Russia’s alleged cyber-meddling in the US presidential election demands immediate retaliation if the country is to deter future attacks of the kind, national security experts said Friday.
Delivering a response could provide an important test of America’s still-developing offensive cyber warfare capabilities, but any retaliation must be calibrated and proportional to keep from escalating the conflict, they said.
President Barack Obama set the stage Friday for the riposte, pointing a finger directly at his Russian counterpart for a hacking and leaking operation the CIA believes aimed to damage Hillary Clinton’s campaign.
“Not much happens in Russia without Vladimir Putin,” Obama said.
While Moscow has denied the allegations as “ridiculous”—as has President-elect Donald Trump—the US leader said Russia needs to know there will be consequences to hacking.
“Our goal continues to be to send a clear message to Russia or others not to do this to us because we can do stuff to you,” Obama told a news conference.
“Some of it we do publicly. Some of it we will do in a way that they know, but not everybody will.”
Retired Admiral James Stavridis, the former NATO Supreme Allied Commander and now Dean of The Fletcher School at Tufts University, said the need to retaliate was urgent.
“We need to respond proportionally and immediately,” he told AFP.
“This should include presentation of evidence publicly followed by a similar intrusion into Russian cyber systems.”
‘No choice but to respond’
Pressure on the White House to act has mounted since early October, when top US intelligence officials announced that “senior-most officials” in Russia were behind the break-ins to Democratic Party computers and email accounts that led to the publication of embarrassing documents by WikiLeaks.
Vice President Joe Biden said at the time that the United States would retaliate to send a message to Putin. But there has been no evidence of any action since then, which analysts say risks sending adversaries a sign of weakness.
“From a credibility perspective, we absolutely have no choice but to respond. Everyone is watching,” said Frank Cilluffo, Director of George Washington University’s Center for Cyber and Homeland Security.
What Washington can do is another question. The eventual response could involve a combination of clandestine cyber retaliation and a more public intensification of sanctions against Russian companies and officials.
Any cyber response would likely be led jointly by the CIA and the US military’s Cyber Command.
“It needs to be commensurate,” Cilluffo said. But “you never want to limit your responses to one domain.”
One model is the tightening of US sanctions against North Korea after it leaked embarrassing communications from Sony Pictures Entertainment in November 2014. The hermit nation suffered a still-unexplained 10-hour internet service outage a month later, which some suspect was US retaliation.
Stavridis said a retaliatory US intrusion into Russia cyber systems could be accompanied by something public to damage the image of Putin and the Russian government among Russians.
“Perhaps exposing financial malfeasance and corruption, or demonstrating how the Russian government illegally suppresses its people,” he said.
Washington could also extend sanctions already placed on Putin’s top advisors, he added.
Former CIA deputy director Michael Morell argued in October that the response to Russia must be open, not secret.
“Physical attacks on networks is not something the US wants to do because we don’t want to set a precedent for other countries to do it as well, including against us,” he told NBC. “My own view is that our response shouldn’t be covert—it should be overt, for everybody to see.”
No cyber-warfare playbook
Cilluffo says the US government has been slow to develop a “playbook” of a range of measured responses to cyber-attacks, as it has for the traditional battlefield.
Doing so is crucial for managing any conflict, he adds.
“We have some of the most advanced capabilities” in cyber warfare. “But we also have to realize that we are the most connected and have the most to lose,” given that many smaller adversaries are still capable of what amounts to “cyber drive-by shootings.”
“Companies, the private sector are on the front line,” he noted.
Obama is also under the pressure of time.
President-elect Trump takes office on January 20. His promise of a reset of relations with Russia, including possibly lifting sanctions, and his repeated dismissals of the Russian election hacking allegations, suggest he may not be willing to retaliate.
That could be asking for more trouble, Stavridis says.
“When nations have avoided retaliation,” he said, “the level of attacks has increased.”