’s motives to attack the US
As always with government pronouncements based on intelligence — and especially in an area as sensitive as potential cyberwarfare — much remains unknown about the potential threat, the timing of Biden’s announcement and the messages he sought to send to Russia with the statement on Monday.
But Putin does have burning reasons for wanting to target the United States and inflict pain on Americans.
Unprecedented international sanctions are having a devastating effect on the Russian economy. The longer they remain in force, the more they will hurt ordinary Russians. The Russian banking sector is cut off from the world, and the country has become an international pariah.
Putin’s forces, meanwhile, didn’t pull off an expected blitzkrieg to Kyiv. A military stalemate may force Putin to escalate the crisis to increase his own geopolitical leverage with outside powers. And by his actions over many years, the Russian leader has given every impression that he believes he’s already waging low intensity warfare against the West. Indeed, Russian intelligence agencies used hacking and influence campaigns in the 2016 and 2020 US elections, according to US intelligence.
Putin may also be seeking revenge for the gusher of anti-tank and anti-aircraft weapons being poured into Ukraine by the West, which are being used to kill Russians in an extraordinary proxy war with Moscow in Europe. So the leap to direct, non-military action against the United States may not be as wide to Putin as it might appear to others.
A long record of cyberwarfare
Cyberattacks, though they would be an escalation in the current circumstances, would not be a new Russian tactic.
Nearly a year ago, Washington blamed the Russian Foreign Intelligence Service for the 2020 SolarWinds attack on federal servers and a broad sweep of the public sector and imposed sanctions. A criminal group originating from Russia, named “DarkSide,” was believed to be responsible for a ransomware cyberattack on the trans-America Colonial Pipeline last year.
At a summit in Geneva last summer, Biden told Putin that certain areas of critical infrastructure should be off-limits for cyberattacks, and outlined 16 specific entities including energy and water.
And in its just published Annual Threat Assessment report, the US Intelligence community warned that Russia was developing capabilities to target underwater cables and industrial control systems in the US and elsewhere “because compromising such infrastructure improves and demonstrates its ability to damage infrastructure during a crisis.”
Biden’s multiple audiences
The idea that Putin would not dare to initiate a cyber conflict with the United States may now be less compelling given the Russian President’s dubious decision making in the war so far.
Putin has blown through multiple barriers of acceptable behavior with his invasion of a sovereign, independent nation. His offensive has now degenerated into appalling air, artillery and missile attacks on civilians. Having thrown his domestic and international credibility at the war, he cannot afford to lose. That’s one reason why the US has warned about the possibility of chemical or biological attacks by Russian forces and why there is deep concern among the community of atomic scientists that the Russians could eventually consider the use of smaller, tactical nuclear weapons as acceptable military doctrine. He could see cyberwarfare as just another deployable weapon.
The power of Biden’s warning — even if cyberattacks are not imminent — was cemented by the intelligence community’s success so far in exposing and predicting the Russian military’s actions. As more than 100,000 Russian troops massed around Ukraine earlier this year, some officials in Europe and even in Kyiv dismissed warnings that Putin was about to invade as contrary to Russia’s own interests.
The intelligence success not only contrasted with the community’s failures on the Iraq war and ahead of the September 11, 2001 attacks. It also raised the possibility that the United States has strong visibility into the Russian regime. Biden’s citing of unspecified, “evolving intelligence” on potential cyberattacks is the latest occasion when the US has deployed strategic nuggets of the product of US spy agencies to shape perceptions of the war in the US and abroad. An element of psychological warfare may be also at play given that Putin, a former KGB officer, would be furious at the possibility the US has breached Russian spy agencies.
Biden puts big business on alert
There is debate among cyberwarfare experts whether Putin would be deterred by the risk that the United States could strike back with even more force at Russia.
An in-depth report by CNN’s investigative unit last week found that while there have been smaller attacks on Ukrainian banks and government agencies, there has so far been no major cybersecurity disaster, like a blanket power outage, a poisoned water system or a crippled supply chain, in the US or Ukraine since the invasion. There was consensus among nearly 20 experts who spoke with CNN that while Russia is well positioned to launch catastrophic cyberattacks on the United States, it is not likely to do so. The experts believe that Putin understands his country’s cyber capabilities are outmatched by those of the US.
And Biden underscored again on Monday that the US would respond vigorously to any intrusions, seeking to bolster the deference factor.
He vowed to “use every tool to deter, disrupt, and if necessary, respond to cyberattacks against critical infrastructure.”
Biden’s statement was also a clear warning to US businesses to make a renewed effort to protect themselves from cyberhacking before it is too late. Some firms lack the capabilities of government to protect themselves. The cost of cybersecurity is particularly onerous for smaller businesses and vendors. US firms face cyberattacks every day that cost millions of dollars. But there was a real sense that Biden’s statement was intended as a wake-up to the private sector that something much worse was on the way.
As he put it: “You have the power, the capacity and the responsibility to strengthen the cybersecurity and resilience of the critical services and technologies on which Americans rely.”
