President Joe Biden has been presented with a menu of options for the U.S. to carry out massive cyberattacks designed to disrupt Russia’s ability to sustain its military operations in Ukraine, four people familiar with the deliberations tell NBC News.
Two U.S. intelligence officials, one Western intelligence official and another person briefed on the matter say no final decisions have been made, but they say U.S. intelligence and military cyber warriors are proposing the use of American cyberweapons on a scale never before contemplated. Among the options: disrupting internet connectivity across Russia, shutting off electric power, and tampering with railroad switches to hamper Russia’s ability to resupply its forces, three of the sources said.
“You could do everything from slow the trains down to have them fall off the tracks,” one person briefed on the matter said.
The sources said the options presented include pre-emptive responses to Russia’s invasion of Ukraine, irrespective of whether Russian launches its own cyberattacks on the U.S. in retaliation for sanctions. They said most of the potential cyberattacks under consideration are designed to disrupt but not destroy, and therefore fall short of an act of war by the United States against Russia. They say the idea is to harm networks, not people. Officials are debating the legal authorities under which the attacks would take place — whether they would be covert action or clandestine military activity. Either way, the U.S. would not publicly acknowledge carrying out the operations, the sources say. U.S. Cyber Command, the National Security Agency, the CIA and other agencies would have a role to play in the operations, the sources said.
“Our response will be harsh and measured, but not so severe as to encourage Putin to take more drastic steps,” one U.S. official said.
The White House did not initially respond to a request for comment. After publication, Emily Horne, a spokesperson for the National Security Council, said in a statement, “This report is wildly off base and does not reflect what is actually being discussed in any shape or form.”
The person briefed on the matter said there was a significant divide within the U.S. government, with one camp fearful of escalating and another urging a strong cyber response.
Any use of cyberweapons to retaliate for the Russian invasion of Ukraine would be a turning point for U.S. cyber operations, which have largely been focused on intelligence gathering, information operations and targeted strikes, many of them for counterterrorism purposes. The most significant use of American cyber capability is believed to be the Stuxnet attack on the Iranian nuclear program from 2007 to 2010, which used computer malware to cause massive physical damage.
But the U.S. has been laying the groundwork for years for possible cyber operations against Russia, China and other adversaries, experts say. Those countries have done the same on American infrastructure networks.
“Cyberweapons are going to be used in a way we haven’t used other weapons,” said James Lewis, a cyber expert at the Center for Strategic and International Studies. “It gives us options we didn’t have before.”
Officials stressed that the options being presented to Biden cover a broad range, from fairly modest disruptions to drastic ones. U.S. officials anticipate that Russia will retaliate, the sources say, likely with Colonial Pipeline-style attacks that seek to hurt American consumers.
“Anything we can do to them, they can do to us,” one U.S. official said.
Some experts say the risk of escalation is high.
“The last thing we want to see is a cyber tit for tat between the U.S. and Russia to see who can destroy one another’s critical infrastructure,” said Dmitri Alperovitch, a cybersecurity expert at the Silverado Policy Accelerator. “I think it is horribly escalatory, can have devastating impacts to our security, and could drag us into a war.”
Cyber expert John Cofrancesco said a “digital 9/11 … is unlikely,” but that the Russians would likely “make very strategic attacks against parts of our infrastructure that impact everyday Americans,” like driving up the price of gas. “This is standard Russian operating procedure.”
“We have to start behaving as though cyberweapons are in fact weapons,” said Cofrancesco, who is vice president for government at Fortress Information Security. “They can bring the attack home and we need to be prepared for that.”
U.S. cyber options, a Western intelligence official said, “will be guided by ethics and proportionality of response, bearing in mind the likelihood of any collateral damage, especially civilian. The U.S. is not at war with Russia.”