Published group project from Harvard University to the Congressional Intelligence Committees and National Security Counsel (NSC) addressing Russia's interference of the 2016 U.S. Presidential election.

1. Alaa Tadmori, Randall Siwiec, Ryan Duggan 03 April 2017
Govt E-40
Topic: U.S. response to Russian cyber threats and influence campaigns: The U.S. Senate held hearings to
review past and future cyber threats from Russia, including the possibility of interference in the 2016 U.S.
presidential election.
Actors: U.S. & Russia
Interests:Protection of US citizens and critical infrastructure from cyber attacks,Denial of foreign
influence in the US electoral process,Escalating cyber defense capabilities, Dissuasion of Russia and
other states to attempt cyber attacks on the US.
Addressed to: President Donald J. Trump, Senate Select committee on Intelligence, House Intelligence
Committee, National Security Council (NSC)
Outline: The Intelligence Community’s (IC) confirmation of successfulRussian cyber attacks before the
presidential election has placed a greater emphasis on potential future impacts of Moscow’s efforts to
gain a political advantage through cyber operations (DNI 2017). This policy recommendation will focus
on how and why Russia has chosen to exploit the US in this way and include recommendations for a US
response. Our goal is to disrupt Moscow’s ability to complete successfulcyber attacks and influence
campaigns against the US and its allies going forward.
Attempts by Russia to undermine the US democratic processes:
On 7 October 2016 the U.S. Intelligence Community (USIC) released a joint statement from the
Department of Homeland Security (DHS) and Office of the Director of National Intelligence (ODNI) on
election security identifying that the Russian Government directed the compromise of e-mails from US
persons, institutions, and political organizations. The recent disclosures of alleged hacked e-mails on
sites like WikiLeaks identifies Russia’s attempts to influence the 2016 US presidential election in efforts
to undermine the US democratic processes. Russian directed efforts of targeting, increased level of
activity, and scope are consistent with the methods and motivations of Moscow, but the intensity of
activities identify an escalation of mission requirements compared to previous Russian nefarious
operations in the US. Historically, the Russians have conducted information operations (IO) campaigns
using the same techniques, tactics, and procedures (TTPs) to influence public opinion in Europe and
Eurasia for decades.

2. Russia’s attempts to influence this presidential campaign were based around an IO campaign that
blends covert intelligence operations such as cyber activity with overt efforts that are facilitated by
Russian Government agencies, academic institutions, state funded media, third party conciliators, and
paid social media users known as trolls targeted both major US political parties. The Soviet Union has
also had numerous instances of conducting covert influence campaigns focused on US presidential
elections that have used intelligence officers, agents, and press placements. The reason why IO is so
effective is because population masses psychological and sociological composition are micro-targeted
then the narrative architecture (messaging) is manipulated. The operation’s success cannot be measured
until the responses or effects are evaluated. “Russian intelligence obtained and maintained access to
elements of multiple US state or local electoral boards. DHS assesses that the types of systems Russian
actors targeted or compromised were not involved in vote tallying”. (DNI, 2017) There are no
assessments or indicators that represent a model that illustrates the success of Russia’s multifaceted
campaign or if they were even successfulat all in meddling in the 2016 Presidential election (DNI’s
assessments are medium to high confidence, not guaranteed).
Key findings from the influence campaign and initial US reactions:
Russia has a vast history of directing operations intended to influence US elections and other
matters that may have an effect on overall Russian security or economic interests. This is not a new type
of threat and it has been happening since the Soviet Union. What is unique about this campaign is that it
used offensive cyber operations as its main effort and supplemental resources to push forward its agenda
of destabilizing the US electoral process. Capabilities aimed at detecting Russian cyber operations are
currently no different than our efforts detecting attempts from other nations. Moscow had success in this
“influence campaign” because of their resources,experience,and dedication to improving both offensive
and defensive cyber capabilities.
It is important to note that although Moscow denies directing this attack along with the other
pieces of the influence campaign, the US intelligence community (IC) has confirmed it with substantial
evidence. “The U.S. Government confirms that two different RIS actors participated in the intrusion into a
US political party. The first actor group, known as Advanced Persistent Threat (APT) 29, entered into the
party’s systems in summer 2015, while the second, known as APT28,entered in spring 2016.” (JAR,
2016) These groups have previously targeted government agencies, think tanks, businesses and other
organizations. The IC also concluded that an attack of this magnitude would require high-ranking
approval, and in this instance the GRU ordered the attacks on the Democratic National Committee and
other political organizations, with the approval of the Kremlin.

3. In a detailed report assessing Russian activities and intentions in this attack The CIA, FBI and
NSA summated “By their nature, Russian influence campaigns are multifaceted and designed to be
deniable because they use a mix of agents of influence, cutouts, front organizations, and false-flag
operations. Moscow demonstrated this during the Ukraine crisis in 2014, when Russia deployed forces
and advisers to eastern Ukraine and denied it publicly.” (DNI, 2017) Although great efforts are made by
Moscow to cover up or deny any actions that could result in retaliation, it is not a large problem for the
US to eventually recover sufficient evidence, as seen in previous cyber operations by Russia, China, and
other state actors.
Responding- We assess that although each significant state sponsored cyber-attack against the US will be
unique and have many variables to consider, there should be a detailed protocol for Washington to take
and that it should be categorized by the severity of the attack. This type of response system was
established in the past two years and many of the details are unavailable to the public. While much of the
tactics, techniques and procedures (TTPs) regarding responding to a cyber attack,whether state sponsored
or not, are classified, some public documents and actions have given insight into what the US will do and
how that has worked thus far.
Looking at the 2016 Russian election meddling specifically, President Obama took some initial
actions once the IC confirmed the breach was Moscow controlled. First, 35 suspected Russian
intelligence operatives were forced to leave the US and sanctions were placed on two Russian intelligence
services. Senior officers of the GRU were also penalized by the administration. (Sanger, 2016)
Second, the administration put sanctions on three companies/organizations that it said supported the
hacking operations, one of which used an alias as a cover for a group that provided special training for the
hacking.
Finally, and most importantly, President Obama issued a new executive order that granted the
president authority to retaliate for efforts to influence elections in the US or countries allied with the US,
likely referencing allegations that Russia is already attempting to influence elections in Germany and
France. During this time the FBI and DHS also released samples of the malware and other indicators of
Russian cyber activity but the evidence did not directly tie senior officers of the GRU or FSB directly to
the operation. (Sanger, 2016)
With the success of this influence campaign it is highly likely that Russia has gained significant
confidence in their ability to affect election outcomes throughout the world. Going forward,Moscow will
improve on its offensive cyber operations and the support mechanisms necessary to have successful
operations like this one. They will also be forced to consider the penalties faced after such attacks are
attributed to them, most likely coming from the US and its close allies.
Dealing with significant cyber attacks differently than traditional attacks:

4. Attacks of such magnitude could undermine the trust in the in the US electoral process and could
lead to weakening our democracy. The US response should be serious and proportional to the damage
these attacks inflicted on us, a weak response will set the precedence and encourage other actors to launch
similar attacks.
However,these attacks,albeit so critical, are still manageable as compared to adversaries or
terrorist organizations possibility taking control of our high-tech (nuclear) weaponry or undermining our
use of them so the US investigation in the Russian attacks should go beyond the meddling of the election
to understand the tactics used by attackers and how to prevent future ones.
Policy Options:
Option 1. Counter-attack Russian systems and sanction Russian financial accounts,particularly those
belonging to Vladimir Putin.
Cyber warfare is still a relatively new form of international conflict and the laws for executing for
both defensive and offensive operations have not been clearly defined. World powers are in the infant
stages of identifying cyber-warfare,defining what a cyberattack is, and what the legal parameters are for a
response or countermeasures in this new world-wide domain. World powers continue to discuss ways of
establishing legal guidelines regarding cyber, with certain issues such as jurisdiction, nature of evidence
and identification causing problems in finalizing documents. One of the United States’ main strategies of
cyber-warfare is deterrence,which provides a security blanket for counter-espionage. Deterrence provides
assurance to adversaries that the U.S. is willing and able to use military force in response to a cyber-
attack. The current Department of Defense (DoD) Cyber Strategy is “In the face of an escalating threat,
the Department of Defense must contribute to the development and implementation of a comprehensive
cyber deterrence strategy to deter keystate and non-state actors from conducting cyberattacks against U.S.
interests. Because of the variety and number of state and non-state cyber actors in cyberspace and the
relative availability of destructive cyber tools, an effective deterrence strategy requires a range of policies
and capabilities to affect a state or non-state actors’ behavior”.
In the face of an escalating threat, the Department of Defense must contribute to the
development and implementation of a comprehensive cyber deterrence strategy to deter key
state and non-state actors from conducting cyberattacks against U.S. interests. Because of the
variety and number of state and non-state cyber actors in cyberspace and the relative
availability of destructive cyber tools, an effective deterrence strategy requires a range of
policies and capabilities to affect a state or non-state actors’ behavior”. (DoD Cyber Strategy)
“Deterrence is partially a function of perception. It works by convincing a potential adversary

5. that it will suffer unacceptable costs if it conducts an attack on the United States,and by
decreasing the likelihood that a potential adversary’s attack will succeed.The United States
must be able to declare or display effective response capabilities to deter an adversary from
initiating an attack; develop effective defensive capabilities to deny a potential attack from
succeeding; and strengthen the overall resilience of U.S. systems to withstand a potential attack
if it penetrates the United States’ defenses.In addition, the United States requires strong
intelligence, forensics, and indications and warning capabilities to reduce anonymity in
cyberspace and increase confidence in attribution”. (DoD Cyber Strategy)
In certain cases,even with advanced forensic capabilities, identifying the attacker may be
challenging and without certain where the attack came from the use of military force may be impractical
plus per Article 5 of the NATO charter,defensive force must be “necessary and proportionate to the
armed attack that gave rise to the right”.
In 2015 President Xi Jinping and U.S. President Barack Obama discussed China’s state-
sponsored hacking for corporate and political espionage that was one of the largest . The solution
between the two Presidents was to work out international rules or laws in cyberspace and even with
political pressure to punish China was prevalent there was no penalties implemented for espionage and
cyber-attacks against government agencies and American companies.One of the biggest issues the U.S. is
facing addressing cyber-attacks is China leading in cybercrime the U.S. is right behind them at number 2.
This was verified by the NSA Edward Snowden leaks that identified American espionage in other
countries to include our allies which damaged U.S. credibility to address China for its cybercrimes.
Analyzing options for an appropriate response to Russia meddling in the 2016 U.S. election must
be strategic. The severity of the attack is unknown and there is no measurement of influence that Russia
had on the election. However,there is overwhelming evidence that Russia did meddle in the election
process which is also a typical trended tactic of theirs.
The suggested response should first address Russia’s meddling in the 2016 U.S. election with
financial sanctions specifically aimed at Vladimir Putin. Secondly the historical slow response or
approach to cyber-warfare made the U.S. vulnerable and gave America’s election institution a black eye.
There must be an emergency summit of world leaders to address cyber-warfare,create treaties,and
establish international and domestic laws.
It is imperative that the U.S. simultaneously addresses Russia and all countries with a significant
cyber warfare capability. The credibility of our institutions is what makes our democracy successful. The
President and Congress should establish the legal authority to allow the appropriate response to
cyberattacks that threaten America’s national security or interest that compliment Article 5 of the NATO
charter.

6. Pros
1. Further destabilizing Russia’s economy through sanctions should hinder their funding toward
cyber resources.
2. Immediate retaliation after a confirmed attack would send a clear message that there are
consequences for meddling with US democratic processes or illegally accessing networks with
intent to do harm.
Cons
1. This type of response may not be taken seriously enough. As we have seen with sanctions being
put on countries such as North Korea and Iran when dealing with more traditional threats,
sanctions don’t always incur an immediate stop or slow down to the issue. We assess that hurting
Moscow’s economy even further would have a long term effect but may not do anything to
disrupt attacks in the near future, or disrupt attacks against our allies.
2. Increased potential for a cyber weapons dilemma. By counterattacking Russian networks
(although the argument can be made that both parties involved are continuously attacking each
other and third party nations) there a dilemma will be created that will force increased spending
and dedication of resources.
Option 2. Forman international treaty and set the norms of mutually assured cyber-destruction
(MACD)
Similar to the article five of NATO,by which the parties agree that an attack against one or more
of them shall be considered an attack against them all, the US should seek to form new treaties that are
geared towards collective effort in countering cyber warfare. At the same time, the US should define and
declare the threshold at which it will retaliate without fail with equal or greater force if attacked with
cyber espionage. This could lock our adversaries into a Nash equilibrium in which they have no incentive
to initiate attacks given our advanced capabilities in retaliating in the cyberspace.
Pros
1. Treaties will facilitate cooperation and information sharing. Attackers were successfulin
launching their attacks because we did not have a good understanding of the techniques they
used. The more we know about our adversaries intentions and the techniques they use the more
successfulwe will be in fighting and deterring them. Collective work with other countries will
offer us the opportunity to collect more information and police the network for criminal activities.

7. 2. Countries like Russia use what is known as a neutral space,a third-party country, from which
they launch their attacks to obfuscate and hide the source of the attackers. Most of these neutral
space countries do not have laws that penalize cybercrime. Forming treaties with these countries
should include the enforcement of the criminalization of such activities. The more countries we
get to our side in this open warfare the less space we leave to Russia to use them.
3. We should not expect all countries to join treaties of such kind, nor we should accept countries
that will use these treaties to freeride our technological capabilities. For those countries that we
do not expect will join (like Russia!), we recommend setting forth a mutually assured cyber-
destruction norms similar to those we set during the cold war to deter Soviet Union from using its
nuclear weapons. If our adversaries are assured of our counter response, they will not have the
incentive to lunch further attacks. If they do, it will be easier for us to respond and justify our
action in the international community.
Cons
1. Treaties are costly. The US contributes between one-fifth and one-quarter of NATO's budget.
Cyber treaties will likely to be similar because,as in the NATO case,the US will most probably
be more advanced technologically than other parties. This gap of capabilities means that the US
would need to invest in the infrastructure of the less advanced parties to ensure they are able to
contribute efficiently in deterring cyber attacks. MACD is costly too because it will force all
countries to play by the rules of prisoner's dilemma. That means a costly arms race that is likely
to consume so much resources to engage in the R&D and the maintenance of cutting-edge IT
infrastructure.
2. Treaties currently in place are not mature enough and their effect is not yet proven. An effective
treaty should take two factors into account: 1) resolve the attribution issue — because attackers
uses disguise techniques, treaties should be clear on how to establish a signatory's responsibility.
For this to happen, there must be a clear definition of the terms and a team of independant IT
committee to investigate incidences and present periodic reports. 2) Treaties should take into
account the laws and legislations of the joining parties in regards to the cybercrime. The US
should only partner with the countries that have strict laws banning cyber espionage activities or
those willing to enforce them.
3. MACD does not suffer the issue of taking other countries’ legislations into account but the US
should still resolve the attribution issue. We can not launch attacks against suspected countries
based on weak evidence. This will be bad for two main reasons:1) Terrorist groups could use this
as a mean of provocation — Terrorist groups in country X could launch attacks on the US just to
provoke the US to launch a counterattack on the government of country X. This will empower the

8. terrorists and help them overthrow the government of country X. 2) Terrorist groups could also
use MACD based on weak evidence as a mean of attrition — if they are guaranteed we will
counterattack they are more likely to invest in developing their techniques and launch long-term
attacks.
Final Recommendation: Option 2
As discussed earlier, attribution is a key factor and a prerequisite for any successfulmajors we take to
fight cyber espionage. Once the identity of the attacker is defined, the US response should be swift and
proportional to the damage the attack caused. The US should not launch any attack based on weak
evidence of the identity of the actors. With that, a response by a group of nations will always be stronger
than that of a single nation. Creating a strong cyber alliance will allow for more impactful responses and
future deterrence. Despite some of the concerns and possible speed bumps that will come with setting up
such an alliance, the US should do everything in its power to establish this as soon as possible.
Separately, the US should invest more in protecting its infrastructure and enhance its cybersecurity. Up
until now the majority of our IT investment goes into updating the existing old systems. Stuart Scott,
U.S. Chief Information Officer,reported in 2016 that “The reality is that systems that are 25, 30, 40 years
old were never designed to defend against the kinds of cyber threats that we have today.” The US should
focus instead on replacing and renewing the IT system and build them from ground up based on the new
realities of cyber vulnerabilities.
Sources:
Assessing Russian Activitiesand Intentions in Recent US Elections (pp. 1-25, Rep.). (2017). Washington ,
DC: Office of the Director of National Intelligence (DNI).
GRIZZLY STEPPE – Russian Malicious Cyber Activity (pp. 1-13,Rep. No. JAR-16-20296A). (2016).
Washington, DC: Department of Homeland Security.
Harold, S. W. (2016, August 1). The U.S.-China Cyber Agreement: A Good First Step. Retrieved from
http://www.rand.org/blog/2016/08/the-us-china-cyber-agreement-a-good-first-step.html
Sanger, D. E. (2016, December 29). Obama Strikes Back at Russia for Election Hacking. Retrieved from
https://www.nytimes.com/2016/12/29/us/politics/russia-election-hacking-sanctions.html?_r=0
The Department of State. U.S. Collective Defense Arrangements.
https://www.state.gov/s/l/treaty/collectivedefense/

9. The Federal Bureau of Investigation NCCIC. Russian Malicious Cyber Activity (pp. 1-3). (December 29,
2016).
https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-
1229.pdf
The Federal Bureau of Investigation Countering the Cyber Threat. New U.S. Cyber Security Policy
Codifies Agency Roles (July 26, 2016).
https://www.fbi.gov/news/stories/new-us-cyber-security-policy-codifies-agency-role
The White House. Office of the Press Secretary. FACT SHEET:Cybersecurity National Action Plan
(February 09, 2016).
https://obamawhitehouse.archives.gov/the-press-office/2016/02/09/fact-sheet-cybersecurity-national-
action-plan
North Atlantic Treaty Organization. Funding NATO. (19 Jan. 2017)
http://www.nato.int/cps/en/natohq/topics_67655.htm
The Economist. Military spending by NATO members. Does America contribute more than its fair share?
(The Data Team). (Feb 16th 2017).
http://www.economist.com/blogs/graphicdetail/2017/02/daily-chart-11
U.S.News. Cyberwarfare a Viable Nonviolent Alternative to Military Strikes (Lawrence L. Muir Jr.).
(June 8, 2012).
https://www.usnews.com/debate-club/should-there-be-an-international-treaty-on-
cyberwarfare/cyberwarfare-a-viable-nonviolent-alternative-to-military-strikes
U.S.News. An International Cyberwar Treaty Is the Only Way to Stem the Threat (Bruce Schneier) (June
8, 2012).
https://www.usnews.com/debate-club/should-there-be-an-international-treaty-on-cyberwarfare/an-
international-cyberwar-treaty-is-the-only-way-to-stem-the-threat
NPR National Public Radio. U.S. Chief Information Officer Seeks to Upgrade Government's Computers.
(Brian Naylor). (October 31, 2016)
http://www.npr.org/about-npr/192827079/overview-and-history