US ejects Russian operatives in response to election hacking

President Barack Obama's administration announced sweeping new measures against Russia on Thursday in retaliation for what U.S. officials have characterized as interference in this fall's presidential election, ordering the expulsion of Russian "intelligence operatives" and slapping new sanctions on state agencies and individuals suspected in the hacks of U.S. computer systems.

The response, unveiled just weeks before President Obama leaves office, culminates months of internal debate over how to react to Russia's election-year provocations. In recent months, the FBI and CIA have concluded that Russia intervened repeatedly in the 2016 election, leaking damaging information in an attempt to undermine the electoral process and help Donald Trump take the White House.

Because Thursday's announcement is an executive action, it can be undone by the next administration. But Obama's last-minute measures put pressure on Trump, who has largely waved off the allegations against Russia, to make a decision about whether to keep the punitive measures in place.

In a statement issued by his transition office late Thursday, Trump was noncommittal, saying, "It's time for our country to move on to bigger and better things."

"Nevertheless," he said, "in the interest of our country and its great people, I will meet with leaders of the intelligence community next week in order to be updated on the facts of this situation."

[Kremlin spokesman vows retaliation against U.S. sanctions]

Taken together, the sanctions and expulsions announced Thursday were the most far-reaching U.S. response to Russian activities since the end of the Cold War, and the most specific related to Russian hacking. The administration also released a listing of addresses of computers linked to the Russian cyberattacks and samples of malware inserted into U.S. systems.

Several lawmakers have called on the administration for months to respond, saying that tougher measures need to be taken to punish Russia. The White House resisted acting ahead of the election for fear of appearing partisan.

Obama, who had promised a tough U.S. response, said the new actions were "a necessary and appropriate response to efforts to harm U.S. interests." He said Americans should be "alarmed" by an array of Russian moves, including interference in the election and harassment of U.S. diplomats overseas.

"Such activities have consequences," the president said in a statement.

The new measures include sanctions on two Russian intelligence agencies, three companies that are believed to have provided support for government cyber operations, and four Russian cyber officials. The two agencies named are the GRU, Russia's military spy service, and the FSB, the civilian spy agency that grew out of the KGB.

The administration has also ordered 35 Russian operatives to leave the United States and will shut down Russian-owned facilities on Maryland's Eastern Shore and on Long Island in New York believed to have been used for intelligence purposes.

State Department spokesperson Mark Toner said the diplomatic retaliation was partly a response to Russian provocations against American personnel in Russia, including "arbitrary police stops, physical assault, and the broadcast on State TV of personal details about our personnel that put them at risk."

In June, a senior U.S. diplomat was attacked by a Russian soldier at the doorway to the U.S. embassy as he tried to enter. That incident, circulated on video, resulted in the earlier expulsion of two Russian diplomats from Washington. The State Department also said that personal details about U.S. diplomats were publicly released in Moscow, and that the Russian government had refused to approve security upgrades to the U.S. diplomatic facility in St. Petersburg.

Obama suggested Thursday that the United States may undertake covert activity in response to Russian activities. Officials gave no details. The Treasury Department also designated two Russian hackers, Evgeny Bogachev and Aleksey Belan, for criminal cyber activities involving U.S. firms and unrelated to the election hacks.

Moscow, which has denied involvement in attacks related to the election, vowed to respond in kind.

"I cannot say now what the response will be, although, as we know, there is no alternative here to the principle of reciprocity," Russian presidential spokesman Dmitri Peskov said in a statement late Thursday evening carried by the Interfax news service.

Peskov said the response would be authorized by President Vladimir Putin. In virtually all previous cases of Soviet or Russian diplomats declared persona non grata in this country, an equal number of U.S. officials have been expelled from Russia.

[The Kremlin cast a wide net to recruit hackers]

Trump has called on the Obama administration to present proof of Russian hacking. Speaking Thursday before the reprisal announcement, Sean Spicer, the incoming White House press secretary, said Trump's views on the hacking allegations could change if more solid evidence emerges that Russia was responsible.

"If the United States has clear proof of anyone interfering with our elections, we should make that known," Spicer said, adding, "Right now we need to see further facts."

Spicer also said that some on the political left were using the Russia allegations to downplay Trump's victory at the polls on Nov. 8.

U.S. officials say they have been refining for months their assessment of the attacks, in which they say a Russian military intelligence agency hacked the Democratic National Committee and stole emails that were later released by WikiLeaks. Emails hacked from the account of John Podesta, who chaired Hillary Clinton's presidential campaign, also were made public. State electoral systems were also targeted, but administration officials said Thursday, as they have in the past, that they have no evidence the actual voting process was interfered with on Election Day.

While U.S. officials have not named Putin himself in the cyber meddling, Obama has suggested that approval came from the very top of the Russian government.

As part of the new measures, the administration has amended a 2015 executive order allowing the president to respond to foreign cyberattacks. That order was intended primarily for attacks against infrastructure or commercial targets, but officials adapted it to cover attempts to undermine the electoral process – not only in the United States but in other countries as well.

In a call with reporters, U.S. officials said they chose to announce the new measures before the end of Obama's term in an attempt to educate Americans about Russian activities and to deter future intrusions.

"There's every reason to believe Russia will interfere with future U.S. elections and future elections around the world," said one senior official, speaking on the condition of anonymity because he was not authorized to speak on the record.

"The Russian actions have been sustained over an extended period of time, and by any definition are against the national interests of the United States, not the interests of President Obama." The harassment, the official said, "has been escalating steadily for some time" and is "a direct threat to the ability of the United States to conduct diplomacy."

Both U.S. allies and American businesses were concerned about Russian activities, the official said, and "if [Trump transition officials] aren't, then they should explain why."

The Obama administration also released a document providing some details about the cyber operation U.S. officials have labeled "Grizzly Steppe," including a list of names the hackers used.

These groups have conducted campaigns against think tanks, universities and corporations, as well as government agencies, according to the administration. In foreign countries, they have carried out damaging and disruptive cyberattacks, including on electrical utilities.

John Carlin, former head of the Justice Department's National Security Division, said the measures announced Thursday were significant. "It's important to show that we can do attribution and are willing to impose a deterrent – not just for the Russians, but for the world, as we're figuring out what the norms should be in cyberspace," he said. "It's not a world of free passes."

Identifying the malware that was used, imposing sanctions and affecting the Russians' ability to hack for intelligence purposes all "raise the cost" of conducting such activities, Carlin said.

The Obama administration has already imposed sanctions on Russia for its activities in Ukraine, but those measures do not appear to have deterred Russia's actions there.

Congressional Republicans welcomed the crackdown but said it was overdue.

"It is an appropriate way to end eight years of failed policy with Russia," House Speaker Paul Ryan, R-Wis., said in a statement.

Sens. John McCain, R-Ariz., and Lindsey Graham, R-S.C., said the measures were inadequate and promised to fight for stronger sanctions.

[The perfect weapon: How Russian cyberpower invaded the U.S.]

Despite the Obama administration's efforts to deliver an 11th-hour blow against Russia, Leonid Slutsky, chairman of the international affairs committee of the State Duma, the lower house of Russia's parliament, suggested the measures would not inflict lasting damage.

"None of this will change the results of the election of the American president, and in January, the rightful owner of the White House will be Donald Trump," Slutsky said. "I expect that with his arrival the dialogue between Russia and the United States will be conducted in a more healthy political atmosphere."

David Filipov and Andrew Roth in Moscow and John Wagner in Washington contributed to this report.

Sanctions against Russia

President Obama authorized the following actions Thursday in response to the Russian government's "harrassment of U.S. officials and cyber operations aimed at influencing the U.S election in 2016."

– Approved an amendment to Executive Order 13964 allowing the president to sanction nine entities and individuals: two Russian intelligence services (the GRU and the FSB); four individual officers of the GRU; and three companies that provided material support to the GRU's cyber operations.

– The State Department declared 35 Russian government officials from the Russian Embassy in Washington and the Russian Consulate in San Francisco "persona non grata." for acting in a manner inconsistent with their diplomatic status. Those individuals and their families were given 72 hours to leave the United States.

– The State Department also provided notice that as of noon on Friday, Dec. 30, Russian access will be denied to two Russian government-owned compounds, one in Maryland and one in New York.

– The Department of Homeland Security and Federal Bureau of Investigation released a Joint Analysis Report (JAR) that includes declassified technical information on Russian civilian and military intelligence services' malicious cyber activity.

– Sylvester Monroe, The Washington Post