Mr. Biden said he wanted a “proportional response,’’ and settled on more economic sanctions — hinting there may be other “unseen” actions — but it is far from clear those left an impression. “The issue of state-sponsored cyberattacks of that scope and scale remains a matter of grave concern to the United States,’’ Jake Sullivan, the president’s national security adviser, said aboard Air Force One on the way to Europe last week. The issue, he said, is “not over.”
The SolarWinds hack was followed by an astounding surge in ransomware attacks, the headline-grabbing extortion schemes in which criminal hacker groups lock up a company or hospital’s data, then demand millions in Bitcoin to unlock it. Mr. Biden has accused Russia of harboring those groups, even if they are not working for the Russian government.
Mr. Rosenbach, the former Pentagon cyber policy chief, said that ransomware gives Mr. Biden an opening. “Rather than focus on naïvely abstract ‘rules of the road,’ Biden should press Putin hard on concrete actions, such as halting the scourge of ransomware attacks against U.S. critical infrastructure,’’ he said.
“Putin has plausible deniability,” he said, “and the threat of additional sanctions is likely enough to convince Putin to take quiet action against” the groups responsible for the attacks.
That would be a start, if a small one.
If the history of nuclear arms control applies again — and it may not — expectations should be low. It is far too late to hope for the elimination of cyberweapons, any more than one could hope to eliminate guns. The best we could do might be a first attempt at a digital “Geneva Convention’’ limiting the use of cyberweapons against civilians. And the perfect place to try may be in Geneva itself.
But that is almost certainly further than Mr. Putin is willing to go. With his economy overly dependent on fossil fuels, and his population showing signs of restiveness, his sole remaining superpower is the disruption of his democratic rivals.