Obama: 'We can't tell people what to do' on cyber

President Barack Obama defended the administration's handling of probes into hacks of the Democratic National Committee networks and other election targets at a Dec. 16 White House press conference. But his remarks also provided a summary of the administration’s ongoing efforts to make cybersecurity a priority for government and to share best practices with industry.

Obama said that White House was apprised of possible hacks at the beginning of the summer, and law enforcement and intelligence agencies were ordered to investigate.

"And once we had clarity and certainty around what in fact had happened, we publicly announced that in fact Russia had hacked into the DNC. And at that time, we did not attribute motives or, you know, any interpretations of why they had done so," Obama said.

The comments come against news reports that indicate that the FBI, the CIA and the Office of the Director of National Intelligence are in agreement that Russia's hacks at Democratic Party targets were conducted to support the candidacy of now President-elect Donald Trump.

However, Obama said that it was unlikely that the evidence that provides the basis for these conclusions will be declassified as part of the review expected from ODNI before the end of the Obama presidency.

"Look, we will provide evidence that we can safely provide, that does not compromise sources and methods," Obama said. "But I'll be honest with you, when you are talking about cybersecurity, a lot of it is classified, and we're not going to provide it -- because the way we catch folks is by knowing certain things about them that they may not want us to know, and if we're gonna monitor this stuff effectively going forward, we don't want them to know that we know."

Obama also sought to allay concerns that the voting process itself had been subject to any penetration and manipulation by foreign powers.

"I can assure the public that there was not the kind of tampering with the voting process that was our concern and will continue to be of concern going forward, that the votes that were cast were counted, they were counted appropriately," Obama said.

Obama used the occasion to make a larger point about the continued vulnerability of U.S. government, business and infrastructure to hacks. He cited the recently released report of the Commission on Enhancing National Cybersecurity, which was established in the wake of the hacks of the Office of Personnel Management.

Obama said it was "difficult" to put the range of recommendations into action. "The target of cyberattacks is not one entity, but it's widely dispersed and a lot of it is private, like the DNC. You know, it's not a branch of government. We can't tell people what to do" Obama said.

"What we can do is inform them, get best practices. What we can also do is to, on a bilateral basis, warn other countries against these kinds of attacks, and we've done that in the past."

In his press conference, Obama referenced a conversation with Russian leader Vladimir Putin after the DNC and other hacks in which Obama "told Russia to stop [the hacking] and indicated there will be consequences when they do it." He also cited conversations with Chinese leaders designed to put an end to industrial cyber espionage.

"The Chinese have in the past engaged in cyberattacks directed at our companies to steal trade secrets and proprietary technology, and I had to have the same conversation with President Xi. And what we've seen is some evidence that they have reduced, but not completely eliminated, these activities, partly because they can use cutouts," he said.  Cutouts are third parties --  such as an organized criminal gang, hacktivist group or other entity -- that can shield a nation state actor from attribution.

"One of the problems with the internet and cyber issues is there's not always a return address, and by the time you catch up to it, you know, attributing what happened to a particular government can be difficult, not always provable in court, even though our intelligence communities can make an assessment," he said.

From a global perspective, Obama said, the administration has worked on creating norms in cyberspace, "to prevent some sort of cyber arms race because we obviously have offensive capabilities as well as defensive capabilities. And my approach is not a situation which everybody's worse off because folks are constantly attacking each other back and forth, but putting some guardrails around behavior of nation states, including our adversaries, just so that they understand that whatever they do to us, we can potentially do to them."