Deterrence only works if an adversary assesses that the cost of a response to acting will significantly outweigh any prospective gains. At present, Russian President Vladimir Putin is not sufficiently deterred from carrying out major cyberattacks on the United States.
That’s a problem, because Putin will view cyberattacks as an increasingly preferable means of retaliation for Western sanctions on Russia. Military and intelligence sources tell me that Putin’s war in Ukraine is going so badly that Russia may lose the ability to conduct significant offensive operations in Ukraine by mid-April. In turn, Putin will likely wish to restore the strategic initiative via military escalation or more affordable, covert means such as cyberattacks. Putin might also see cyberattacks on the U.S. as a means of retribution for Western sanctions imposed on Russia’s economy. It’s undeniable that those Western sanctions have smashed the value of Russia’s ruble currency, catalyzed already high inflation rates, and greatly limited Russia’s access to global markets.
But CBS News now reports that the FBI is warning of Russia testing intrusions into U.S. energy networks. I understand that this activity goes above and beyond the standard surveillance and targeting activity that Russia normally engages in. President Joe Biden also warned this week that Russian attacks are “coming.”
The key challenge for the U.S., then, is twofold. First, to deter these attacks from occurring in the first place. Second, to ensure that if attacks occur, U.S. retaliation forces Putin to recalculate his cost-benefit analysis of any future cyberattack. As with nuclear weapons, the U.S. needs a deterrent posture for cyberwarfare. So, what to do?
For a start, Biden must speak publicly and far more plainly as to what costs Russia will face. So far, Biden administration officials have used private channels and only veiled public warnings. This might be sensible in normal times, balancing an interest in respecting Russian pride with clarity of purpose. However, it makes little sense now. Putin’s regime and his inner circle are under unparalleled pressure. Their military is at a breaking point in Ukraine, and the Russian economy is in free fall. While it remains unlikely, Putin must now consider the possibility of a palace coup. Deterring Putin in this strategic environment means delivering colder clarity to the wartime leader and the Kremlin.
Biden should thus publicly state something along the following lines:
“Any major Russian cyberattack that affects the health, normal conduct, or confidence of the U.S. economy or our society will meet a decisive, punitive response. The U.S. response will be the same whether any attack is carried out by state actors or deniable actors working on the Kremlin’s behalf. The U.S. may trigger NATO’s Article 5 mutual defense commitment in the event of such an attack. To be clear, any attack on U.S. critical infrastructure, including but not limited to our energy, transportation, or telecommunications networks, will result in outsize costs on Russia. President Putin would make a grave error were he to believe that he could attack U.S. civilian interests and avoid similar retaliation against his own civilian interests. His inner circle won’t be the only ones to suffer.”
Such a statement would serve three purposes.
First, it would deny Putin the presumption that he could use deniable cyber actors operating outside of direct Kremlin structures to carry out an attack and thus avoid meaningful retaliation. Putin must know that if a major attack comes from Russian officers or agents, U.S. retaliation will target Russia, proper. The Biden administration has unfortunately encouraged Putin’s countervailing understanding in this regard. Biden has refused to hold the Kremlin directly accountable for cyberattacks conducted by hackers who operate under the Russian security establishment’s protection. These hackers then use ransomware payments to provide kickbacks to Russia’s FSB, SVR, and GRU intelligence services. Indeed, so close are links of these groups to the Kremlin that when Russian cybersecurity experts complain about the hackers’ impunity, they find themselves imprisoned on trumped-up charges.
Biden’s statement would also address the need to deter Russia more robustly. The risk is that Putin will judge his ability to impose havoc on the U.S. as more significant than the U.S. willingness to impose havoc on Russia. While Putin knows that the U.S. has unparalleled cyber-offensive capabilities, he may believe that the U.S. will be more reluctant to cause harm to Russia’s civilian population — even in a retaliatory strike. Such a belief is incompatible with effective deterrence, which reaches its apex at the nuclear level. Put simply, Putin must believe that if he disrupts U.S. power, water, or internet supplies on the East Coast, similar effects will be suffered by an even greater population of Russia.
Finally, there’s Biden’s suggested reference that Putin’s “inner circle and cronies” would also suffer in any U.S. cyber retaliation. However they might shield their assets from sanctions, Putin’s top cronies, such as Roman Abramovich, Gennady Timchenko, Alisher Usmanov, Igor Sechin, and Mikhail Fridman, cannot protect their funds, power for their homes, and the operation of their businesses from U.S. cyber warfare tools. Matching threats against these interests within its broader cyber-deterrent posture, the U.S. would thus increase the political pressure on Putin to suspend his offensive against Ukraine.
Top line: Putin sees his conquest of Ukraine as an almost theological mission. He will not easily give in to sanctions, but will escalate against the U.S. if he believes that he can do so without excess cost. Deterring that escalation and pressuring Putin’s retreat from Ukraine require Biden’s recognition of the Russian leader’s threat and ambitions. It then requires Biden’s willingness to use all necessary force to restrain Putin. Only that resolution will protect America and help end Putin’s war on Ukraine.
