Biden first warned on Monday in a written statement that it was time for the private sector, which owns much of the nation’s critical infrastructure and hasn’t always heeded government warnings, to immediately harden its online defenses.
Then he took an even more chilling message in person to a Business Roundtable meeting in Washington.
“The magnitude of Russia’s cyber capacity is fairly consequential, and it’s coming,” the President warned. “He hasn’t used it yet, but it’s part of his playbook,” Biden said of Putin.
Anne Neuberger, White House deputy national security adviser for cyber and emerging technology, said Monday that after detecting “preparatory activity” by Russia, the administration had held classified briefings with companies and sectors that could be vulnerable to cyberattacks. But she also said that there was currently no evidence of any specific threat. The White House has consistently warned of a potential cyber front of the Russian war on Ukraine ever since the invasion more than three weeks ago, over and above its regular guidance to state and local governments and big businesses and industry.
Putin’s motives to attack the US
As always with government pronouncements based on intelligence — and especially in an area as sensitive as potential cyberwarfare — much remains unknown about the potential threat, the timing of Biden’s announcement and the messages he sought to send to Russia with the statement on Monday.
But Putin does have burning reasons for wanting to target the United States and inflict pain on Americans. Unprecedented international sanctions are having a devastating effect on the Russian economy. The longer they remain in force, the more they will hurt ordinary Russians. The Russian banking sector is cut off from the world, and the country has become an international pariah.
A long record of cyberwarfare
Cyberattacks, though they would be an escalation in the current circumstances, would not be a new Russian tactic.
At a summit in Geneva last summer, Biden told Putin that certain areas of critical infrastructure should be off-limits for cyberattacks, and outlined 16 specific entities including energy and water.
Biden’s multiple audiences
The idea that Putin would not dare to initiate a cyber conflict with the United States may now be less compelling given the Russian President’s dubious decision making in the war so far.
Putin has blown through multiple barriers of acceptable behavior with his invasion of a sovereign, independent nation. His offensive has now degenerated into appalling air, artillery and missile attacks on civilians. Having thrown his domestic and international credibility at the war, he cannot afford to lose. That’s one reason why the US has warned about the possibility of chemical or biological attacks by Russian forces and why there is deep concern among the community of atomic scientists that the Russians could eventually consider the use of smaller, tactical nuclear weapons as acceptable military doctrine. He could see cyberwarfare as just another deployable weapon.
The power of Biden’s warning — even if cyberattacks are not imminent — was cemented by the intelligence community’s success so far in exposing and predicting the Russian military’s actions. As more than 100,000 Russian troops massed around Ukraine earlier this year, some officials in Europe and even in Kyiv dismissed warnings that Putin was about to invade as contrary to Russia’s own interests.
The intelligence success not only contrasted with the community’s failures on the Iraq war and ahead of the September 11, 2001 attacks. It also raised the possibility that the United States has strong visibility into the Russian regime. Biden’s citing of unspecified, “evolving intelligence” on potential cyberattacks is the latest occasion when the US has deployed strategic nuggets of the product of US spy agencies to shape perceptions of the war in the US and abroad. An element of psychological warfare may be also at play given that Putin, a former KGB officer, would be furious at the possibility the US has breached Russian spy agencies.
Biden puts big business on alert
There is debate among cyberwarfare experts whether Putin would be deterred by the risk that the United States could strike back with even more force at Russia.
An in-depth report by CNN’s investigative unit last week found that while there have been smaller attacks on Ukrainian banks and government agencies, there has so far been no major cybersecurity disaster, like a blanket power outage, a poisoned water system or a crippled supply chain, in the US or Ukraine since the invasion. There was consensus among nearly 20 experts who spoke with CNN that while Russia is well positioned to launch catastrophic cyberattacks on the United States, it is not likely to do so. The experts believe that Putin understands his country’s cyber capabilities are outmatched by those of the US.
And Biden underscored again on Monday that the US would respond vigorously to any intrusions, seeking to bolster the deference factor.
He vowed to “use every tool to deter, disrupt, and if necessary, respond to cyberattacks against critical infrastructure.”
Biden’s statement was also a clear warning to US businesses to make a renewed effort to protect themselves from cyberhacking before it is too late. Some firms lack the capabilities of government to protect themselves. The cost of cybersecurity is particularly onerous for smaller businesses and vendors. US firms face cyberattacks every day that cost millions of dollars. But there was a real sense that Biden’s statement was intended as a wake-up to the private sector that something much worse was on the way.
As he put it: “You have the power, the capacity and the responsibility to strengthen the cybersecurity and resilience of the critical services and technologies on which Americans rely.”
Analysis: Putin’s next escalation could be a direct cyberattack on the US