Major cyberattacks with links to Russia have grown bolder even in the face of escalating U.S. economic sanctions, presenting a high-stakes dilemma for President Biden as he weighs how to respond to the devastating assault on the Colonial Pipeline and what tools America may have at its disposal to punch back.
Washington over the past decade has leveled more than 140 targeted economic sanctions against Russian individuals and entities for hacking and other cybercrimes. But analysts say the tactic has done hardly anything to deter the Kremlin and Russian-linked gangs operating across Eastern Europe from hacking U.S. companies and government assets.
There is no proof that the Kremlin explicitly ordered the attack on the Colonial Pipeline, but Mr. Biden has made clear that the hackers and the digital weapons they used appear to be inside Russia. He said Moscow bears “responsibility” for the incident, which has driven up U.S. fuel prices, led to long lines at gas stations and sparked fears of energy shortages in key metropolitan areas along the East Coast.
Responding with yet another round of sanctions won’t reduce the risk of further cyberattacks directly ordered or indirectly backed by Russian President Vladimir Putin, foreign policy experts say. They note that past sanctions have not had the desired impact.
Russia’s interference in multiple U.S. elections, expansion of online propaganda campaigns in Eastern Europe and the recent Kremlin-backed SolarWinds hack of U.S. computers have all occurred within a decade after the Treasury Department began leveling cyber-related sanctions against Russia.
“We’re still trying to figure out, on the Putin scale, what gives him pain?” said Jim Townsend, who was deputy assistant secretary of defense for European and NATO policy during the Obama administration. “No matter what it is, after the invasion of Georgia, the invasion of Ukraine, the sanctions Biden just put on him … we’re trying to figure out what works.”
The Biden administration most recently slapped sanctions on Moscow in response to the 2020 SolarWinds hack of the U.S. government and leading private American companies. The White House targeted more than three dozen Russian individuals and entities for retaliation.
But the impact of sanctions, which can freeze the assets that an individual or entity may have in banks tied to the U.S. financial system, remains questionable.
“The only sanctions that I know that really seemed to work were [those that targeted] apartheid in South Africa,” Mr. Townsend said in an interview Tuesday. “We’ve sanctioned Iran, we’ve sanctioned Cuba. What are you trying to get at with sanctions? Give me an example of sanctions really working.”
Indeed, the Russian government and criminal outfits with apparent ties to Moscow have ramped up their online operations despite being the hardest hit by U.S. financial penalties. Since 2011, the Treasury has slapped 141 cyber-related economic sanctions on Russian individuals or entities, according to figures compiled by the Center for a New American Security.
That is far more than any other nation. Iran came in second at 112. North Korea has been hit with 18 cyber-related sanctions and China with five over the past decade.
Biden administration officials have been tight-lipped about their plans for responding to the Colonial Pipeline attack, which the FBI has pinned on the Eastern Europe-based gang of hackers known as DarkSide.
Top Russian officials on Tuesday denied having any involvement in the incident. “Russia didn’t have anything to do with hacking attacks that had taken place earlier,” Kremlin spokesman Dmitry Peskov said in a conference call with reporters. “We categorically don’t accept any accusations against us in this regard.”
The attack relied on ransomware, an operation in which key data is locked or stolen and held for ransom. It’s unclear whether the Colonial Pipeline Co. has or is considering paying a ransom.
The company said Tuesday it is slowly bringing the pipeline, which provides roughly 45% of the fuel consumed on the East Coast, back online. But some gas stations in the mid-Atlantic and the South were reporting that they had run out of fuel, and gasoline prices were on the rise across areas of the country.
Top administration officials warned gasoline station operators not to try to profit from motorists’ panic.
“We will have no tolerance for price-gouging. Federal and state officials will be investigating those actions if we see price-gouging,” Energy Secretary Jennifer Granholm said.
As the government deals with domestic energy concerns, Mr. Biden and his top foreign policy deputies are hashing out how best to respond on the international stage. The president has vowed to bring up cyberattacks when he meets in person with Mr. Putin sometime in the next several months.
Meanwhile, debate is widening among U.S. government analysts over the effectiveness of sanctions.
“Russian policymakers may be willing to incur the cost of sanctions, whether on the national economy or on their own personal wealth, in furtherance of Russia’s foreign policy goals,” said a recent Congressional Research Service report. “Sanctions also might have the unintended effect of boosting internal support for the Russian government, whether through appeals to nationalism or through Russian elites’ sense of self-preservation.”
Beyond strictly targeting Moscow, the United States also could seek to use economic sanctions to derail Russia’s prized Nord Stream 2 pipeline to Germany.
The energy project is deeply unpopular on Capitol Hill and is widely viewed as an effort by Moscow to use fuel supplies as leverage over Ukraine and other European nations.
German officials strongly support the project because of the economic boon for their country, and the Biden administration has been reluctant to throw its full weight behind undermining the pipeline.
Mr. Biden could order more U.S. troops to Eastern Europe or take other military steps to intimidate Russia, but past moves have had little effect at slowing Russia-linked cyberattacks.
Some specialists say the U.S. may consistently find itself at a disadvantage in cyberspace. Unlike Russia and criminal gangs, they say, Washington is unlikely to willingly target energy infrastructure or other entities that could lead to serious consequences across an entire society.
“It’s hard for us because we’re not ruthless,” Mr. Townsend said. “They don’t care.”
⦁ Haris Alic and Ryan Lovelace contributed to this report
