Three days after the seemingly disastrous Oval Office meeting between presidents Donald Trump and Volodymyr Zelensky, inside sources speaking to The Record reported that the US cyber command had been ordered to stand down from cyber operations targeting Russia. The initial headlines did not quite tell the full story, however, as the sources say this order was issued sometime prior to the Trump-Zelensky spat when it was still widely believed the two countries would sign a minerals agreement.
Cyber operations paused indefinitely, exact motivation not revealed
The inside sources said that the order to pause Russian cyber operations came before the February 28 shouting match in the Oval Office, so it does not appear to be a response to the sudden scuttling of the mineral deal that was expected to be signed that day. The sources did not indicate what the motivation for the order was, so speculation is naturally percolating.
The sources did clarify that the order only halts offensive cyber operations. CISA responded to the report by indicating that its defensive mission has not changed at all. But, due to the sensitive nature of these missions, it’s not clear exactly what that encompasses. It could mean that cyber operations against the Russian government are paused, but active measures against ransomware gangs in the country continue.
The order was issued by new defense secretary Pete Hegseth, who also requested a risk assessment report outlining what missions would be halted and what threats would continue to be expected. The order seems to primarily impact cyber operations at the Cyber National Mission Force, with the NSA specifically exempted from its parameters.
The order also excepts planning for future cyber operations from the pause, and the NSA possesses its own offensive cyber capabilities that may not be impacted.
Will Trump’s unorthodox actions promote peace?
Since Hegseth reportedly issued the order while the mineral deal was still being negotiated, the purpose was most likely as a signal to Russia of a period of increased safety and reduced tension in which to approach the negotiating table and make a serious effort at ending the war. The move is far from unprecedented, with a variety of prior presidential administrations announcing a temporary halt to intelligence and cyber operations during talks to ease suspicions about their intent. The prospect of peace in the near term still remains dim, however, with Zelensky traveling to Europe to seek more funding for combat and drawing a pledge from the UK to put “boots on the ground” in Ukraine.
For the average organization, this likely changes nothing in terms of defensive cyber strategy. Most would not be targeted by APT groups anyway, and CISA and associated agencies appear to be continuing with their usual defensive programs as this unfolds. It is possible that this is a temporary shift of offensive cyber assets to another front, with Mexico the leading suspect as the Trump administration has ramped up drone surveillance and other passive measures against the fentanyl production labs on the other side of the border.
