16 August 2021

The Limits of Cyberoffense

Eric Rosenbach, Juliette Kayyem, and Lara Mitra

The recent wave of high-profile cyberattacks by Russian organized crime groups has forced U.S. President Joe Biden’s administration to confront a difficult question: How should the United States respond to hacks not by hostile foreign governments but by criminal nonstate actors? Last October, Russian hackers targeted several U.S. hospital systems with ransomware, disrupting access to electronic medical records and leaving some providers to piece together medical protocols from memory in the midst of a global pandemic. Seven months later, in May 2021, hackers shut down one of the largest fuel pipelines in the United States, leading to shortages across the East Coast and forcing the operator to pay a ransom of $4.4 million to restore service.

These attacks and others like them are a sobering reminder that U.S. critical infrastructure is rife with vulnerabilities—and that criminals around the world are more than capable of exploiting them. The attacks have also prompted a growing chorus of calls for the Biden administration to not only shore up U.S. cyberdefenses but also to go on the cyberoffensive—to “hit Putin with a serious cyberattack,” as Senator John Kennedy, Republican of Louisiana, put it. But as the administration weighs its

No comments: