“I don’t think that the prospects are very high for dealing with Russia unless and until the U.S. develops a strategy of some sorts for imposing adverse consequences on Russia that will drive it to take the strategic decision to control the ransomware from within its borders,” Paul Rosenzweig, Senior Fellow at the R Street Institute and former deputy assistant secretary for policy in the Department of Homeland Security, tells CSO.
Putin lacks motivation to change
President Putin has little motivation to change the status quo, according to Rosenzweig. “Ransomware in the United States is a three-for-one for Putin,” he says. “It disrupts America. That’s always a good thing. Two, it’s a training ground for his cyber militia, who are often part-time contractors when he needs them for state action stuff. And I’ve always had a personal suspicion, and this is speculation, that he and the oligarchs profit. They get a tithe for looking the other way.”
Painter said that during his time at the Justice Department and as Chair of the G8 High Tech Crime Group (when Russia was in the G8), Russia was not particularly cooperative when it came to cybercrime because the criminals were working at the behest of the state. “That does not seem to be the case here, or at least the White House is saying that does not seem to be the case here,” he says. “Or there was corruption, which I think persists. As long as they were attacking targets that were outside of Russia, Putin and the regime didn’t care about them and left them to their own devices.”
“If these ransomware groups are not acting on behalf of the Russian state, I think there’s an opportunity to uproot them and actually take action. Biden can certainly make these groups’ lives miserable if he wanted to, whether or not they get arrested.”
What options exist to push Putin to the table?
Aside from arresting the ransomware attackers, a near-impossibility given that Russia’s constitution forbids extraditing its citizens, the Biden administration does have some options to push Putin to the table. “The key is for America to find a way to change the incentive structure in its dealings with Russia,” Rosenzweig says. “We can go directly after the bad guys by destroying bitcoin wallets and stuff like that. But if we’re talking about Russia incentivization, the only answer that makes any sense is to find something that Russia has or wants or needs that we can hold at risk that compels them to stop.”
“You can imagine a number of tools we can use to either put pressure on Russia itself, like additional sanctions,” Painter says. But, “we haven’t really had a strategic application of sanctions or other tools that we have. They’ve been sort of happenstance.”