The White House's risky cyberoffense stand-down

Washington Post

05-03-2025

'Stand down' is an order that military leaders fear. But that's what Defense Secretary Pete Hegseth reportedly ordered U.S. Cyber Command to do in its operations and planning against Russia, as part of President Donald Trump's efforts to cajole the Kremlin into making a peace deal with Ukraine.
The order to pause offensive cyberoperations, first reported Friday by the Record, may be the most dramatic example of Trump's eagerness to woo Russian President Vladimir Putin. And it raised alarm among a half-dozen former senior national security officials I talked with Monday. The Pentagon hasn't responded to the story except to say that it does not 'discuss cyber intelligence, plans, or operations.'
The stand-down order isn't dangerous in itself, officials tell me. This is the kind of sweetener that often accompanies diplomatic efforts. When the United States wants to foster negotiations, it will cancel military exercises or halt provocative overflights — or occasionally, as in the case of Trump's summitry with North Korea in 2018 and 2019, suspend offensive cyberoperations.
But beware: Cyberoperations may be the most valuable weapons in today's national security arsenal. They're the essential tool in collecting intelligence, and they can cripple an adversary's military operations and economic stability. Once a president begins making concessions in this area, he risks giving up U.S. power in a domain where, for all Russia's and China's efforts, the United States remains dominant.
Understanding what's at stake in the cyber realm is hard, because the activities of Cyber Command and its civilian partner, the National Security Agency, are so secret. But the basics were outlined in a 2020 article in Foreign Affairs by Gen. Paul Nakasone, then head of Cyber Command and the NSA, and Michael Sulmeyer, his senior adviser. They explained that in cyberspace, the United States maintains 'persistent engagement' — meaning that conflict with adversaries isn't an on-off switch, but more like a rheostat you can dial up or down. And it's normally at about three, officials tell me.
We're always at a low level of cyberwar with Russia and China, in other words. The NSA and Cyber Command are constantly inside Russian servers — gathering intelligence, monitoring threats and planting tools for future use. 'We stay engaged. We stay in the network. We see what malware they're developing,' said one former senior official. And sometimes, as in responding to last year's Russian sabotage campaign against NATO supporters of Ukraine, the United States has probably taken offensive action to disrupt threats.
Russia and China, meanwhile, are constantly attacking the United States, often to devastating effect. If you doubt it, take a look at Microsoft's regular reports on the Russian intelligence operation it calls 'Midnight Blizzard,' which over the past two years hacked into hundreds of sensitive organizations. Or read up on the Chinese 'Salt Typhoon' and 'Volt Typhoon' attacks that have burrowed into our telecommunications companies and critical infrastructure.
The cyber experts I consulted don't know for sure what Hegseth's order means in practice. It appears to apply only to Cyber Command's offensive hacking — and not to the NSA's intelligence gathering. But the two are intertwined. The NSA will penetrate a Russian network to collect information and, in the process, detect a threat or vulnerability and share that information with Cyber Command. Sometimes, the dual-hatted commander of the two organizations must decide whether to preserve the intel source or take it down. The fear is that limits on Cyber Command may bleed into NSA operations.
Then there's the question of how long this operational pause will last. Experts fear that if it lasts more than a month, Cyber Command will start losing essential threads. It's hard to recover access points and signatures. And there's lost human contact, too. The Cyber Command doctrine is to 'hunt forward' — meaning to send cyberwarriors to friendly countries where Russian networks may be easier to access. Those ties could wither, too.
Finally, cyber experts worry that Trump, in his deepening embrace of Putin, may contemplate a bigger deal that would amount to disarmament in cyberspace. That's a dangerous mistake for two reasons, experts say: The United States is ahead in cyber and would lose this advantage, and any deal in this domain would be unverifiable.
The easiest way to illustrate the perils of Trump's tilt toward Russia is to recall a similar experience, the U.S.-Russia 'reset' attempted by President Barack Obama when Dmitry Medvedev was Russia's president. For a trip down bad-memory lane, take a look at the Obama team's 11-page summary in 2010 of its reset agenda, whose initiatives all crashed and burned when Putin regained the presidency in 2012. Trump probably wouldn't like to think he's emulating Obama, but that's a fact.
The Kremlin is crowing that Trump's version of a Moscow-friendly peace deal on Ukraine 'largely aligns with our vision.' That should frighten anyone who has studied Putin's attempts to redraw the security map in Europe.
In 1987, in his book 'The Art of the Deal,' Trump had it right: 'The worst thing you can possibly do in a deal is seem desperate to make it. That makes the other guy smell blood, and then you're dead.' He should follow his own advice — especially when it comes to lowering our cyberdefenses.