A key American defense has failed, and now Russia fears no reprisal for hacking the US

The US intelligence community has accused Russia of conducting cyberattacks on US voting systems and political networks during the 2016 presidential campaign and election. Cybersecurity experts also attribute a series of recent intrusions into US nuclear power plants to Russia.

While cyberattacks do not kill humans outright in the way the Japanese attack on Pearl Harbor did, they degrade the faith of Americans in their political systems and infrastructure in a way that could devastate the country and that furthers the foreign-policy goals of the US's adversaries.

"When Americans have lost trust in their electoral system, or their financial system, or the security of their grid, then we're gonna be in big trouble," Eric Rosenbach, a former US Army intelligence officer who served as Secretary of Defense Ash Carter's chief of staff, said Thursday at the Defense One Tech Summit.

A failure of deterrence

The US has long relied on the concept of deterrence, or discouraging nation-states from taking action against the US because of the perceived consequences, for protection.

The brazen hacks during the US presidential election and the recent cyberattacks on Ukraine's power grid and infrastructure for which Russia has been blamed reveal "a failure of deterrence" on the part of the US, Rosenbach said.

"Deterrence is based on perception," Rosenbach said. "When people think they can do something to you and get away with it, they're much more likely to do it."

While the US conducts cyberoperations, especially offensives, as secretly as possible, mounting evidence suggests that the US has not fought back against hacks by adversarial countries as strongly as possible.

After receiving intelligence reports that Russia had been trying to hack into US election systems to benefit Donald Trump, President Barack Obama told Russian President Vladimir Putin to stop and brought up the possibility of US retaliation.

Obama later expelled Russian diplomats from the US in response to the cyberattack, but cybersecurity experts say Russia has continued to attack vital US infrastructure.

A former senior Obama administration official told The Washington Post earlier this year that the US's muted response to the 2016 hacking was "the hardest thing about my entire time in government to defend."

"I feel like we sort of choked," the official said.

The Post also found that Obama administration's belief that Hillary Clinton would win the election prompted it to respond less forcefully than it might have.

While the attacks on vital US voting systems and nuclear power plants highlight recent failures of deterrence, Russia has been sponsoring cybercrimes against the US for years.

"The Russians, and a lot of other bad guys, think that they can get away with putting malware in our grid, manipulating our elections, and doing a lot of other bad things and get away with it," Rosenbach said. "Because they have."

In physical war, the US deters adversaries like Russia with nuclear arms. In cyberspace, no equivalent measure exists. With the complicated nature of attributing cybercrimes to their culprits, experts disagree on how to best deter Russia, but Rosenbach stressed that the US needed to take "bold" action.

While Rosenbach doesn't find it likely that Russia would seek to take down the US's grid in isolation, he pointed out that the nuclear-plant intrusions gave Russia incredible leverage over the US in a way that could flip the deterrence equation, with the US possibly fearing that its actions might anger Russia.

Russia's malware attacks have been so successful, Rosenbach says, that the next time the US moves against Russia's interests, fear of future attacks could "cause the US to change course." The US losing its ability to conduct an independent foreign policy would be a grave defeat for the world's foremost superpower.