Russia and America's Cyber Deterrence Dilemma

Sanctions won't deter future Russian cyber attacks not only because of Washington’s limited ability to impose costs on officials it believes ordered the hacking, but because neither side is ready to accept deterrence in the cyber domain.

After months of increasingly strident warnings about Russian cyber attacks, including Russia’s alleged meddling in the 2016 presidential race, the Obama administration has imposed an array of sanctions and punitive measures against Russian targets. The President described the measures as a “response to the Russian government’s aggressive harassment of U.S. officials and cyber operations aimed at the U.S. election.”  After “repeated private and public warnings that we have issued to the Russian government,” Obama added, sanctions “are a necessary and appropriate response to efforts to harm U.S. interests in violation of established international norms of behavior.”

In its remaining time in office, the Obama administration’s resolve to respond to Russia’s actions is clear. A bipartisan majority on Capitol Hill appears almost certain to support these measures, and is likely to impose additional punitive sanctions against Moscow in the near future. Much less clear is whether pressure from such sanctions can actually change the Russian behavior that has caused so much consternation in Washington.

U.S. sanctions against Russia are not new. Throughout the Cold War, Congress and the Executive branch wielded trade sanctions to underscore U.S. disapproval of Soviet foreign policy, as well as Moscow’s treatment of its own citizens, including Jewish refuseniks and other dissidents. Since the collapse of President Obama’s own attempt to “reset” relations with Russia, sanctions have once again taken center stage as the preferred instrument of U.S. opposition to Russian policies.

In 2012, Obama signed into law the Magnitsky Act, which sanctioned designated Russian individuals for their involvement in human rights abuses, and to which Moscow responded with a ban on adoptions of Russian orphans by U.S. citizens, plus a crackdown on U.S.-supported Russian charities and NGOs. New rounds of U.S. sanctions, this time paired with similar European measures, followed Russia’s 2014 invasion and annexation of Ukraine’s Crimean Peninsula, and its support for an armed insurgency in Eastern Ukraine. Russia responded with counter-sanctions against Western products and services, harsh anti-Western rhetoric, and—according to U.S. and European intelligence communities—a concerted disinformation campaign, including cyber attacks on U.S. political targets.

If the purpose of the Magnitsky sanctions has been to improve the situation for dissidents and whistleblowers in Russia, it would be hard to argue that they have succeeded. Likewise, to the extent that Ukraine-related sanctions seek to compel Moscow to implement its commitments under the Minsk framework agreements, they have clearly fallen short as well.

It should be no surprise that Western sanctions have resulted in neither dramatic reform of the Russian political system nor reversals in the Kremlin’s foreign policy. But, as sanctions advocates contend, they could serve as part of an effective deterrent against future Russian actions. The key question, therefore, is whether the latest sanctions—or any sanctions, for that matter—will be adequate to deter future Russian actions of the sort that have provoked this U.S. response.

At the height of the Cold War, Nobel laureate economist Thomas Schelling defined deterrence as the use of power not to coerce or compel, but to prevent an adversary’s attack. Schelling’s view of nuclear weapons as a deterrent echoed George F. Kennan’s famous insistence that the Soviet leadership could be deterred.  “If the adversary has sufficient force and makes clear his readiness to use it,” Kennan wrote, “he rarely has to do so.”

What would it take for such a deterrence framework to constrain future Russian cyber attacks?  First, the attacks must be clearly defined and clearly attributed to Russia. By that measure, it is problematic that the White House has announced retaliatory measures before releasing the results of an intelligence community review of Russia’s intervention in the 2016 election to be completed later in January.

While some U.S. intelligence sources have already concluded with “high confidence” that senior Russian officials approved of cyber attacks on U.S. political targets with the intention of swaying the 2016 election, President-elect Donald Trump has dismissed this finding, tweeting, “these are the same people that [in 2003] said Saddam Hussein had weapons of mass destruction.” The problem is that if Americans are not in clear agreement about the specific Russian actions being punished—and thus the actions to be deterred in the future—they risk muddling the message to Russians, Chinese, or anyone else Washington intends to deter.

The second measure of a successful deterrent strategy is whether the threatened punishment is credible and within Washington’s power to execute. The administration will almost certainly follow through on punitive measures against those listed in the new executive order, including Russia’s top FSB and GRU leadership. The President has also promised to “continue to take a variety of actions at a time and place of our choosing, some of which will not be publicized.”  What matters is whether the targets of these measures are those actually responsible for the cyber attacks, and thus those who can decide whether to undertake such attacks in the future.

Pages