The Trump administration’s latest effort to deter foreign interference in U.S. elections is falling flat with lawmakers, who are prepared to pursue even tougher punishments against Russia and other adversaries who seek to disrupt U.S. politics.
Democrats -- and at least one Republican -- said President Trump’s order Wednesday authorizing additional sanctions against foreign entities that interfere in elections is too weak because it gives Trump discretion over when to impose the harshest penalties, as my colleagues Anne Gearan and Felicia Sonmez reported. The lawmakers seized on the opportunity to renew calls for legislation that they argued would more effectively deter election cyberattacks.
“An executive order that inevitably leaves the President broad discretion to decide whether to impose tough sanctions against those who attack our democracy is insufficient,” Sen. Mark R. Warner (Va.), the ranking Democrat on the Intelligence Committee, said in a statement. “If we are going to actually deter Russia and others from interfering in our elections in the future, we need to spell out strong, clear consequences, without ambiguity. We remain woefully underprepared to secure the upcoming elections, and an executive order is simply no substitute for congressional action.”
Indeed, the announcement -- timed right around two hearings on separate sanctions bills-- seemed to be an attempt to hold off congressional action that would require harsher and more immediate penalties. Congress is weighing a handful of bills that are tougher on election interference than what the administration is threatening. But the critiques of Trump’s order send a strong signal that lawmakers are prepared to move on the legislation anyway.
Trump said in a statement Wednesday that his order “ensures a quick, forceful, and proportionate response” to “any foreign meddling.” The order would allow the president to sanction countries or individuals who interfere in U.S. elections, covering efforts to meddle in election infrastructure and attempts to influence voting from abroad.
But just hours after Trump signed it, Democrats on the Senate Banking Committee held a hearing in which they questioned a panel of Russia experts about whether the order would have any impact on Moscow’s cyberaggression.
“Until the president is willing to say unequivocally the Russians are attacking our elections, are trying to meddle in our elections, I don’t know how we or Vladimir Putin for that matter can take seriously our government’s efforts,” Sen. Sherrod Brown (Ohio), the committee’s ranking Democrat, said in the hearing. “And that means it’s up to us in this Congress to write strong, strong sanctions language and push and push and push this equivocating — or worse than that — president to take decisive action.”
The main bill lawmakers are pushing is the bipartisan DETER Act, which was introduced by Sens. Marco Rubio (R-Fla.) and Chris Van Hollen (D-Md.). The bill would require the administration to slap Russian businesses and oligarchs with sanctions within 10 days if the director of national intelligence determines that the Kremlin has interfered in an election. It would also place a powerful check on the White House: Under the legislation, the president would be barred from lifting the sanctions unless intelligence officials report to Congress that Russia has gone two election cycles without interfering in U.S. elections. The bill has drawn more than a dozen co-sponsors, including Warner.
“Today’s announcement by the Administration recognizes the threat, but does not go far enough to address it. The United States can and must do more,” Rubio and Van Hollen said in a joint statement Wednesday. “Mandatory sanctions on anyone who attacks our electoral systems serve as the best deterrent.”
Rubio added in a tweet that the White House and the president "deserved credit" for taking action, but said they were "limited from going further without legislation":
The @WhiteHouse & @POTUS deserve credit for taking this action. They did as much as they could do with an executive order but are limited from going further without legislation. We still need the #DeterAct & are open to making reasonable changes to pass it https://t.co/wJAuBLAUVU— Marco Rubio (@marcorubio) September 12, 2018
It's not the only option lawmakers are mulling. Another bill, the Defending American Security from Kremlin Aggression Act, would require the administration to hit Russia with an even broader package of sanctions, targeting Russian banks, energy projects and wealthy Russians with Kremlin connections. The bill, sponsored by Sens. Lindsey O. Graham (R-S.C.) and Robert Menendez (D-N.J.), would also create a panel of national security officials that would report to Congress on disinformation campaigns, cyberthreats and other “malign influence activities” by the Russian government.
A third bill, the Defending Elections against Trolls from Enemy Regimes Act, would bar from the United States any foreigner who “is seeking to engage in, or has engaged in, improper interference in a U.S. election.” The Senate Judiciary Committee is set to debate the legislation, sponsored by Graham and Sen. Richard J. Durbin (D-Ill.), in a hearing today.
National security adviser John Bolton said the White House is willing to work with Congress on a solution, as my colleagues reported. But he told reporters in a conference call that new legislation might be slow in coming, and said Trump's order offered a more immediate response. “We felt it was important to demonstrate the president has taken command of this issue, that it’s something he cares deeply about,” Bolton said. “The integrity of our elections and our constitutional process are a high priority to him.”
|You are reading The Cybersecurity 202, our must-read newsletter on cybersecurity policy news.|
|Not a regular subscriber?|
PINGED: Cyberattacks against the United States will probably evolve into persistent and draining “cyber trench-warfare” rather than strike as one massive “Cyber Pearl Harbor” attack, Kevin Mandia, chief executive of the cybersecurity company FireEye, plans to tell senators today. Mandia is scheduled to appear before the Senate Homeland Security and Governmental Affairs Committee for a hearing about “evolving threats to the homeland.” According to his prepared remarks, Mandia also plans to say that citizens and businesses constitute more vulnerable targets to cyberattacks than defense networks or large organizations that control critical infrastructure.
“These softer targets, such as individuals, state and local governments, public schools, academia, smaller businesses, form the fabric of our daily lives and drive the economic engine that we rely on,” Mandia plans to say, according to his prepared statement to the committee. “Not every company or organization has the resources or capabilities to defend itself in cyberspace, and a catastrophic or even gradual failure of the softer targets will result in significant impact perhaps as grave as attacks against well protected, critical systems.”
Mandia also plans to warn senators about three kinds of cyberthreats, according to his statement:
- Threats to utilities, especially in rural areas and smaller communities that may not have enough resources to defend themselves against sophisticated cyberattacks;
- Threats of “indiscriminate” cyberattacks that would take aim at citizens, critical infrastructure and government institutions;
- Threats of influence operations that may seek to spread disinformation or sow discord in American society. Moreover, Mandia plans to say that artificial intelligence will make such influence operations increasingly effective.
PATCHED: A Russian hacker on Wednesday pleaded guilty in federal court in Hartford, Conn., to charges related to his control of the Kelihos botnet that infected at least 50,000 computers, according to a news release from the Justice Department. Peter Yuryevich Levashov used the botnet to steal log-in credentials and spread spam email, ransomware and other kinds of malware, according to the statement. Levashov also operated other botnets — such as the Storm and Waledac botnets — between the late 1990s and his arrest in April last year, the department said.
John H. Durham, U.S. attorney for the District of Connecticut, called Levashov a “prolific cybercriminal” who also took part in criminal online marketplaces for hacking tools, stolen identities and credit card information. “For years, Mr. Levashov lived quite comfortably while his criminal behavior disrupted the lives of thousands of computer users,” Durham said in a statement. Levashov pleaded guilty to one count of causing intentional damage to a protected computer, one count of conspiracy, one count of wire fraud and one count of aggravated identity theft, according to the department's statement. He was arrested in Spain last year and was extradited to the United States in February. His sentencing has been scheduled for Sept. 6, 2019.
PWNED: “Two years before Equifax Inc. stunned the world with the announcement it had been hacked, the credit-reporting company believed it was the victim of another theft, only this time at the hands of Chinese spies, according to people familiar with the matter,” the Wall Street Journal's Aruna Viswanatha and Kate O’Keeffe reported on Wednesday. “In the previously undisclosed incident, security officials feared that former employees had removed thousands of pages of proprietary information before leaving and heading to jobs in China. Materials included code for planned new products, human-resources files and manuals.”
Moreover, Viswanatha and O’Keeffe wrote that “Equifax grew so worried it began building a way to monitor the computer activity of all of its ethnic-Chinese employees,” but such a plan raised legal worries and was discontinued. Equifax informed the FBI and the CIA about its suspicions of theft, but the investigation eventually ground to a halt, according to the Journal. “The FBI wanted to pursue a criminal case, believing the theft of trade secrets costs the U.S. hundreds of billions of dollars a year, with China the leading offender, said people familiar with the investigation.” Viswanatha and O’Keeffe wrote. “Equifax began to worry about legal exposure and how onerous the inquiry could become, according to these people, and eventually reduced its cooperation with law enforcement.”
— “A Latvian computer hacker who said he pocketed between $150,000 to $250,000 by infecting visitors to the Star Tribune website with a malware virus will spend nearly three years in federal prison before being sent back to his home country, a federal judge ordered on Wednesday,” the Minneapolis Star Tribune's Stephen Montemayor reported. “Peteris Sahurovs, 29, was once the FBI's fifth-most wanted cybercriminal and the bureau offered $50,000 for help with his capture. Arrested in Latvia in 2011 to face charges filed in Minnesota, Sahurovs vanished for nearly five years before his arrest in Poland in November 2016.”
Sahurovs was sentenced to 33 months in prison for conspiracy to commit wire fraud, according to a news release from the Justice Department. He was extradited to the United States in June 2017 and pleaded guilty in February. “The level of sophistication and the fact that cybercriminals can perpetrate their attack from a computer half way around the world, or right next door, make these cases extremely difficult to investigate and prosecute,” U.S. Attorney for the District of Minnesota Erica MacDonald said in a statement, as quoted by Montemayor.
— More cybersecurity news from the public sector:
— “Electronic surveillance has been crucial” in helping thwart Islamic State attacks in the West, the New York Times's Rukmini Callimachi reported Wednesday. Law enforcement authorities track members of the group online, for instance, on the secure-messaging app Telegram, according to the Times. “With each arrest, the authorities seize the suspects’ cellphones and electronics, download their contacts and study their chats, turning one arrest into an opportunity to roll up an entire network,” Callimachi wrote.
— “The European Union took a stance against ‘killer robots’ on Wednesday when the European Parliament passed a resolution calling for an international ban on the development, production and use of weapons that kill without a human deciding to fire,” Reuters’s Daphne Psaledakis reported. “Autonomous weapons are machines programmed to select and attack targets using artificial intelligence, without human control. Opponents fear they could become dangerous in a cyber-attack or as a result of a mistake in their programming.”
— More cybersecurity news around the world:
- Senate Homeland Security and Governmental Affairs Committee hearing on “evolving threats to the homeland.”
- House Homeland Security Committee markup of two cybersecurity bills — a bill by House Majority Leader Kevin McCarthy (R-Calif.) that would establish a vulnerability disclosure policy for DHS websites and a bill by Sen. Maggie Hassan (D-N.H.) that would create a bug bounty pilot program at DHS.
- The Senate Judiciary Committee examines a bill by Sens. Richard J. Durbin (D-Ill.) and Lindsey O. Graham (R-S.C.) to prevent foreigners who “improperly interfere” in U.S. elections from entering the United States.
The perjury trap argument, deconstructed:
Carolinas board up, move out as Florence closes in
Five things that are smaller than the screen on Apple’s new iPhone Xs Max: