President Barack Obama says the U.S. will respond to the Russia’s interference in the 2016 campaign.
In an interview with NPR on Friday, Obama said, "I think there is no doubt that when any foreign government tries to impact the integrity of our elections ... we need to take action. And we will — at a time and place of our own choosing. Some of it may be explicit and publicized; some of it may not be.”
It is “important for us to do that in a thoughtful, methodical way,” Obama said Friday at his final press conference of the year.
“How we approach an appropriate response that increases costs for them for behavior like this in the future but does not create problems for us is something that's worth taking the time to think through and figure out. And that's exactly what we've done,” he told reporters.
As the White House considers its response to the Russian hacking of U.S. political organizations, what legal authorities guide and determine the options available?
“The first thing is to figure out what domestic law authority and international authority [we] are going to rely upon to respond,” Robert Eatinger, former senior deputy general counsel at the CIA, said. “We’ll have to characterize what this Russian hacking is — is it a criminal act under U.S. or international law, or is it some kind of attack, a national security threat?”
In October, the U.S. Intelligence Community, in coordination with the Department of Homeland Security, officially accused Russia of interfering with the U.S. election process. But on Thursday, the Obama administration took this further, suggesting that Russian President Vladimir Putin was personally involved in approving the hacking.
This comes on the heels of the Washington Post report last week that the CIA concluded, in a secret assessment, that Russia intervened not just to undermine confidence in the electoral process and democracy, but to actively help President-elect Donald Trump win. And on Friday, the Post reported FBI Director James Comey and Director of National Intelligence James Clapper support the CIA’s conclusion.
Legal authorities and limits
Experts told The Cipher Brief that a number of legal authorities are in place for the president to respond to Russia’s interference, although there is some uncertainty given that it occurred in cyberspace rather than more traditional battlespaces.
This particular incident “complicates the U.S. national security ability to respond in a defense mechanism because we are not defending a government information structure, nor are we defending critical infrastructure like a power plant or water dam,” Eatinger noted.
But the hacking of political organizations threatens “our own political independence,” he said. Typically, if it were done on behalf of the Russian intelligence community, it would be characterized as an intelligence activity — what the Russians dub active measures, or what the U.S. would call covert action. The U.S. responding in kind is just one option on the table to deal with Moscow, according to Matt Olsen, the former director of the National Counterterrorism Center.
“The administration should look at the full slate of responses, including economic sanctions, diplomatic action, law enforcement responses…all of those would be on the table. The options would include, but not be limited to, taking action in cyberspace itself,” Olsen told The Cipher Brief in October. “I think the administration is likely to consider some kind of financial sanctions under a new executive order that gives the Treasury Department the authority to freeze the assets of people tied to attacks like this.”
“I also think that criminal indictments can play a significant role in responding to these types of attacks, even though we may be unlikely to actually bring anyone from Russia to trial here,” he added.
Domestically, the president has a great deal of independent constitutional power to respond to foreign threats, while Congress has and can propose statutes that authorize the executive branch to take action on national security issues.
“There are lots of existing legal authorities,” David Fidler, adjunct senior fellow for cybersecurity at the Council on Foreign Relations, said. “The harder question, I think, is where on the scale of response does the president want to go? As you go up the scale, things get more complicated as a legal matter.”
Fidler said he believes military force would be unlikely for a number of reasons. There would be questions over congressional war powers, as well as broad debate concerning the use of military force to respond to incidents that don’t fall under the concept of armed conflict. Additionally, there are more limitations in Title 10 of the U.S. Code, which outlines the role of the armed forces in the U.S. and dictates the country’s commitment to the international law of armed conflict, than in Title 50 authorities, which tackle the intelligence agencies and covert action.
That makes the IC “the most likely and most realistic instrument” for the U.S. government, Fidler said.
Possible responses
Responding in a way that is short of using force — such as economic sanctions, diplomatic démarches, curtailing trade or putting tariffs on Russian goods, for instance — would be within what is allowed in domestic and international law.
“The tricky part there is, of course, the Russians will continue to deny having any role and see anything we’ve done to them as a hostile act,” Eatinger said. “We do risk getting into the back-and-forth with the Russians if we do respond.”
The potential for escalation may factor into the president’s decision to engage in overt activities, such as economic sanctions or traditional diplomatic operations, or favoring treating it as an intelligence matter. Viewing the Russian action as executed by intelligence services or those working on their behalf would allow the U.S. use of either counterintelligence or covert action authorities.
If the president wants the CIA to take an action, the agency must undertake a legal analysis to determine if that action is overt action, counterintelligence activity, or covert action. If the request is determined to be covert action, the lawyers will communicate back to the White House that a presidential finding — an executive directive similar to an executive order — is required to support taking secret, unpublicized action against a country. This is not needed for overt actions or counterintelligence activities.
Any action must comply with the Constitution and statutes of the U.S. A presidential finding also requires notifying the Senate Select Committee on Intelligence and House Permanent Select Committee on Intelligence – but Congress does not have the authority to approve or disapprove of the covert action. But, according to Eatinger, members can potentially prevent the activity by not allowing the executive branch to spend any money on it.
A benefit to covert activity would be that although Russia would likely figure out the U.S. was behind whatever action was taken, they wouldn’t “lose face in the world if they don’t respond,” added Eatinger.
“If it’s overt, Russia may feel forced to take an action back against the U.S.,” he noted.
Traditional counterintelligence activity does not require a presidential finding, unlike covert action. That’s due to the distinction between counterintelligence and covert action. With counterintelligence activities, the purpose is to counter the hostile intelligence activities of another country, while covert actions are meant to influence or change the policies of another country — not just counter the work of their intelligence services.
“They could decide to act, to take this as a counterintelligence activity and use traditional tools to disrupt the activity,” Eatinger said.
In this case, the hacking and interference in the U.S. election process has already happened, so the question would likely be whether it is necessary to do something to preclude Russia from using that same intelligence tool in the future.
A new context
The president certainly has ample authority to take action, but there are a number of uncertainties given that this happened in the cyber realm.
“What government agency has what responsibilities for cyber if the threat comes from overseas, but the impact is in the U.S. domestic realm? All of that right now is unsettled,” Eatinger said.
There are wildly different views among all the agencies over who has the authority to do what, he noted. “Everyone takes the most forward leaning approach to their own activities,” Eatinger said, and there is the hope that a consensus will emerge. “But at the end of the day, the Department of Justice has the final view on legal issues,” he added.
Meanwhile, in terms of international law, “this is also the type of incident that creates more questions than answers,” Fidler noted. One question is what international law did Russia violate here that would give the U.S., under international law, the authority to respond? Would it be a violation of the principle of non-intervention or sovereignty?
In terms of espionage, there is no international law against hacking and taking information, but then giving that information to various third parties that disclose it complicates the issue. It’s unlikely the non-intervention argument would hold, Fidler said, given that the principle is designed to stop a foreign government from coercing another to take an action it would otherwise not take. The Kremlin did not “try to twist the U.S. government’s arms — they just made the information available,” according to Fidler.
On the principle of sovereignty, there could be an argument there given that Russia was interfering with the election system. In international law, however, there is a very high standard to launch a retaliation against another country — the act must be attributed with evidence to another state, and the countermeasure must be proportionate and cannot be intended to punish the state that committed the initial wrongful act, according to Fidler.
“There has always been this tension between deterrence by punishment as a strategy and international law’s attempt to try to constrain this tit for tat,” Fidler said. “We’re seeing that here.”
Overall, this incident shows “how much in the cyber world has not been worked out,” Eatinger said.
“Do we respond with FBI, Homeland Security, with military, with intelligence? Do we use overt or covert action? Do we limit the diplomatic action or do something more severe and, if so, what rules apply?” he asked.
All of that is “left open here because the target that was attacked was not government property or critical infrastructure,” Eatinger said, and it was an attack on the political independence of the U.S. - but not an armed attack.
Responding to this problem is less a question of legal authority than strategy and tactics, according to Fidler.
“My goodness is this serious, and it’s so different that we look like we’re fumbling around in the dark because we don’t know how to respond,” Fidler said. “It’s not a lack of general legal authority, but the nature of the problem is such we need something that is more targeted.”
Although the Obama White House has indicated it would respond, there is nothing to force Trump to do so, especially with his repeated denials of Russian involvement in the hacks.
“There is nothing in constitutional or statutory law that would force a president to take action against a foreign government,” Fidler pointed out.
Mackenzie Weinger is a national security reporter at The Cipher Brief. Follow her on Twitter @mweinger.
