The Trump administration has publicly and privately signaled that it does not believe Russia poses a cyber threat to national security or critical infrastructure of the United States, marking a radical departure from long-standing intelligence assessments, according to The Guardian.
This policy change could make the US vulnerable to Russian hacker attacks, experts have warned, and seems to reflect the warming relations between Donald Trump and Vladimir Putin.
Two recent episodes indicate that the US no longer characterizes Russia as a cyber security threat.
Russia, removed from the blacklist
Liesyl Franz, deputy assistant secretary for international cyber security at the State Department, stated in a speech last week to a United Nations cyber security working group that the US is concerned about threats posed by some states, but only named China and Iran, without mentioning Russia in her remarks.
Additionally, Franz did not mention the Russia-based ransomware group LockBit, which the US had previously stated is the most prolific ransomware group in the world and has been mentioned in UN forums in the past. The Treasury Department announced last year that LockBit operates on a ransomware-as-a-service model, where the group licenses its ransomware software to criminals in exchange for a portion of the ransom payments.
In contrast to Franz's statement, representatives of US allies in the European Union and the United Kingdom have focused their remarks on the threat posed by Moscow, with the UK emphasizing that Russia has used offensive and malicious cyber attacks against Ukraine alongside its illegal invasion.
"It is incomprehensible to speak about cyber threats and not mention Russia, and it is illusory to believe that this will turn Russia and the FSB (Russian security agency) into our friends," said James Lewis, a veteran cyber expert and former member of the Center for Strategic and International Studies think tank in Washington. "They hate the US and are still upset that they lost the Cold War. Pretending otherwise will not change that."
Change also behind closed doors
A recent memo from the Cybersecurity and Infrastructure Security Agency (CISA) set new priorities for the agency, which is part of the Department of Homeland Security and monitors cyber threats to US critical infrastructure. The new directive establishes priorities that include China and protecting local systems. It did not mention Russia.
A source familiar with the matter, who spoke to The Guardian on condition of anonymity, said that agency analysts were verbally instructed not to track or report on Russian threats, even though this was previously a primary focus for the agency.
According to the source, work related to Russia has been "cancelled."
"Russia and China are our biggest adversaries. With all the cuts being made at various agencies, a lot of cybersecurity staff members have been laid off. Our systems will not be protected, and our adversaries know this," the source said.
"People say Russia is winning. Putin is inside now," she added.
The New York Times reported that the Trump administration also reassigned officials from CISA who were focused on protecting elections against cyber attacks and other attempts to disrupt the vote.
The US has long warned that Russia poses a cyber threat to American infrastructure, including in last year's annual threat assessment published by US intelligence agencies.
The report stated that Russia poses a "sustained global cyber threat," even though it prioritizes cyber operations against Ukraine. Moscow "views cyber disruptions as a foreign policy lever to shape decisions of other countries and continuously refines and uses its espionage, influence, and attack capabilities against a variety of targets." Russia has managed to target critical infrastructure, industrial control systems, in the US and in allied and partner countries, the report concludes.