Trump administration sanctions Russians for 2016 election interference, other cyber attacks

The Trump administration is hitting five Russian entities and 19 Russian citizens with sanctions for cyber activity, including their interference in the 2016 election.

The sanctions represent some of the most significant actions by the Trump administration against Russians for their "malign... cyber activity, including their attempted interference in U.S. elections, destructive cyber-attacks, and intrusions targeting critical infrastructure," Treasury Secretary Steven Mnuchin said in a statement.

It is also the first time the administration has punished Russia for its election interference using sanctions authorities Congress passed overwhelmingly last summer and spent months demanding the White House utilize. The Trump administration has been criticized for not doing enough to push back on Russia's aggression, including in cyberspace.

Additionally, the Trump administration accused Russia of waging a long-term and ongoing campaign to infiltrate the U.S. energy grid.

The sanctions announced today target the Internet Research Agency, two affiliated companies, and 13 Russians who worked at the organization that spread disinformation online in the U.S., including through the use of fake personas posing as real Americans and American political groups, according to Treasury. Included on that list is Yevgeniy Prigozhin, a powerful Russian oligarch known as "Putin's chef" because he owns a catering company that services the Kremlin.

All 13 of the individuals, including Prigozhin, were indicted by the office of Robert Mueller, the special counsel investigating Russia's interference in the election and its possible ties to the Trump campaign. The announcement from the Treasury Department mirrors much of what Mueller's office laid out in indictments on February 16.

"The [Internet Research Agency] tampered with or altered information in order to interfere with the 2016 U.S. election," "created and managed a vast number of fake online personas that posed as legitimate U.S. persons," "posted thousands of ads that reached millions of people online," and "organized and coordinated political rallies during the run-up to the 2016 election, all while hiding its Russian identity," the Treasury Department said today.

The sanctions also cite the NotPetya attack, which is considered to be the most destructive and costly cyber attack in history. In February, the White House joined the British government in publicly blaming Russia for the attack, which disrupted global shipping, trade, and medical facilities in Europe, Asia, and the U.S.

The administration also employed the authorities it was given by Congress last August in a sweeping sanctions bill that some critics say the Trump administration has not properly utilized — the first time the White House has sanctioned anyone under this law. The Countering America's Adversaries Through Sanctions Act, or CAATSA, was passed overwhelmingly by both chambers and signed begrudgingly by Trump, calling for sanctions on Russia, Iran, and North Korea.

Under CAATSA, the administration announced Thursday it is sanctioning Russia's spy organization and military intelligence organization — both of which were already sanctioned by the Obama administration for their role in the 2016 election. The sanctions also target six Russians who worked for the military intelligence organization, four of whom were also already sanctioned.

Congress has criticized the White House for not implementing these sanctions. The administration initially dragged its feet on publishing a blacklist of Russian defense and intelligence sector entities that the U.S. would sanction others for doing business with, and when it could start sanctioning those third parties, it announced instead that it would hold off and monitor the situation because the sanctions already had a deterring effect.

The sanctions also relate to the Russia government's attempts to access the energy grid. A senior national security official said the FBI, DHS and intelligence community have determined "Russian government cyber actors are behind the targeting of the organizations in the energy sector."

"Cyber actors are using a multi-staged attack campaign with staging and intended targets involved, and the campaign is long-term and still ongoing," another national security official said. They added cyber actors "conducted network reconnaissance, moved laterally and collected information pertaining to industrial control systems, the systems that run our factories and our grid."

The same official said DHS and FBI have removed the Russian infiltration in systems/organizations currently known to be targeted.

"We were able to assist those victims and ensure that the Russians failed in their attempt to gain further access into critical systems," the senior national security official said.

The DHS and FBI released a public alert to inform and educate organizations of these attempts, which includes the use of malware and spear phishing.

The top Republican on the House Foreign Affairs Committee, Rep. Ed Royce of California welcomed today's sanctions announcement as "an important step by the administration. But more must be done," he said in a statement, adding that his committee "will continue to closely track implementation" of CAATSA and "keep pushing to counter Russian aggression."