President Biden today reiterated that the US does not believe the Russian government is responsible for the ransomware attack on Colonial Pipeline, but said the intel community is confident the hackers reside in Russia.
“We don’t believe the Russian government was involved in this attack,” Biden said Thursday. “We do have strong reason to believe that the criminals who did the attack are living in Russia.”
The US has “been in direct communication with Moscow about the imperative for responsible countries to take decisive action against these ransomware networks,” Biden said.
The US will “pursue a measure to disrupt” the ability of the DarkSide ransomware group to operate, according to Biden. He didn’t elaborate, except to say that a new Justice Department task force would work to prosecute ransomware hackers “to the full extent of the law.” When asked if there were plans for a retaliatory cyberattack, Biden said no.
For now, “we are working to try to get to the place where we have an international standard” whereby governments who know criminal activity is happening in their territories “move on those criminal enterprises,” Biden said. “I suspect that’s one of the topics I’ll be talking about with President Putin.”
The White House and Moscow are currently in talks about a possible meeting between the two presidents next month. When pressed on how confident he is that Putin was not involved in the Colonial hack, Biden said he is “confident that I’ve read the report of the FBI accurately and they say the [Russian] government was not.”
“This event is providing an urgent reminder of why we need to harden our infrastructure and make it more resilient against all threats, natural and manmade,” Biden said. “My administration is continuing to safeguard our critical infrastructure, the majority of which is privately owned and managed, like Colonial Pipeline.”
Colonial restarted its pipeline last night after several days offline. Biden today warned that it’s “going to take some time” for things to get back to normal. “It’s not like flipping on a light switch,” he said, noting that Colonial’s pipeline has never been fully shut down. He anticipated a return to normal operation by the weekend, and urged people not to hoard gas in the interim.
Bloomberg, meanwhile, reports that Colonial paid a $5 million ransom to the DarkSide group “within hours after the attack.” The hackers then gave Colonial a decrypting tool, but it was too slow, so Colonial continued using its own backups, too. When asked today about the report’s accuracy, President Biden said he had no comment.