Russian cybercriminals are thought to be behind a pair of recent cyberattacks targeting the Colonial Pipeline and meat-processing company JBS Holdings. Both companies paid multi-million dollar ransoms to reacquire access to their systems.
Biden told reporters Wednesday he handed President Vladimir Putin a list of 16 critical infrastructure entities that are "off limits" to a Russian cyberattack: "I talked about the proposition that certain critical infrastructure should be off limits to attack — period — by cyber or any other means. I gave them a list, if I’m not mistaken — I don't have it in front of me — 16 specific entities; 16 defined as critical infrastructure under U.S. policy, from the energy sector to our water systems."
Biden's "off-limits" list has led specialists and members of Congress to question whether everything not on the list is hence fair game for attacks.
"As soon as you draw red circles around things you don't want Russia to attack, you're both telling Russia what is most valuable to you and that they can attack anything else without serious consequence," Rebecca Heinrichs, a senior fellow at the Hudson Institute, announced.
"It could actually entice Russia to increase attacks against all the other entities besides those 16 things. We should be complicating Russia’s calculations not making them simpler and certainly not essentially green-lighting any kinds of attacks," Heinrichs continued.
"I'm very circumspect about Biden’s actions in this summit because we're supposed to impose costs when cyberattacks occur and when they meet a level of attribution to a state," explained Kara Frederick, a research fellow in technology policy at the Heritage Foundation.
"Most cyber criminals in Russia operate with tacit state approval," Frederick stressed. "Instead of painting a target on 16 of these things, we should be disrupting their networks," she continued.
Those objections were repeated by a long list of Republicans on Capitol Hill, whose responses to Biden's list ranged from skepticism to outrage.
Sen. Ron Johnson, R-Wis., said on Thursday that it appears Biden "has drawn red lines with Putin that he now must enforce" and said the president's "demand" for Russia to "cease cyberattacks on only 16 economic sectors was truly bizarre."
"Together with deciding not to impose sanctions to halt the completion of the Nord Stream 2 pipeline, his limited demand on cyberattacks signals weakness that our adversaries will notice and take advantage of," said Johnson, who sits on the Senate Homeland Security and Governmental Affairs Committee.