Thread by @TomBossert

It is clear that a foreign government is holding American networks at risk. @SecPompeo took a necessary step attributing the attack to Russia. That step requires formalization. 1/

The United States government, ideally with at least one ally, must issue its written conclusion on attribution.

The stakes are too high to cloud responsibility, blame the wrong country, or divide our focus. The first step in solving a problem is clearly understanding it. 2/

If it’s Russia, as all indications suggest, the free world—led by the United States—must impose costs on the Kremlin. The imposition of costs is the right message. It is punitive and it has a deterrent effect against future such attacks. However, there is an important nuance. 3/

The sequencing of our actions is critically important. We must fully grasp the degree to which our pants are down and the integrity of our networks threatened. 4/

Regaining network control requires inspecting incoming and outgoing Internet traffic for malicious code and command and control signals between the hackers and the compromised networks and machines. 5/

We must deploy such active screening technology in-line, out-of-band, and outside the compromised networks. Once that’s in place for critical networks, then we will have greater latitude to punish the Kremlin without costly reprisals and escalation. 6/

For now, they are holding the Nation—and large parts of the world—at risk. That is unacceptable. Our long term goals must be to regain network integrity and control and to establish geopolitical deterrence. 7/

Until we start defending digital infrastructure as if commercial and government operations depended on it, we will remain adrift with malign forces controlling our destiny. A coalition of free world governments is ready for leadership. A global response is needed. 8/