Revelations that the US has been the target of two significant hacking campaigns by Russia and China just weeks apart have ignited a debate about how the US should respond to cyber aggression without formally entering into a conflict, reports Financial Times. President Joe Biden had earlier used his first phone call with the Russian President to protest against the SolarWinds hack.
This month a second spying campaign was discovered that targeted key individuals at nongovernment organizations and think-tanks by taking advantage of the flaws in Microsoft email software. Microsoft linked the campaign to a Chinese state-sponsored hacking group called Hafnium. While the US administration is still assessing the fallout from the Microsoft campaign — and has not yet attributed it to China — Biden has raised expectations that he is considering retaliation against Moscow. Last month Jake Sullivan, the US national security adviser, said the response to SolarWinds “will include a mix of tools seen and unseen, and it will not simply be sanctions.”
According to the New York Times, the first move is expected in the next three weeks and will involve “clandestine actions across Russian networks,” although the administration has not confirmed this.
However, cyber experts caution that retaliation may not be justified. The SolarWinds hack is thought to have been pure espionage, rather than a cyberattack on critical infrastructures, such as previous strikes by Russian hackers against Ukrainian power supplies and banks and businesses in Georgia.
Others note that the US should likewise be careful of criticizing cyber-spying campaigns given its own extensive espionage operations against adversaries — as exposed by the whistleblower Edward Snowden in 2013. “If you want to get upset about SolarWinds as an outrage, then close down the National Security Agency, close down GCHQ [the UK signals intelligence agency],” a security veteran said while talking to Financial Times.
Source: Financial Times
