US President Joe Biden orders sweeping assessment of Russian hacking, even while renewing nuclear treaty

President Joe Biden ordered a sweeping review on Thursday of American intelligence about Russia’s role in a highly sophisticated hacking of government and corporate computer networks, along with what his spokesperson called Moscow’s “reckless and adversarial actions” globally and against dissidents inside the country.

At the same time, White House officials said the president would seek a clean, five-year extension of the last remaining nuclear arms treaty between the two countries, which expires in two weeks.

While Biden has long favoured the extension, there was debate among his top aides about how long it should be. He chose the most time available under the treaty’s terms, in hopes, his aides said, of preventing a nuclear arms race at a time the new president expects to be in a state of near-constant, low-level competition and confrontation with Moscow around the world — and particularly in cyberspace.

“This extension makes even more sense when the relationship with Russia is adversarial as it is at this time,” said Jen Psaki, the White House press secretary.

Taken together, the paired announcements make clear the complexity of Biden’s two-step approach to contain the actions of President Vladimir Putin of Russia. Biden’s aides have said they have no interest in a “reset” in relations of the kind that President Barack Obama and his secretary of state at the time, Hillary Clinton, tried a dozen years ago.

But that puts Biden in the awkward position of seeking to extend the nuclear treaty — which Putin has already said he is willing to renew — while very publicly discussing the need to make Russia pay a price for the hacking. He has few alternatives: If the treaty is not extended, both countries would be free to deploy as many nuclear weapons as they want starting Feb. 6.

But Biden’s aides have privately cautioned that his options for retaliation in response to the attack on the “supply chain” of software used by the government and private industry are limited. In part because the evidence amassed so far suggested the Russians used their covert access chiefly to conduct espionage — something that all nations engage in and that the United States conducts against Russia all the time, often through software manipulation.

Biden’s order for a study of the SolarWinds hacking — named for the Texas company whose widely used network management software was one way Russian hackers gained access — comes as intelligence officials have quietly concluded that more than 1,000 Russian software engineers were most likely involved in it, according to people involved in the investigation.

That suggests it was a far larger and stealthier operation than first known — and raises anew questions about why the National Security Agency and its military counterpart, U.S. Cyber Command, missed it. The Russians were active for nine months in those networks before a cybersecurity firm, FireEye, and Microsoft Corp. alerted the government, and then the public, about the hacking.

A key question facing Avril Haines, new director of national intelligence, is whether the operation was limited to espionage, or whether “back doors” placed in government and corporate systems give Russia new abilities to alter data or shut down computer networks entirely.

Biden also instructed Haines on Thursday to provide him with an assessment of the Kremlin’s effort to use a chemical weapon against Russia’s leading opposition politician, Alexei Navalny. Navalny, who survived the attack, was arrested this week when he returned to Russia.

Haines was also asked to review intelligence that produced evidence that Russia put a “bounty” on the lives of U.S. troops in Afghanistan.

Intelligence reviews are routine when the White House changes hands. But in the case of Russia, it is particularly vital: From his first meeting with Putin in Hamburg, Germany, in 2017, President Donald Trump seemed oddly deferential to the Russian leader.

Trump appeared to endorse Putin’s denial that Moscow had anything to do with the 2016 effort to influence the presidential election, and in December, Trump suggested that maybe China, not Russia, was behind the hacking of government systems. He was contradicted within days by his own intelligence officials and, as far as it is known, did nothing to respond to the Russian hacking.

Biden, in contrast, promised to take action.

The top Democrats on congressional intelligence panels said the new order was well-timed and was something they had long sought from the spy agencies.

Sen. Mark Warner, D-Va., who will become chairman of the Senate Intelligence Committee, said Biden was ordering a broad new intelligence assessment on Russia, and, in particular, a better understanding of the SolarWinds hacking.

“SolarWinds is one of the most sophisticated and deep hacks we’ve faced, and the president needs the best information he can get to not only lead the remediation of the penetration but to understand how to prevent it in the future, and what actions might deter Russia going forward,” Warner said.

Rep. Adam Schiff, D-Calif., the chairman of the House Intelligence Committee, said that Biden needed the “very best assessment our intelligence agencies can produce” on the hacking, on Russian interference in the election and on any bounties they have offered on US troops.

“If we hope to be successful in thwarting future threats to our national security from Russia,” Schiff said, “we must examine Putin’s malign conduct with objectivity and our eyes wide open.”

The new White House order to the intelligence community should not require a huge reworking of the analysis produced by the CIA and other agencies over the past four years, according to some people familiar with the matter.

Under the Trump administration, there was a relatively high bar for sending intelligence reports on Russia to the White House, given the hostility and skepticism with which Trump viewed them. The new order is a clear message that the Biden administration wants the intelligence community to share with the White House a broad selection of its information on Moscow.

On Thursday, shortly after being sworn in by Vice President Kamala Harris, Haines attended the daily intelligence briefing for Biden, an official said. In a statement, Haines pledged to “never hesitate to speak truth to power and to deliver intelligence driven by facts, not politics.”

Some cases will require the new Office of the Director of National Intelligence to review some products produced under the Trump administration, like a memo from the office at the time that viewed the intelligence on the Russian bounties sceptically. That memo was at odds with the views of top CIA officials, including Gina Haspel, then the agency’s director.

Interestingly, during the confirmation hearing for Haines, there was far more discussion about the espionage threat from China than there was about Russia.

Haines, a former deputy national security adviser and deputy CIA director during the Obama administration, told senators at her hearing that she had yet to learn the classified details of the hacking, adding she was alarmed that the government learned about it from a private company, not its own agencies.

Over the past several years, though, she has spent considerable time thinking about U.S. vulnerabilities in cyberspace and led a study group that examined the obstacles to introducing new technology into US intelligence agencies.

“One of the great challenges that we face in the United States is the asymmetry of the threat in cyber,” Haines said. “It is relatively easy for adversaries to hold at risk what are high-value assets to the United States, given how much we rely on cyber and digital work for our economy.”

Haines has described deterrence by fear — the fear that the United States or others would retaliate. “When you have an imposition of costs, you can deter, obviously, actors from engaging further in that activity if the cost is sufficient that it actually has an impact on them in their decision making,” she said.

But in SolarWinds, the Russians concluded that there would be a little cost for a sophisticated attack, and so far, they have been right.