The White House is continuing to develop a strategy for cyber security that includes deterrence and identifies unacceptable behaviors in cyber space, Homeland Security Secretary Kirstjen Nielsen told a Senate committee on Wednesday.
Nielsen said that a deterrence doctrine “needs to be very clear that there are consequences when countries meddle in our affairs,” and that components of deterrence could include expelling diplomats, indicting foreign officials and citizens, and sanctions.
Last year, Tom Bossert, the White House official that oversees the development of homeland security and counter-terrorism policies, said that deterrence in the cyber realm will likely be focused on traditional means rather than a cyber response.
Sen. Richard Burr (R-N.C.), chairman of the Senate Intelligence Committee, said at the conclusion the committee’s open hearing on the security of U.S. election infrastructure and Russia’s probing of vulnerabilities in our election systems that “we also need to have in place a solid deterrent, a deterrent to activities like this in the future. Any hostile power who seeks to undermine the fundamental structures of our democracy should be prepared to pay a hefty price.”
Jeh Johnson, who was Secretary of Homeland Security for the last three years of the Obama administration, told the panel that sanction imposed on Russia in late 2016 for meddling in the U.S. presidential election that November haven’t worked and that the Trump administration must add to these.
“In my experience super powers respond to significant deterrence and will not engage in behavior that is cost prohibitive,” Johnson said. “Plainly that has not occurred and more needs to be done.”
In February, the heads of key U.S. intelligence agencies told the committee that Russia is targeting U.S. elections this year. Special elections and primaries for national offices have already occurred and more will take place into June ahead of congressional mid-term elections this November.
Nielsen, responding to questions from Sen. Joe Manchin (D-W.Va.) about punishing Russia for its behavior, said, “We need to do more. We need to continue to make the point.” However, she noted that the U.S. has a “multifaceted relationship with Russia” and that their cooperation is needed in various areas, highlighting North Korea, Syria and Iran as examples.
“So the consequences and what we do in reaction to their meddling in our election needs to be proportionate and also needs to be driven in a way that they understand the specific behavior that we are seeking to avoid,” Nielsen told Manchin.
In January 2017, shortly before the inauguration of President Trump, Johnson designated U.S. election systems as critical infrastructure. The designation gave states and localities, which are responsible for administering their election systems without federal interference, a formal way to voluntarily seek the assistance of the Department of Homeland Security in helping to secure their election infrastructure.
Johnson pointed out that the designation also meant that election systems, like any critical infrastructure in the U.S., are now subject to international norms of behavior.
Nielsen, to the point, said this designation means “the hope in general is that the international community continues to recognize that affecting and attacking critical infrastructure of another nation is a red line. As an international community we all need to hold each other to that and recognize that that is a red line.”
Neither the federal government nor Congress has determined yet when a cyber event might constitute an act of war, Nielsen said.
Trump administration officials have said for months that a new cyber security strategy is forthcoming soon. Nielsen said an updated DHS strategy will “nest” into the White House cyber strategy.
DHS offers states who request help a range of cyber security services, including risk and vulnerability assessments such as scans. The federal government is also working to approve security clearances for key election officials in each state so that classified information about threats can be more easily shared with them.
Nielsen said that so far 20 of 150 state and local officials have received their clearances with the goal that all officials be approved by this summer. In the meantime, the government is doing “read ins” of state and local officials for classified briefings as needed, she said.
On Tuesday, the committee released initial recommendations from an ongoing investigation it is doing of Russian meddling in U.S. election systems. The recommendations include, among others, the need for a cyber deterrence policy, better sharing of threat information by the federal government with states, and that states should continue to run their own elections. Nielsen and Johnson both said there is no evidence that Russia was able to change any vote tallies in the 2016 presidential election.
Burr said the threat to U.S. elections is “sobering” and that his committee is “concerned about potential future attacks.” He said DHS has begun to work with state election officials as “a true partner,” but that the department still can bring more resources and technical assistance to bear. He also said that states need to get more information from the federal government on how to better secure their systems.
Burr also said that congressional appropriators have agreed to include about $380 million for election security grants in a new FY ’18 omnibus spending bill. Nielsen also said that DHS has asked Congress for another $25 million to help it provide assistance to states this year with election security.
Separately, Rep. Bennie Thompson (D-Miss.), the ranking member on the House Homeland Security Committee, said on Wednesday that Committee Chairman Michael McCaul (R-Texas) has decided not to hold a hearing on election security despite earlier this month saying he would.
“Chairman McCaul often reiterates his opposition to Russia, but actions speak louder than words,” Thompson said in a statement, adding that “he is ensuring the House stays true to its partisanship and seems too willing to do President Trump’s bidding.”