The Big Message in the Iranian Cyber Indictments: Deterrence

Indictments and sanctions the Justice and Treasury departments handed down against an Iranian business and a handful of hackers Friday were about more than just meting out punishment, Deputy Attorney General Rod Rosenstein stressed repeatedly.

Rosenstein’s big message: These sanctions and indictments will deter future cyber theft by Iran and other countries.

“Our work on this case is critically important because it will disrupt the criminal operations of the Mabna Institute and deter similar crimes by others,” Rosenstein said, referencing the Iranian organization that U.S. officials say orchestrated $3.4 billion in cyber thefts from 144 U.S. universities and 176 foreign universities, among other victims.

That deterrence claim—the notion that indictments and sanctions against one set of nation state-backed hackers will inhibit other hackers from launching similar campaigns—has come under fire in Congress from lawmakers who argue the U.S. responses to nation state hacking have had little deterrent effect to date.

Rosenstein took pains to rebut that claim during Friday’s press conference, arguing that, “by making clear that criminal actions have consequences, we deter schemes to victimize the United States, its companies and its citizens.”

“We’re going to have a specific deterrent impact on the people who are blocked as a result of this case,” he later added, “and we’re going to have a general deterrent impact because we are spreading the word that anyone who attacks America is going to face an appropriate response, a coordinated response by the United States government.”

When a reporter asked for some evidence that deterrence was working, Rosenstein replied: “You don’t see the attacks that have been deterred. You only see the ones that haven't been deterred.”

Megan Brown, a Justice Department official in the Bush administration, praised Rosenstein’s focus on deterrence but warned that the department can only do so much without extensive buy-in from the private sector, which is overwhelmingly the largest victim of criminal and nation state cyberattacks and doesn’t always share information about those breaches with the government.

“Numerous [government] reports…and private companies have been saying we have to raise the costs to the bad guys,” Brown told Nextgov. “DOJ has tools and I’m glad they are using them.”

The government’s more aggressive posture in recent years, which includes sanctions against Russia and North Korea and indictments against Russia, Iran and China, might also help quell calls for companies to fight back in cyberspace on their own, she added.

Proponents of those schemes, sometimes called active defense or hacking back, say that companies need some limited hacking power—perhaps a go-ahead to destroy their own data after an adversary has stolen it—in order to deter the most brazen criminal and government-backed hacking campaigns.

Critics, including government officials, say such plans are a recipe for disaster if a company unwittingly gets the U.S. into an escalating cyber conflict with an adversary such as Iran, Russia or North Korea.

Friday’s sanctions targeted the Mabna Institute and 10 Iranian hackers. The indictments targeted nine Iranian hackers.

The hacking campaign, which began around 2013, compromised email logins for about 8,000 professors spread across more than 300 universities in 21 countries. Subject areas for the stolen research and intellectual property included science, technology and engineering, Rosenstein said, but he declined to describe specific research or technology that was stolen.

A goal of the campaign seems to have been acquiring information that was denied to Iran by existing U.S. and international sanctions, according to Adam Meyers, vice president for intelligence at the cyber threat tracker Crowdstrike.

“CrowdStrike has been tracking Iranian actors for years and has observed multiple attempts to acquire information in the fields of aviation, defense, energy, financial, manufacturing, telecommunications and high-tech,” Meyers said.

Other victims of the hacking campaign include the U.S. Labor Department, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations, the United Nations Children’s Fund and 47 companies in the U.S. and abroad, according to a Justice Department document.

Concerns about the U.S.’s deterrent capabilities have been mounting in recent weeks.

During a Wednesday hearing, Senate Intelligence Committee members bemoaned the fact that neither sanctions nor indictments under the Trump or Obama administrations have effectively deterred Russia’s digital efforts to meddle in U.S. elections.

“With the benefit of two years’ hindsight, it does seem plain that the Russian effort has not been contained or deterred,” former Homeland Security Secretary Jeh Johnson acknowledged.

“In my experience, superpowers respond to sufficient deterrence and will not engage in behavior that is cost prohibitive,” Johnson said, adding, “plainly that has not occurred.”

On Thursday, President Donald Trump signed a presidential memorandum targeting unfair Chinese trade practices.

An accompanying report from the U.S. Trade Representative argued that the 2014 indictment of five People’s Liberation Army hackers for breaching U.S. companies and a 2015 no-commercial-hacking agreement between Obama and Chinese President Xi Jinping had been insufficient to deter China’s digital aggression.