Threatening Russia with nonspecific cyber attacks if they meddle in our elections is not a deterrent. A deterrent must be credible. This is not. Russia must believe we can (and will) hurt them for a retaliatory cyber attack to be effective. 1/n 
Patrolling a no fly zone is an effective deterrent. We don't have to balance Intelligence collection with a response. Shooting down a violating plane also hurts the adversary in a visible, tangible, and predictable manner. Cyber does none of that. 2/n
If we can hurt Russia using cyber in a visible and predictable manner (and I'm not sure we can), doing so almost certainly blinds us to intelligence we'll definitely need now that we're escalating tensions. 3/n
Too many folks picture cyber like a video game or a CTF, but it's not. There are real equities at stake. Every action you take exposes your worldwide intelligence operations to risk (see also todays CIA COVCOM story). We're far better off combating propaganda with education. 4/n
I want to clarify that I think we can hurt Russia through cyber actions. But predicting the outcome of cyber effects is exceedingly difficult. Want to bet your annual salary on the fallout in your network if I brick these three servers and degrade that router? 5/n
Of course not. And that's YOUR network. Now bet millions in research and development (exploits and tools) and international backlash (possibly kinetic) on how that will impact someone else's network. Maybe you don't care, but we do. We have to. 6/n
We can't afford to take down a hospital connected to a network we intend to disrupt. Collateral damage is judged very harshly in peacetime. And this is the problem (some of the problems) with cyber deterrents. 7/n
Russia knows all of this, so us threatening them is like an Army officer threatening that he'll flatten my house with a tank. He has a tank. My house is vulnerable. But I know a rational actor won't do it. The cost to him is far too high. So it's just not a deterrent. /fin
