U.S. Condemns Russia for Cyberattack, Showing Split in Stance on Putin

WASHINGTON — The United States on Thursday joined Britain in formally blaming Russia for a huge cyberattack last June that was aimed at Ukraine but crippled computers worldwide, a highly public naming-and-shaming exercise that could further fray relations with Moscow.

The White House threatened unspecified “international consequences” for the attack, which it said “was part of the Kremlin’s ongoing effort to destabilize Ukraine and demonstrates ever more clearly Russia’s involvement in the ongoing conflict.”

The statement, issued by the press secretary, Sarah Huckabee Sanders, said the attack, known by the name NotPetya, was “reckless and indiscriminate” and spread rapidly, “causing billions of dollars in damage across Europe, Asia and the Americas.”

NotPetya, which had the characteristics of a ransomware attack, had been widely identified by cybersecurity experts as coming from Russia, so the attribution was no surprise. But the decision of the United States and Britain to nearly simultaneously condemn the Russian military is noteworthy.

It underscores the dichotomy between the administration’s consistently tough stance toward Russia on issues involving Ukraine and President Trump’s continued reluctance to criticize President Vladimir V. Putin over anything else.

Administration officials declined to say what steps the United States would take against Russia. But they could include both sanctions against Russian officials involved in the attack and covert measures — any of which would be likely to fray an already fragile relationship.

The administration’s public statement echoed one in mid-December when it publicly blamed North Korea for a damaging ransomware attack known as Wannacry. In that case, however, the United States did not follow up with stiff penalties, in part because North Korea was already under heavy sanctions for its nuclear and ballistic missile programs.

“President Trump has used just about every lever you can use, short of starving the people of North Korea, to change their behavior,” the homeland security adviser, Thomas P. Bossert, said at the time. “So we don’t have a lot of room left here to apply pressure.”

Punishing other nations for cyberattacks has proven exceedingly difficult, particularly when the players are as sophisticated as North Korea and Russia. The Russian government flatly denied the allegations that it carried out the attack.

“We think they have no basis and no foundation, and this is nothing else but the continuation of the Russo-phobic campaign,” the Kremlin’s spokesman, Dmitry Peskov, told reporters.

The administration had planned to issue the statement a day earlier to coincide with that of the British, according to a senior official, but delayed it after the deadly school shooting in Parkland, Fla.

The White House statement made no mention of an embarrassing related fact: The NotPetya attacks took advantage of vulnerabilities identified by the National Security Agency and then made public by a group calling itself the Shadow Brokers.

Source: Nytimes News