NSA official: U.S. has yet to hit Russia back 'where it hurts' for cyber aggression

The deputy director of operations at the NSA said Monday the U.S. doesn't "yet have the political fortitude to say how we'll strike back."

The Trump administration has yet to hit Russia “where it hurts” after Russian intelligence agencies orchestrated a complex operation in 2016 that saw U.S. political organizations hacked and targeted propaganda spread among voters, according to a senior U.S. intelligence official.

Natalie Laing, the deputy director of operations at the NSA, told attendees of an exclusive security conference Monday that the U.S. doesn’t “yet have the political fortitude to say how we’ll strike back.”

The comment follows recent public testimony by current NSA Director Adm. Michael Rogers and his presumed successor, Gen. Paul Nakasone, regarding the lack of a coherent, aggressive response to Russia’s bad behavior in cyberspace. The executive branch would be responsible for developing such a strategy, which would then be carried out by the Office of the Director of National Intelligence and Pentagon leadership.

A historic intelligence community report published in January 2017 showed that the Russian government was responsible for breaching the Democratic National Committee in 2016 and then sharing fake news on social media to misinform American citizens.

Laing’s comments were first reported by CNN and NBC News. The event was hosted by D.C. media company, The Cipher Brief. CyberScoop spoke with attendees of the conference to confirm the content of Laing’s speech because there was no livestream recording of the talk.

At the moment, the White House and Congress are both considering a wide range of options, including “next-level offensive capabilities,” according to Laing, but a decision about how best to respond in order to protect upcoming elections does not appear imminent.

White House homeland security adviser Thomas Bossert, who spoke at the same conference on Sunday, said that the U.S. is holding Russia accountable in “known and unknown ways” for its previous cyberattacks on U.S. organizations. Bossert cited several recent announcements, including new sanctions against Russian oligarchs, as an effort to Vladimir Putin.

National security experts warn that sanctions alone are not sufficient to deter Russia or other developed countries from meddling in future U.S. elections.

Current and former officials have floated various possibilities for how the Trump administration should respond to deter Russia. These ideas include a more forceful, offensive strategy led by NSA or U.S. Cyber Command to hack Russian organizations to cause damage.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure