Suzanne Spaulding was undersecretary for cybersecurity and critical infrastructure protection in the Department of Homeland Security from 2013 to 2016.
Last week, the president tweeted about forming a joint cyber-unit with the country that hacked our election. Now the White House reportedly is considering giving Russia back the compounds it used to spy on us. This latest signal that the United States is moving on, rather than seriously addressing Russian interference in our democracy, should meet the same fate as last week’s bad idea: bipartisan condemnation followed by a quick reversal.
If the administration is set on talking to Russia about cybersecurity, however, we could consider engaging in carefully limited cybersecurity talks, strategically focused on our national interests and with a clear-eyed understanding that Russia is not our ally. As the head of cybersecurity and critical infrastructure protection at the Department of Homeland Security in the Obama administration, I was part of similar talks with China. The lessons from that dialogue, which led to a significant reduction in China’s commercial cyberespionage activities, can teach President Trump much about how to deal with Russia.
China has a long record of stealing sensitive U.S. business information to help its own industries. For years, China had rejected U.S. assertions that commercial espionage could not be tolerated in a global economy. But the Obama administration remained clear and consistent in communications with China that this kind of activity was unacceptable. In 2014, for example, five members of the Chinese military were indicted on cybertheft charges.
In the late summer of 2015, as President Xi Jinping prepared for his first state visit to the United States, the media reported that the U.S. government was preparing sanctions against China. The White House’s consistent messages and actions up to that point made these threats credible. Not wanting to mar the images of his arrival in the United States, Xi dispatched senior advisers to fly to Washington to negotiate a way out. With that leverage, I joined an interagency team in talks that finally produced an agreement, announced days later by Presidents Barack Obama and Xi. The result was that, for the first time, China agreed that it should not steal sensitive business information to benefit its commercial entities.
Getting caught violating a commitment made at the presidential level raised the stakes for China’s cyberspies. At a minimum, it significantly increased their costs by requiring them to be more stealthy and targeted. They could no longer engage in widespread, unsophisticated smash-and-grab operations across our economy. Private cybersecurity firm FireEye reported in June 2016 that the number of network compromises by the China-based hacking groups it tracked dropped from 60 in 2013 to fewer than 10 three years later.
The agreement also established an important mechanism for regular high-level talks and appropriate working-level communications. I made several trips to Beijing over the next two years, and we hosted senior Chinese cyber officials in the United States. China clearly valued this ongoing dialogue, and we made clear in every meeting that its continuation was contingent upon China living up to its agreements. We never implied that we were ready to “move on.”
In contrast, members of the current administration apparently couldn’t even wait until they were in office to begin weakening their leverage over Russia. Weeks before inauguration, Michael Flynn already was discussing with the Russian ambassador the sanctions imposed by the previous administration. Do we really think that discussion conveyed the incoming administration’s strong determination to keep those sanctions in place unless Russia changed its behavior?
Administration policy since the inauguration is not encouraging to those looking for a more robust stand against Russian interference. Instead, media reports indicate that the White House continues to work to weaken the current sanctions bill in Congress. And Trump says sanctions were not even discussed in his meeting with Russian President Vladimir Putin. What clearly did come up was the desire to move on and work together to guard against election hacking and “many other negative things.” (We know what Putin puts in the category of “negative things”: free speech, dissent, the open flow of information and true democracy.)
It will clearly take more pressure from all sides for the president’s behavior to change. And it’s not just the White House that needs to start operating from a position of strength instead of as a supplicant trying to curry favor because we need Russia’s help. Congress also needs to assert itself more strongly. All parts of the government need to make clear that existing deterrents will remain in place — and that further punishments are possible. Moving promptly on a strong sanctions bill would be a good start. Otherwise, Russia will continue interfering in U.S. democracy.