Biden-Putin summit – Will state-sponsored cyberattacks take a plunge?

• Talks to be complex after both sides disagreed about who was to blame for the growing problem of ransomware
• Biden gave Putin a list of 16 specific critical entities that should be considered “off-limits” from future cyberattacks
• Putin claimed he had been told by US sources that most cyberattacks originate from the US

When American presidents and Soviet/Russian leaders started holding summits 70 years ago, it was predominantly about one looming threat; the vast nuclear arsenals that the two nations started amassing since the 1940s. Last week’s summit, however, was for the first time dominated by talks on cyberattacks.  The meeting between US President Joe Biden and Russian President Vladimir V. Putin in Geneva was considered the most contentious one yet.

US intelligence officials have blamed hackers based in Russia for a range of notable cyberattacks including the one that had forced Colonial Pipeline to shut down its pipeline carrying gas to 45% of the East Coast’s gasoline, though Biden has asserted there’s no evidence the Kremlin was involved. The intelligence community has also claimed Russia attempted to interfere in the last two presidential elections.

The meeting on Wednesday was the first between the two leaders since Biden took office in January, and lasted for more than three hours. At a solo press conference following the summit, Biden stressed that he did not make threats during the meeting, and said he outlined US interests, including cybersecurity, and made clear to Putin that Washington would respond if Russia infringed on those concerns.

It will not be easy. If a decade of intensifying cyberconflict has taught anything, it is that the traditional tools of deterrence have largely failed. Experts are waiting to see how Russia will respond to US concerns about cyberattacks targeting its critical infrastructure. Some also say the summit could serve as a catalyst for new US laws, such as a national data breach reporting requirement and ransomware threat mitigation measures.

Cyberattacks and takeaways 

Biden gave Putin a list of 16 types of critical infrastructure that should be “off-limits” from cyberattacks, such as the energy and water sectors. Biden also pressed Putin to stop harboring Russian cybercriminals and hold them accountable for attacks overseas. 

That covers the recent ransomware attacks against Colonial Pipeline that disrupted US oil supplies and against the meat processor JBS, which threatened the US meat supply. US officials believe both those hacks were conducted by Russia-based criminals rather than the Russian government – but with at least the Kremlin’s tacit approval. Those 16 sectors also include telecommunications, information technology, and the defense industrial base. Those sectors are all common targets for espionage-focused hacking, which US officials have long insisted is perfectly appropriate. 

Putin on the other hand, during his own news conference on the same day claimed that the US and the West – not Russia – are responsible for the bulk of offenses in cyberspace while denying Moscow’s involvement in recent cyberattacks. Both presidents said US and Russian officials would have follow-up discussions in the area of cybersecurity.

“We agreed to task experts in both our countries to work on specific understandings about what’s off-limits [for hacking] and to follow up on specific cases that originate in either of our countries,” Biden said. Many experts at this point say Russia will stop only when the US launches its own aggressive cyberattacks against Russian targets — or makes abundantly clear it’s prepared to do so.  The US president made it clear multiple times during his post-summit press conference that he doesn’t expect a change in Russian behavior to be easy or automatic. 

To be fair, skepticism is warranted. Prior to Biden, Obama unsuccessfully tried both dialogue and retribution to get Putin to stand down in cyberspace. Trump largely appeased Russia and things got even worse. The odds are against Biden making major progress on this front and most believe there’s a near-zero possibility of Russian cyber aggression ceasing entirely.