David Sanger

… So one day in October, amazing things happen. What are they?

The afternoon of Oct. 7, I remember we were sitting in the newsroom of The New York Times Washington bureau. We got a heads-up that the long-awaited intelligence report was going to come out, or intelligence statement. 11Oct. 7, 2016: A government warning on "election security"View LinkAnd it did come out. It was not very lengthy, and it basically said that the United States government had concluded that not only was Russia responsible for the hack into the DNC and similar organizations, but that it also had to have been ordered at the highest levels of the Russian government. It didn’t say they had seen evidence, although they had. It didn’t say they were listening in on conversations that would take it directly to Putin, although they had. It said, “it had to have been ordered at the highest levels.”

We thought this was a pretty good news story. 22U.S. Says Russia Directed Hacks to Influence ElectionsThe New York Times | Oct. 7, 2016View LinkWe started figuring out how quickly we could get it up on the Web, ripping up Page 1. And along comes one even more wild, and that was, of course, the famous tape of Trump boasting about how he would deal with women when he was such a star, [how] he could get away with anything. That was such a wild story, for a while we wondered whether or not the intelligence report was even going to get on Page 1 of the paper editions of The New York Times. They both got on.

But in retrospect, there were a few interesting things about that intelligence report. First, it gave us no details. Second, it was incredibly late. We had reported in late July of 2016 that the CIA already had high confidence that Russia was behind the hack. 33Spy Agency Consensus Grows That Russia Hacked D.N.C.The New York Times | July 27, 2016View LinkIt took the Intelligence Community more than two months to be able to come up with a few sentences that essentially confirmed that story.

But, more importantly out of this, was who didn’t sign the statement. It was signed, as best as I can recall, by the director of national intelligence, the director of the CIA. But missing was Jim Comey, the FBI director.

Why?

Well, you’ll have to ask him. But from everything we were able to piece together later on, he had some objections to the idea of putting this out there and how it could affect future prosecutions. I would argue that overall, the Obama administration made a very major error consistently in this investigation, first by not having the FBI put some real energy into this between mid-2015, when they were first alerted that the DNC had been hacked into, and June of 2016. You had nine months during which an FBI special agent was trying to communicate with a young IT professional at the Democratic National Committee, who didn’t even believe that the guy on the other end of the phone was an FBI special agent. 44The Perfect Weapon: How Russian Cyberpower Invaded the U.S.The New York Times | Dec. 13, 2016View Link

At no point did anybody from the FBI walk out of their building, up the street, to DNC headquarters. I did that once as we were writing a reconstruction of this hack. It’s about a 12-minute walk if you stop at Starbucks to pick something up along the way. They never bothered.

Why? This is the big why, right?

People talk about conspiracy in Washington. I usually find the more reasonable answer is not recognizing what you're doing, and that’s what happened here. The FBI agent who was handed the DNC hack case had the DNC as one of 150 or 200 or however many cases he had of cyber intrusions. Watergate, the history of the DNC, the fact the election was coming—it just didn’t resonate with anybody in the FBI leadership, because they thought this was so familiar. The Russians had hacked into the ’08 election, both the Obama campaign and the McCain campaign. They had hacked into the 2012 election, both the Obama campaign and Mitt Romney’s campaign. They thought the Russians were just in for the kind of surveillance the Russians always do.

There was a failure of imagination, a failure to imagine that the Russians would take the information and use it the way they have taken information and used it in Ukraine, taken information and used it in Europe. They just couldn’t imagine it would happen on these shores.

The other day, the new director of national intelligence, Dan Coates, said that we were a little behind the curve in thinking about what the Russians would do with this information. Boy, was that an understatement.

It’s part of a pattern that the more we look into the Obama administration, what it did and what it didn’t do, what its assumptions were—“Hillary is going to win, so we’d better watch ourselves,” or whatever the justification is—the fact is, it looks like there's a whole pattern of behavior since midsummer, until the election, when the actions of the Obama administration do not seem to be determinedly: “Here we go. Let’s shut this down. Let’s push back. This is really significant.”

I don’t think that’s because many in the White House didn’t want to push back. We know that some people in the White House were actually arguing for some significant action. Toria Nuland over at the State Department was asking for significant action. Some within the White House team were looking for significant action. But President Obama was famously cautious, and was particularly cautious in this case, I think for three reasons. One of them was, I think they all assumed Hillary would win, and therefore this wouldn’t make such a difference. Secondly, President Obama didn’t want to appear to be being too political.

They were quite shocked when, in August, [CIA Director] John Brennan, [James] Comey, [Homeland Security Adviser] Lisa Monaco, all went up to Capitol Hill to try to get a joint statement condemning what the Russians were doing. 55The FRONTLINE Interview: John BrennanFRONTLINEView LinkThe Republican leadership wouldn’t sign on to it, because they said, “You're just doing this for political purposes in an effort to try to get some advantage in the vote.” So President Obama was very cautious about appearing to be making this statement on behalf of Hillary Clinton. It was no secret where his sympathies in the election lay.

Thirdly, they were convinced that they could deal with this kind of thing quietly. In September, when the president went to the Group of 20 meeting, Putin was there. He takes him aside. Depending on who you believe, he spoke to him toughly, very toughly, and outright threatened him. And the story gets better and better as time has gone on, right? But basically what he said to him was, “We know what you're doing, and you’d better stop.”

And Putin’s response?

Don’t know. We didn’t see a whole lot of abatement of activity. In fact, much of the attacks that you’ve seen on the physical election systems happened after that meeting. Now, you could ask yourself, what other options did President Obama have? You're not going to declare war with somebody because they're manipulating your election, at least in the modern age. But he did have some other things he could do. He could have destroyed computer servers that were involved in this. He could have stepped in to reveal information about Putin himself and his financial connections to the oligarchs. He had all kinds of cyber choices. And then he had all kinds of non-cyber tools—sanctions, things like that.

In the end, he didn’t want to do any of them until after the election. And after the election, he threw out 35 Russian diplomats and closed, at least temporarily, two Russian facilities that were used for, among other purposes, spying. It was the perfect 19th-century solution to a 21st-century attack. …

… Tell us a little bit about what the Russians were doing, besides hacking into emails and servers.

We only discovered the hacking into the emails and servers starting in June, and then more activity became evident. But it really wasn’t until the last weeks of the election, mid-October into early November, that we began to understand the scope of the hacking operation, that there were these bots, automated systems, that were going around, searching for and reproducing stories of dubious truth that might take hold with pro-Trump, or at least anti-Hillary, voters, and might, at a minimum, just keep some of those Hillary voters home.

The onslaught of the fake news was something that nobody fully understood where it came from. And frankly, because we live in a country in which First Amendment protections are so supreme, there is nothing illegal in stepping out and saying something completely wrong about a candidate.

… Let’s back up just a little bit and get on the record Trump’s response to the initial announcements, essentially where he says, “Let’s go find Hillary’s emails.” Tell me that story, and tell me what the meaning of it is in terms of what Putin might think. A: … So on the morning of July 27, I was back in the Washington bureau of the Times. We had just been out at the Republican convention. I interviewed then-candidate Trump the night before he accepted the nomination, partly on the subject of how he would deal with Russian aggression. That was one of the moments when he questioned whether or not the United States would come to the defense of NATO countries like Lithuania or Estonia if they had not paid up their dues to NATO, as he would say. I got a phone call from a colleague of mine, who was out on the campaign trail. She said, ‘David, you won't believe what Trump just said.” I said, “Come on, Trump’s always saying wild things.” She said, “He just stood here and invited the Russians to come in and hack into Hillary’s email accounts and find the 30,000 missing emails and publish them.”

This was truly remarkable. You had someone who was running for president of the United States, who had already received his party’s nomination, who was asking an adversary state, even in a joking way, to come into the United States, commit a felony, break into the computer systems of his opponent for president of the United States, the former secretary of state, and publish the result. This was pretty wild behavior. We had never seen anything like this in the course of a presidential campaign.

But it also told you how much Russia was on his mind. He didn’t say: “Hey, China, come in and hack.” “Hey, Iran, come in and hack into Hillary’s accounts.” “Hey, North Korea, since you did such a fine job on Sony, why don’t you come in and hack into Hillary’s accounts?” No, he specifically sought Russian help. What does that tell you?

Well, the first thing it tells you is that he seemed to recognize, somehow or another, that the Russians preferred him over Hillary Clinton. Now, that should not have been exactly rocket science. It was Hillary, in Putin’s mind, who had incited violence, brought protests out into the streets, when she called into question the validity of parliamentary elections in which Putin’s party had come out supreme.

But the idea, even in jest, of coming out and suggesting that a foreign state should come in and hack an opponent’s computers, well, that’s pretty wild.

And for Putin it’s almost like Trump then becomes a kind of force multiplier for what he’s trying to do, whether it’s winning or unwinning.

Well, that’s right. I think Trump was a force multiplier. I'm not sure it was winning. I'm not sure, at the end of this, we’ll ever find an example of collusion or conspiracy. We might, but there's no guarantee. But in some ways, you didn’t need one. Trump had been out there for more than 10 years, calling for better relations with Russia, and had questioned, in our interviews in the Times that Maggie Haberman and I did, whether or not those sanctions were just the stuff of making the Germans happy.

So he, in the end, has never really believed in the concept that Russia was the one who hacked into the systems, because if he did believe it, it would call into question, in his mind, the legitimacy of his own election, and he doesn’t want to go there.

Yeah. Did we get the fake news? No. Let’s go back to fake news. …

There's nothing new about fake news. Back in Stalin’s era, the Russians would try to plant fake news stories in newspapers in agricultural parts of the United States. They had no way of measuring their impact, but it wasn’t terribly expensive to take what they call active measures. In the Internet age, it’s become much, much easier for them. They can automate the selection of news stories that they consider to be helpful to their cause and undermining of someone else’s, and that’s exactly what they did.

They were able to turn out news stories, fake news stories, have them replicated on the Web, but, more importantly, have them targeted to particular audiences that were ready to go receive that news. And in the case of Twitter accounts or Facebook accounts, there were a lot of fake accounts, mostly Twitter, which appeared to be the accounts of somebody who might look like you in your community, and make there to be a higher chance that you're going to be persuaded by that message, and might even open your computer to the Russian malicious activity.

So that’s what trolls are? That’s what trolls and bots did?

What trolls do is follow [you] around and egg you on. What the bots do is the automatic replication of the information, so it can look as if many people are interested. There's a big crowd size when there may not be.

So a story like Hillary Clinton is sick, and guys are walking around with EpiPens ready to save her at any given moment, that’s a fake news story?

It was a fake news story in this case.

How did it work?

In that case, they took a news story that—I don’t know if they commissioned or just got written by somebody whose relationship to the truth was not terribly strong. They note some health issues that Hillary had in 2015, and then they make up this story out of whole cloth, and what happens after that? It gets replicated. So the only difference between 1947 and 2017 is that life is a lot easier for the Russians than it was for their Soviet brethren. In the old Soviet days, they had to take that story, translate it, place it into newspapers in different places around the world, buy off different people. Here you can just send it around on the Internet in a moment.

So was it effective?

One of the very difficult questions is understanding how effective the information operations part of the influence operation was. You can measure changed votes. And in this case, we have not seen much evidence so far that the Russians changed a significant number of actual votes in the voting booth. You can't measure whether or not a negative story about Hillary Clinton—and there were many others that were not fake news—made somebody say: “Oh, I'm not going out to vote today. I'm just going to stay home.”

That’s how it works.

Yes. The best propaganda plays to an existing rift in the society and a willingness of people on both sides of that risk to assume the worst of their enemy.

Do you know enough about what happened in Ukraine and Estonia and all of the various places that feel like they were kind of road tests of hybrid war—?

… There's a funny expression that when Columbus discovered America, it was only new to Columbus; it wasn’t new to the Native Americans. Well, that’s a little bit about what the kind of information operations, active measures, hybrid war you’ve seen is with the Russians. There's nothing new here to Estonia, which saw the Russians close down their banking systems in 2007. Nothing new to Georgia, which saw all kinds of cyberactivity along with military activity by the Russians in 2008. Nothing new to Europeans and others who have seen many of these same techniques.

The only thing that was new here was that the Russians had worked up the nerve to go do it to us. So why is that? Well, cyber is a unique weapon. It’s a short-of-war weapon. You can dial it up and dial it down. You don’t necessarily need to have a big infrastructure. You build an atomic bomb, you need a plutonium reprocessing plant. You need a uranium enrichment plant. You need a way to build delivery vehicles. You need to know a lot about warheads. You need to machine them finely. You need thousands of people.

To do a cyberattack, you need a couple of really good computer geeks in a room, anywhere, with a good Internet connection. The thought that we had, that the Russians would somehow stop short of coming to the United States and mucking with its election, you ask now, why did we think it would be any different? What made us immune in a way the Europeans wouldn’t be?

Then you add to that the caution that President Obama had shown in previous attacks, including Russian attacks. The Russians, before they went into the U.S. election, did a whole bunch of other things. They went into the Ukraine and turned off the power in Christmastime in 2015. They went back to Ukraine with a more sophisticated piece of software and turned off the power again in parts of Kiev in 2016. They took all kinds of steps to back Donald Trump or spread false news about Hillary Clinton. But they did this subtly.

… They did exactly what they did in Ukraine, which is the petri dish for Russian cybertechniques that they want to test out before they take it on the real battlefield. They had all kinds of ways that they could have made sure that they got into our election discourse. Did they influence it in the end? We’ll probably never know. You’d have to crawl into the mind of everybody who had access to that kind of filming.

But there’s no doubt they did it, no doubt in your mind they did it?

Based on the evidence I have seen and heard about, I have no doubt that the Russians were in the system. I do have doubts about how effective they were inside that system.

The thing they did that was different is weaponized the information. They used it. They went to Wiki. They went to DCLeaks. A lot of people tell us that, for example, the Toria Nuland phone call in Ukraine, that the new thing was not that they had wiretapped her but that they had decided to use it, play it in that information war scenario, they weaponized it, and that it wasn’t surprising that they were doing information gathering in the United States elections; it was that they had decided to roll it out. 66The FRONTLINE Interview: Victoria NulandFRONTLINEView Link

The turn here came in July of 2016. Until that time, U.S. intelligence had assumed that the Russians would simply gather what they could, read it, use it for their intelligence purposes. What took everybody by surprise was the decision by the Russians, mostly by the GRU, the military intelligence unit, to go out and make some of these emails public, first through a site called Guccifer 2.0, then through something called DCLeaks. We think these channeled straight back to the Russian intelligence services. And then, when they couldn’t get enough pickup from that, they actually handed documents to WikiLeaks. Those documents included, of course, John Podesta’s emails. They were making use of a low-investment attack quite brilliantly.

… When Trump wins, what do we know about whether this is viewed as a success by Putin and others in Russia?

We believe that Putin and others were in a pretty celebratory mode when Donald Trump won the presidency. That isn't to say that they thought they would get everything out of him, but clearly they had come upon a result that nobody had really expected, and they had paid no price for it—almost no price whatsoever. They had not had sanctions against them. The president had threatened President Putin, but President Putin’s a big boy; he can take it. They had done nothing through Election Day other than private warnings to the Russians to cut it out, that would have, in this case, perhaps sounded the alarm a bit earlier.

So it cost them nothing.

It costs the Russians virtually nothing. And you know what? The Russians didn’t pay a price for going into the White House unclassified system, for going into the State Department unclassified system, for going into the Joint Chiefs of Staff unclassified system. Why not? Because our view was, this is spying, and everybody does it. We do it to them; they do it to us. This week they're the ones who got caught; next week it might be us who gets caught. That kept people from backing up and saying, “Whoa, this isn't about Russia versus the United States; this is about the sanctity of our democracy, a specific voting booth.”

… Were you surprised that nothing was happening, that there was no smoke signals that said, “Hey, we’re pushing back”?

I was writing stories along the way, news analyses that described the Obama administration’s options. Some of them were non-cyber responses. They could do a dèmarche, complain to the Russians, as the President [Obama] did to President Putin. They could issue economic sanctions. They could issue travel restrictions. They could throw old Soviet spies out of the country. There was a range of things they could have done. In the end, they did very few of them.

And now with hindsight, we understand a little bit why: Obama himself did not want to seem to be lowering himself into this question, even though he knew all of the players involved. I think it was a case of overcaution.

… There's of course the risk-reduction ping, whatever it was. Is it a phone? What is it, the risk-reduction device? It must be an Internet signal we sent to them.

The president did send a second message. The president did send a second message just before Election Day. He used an unusual channel for it, not the hotline to Moscow that you hear about in the movies and so forth, but there is a channel, a risk-reduction channel that’s supposed to be manned at both sides, usually to send Defense Department to Defense Department messages, to make sure you don’t have unintended conflicts in the skies or in the seas. In this particular case, they actually used it to send a message about cyber and for the Russians to know it’s time that they got out of this.

And what happened?

Nothing.

Nothing?

Nothing. The Russians get a letter. Russians get lots of letters. This was an effort to do the minimum possible, to have a credible election, which they thought Hillary Clinton would win. Instead, it blew up a bit on them.

By the way, the Clinton campaign is haranguing these guys, [right]? “Do it, do it. Do something.”

During this time, a lot of people in the Clinton campaign are calling over to their old friends in the White House and saying, "Look at this evidence." The FBI has concluded, as the Times had reported by that time, that the Russians were behind the DNC hack. You’ve got a presidential candidate who is calling on the Russians to hack into his opponent’s computer system and find missing emails. "Do something about this."

And the answer they got back from the White House was: "First, we need to follow legal procedures. You shouldn’t be pressuring me on this kind of thing. Second, the president is being very cautious. While he’ll deal with the Russians, he’ll probably deal with them after the election."

You mentioned the sanctions. The sanctions are proposed by the president, or enacted by the president. Bring me to [Michael] Flynn and his telephone call.

After the election is over, President Obama issued fairly mild sanctions on individuals and entities; PNG'ed [persona non grata’d], threw out of the country 35 Russian diplomats; temporarily closed two Russian summer houses, houses that they thought were being used for intelligence purposes. It’s not, as Donald Trump later said, that Obama did nothing. The question is, did he do something way too late? He’s never admitted to that. But then again, he’s never admitted that the United States uses cyberweapons.

So the Russians are dealt these sanctions. A lot of people hold their breath and say: “All right. Now Putin has to respond. Putin will respond.” But he doesn’t respond.

Putin didn’t respond. He took it very cool. He could have stood up and said: “You're going to close two buildings? I'm going to close two buildings. You're going to throw out 35 diplomats? I'm going to throw out 40.” He didn’t do that. And we wonder now whether he may have been urged in that still-mysterious phone call between Ambassador [Sergey] Kislyak, the Russian ambassador to the United States, and Lt. Gen. Flynn, who was the incoming national security adviser, whether they had reached some kind of an agreement that the Russians would not respond and the Trump administration would deal with this when they got to office.

We know this because the telephone call was recorded.

We know this because Sergey Kislyak, the Russian ambassador to the United States, couldn’t go to the men’s room without somebody somewhere having recorded his every move.

… What do you make of a banker meeting with young [Jared] Kushner, the son-in-law of the president, even now, a lawyer with some affiliation to the Kremlin, even now we know, but during the campaign, meeting with the president’s son? What is that about?

There's nothing illegal about foreign actors, adversaries or allies alike talking to two campaigns, talking to the candidates, embracing the incoming president. Nothing illegal, nothing immoral, except if you're using that to try to say to the Russians: “Don’t worry about all those sanctions that Barack Obama put on you. We’ll undo them as soon as we get to office,” to try to portray a very friendly incoming administration.

We don’t know whether the Russians sensed this and were playing on this or whether they gave somebody some reason to go do this. What we do know is that Gen. Flynn incorrectly characterized that conversation later on to Vice President Mike Pence, and that led to his downfall.

He lied.

… We haven't seen exactly what Flynn said to Pence, but we do know that once he said it, it so alarmed the acting attorney general, Sally Yates, that she went to the White House basically with a transcript of conversations, and [said]: “This is a really big problem. You’ve got a problem down the hall with your national security adviser, and I don’t understand how he can stay on.” And of course he didn’t.

When she does it, is it the first? It’s in line with other moments where the incoming president is informed of the role of Russia in the hacking and the rest of it. The DNI and three others appear at the Trump Tower. They have a session with the incoming president.

President Obama ordered up a fairly rapid full assessment of what the Russians did. Why he waited until after the election is one of those things lost to memory. There are a lot of people now who defended to me, inside the White House, Mr. Obama’s conservative nature to this, who now that they’ve been out for a while and nursed the wounds of Election Day, are saying: “You know, we never really imagined that it would come to what it came to. We had a failure of imagination.”

So see, I've lost track of that.

The DNI and the other three, Comey and Brennan, they go to the Trump Tower.

One day in January, once this report is written, they have three different versions of it. 77Putin Ordered ‘Influence Campaign’ Aimed at U.S. Election, Report SaysThe New York Times | Jan. 6, 2017View LinkThey’ve got a public version, which doesn’t tell us very much, a little more specific about Putin. They’ve got a classified version for members of Congress and all that, but they knew those details would leak. … And they had a very short, compartmentalized section of the report, only available to the president, the vice president, president-elect, the vice president-elect, a few others, that was supposed to explain exactly why they believed that the Russians had hacked. It had the sources and methods in it.

President [-elect] Trump, at the end of that briefing, turned out the only strong statement he ever made, saying that he believes now that Russia was central to the hacking. 88Donald Trump Concedes Russia's Interference in the ElectionThe New York Times | Jan. 11, 2017View LinkHe’s backed away from that since.

They are at Trump Tower, these guys, right? They go in. Comey hangs around afterward.

Comey hangs around afterward to take the president[-elect] aside and show him the dossier. 99Trump Received Unsubstantiated Report That Russia Had Damaging Information About HimThe New York Times | Jan. 10, 2017View LinkThis is the one written by a former British special agent by the name of [Christopher] Steele, who had been hired by a team here in Washington to basically gather opposition research and things like that. … So it turns out he’s the one who produces this detailed report full of unverified claims about what Trump’s relationships in Russia were all about, what his trip to Russia during the Miss Universe Pageant was all about. We had seen this report as early as September, but we couldn’t confirm any of the details in it. One of the first rules of journalism is, you don’t just run with something because you have a document; you’ve got to figure out if it’s for real.

Did you have the document?

We had the document. There were many versions of the document, but we definitely had the document.

And?

Lots of interesting stuff. Very little we could prove. Some we could disprove.

So by the time Comey is talking to him about it, has Comey proved things?

By the time Comey talks to President-elect Trump at that moment, he is doing so, he says, to warn the president that this is out there, that there are people really looking for him, trying to get him, and he should be aware. Now, he read that very differently. He read it as a threat. And of course, ultimately he fired Comey.

… One of the things that we’ve noticed is, if you watch Trump’s press conference after the DNI and those guys come and visit him, I mean, you talk about a tepid acknowledgement. You said it was the only real acknowledgement. But jeez, this is—

When the briefing was over that day in New York, I remember it clearly, because I was up in New York that day and reporting on it. The president came as close as he’s ever come to acknowledging the Russians were just it. But he did so so grudgingly. It should have surprised no one that as soon as everybody went home or back to their corners, he was out again, making the case that there was no way to know whether the Russians were the ones.

… Have you heard or talked to people who know what his [Trump’s] opinion of Putin is?

I have.

And?

Putin made the case to him during the talks they had in Hamburg in the G-20 that if Russia was going to come in and hack American systems, they would have just done it and never gotten caught. Mr. Trump has said to many aides and many others, starting almost immediately after the meetings with Putin ended, that he found this a very convincing argument. Well, it’s convincing only if your purpose of your cyberattack is surveillance; you don’t want to get caught. But if your purpose is actually to take the data and publish it and put it in the mainstream, and try to get people to read it, and try to get them to think differently about your opponent, well, under those circumstances, your chances of getting caught are very, very high. And the president just has not differentiated the two approaches.

What is, when you think about Putin’s motivation, what do you think it was?

I think Putin has come to the conclusion that we meddled in his election when Hillary Clinton was secretary of state; that had caused him a huge amount of trouble; that we’re kind of holier-than-thou about our election system and our democratic institutions and so forth; and that he basically is going to undercut all of that.

…Tell me the story of what happened in Hamburg.

The day before the president arrives in Hamburg for the G-20, he gives a speech, a pretty good speech, in Warsaw. He talks about Western values and the unity of that. But it’s in opposition to radical Islamic extremism. It’s, in the old days, in the Cold War days, that would have been the perfect speech about Western values to give in contrast to Russia. In the course of those conversations, while he is traveling and not yet at the G20, he says something that I think was really interesting. He says that he is, once again, questioning whether or not it was solely the Russians who broke into the system. It could have been anybody, he says, the usual way of fuzzying it up.

But the result is that when he finally got to the G-20, and he finally sat down with Putin, he had lost some leverage, because he couldn’t lecture Putin about not repeating activities that he himself has doubted even happened. …

… Help us a little bit with beyond the hacking, beyond the release, beyond the disinformation, there's also the fact that, by the fall of 2016, the FBI is finding that Russia has penetrated at least 21 state election networks. At this point, it seems that the White House takes a special interest because of the ramifications. Talk a little bit about that part of the story, why it’s important to understand and what's you take from it.

… One of the reasons Barack Obama was hesitant to penalize the Russians before the Nov. 8 election was he was afraid that the Russians themselves could escalate, that they could come back on Election Day and actually begin to manipulate votes or, more importantly, manipulate the outward-facing voter registration rolls, so that you might go up to the polling place, and they say, “Sorry, you voted half an hour ago,” or “Sorry, you're not on our list,” or “Sorry, we think you moved,” or something like that, something that would invalidate votes.

So Obama proceeded very carefully. We put a lot of effort into trying to figure out how vulnerable the American election system was. I went up to see Jeh Johnson, who, before Oct. 7, though he was the secretary of homeland security, he couldn’t utter the word that Russia was involved in the hack, not until they had all agreed on this in the Intelligence Community.

As a result, he couldn’t actually muster people to go do what they needed to do to lock down their election systems. And of course the election system had not been declared critical infrastructure in the United States. The Washington Monument is; the telephone network is; the electric grid is; movie studios are on the list. But the fundamental underpinnings of our democracy, the election system, [is] not critical infrastructure, and many states didn’t want it to be declared as such, because they were afraid that if they did, the federal government would come in and boss them around about how they had to run it.

But this lights a fire under Obama in a way that the more general hacking doesn’t seem to.

The fear of voter manipulation certainly lit a fire under President Obama, and they deployed to make sure that the election would be trouble-free. They ran simulations of an attack, not only a cyberattack on the booths themselves or on the collection system of votes, but on streetlights and traffic lights and anything else that the Russians might be able to do to mess up the turnout in some way. Now, all of that turned out to be overkill. It wasn’t really the big event.

Just thinking about what you're saying, have you found a battle going on between the Intelligence Community and the White House? I mean, certainly Clapper was raising red flags in 2015. Brennan became very involved in the summer of 2016 and was pretty irate, I think, about the fact that nothing was being done. Was there angst between intelligence and Obama that you found? What was the debate?

The Intelligence Community is not there to prescribe policy; they're there to provide facts. But Brennan was certainly of the view that the administration had not woken up to the enormity of what the Russians were doing, and I think that’s fundamentally right. This is a very common problem when an attack is a cyberattack rather than a physical attack. We’ve organized our government the way we’ve organized our brains, which is to say, here is the responsibility of agencies that take care of things within the local United States. Here are agencies that take care of things abroad. Here are countries. Here are boundaries. Here’s a new set of technologies. We were wholly unprepared for a widespread, very well-thought-out, methodical attack on the actual infrastructure of the election. That will remain a vulnerability for a number of years to come.

The thing that keeps suggesting itself to us is, so a lot of people may say, even now: “We don’t have to worry about this. So it’s an election thing. Maybe it will be in ’18; maybe it will be in ’20.” But what should really worry us about cyber and what the Russians might be able to do? … And if Ukraine and Estonia were a road test once upon a time, and if you have a president who doesn’t think Russia is going to do anything like this or ever did it before, is this the other shoe that’s waiting to drop that people should be worried about?

Let me answer your Ukraine question better than I did before then.

Ukraine, more than any other country, is the petri dish in which the Russians conduct their experiments in cyber operations. It’s where they work on manipulating elections. It’s where in Christmastime of 2015, they came up with an ingenious way of turning off the power to a quarter of a million people. It’s where, in 2016, in Kiev, they came up with a way to do another attack on the power grids, smaller but far more sophisticated. And most recently, Ukraine is a place where they figured out how to use a weapon that was a vulnerability in computer systems, that was stolen from the NSA and maybe by the Russians—we don’t know who stole it initially—and refashioned it in a way to cause chaos in retail stores and any other place that uses a computer within Ukraine.

So what happened here in the United States? We couldn’t get our heads around the thought that the Russians would use those same techniques against us. We thought, we’re the big, great superpower. And we are. But no one’s going to go to war over the manipulation of some votes or some fake news stories, and the Russians knew it. Cyber power is something you can dial up and you can dial back down. It’s like the thermostat in your house. And the Russians figured out just how far they could go without provoking a reaction from us. And by and large, that’s been pretty successful.

And the threat?

Everyone walks around and talks about a cyber Pearl Harbor, you know, the attack that takes out all the lights from Boston to Washington, or San Francisco to L.A. That’s a risk and something you certainly want to go defend against. And the utility companies are getting better and better at doing that. But if there's a lesson from the election hack, it’s that we may have been focused on the wrong thing. We’re thinking of cyber 9/11s because it’s easy to imagine the lights going out. It’s easy to imagine the cell phone system going down. Harder to imagine? Very subtle attacks on people’s perceptions prior to the time that they go in and pull that lever in the voting machine.

In other words, the Russia hack was a sign of the future. It was a sign that the Russians aren't simply gathering together cyber power to use in wartime. Certainly they're reserving some of that there. They are using it to extend their regional influence. It is the equivalent, the equivalent of putting “little green men,” ununiformed militia officers, in Ukraine. It’s the world you don’t really see. …

Do we have an offensive cyber capability to strike back? And why is he so reluctant to use it?

Starting in the Bush administration, and certainly in Barack Obama’s time, the United States developed one of the most powerful offensive capabilities in cyber that any nation has ever had. We pulled off Olympic Games. The cyber strike against Iran’s nuclear centrifusions. We attacked North Korea’s missile systems, not entirely successfully, but we did it. We attacked ISIS with cyber weapons. So the United States has all kinds of cyber options.

… But we had no real concept, and still don’t, about how you control the escalation of a cyber conflict once one begins. And that’s what worried Mr. Obama. He was concerned that, if he had struck back in a cyber way against the Russians, if he had gone into the central bank and exposed relationships between the oligarchs and Putin, if he had done something to the Russians similar to what they were doing to us, all it would do is get us on an escalation in that ladder, one that we might regret on Election Day if the Russians mucked around.

So you can have the world’s best weapon, but using it has its consequences. And he was highly aware of that.

…Did Obama have some problem here exercising strength in response to a bully?

Most cyber operations are short-of-war operations; that is to say, they're doing something that is more akin to vandalism or more akin to election manipulation or more akin to surveillance, or that threaten but don’t really do harm to your electrical grid. The question is, how do you respond to that? Do you go kinetic and say, “If you mess with my election system, I'm bombing your cities”? Not likely. Do you do another cyberattack? Well, you could. The president was given many options to do that in 2016 against the Russians. But when he asks the question, “OK, so we do this, and we feel really good about it for about 30 minutes,” what do they do in response? And how do you maintain escalation dominance? How do you make sure this doesn’t spin out of control? And the answer was, we don’t have an answer for you, Mr. President.