Biden won’t rule out a retaliatory cyberattack on group responsible for pipeline hack and says Russia isn’t to blame

President Joe Biden said Thursday he does not believe the Russian government was behind a cyberattack that shut down the pipeline supplying gasoline to the eastern US but said Moscow must do more to stop such attacks coming from Russia.

When asked directly if he would rule out any sort of cyberattacks targeting the criminal group that carried out the attack, Biden simply said, “No.”

Speaking from the White House’s Roosevelt Room Thursday afternoon, the President provided an update on the Colonial Pipeline incident, seeking to assure the American people that his administration is mitigating gas shortages in the Southeast and protecting Americans from price gouging in the aftermath of the shutdown.

“We do not believe — emphasize, we do not believe — the Russian government was involved in this attack,” Biden said. “But we do have strong reason to believe that the criminals who did the attack are living in Russia. That’s where it came from.”

Moscow bears a responsibility to stop such attacks when they originate within its borders, the President added.

“We have been in direct communications with Moscow about the imperative for responsible countries to take decisive action against these ransomware networks,” he went on.

Colonial Pipeline, which carries fuel from refineries along the Gulf Coast to New Jersey, learned of the cyber threat on Friday and shut down operations, while engaging federal agencies and a third-party cybersecurity firm, FireEye, to investigate the attack. The attack on the critical pipeline highlighted growing concerns over the vulnerabilities in the nation’s critical infrastructure, as ransomware attacks have worsened over the years, with recent targets as varied as state and local governments, hospitals and police departments.

Colonial Pipeline launched the restart of its operations Wednesday evening, but the pipeline’s operators warned it will take several days for service to return to normal.

The group ascribed responsibility for the attack, DarkSide, is a criminal syndicate believed to be based in Russia. Cyber experts have said it operates with the tacit permission from Moscow, though isn’t controlled by the government.

Biden said he planned to raise the topic of cyberattacks with Russian President Vladimir Putin at their upcoming summit, a date and location for which is yet to be announced, and suggested world leaders were working to develop an “international standard” where governments will prosecute hacking networks operating within their borders.

He said he was confident Putin himself had not directed the pipeline attack.

“I am confident that I read the report of the FBI accurately and they say they were not, he was not, the government was not” responsible, Biden said.

But he would not rule out taking cyber countermeasures to prevent future attacks from the criminal group.

Biden signed an executive order Wednesday meant to better secure the nation from cyberattacks, but even as he signed it, the White House acknowledged more will need to be done to prevent the type of hack that impacted the Colonial Pipeline.

The US has accused Russia of meddling in the 2020 US election and the country’s foreign intelligence service of being behind the SolarWinds intrusion campaign last year that compromised nine US agencies and dozens of private organizations. The Biden administration last month targeted Russia with sweeping sanctions and diplomatic expulsions in response.