Validity of Russia Hack Claims, U.S. Retaliation Focus of Senate Hearing

A Senate Armed Services Committee hearing Thursday focused almost as much on validating the U.S. intelligence community's assessment that Russia masterminded the hacking of U.S. entities' IT systems aimed at affecting the outcome of the 2016 presidential election as it did on how to counter the cyberthreat posed by Russia and other foreign state actors. The hearing came amid renewed criticism and doubt from President-elect Donald Trump about intelligence agencies' assessment that Russia provided WikiLeaks with hacked emails from officials at the Democratic National Committee and the campaign of Democratic presidential nominee Hillary Clinton (see 1701040066). The hearing had been expected to focus primarily on the Russia-led hacks (see 1612300032), though committee members and intelligence officials also highlighted the threat posed by China, Iran and North Korea.

Chairman John McCain, R-Ariz., and other committee members said that an investigation into Russia's involvement in the election-related hacks isn't aimed at delegitimizing Trump's election win. Russia's hacks are still an “unprecedented attack on our democracy” that “every American should be alarmed” about, McCain said. Sen. Tim Kaine, D-Va., Clinton's running mate in the election, compared Congress' need to investigate Russia's hacks to the body's 1973-1974 investigation into the Watergate scandal. That investigation “was a high moment for Congress” because lawmakers “in a bipartisan way stood for the principle that you couldn’t undertake efforts to influence an American presidential election and have there be no consequence,” Kaine said. The Watergate investigation focused on the break-in at Democratic party headquarters financed by the President Richard Nixon's Committee to Re-elect the President.

McCain and other lawmakers defended intelligence agencies' findings that Russia was behind the election-related hacks and sought to discredit WikiLeaks founder Julian Assange. Trump referenced Assange's recent assertions that Russia wasn't the source of Democratic officials' emails gleaned from the network breaches that WikiLeaks published. McCain asked Director of National Intelligence James Clapper and others whether they think there's “any credibility we should attach” to Assange's statement. NSA Director Michael Rogers and Clapper said no. No Senate Armed Services members questioned the validity of the intelligence agencies' findings, though Sen. Tom Cotton, R-Ark., said the conventional wisdom that Russian President Vladimir Putin sought the hacks in a bid to aid Trump might be wrong.

Trump's “trashing” of the intelligence agencies' assessment likely benefits U.S. adversaries like Russia, Iran, North Korea and the Islamic State group, said Sen. Claire McCaskill, D-Mo. Clapper said being skeptical of intelligence agencies' reports differs significantly from “disparagement” of the U.S. intelligence community. Clapper said he and other officials are ready for a Friday briefing with Trump on their assessment of Russia's involvement in the hacks. Intelligence officials were to hold a confidential briefing Thursday with the Senate Foreign Relations Committee on President Barack Obama's response to Russia's hacks. The actions the White House announced last week included sanctions against Russian intelligence agencies and officials (see 1612290040).

Clapper confirmed that an unclassified version of intelligence agencies' joint report on Russia's hacks will go public early next week. He and others demurred Thursday from disclosing new information on the hacks before the report's publication. Intelligence officials briefed Obama on a classified version of the report Thursday and will provide the classified report to Trump during the Friday briefing. Clapper said he will “push the envelope” in ensuring as many details as possible will be included in the report's declassified version, though “there are some fragile and sensitive sources and methods” involved in the investigation. The report indicates the1 intelligence community's “assessment now is even more resolute” that Russia masterminded the hacks, Clapper said. The document also will “ascribe a motivation” for Russia's decision to influence the election's outcome, he said.

Sen. Lindsey Graham, R-S.C., criticized Obama for taking retaliatory actions against Russia that were the equivalent of throwing “pebbles.” The U.S. should “be ready to throw rocks” in response to cyber incidents of the magnitude of Russia's hacks, Graham said. McCain blasted the Obama administration's overall policy on retaliation for cyberattacks, saying the White House didn't implement a clear response standard, which caused the U.S. at times to become a “bystander” on the world stage.

Sen. Dan Sullivan, R-Alaska, questioned whether the U.S. should rethink its response to state-sponsored cyber incidents given what he believes was an insufficient response against China over the 2015 Office of Personnel Management data breach. “Nobody seems intimidated by us,” he said: “We're showing it will not be costly” for governments to engage in cyberattacks against the U.S." Clapper said the U.S. considered the OPM breach an act of cyber espionage, and the U.S. and its allies engage in similar practices. “People in glass houses need to think about throwing rocks,” he said.

McCain and Senate Armed Services ranking member Jack Reed, D-R.I., called for the Senate to form a select committee with consolidated jurisdiction over cybersecurity issues. Senate Majority Leader Mitch McConnell, R-Ky., remains opposed to forming such a committee despite recent calls by McCain and other lawmakers (see 1612190061 and 1612200044), an industry lobbyist told us.

McCain questioned whether Congress is “just as stovepiped as the executive branch” on cybersecurity policy given that jurisdiction over cyber issues falls among multiple committees. Congressional committees' overlapping oversight on cybersecurity issues “actually reinforces problems rather than helping to resolve them,” McCain said. The issues posed by the Russia hacks and other state-sponsored cyber threats “spill across the jurisdictional divides” between committees that currently have cybersecurity oversight, Reed said.