Next steps after attribution: Deterring further Russian interference

A few weeks ago, the U.S. government issued a statement declaring that Russia has been engineering disclosures of communications from U.S. political organizations and operators in an attempt to influence the upcoming U.S. presidential election. This is the first public, official acknowledgment of a long-running information warfare campaign that the statement asserted could have been authorized only by “Russia’s senior-most officials.”

Publicizing Russia’s role and warning the American people undermines Russia’s efforts as the campaign moves forward. In fact, we have already seen examples of public figures, including a prominent Republican politician, trying to push the disclosures from the spotlight as their link to Russia has become apparent.

But it’s unlikely that publicity alone will be enough to check this aggression. In fact, Russian President Vladimir Putin already has dismissed the attribution as nothing but hysteria. The discussion in the U.S. about next steps has focused on cyber-enabled counterattacks that would expose corruption in Russia or leak information about bank accounts linked to Putin.

Such cyber-enabled disclosures could impose costs on Putin’s regime, and used appropriately, they could be an effective part of a broader response. But we should tread carefully. Part of Putin’s goal seems to be to create equivalency between a supposedly corrupt U.S. system and his government and thereby take away our moral high ground. Creating a tit-for-tat cyber war between two great powers could play into that scenario.

The United States can derail that strategy by doing three things. First, we should complement any cyber response with non-cyber responses -- exposure, economic tools such as sanctions, and renewed collaboration with and focus on NATO allies. Second, we should frame our response not around Russia as an adversary, but around condemning its clear, cyber-enabled effort to influence our free elections. A designation under the new cyber sanctions executive order, which is triggered by activities rather than nationalities, could be especially useful here.

And third, we should coordinate responses with other nations to demonstrate that this is not just about a spat between the United States and Russia but about Russia seeking to subvert a bedrock of modern democracy. Our unified voice would make it clear that Russia’s actions are unacceptable.

On that last point, reports now suggest that the U.S. intelligence community informed Ecuador of WikiLeaks’ role as a conduit for Russian-distributed information dumps, which prompted Ecuador’s decision to restrict the internet access of Julian Assange, the WikiLeaks founder still holed up in the Ecuadorean embassy in London. Ecuador’s statement on the matter affirmed that its decision was based on “the principle of non-intervention in the internal affairs of other states.” The more that other nations condemn Russia’s actions by word and deed, the clearer it becomes that this is not a struggle between two nations but a violation of international norms.

As important as our short-term condemnation of Russia’s actions is, the exchange should also serve as a wake-up call. The most fundamental elements of our society and public sphere are increasingly run on communications systems that are easy targets for exploitation. Without visibility into our systems and control over own environments, we cannot identify -- much less stop -- the intruders who will continue to find new ways to cause damage and extract value.

We have already seen attempts to undermine our free speech and our free elections, and we will see more. If we do not change this reality, future cyberthreats will not only cost money or expose covert operations -- they will chip away at our institutions.