European allies to tap brakes on any rush to cyber ‘war’ with Russia

U.S. allies are hesitant to classify the recently revealed cyberattack as an act of war due to misgivings about the consequences of such a label, according to European diplomatic sources and analysts.

“When it comes to naming it officially, then I think nobody would do that,” a Baltic official predicted. “A war means you need to take actions, and nobody would really want to escalate the situation.”

The existence of a question about whether an act of war has taken place reflects the novelty of cybertactics in the history of international relations. Diplomats on both sides of the Atlantic remain uncertain about how to identify the line between espionage and conflict, whereas the risks of an outright military conflict with nuclear-armed Russia, which Secretary of State Mike Pompeo has blamed for the attack, has been the preoccupation of NATO leaders for generations.

“Cyberespionage is a part of espionage … It does not necessarily mean that it will escalate to real world events,” a senior European diplomat who works on cyberissues said. Nevertheless, this source allowed that “it’s also possible that cyberoperations are serious enough to amount to be considered armed conflict.”

But a proportional response has been promised, even if that has not yet been defined.

“When I learn the extent of the damage, and, in fact, who is formally responsible and responsible, they can be assured that we will respond — and probably respond in kind,” President-elect Joe Biden said Tuesday, before brushing off a request for more specific threats. “We don’t sit here and say that we are going to strike you with a nuclear weapon … Let us determine what the extent of the damage is. I promise you, there’ll be a response.”

Pompeo has blamed Russia for the cyberattack, a hack that first targeted an American software supply chain and then infected a wide range of companies and agencies. The thought of Russian intelligence agencies enjoying months of undetected access to American networks has sent a shudder through the U.S. national security community, which fears both the loss of information and the prospect that Russian agents used the opportunity to embed themselves in even more sensitive networks.

“As we’ve seen in past human-operated attacks, once operating inside a network, adversaries can perform reconnaissance on the network, elevate privileges, and move laterally,” Microsoft warned Friday in an analysis of the hack.

Depending on the reach of the malware, the difference between a major loss of information and an assault that inflicts chaos on millions of civilians — Russia was blamed for taking down a Ukrainian electric grid in a 2015 attack — depends on the whim of the cyberoperator.

“In a traditional military environment, the hard bit is delivering a killer punch,” said the German Marshall Fund’s Ian Wallace, a cybersecurity expert who previously worked in the United Kingdom’s defense ministry and at the British Embassy in Washington. But “in a cyberdomain, in many ways, the hard bit is getting to a position where you can [attack], and the killer punch is arguably a few keystrokes different in a piece of code,” he said.

Utah Republican Sen. Mitt Romney likened the incursion to “Russian bombers repeatedly flying undetected over the entire country.” Sen. Chris Coons, a Delaware Democrat, agreed that “it’s pretty hard to distinguish this from an act of aggression that rises to the level of an attack that qualifies as war.”

European allies are likely to use more tempered rhetoric. “I belong to this camp: We should be careful of calling something war unless you know what to do,” the senior European diplomat said.

This envoy acknowledged that “diplomats are struggling” to agree on appropriate responses to such cyberattacks, but Russia hawks are heartened by Biden’s thinly veiled threat of a retaliatory operation.

“That’s quite a wise approach, to attack them, so that in the future, they would have less capabilities of doing this,” said the Baltic official, before allowing that there’s some value in ambiguous rhetoric. “If you don’t call it war, you have more room for maneuver, more options open, and you have more room for negotiations.”