12/21/2020
Mitt Romney warned a few days ago that the Russians potentially "have the capacity to cripple us economically [and] the potential to also cripple us with regards to our water and electricity and so forth."
He's right. Oh, maybe not "cripple," if luck is with us, but significantly disrupt, and to an extent we have never seen outside of war.
Also, by the way, we have the capability to do it to them, as well. For many years now, we have in fact been in a three-way standoff with the Russians and the Chinese. I said, in 1999, that we would someday reach a state of "Mutually Assured Downtime" -- like the nuclear war doctrine Mutually Assured Destruction, but with computer networks -- and we reached that state about 2014, by my reckoning.
Today, however, the big hack by the Russians has potentially de-stabilized the standoff. We need to make a national response, proportionate and tough and immediate. It may not need to a public blow, but it's critical we demonstrate that violations of the sort that have just been revealed do not go unpunished.
To be clear, I do not expect an attack by the Russians or anyone else on our food supply, or the power grid. It is my opinion, and I think that of most other analysts, that our deterrents are likely to hold for the foreseeable future. But we seem to have been caught wrong-footed here and now -- perhaps distracted by the election -- and we must take action to stabilize the situation.
When I was the Chief Information Security Officer of Nasdaq, I pointed out to two different Secretaries of Homeland Security that if a Russian submarine parked in New York Harbor and fired a cruise missile at 'my" stock market, or the NYSE, the U.S. would likely treat that shot as an act of war. How -- exactly -- is this extended, aggressive cyberattack different? We must decide quickly, and act accordingly.