(The author is a Reuters Breakingviews columnist. The opinions expressed are her own.)

 

WASHINGTON - A Russian fight over Ukraine could spill over to the cyber world. The United States on Tuesday joined allies in announcing new sanctions for Moscow’s military maneuvers. As payback, Russia may hack American energy firms and banks, and it won’t take much to cause real damage.

The White House on Tuesday dubbed Russia’s moves so far an “invasion,” opening the door to economic punishment. Although not yet named by U.S. officials, big Russian firms like VTB Bank, Sberbank and Gazprombank could be cut off from U.S. dollar transactions while oligarchs close to Russian President Vladimir Putin could have their assets parked at Western firms frozen. That would set the stage for Russian retaliation.

The White House imposed similar sanctions on Iran 10 years ago, and Iranians hit back through cyber attacks. Then, the country’s hackers tapped into dozens of financial firms, including JPMorgan, Wells Fargo and American Express from 2011 to 2013, causing websites to go down and spurring millions of dollars in lost business, according to a U.S. Justice Department indictment. Also alarming was a hack of a dam in New York, though the attackers failed to gain control of the floodgates.

Russia is skilled in cyber breaches. In 2018, U.S. officials accused Moscow of being behind hacks that targeted American utilities and power grids. Instead of directly attacking companies, it went after their suppliers. Smaller contractors often have less cyber defenses and can be penetrated stealthily. Hackers were also able to steal data of some 40 million Target customers in 2013 by zeroing in on a heating and air conditioning company the retailer worked with.

The Colonial Pipeline hack that shut down its network last year is an example of the potential harm. It disrupted fuel supplies to the eastern United States and spurred panic buying at gas stations. The company said it paid almost $5 million to regain access to its system after the ransomware attack.

The United States government has tried to beef up its cyber capabilities, but it is hard to catch everything, and hackers only have to be lucky once. Plus if American cyber warriors start a tit-for-tat, it could escalate leaving U.S. companies caught in the crossfire. Sanctions may have an impact, but they could make a hot war even hotter.

 

CONTEXT NEWS

- The United States on Feb. 22 announced new sanctions after Russian President Vladimir Putin recognized two separatist Ukrainian regions as independent states. Putin also ordered Russian forces to "perform peacekeeping functions" in the self-proclaimed Donetsk People's Republic and the Lugansk People's Republic.

- Sanctions are being applied to VEB bank and Russia's military bank, referring to Promsvyazbank, which does defense deals, President Joe Biden said. Starting on Feb. 23, U.S. sanctions will begin against Russian elites and their family members.

(The author is a Reuters Breakingviews columnist. The opinions expressed are her own.)

(Editing by Lauren Silva Laughlin and Sharon Lam) ((For previous columns by the author, Reuters customers can click on CHON/ SIGN UP FOR BREAKINGVIEWS EMAIL ALERTS https://bit.ly/BVsubscribe | gina.chon@thomsonreuters.com; Reuters Messaging: gina.chon.thomsonreuters.com@reuters.net))