The Biden Administration Is Actually Making Gains in the Battle Against Russian Hackers

by | Jan 30, 2022 | Progress & Solutions, Quick Facts

Shortly after taking office, President Biden declared that the the U.S. would no longer roll over in the face of Russian cyberattacks. AP Photo/Evan Vucci

The Biden Administration Is Actually Making Gains in the Battle Against Russian Hackers

by | Jan 30, 2022 | Progress & Solutions, Quick Facts

Shortly after taking office, President Biden declared that the the U.S. would no longer roll over in the face of Russian cyberattacks. AP Photo/Evan Vucci
On Feb. 4, 2021, Biden addressed Putin in a statement delivered at the State Department. Biden said that the days of the U.S. rolling over in the face of Russian cyberattacks and interference in U.S. elections “are over.”

Republished with permission from The Conversation, by Scott Jasper, Naval Postgraduate School

On Jan. 14, 2022, the FSB, Russia’s domestic intelligence service, announced that it had broken up the notorious Russia-based REvil ransomware criminal organization. The FSB said the actions were taken in response to a request from U.S. authorities. The move marks a dramatic shift in Russia’s response to criminal cyberattacks launched against U.S. targets from within Russia, and comes at a time of heightened tensions between the two countries.

U.S. policy and actions in response to cyberattacks connected to Russia have changed distinctly since the Biden administration took office. President Joe Biden has openly confronted Russian President Vladimir Putin on his responsibility regarding international cyberattacks, and the Biden administration has taken unprecedented steps to impose costs on Russian cyber criminals and frustrate their efforts.

Upon taking office, Biden immediately faced difficult challenges from Russian intelligence operatives and criminals in headline-grabbing cyberattacks on private companies and critical infrastructure. As a scholar of Russian cyber operations, I see that the administration has made significant progress in responding to Russian cyber aggression, but I also have clear expectations about what national cyber defense can and can’t do.

Software Supply Chain Compromise

The SolarWinds hack carried out in 2020 was a successful attack on the global software supply chain. The hackers used the access they gained to thousands of computers to spy on nine U.S. federal agencies and about 100 private-sector companies. U.S. security agencies said that a sophisticated hacking group, “likely Russian in origin,” was responsible for the intelligence-gathering effort.

On Feb. 4, 2021, Biden addressed Putin in a statement delivered at the State Department. Biden said that the days of the U.S. rolling over in the face of Russian cyberattacks and interference in U.S. elections “are over.”

Biden vowed to “not hesitate to raise the cost on Russia.” The U.S. government had not previously issued indictments or imposed sanctions for cyber espionage, in part out of concerns that they could result in reciprocal actions by Moscow against NSA and CIA hackers. Nevertheless, the U.S. Treasury Department issued sanctions against the Russian Foreign Intelligence Service, the SVR, on April 15, 2021.

Biden also signed an executive order to modernize federal government cybersecurity. He directed agencies to deploy systems that detect cyber incursions, like the one that spotted SolarWinds activity at Palo Alto Networks. In parallel, his security agencies published tools and techniques used by the SVR and ransomware gangs to help organizations defend against them.

Economic sanctions and technical barriers, however, did not slow SVR efforts to gather intelligence on U.S. foreign policy. In May 2021, Microsoft revealed that hackers associated with Russia exploited the mass-mailing service Constant Contact. By masquerading as the U.S. Agency for International Development, they sent authentic-looking emails with links to more than 150 organizations, which, when clicked, inserted a malicious file that allowed computer access.

Ransomware Attacks

Also in May, the shutdown of the Colonial Pipeline by a ransomware attack by the Russian cyber gang DarkSide halted the flow of nearly half the gas and jet fuel to the Eastern Seaboard. Panicked drivers rushed to fill up tanks while prices soared. A month later, consumers scrambled to find meat alternatives after REvil infected beef and pork processer JBS USA with ransomware.

Biden said Russia has “some responsibility to deal with this.” At a summit in Geneva in June, he handed Putin a list of off-limits critical infrastructure that would merit a U.S. response if attacked. It is likely that Russian intelligence services and law enforcement have a tacit understanding with cybercriminals and can shut down their resources.

Though not counting on Putin to exert influence, the White House formed a ransomware task force to go on the offense against the gangs. The first step was using a counterterrorism program to offer rewards of up to US$10 million for information on hackers behind state-sanctioned breaches of critical infrastructure.

In close collaboration with international partners, the Justice Department announced the arrest of a Ukrainian national in Poland, charged with the REvil ransomware attack against Kaseya, an information technology software supplier. The Justice Department also seized $6.1 million in cryptocurrency from another REvil operator. Romanian authorities arrested two others involved in REvil attacks.

U.S. law enforcement seized $2.3 million paid in ransom to DarkSide by Colonial Pipeline by using a private key to unlock bitcoin. And the Treasury Department disrupted the virtual currency exchanges SUEX and Chatex for laundering the proceeds of ransomware. Treasury Department sanctions blocked all of their property in the U.S. and prohibited U.S. citizens from conducting transactions with them.

Gen. Paul Nakasone, Director of the National Security Agency, testifying before the House Intelligence Committee on April 15, 2021. Al Drago/Pool via AP

Additionally, the top U.S. cyberwarrior, Gen. Paul Nakasone, acknowledged for the first time in public that the U.S. military had taken offensive action against ransomware groups. In October, U.S. Cyber Command blocked the REvil website by redirecting traffic, which prevented the group from extorting victims. After REvil realized its server was compromised, it ceased operations.

Limits of U.S. Responses

Russia conducts or condones cyberattacks by state and criminal groups that take advantage of gaps in international law and avoid crossing national security lines. In October, the SVR stepped up attempts to break into technology companies to steal sensitive information. U.S. officials considered the operation to be routine spying. The reality that international law does not prohibit espionage per se prevents U.S. responses that could serve as strong deterrents.

Similarly, after cyber gang BlackMatter carried out a ransomwware attack on an Iowa farm cooperative in September, the gang claimed that the cooperative did not count as critical infrastructure. The gang’s claim refers to cyberattack targets that would prompt a national response from the U.S. government.

Despite this ambiguity, the administration has unleashed the military to frustrate the efforts of ransomware groups, while law enforcement agencies have gone after their leaders and their money, and organizations in the U.S. have shored up their information systems defenses.

Though government-controlled hackers might persist, and criminal groups might disappear, rebuild and rebrand, in my view the high costs imposed by the Biden administration could hinder their success. Nevertheless, it’s important to bear in mind that national cyber defense is an extremely challenging problem and it’s unlikely that the U.S. will be able to eliminate the threat.


Scott Jasper, Senior Lecturer in National Security Affairs, Naval Postgraduate School

The Conversation

The Conversation

The Conversation is a nonprofit, independent news organization dedicated to unlocking the knowledge of experts for the public good. We publish trustworthy and informative articles written by academic experts for the general public and edited by our team of journalists.

Comments

Follow Us

Related Articles

Feb 05 2023

The Chinese Spy Balloon: Expert Facts vs. Political Hyperbole

Spy balloons are not new. Monitoring an adversary from a balloon dates back to 1794, when the French used a hot air balloon to track Austrian and Dutch troops.
Jan 23 2023

Car-Sharing Services Turn to Electric Cars and Nonprofit Business Models

Car-share operations are turning to electric vehicles as they reimagine the service as an affordable, nonprofit transportation business model.
Jan 14 2023

GOP-Led Missouri House Passes New Dress Code to Strip Women Lawmakers of ‘Right to Bare Arms’

The Missouri GOP banning women from showing their bare arms isn’t a sign of Shariah or Taliban—it’s a sign of right-wing ‘Christian’...
Jan 08 2023

Katie Porter Goes Viral Just Reading a Book

In a true less-is-more gesture, Katie Porter registered her disdain for the circus of the Congressional “treason caucus” holding up the Speaker vote for...
Jan 04 2023

Quick Facts: What Does the Speaker of the House Do?

The Speaker of the House is the most visible and authoritative spokesperson for the majority party in the House. Speakers articulate an agenda and explain legislative...
Jan 03 2023

New Tools Take a Crack at Predicting Healthcare Costs

This year healthcare providers will be required to provide predictions of costs finally giving patients more freedom to comparison-shop and possibly help slow rising...
Jan 03 2023

US Wind and Solar Are Projected to Outpace Coal and Nuclear in 2023

It is entirely possible that the combination of just wind and solar will outpace nuclear power and maybe even that of coal during the next twelve months.
Dec 23 2022

The January 6th Committee’s Final Report Is Every Bit the Bombshell We Expected

The full document detailing Donald Trump’s betrayal of his oath and his attempted coup has now been released.
Dec 17 2022

Petition Pressures US House Members Not to Seat GOP Insurrectionists in 2023

The petition argues that Republican Reps. like Paul Gosar, Lauren Boebert, and Marjorie Taylor Greene “are ineligible to hold future public office” under...
Dec 14 2022

Electoral Count Reform Act: Congress Prepares to Prevent Presidential Election Mischief and Fraud

A bipartisan group of congressional leaders aims to pass reforms to the 1887 law governing Presidential elections, the Electoral Count Act, before the end of...
Subscribe for Updates!

Subscribe for Updates!

Join our mailing list to receive the latest news and updates from our team.

You have Successfully Subscribed!

Pin It on Pinterest

Share This