US needs to impose ‘real costs’ on bad actors, State Department cyber official says

MUNICH, Germany — For more than a decade, American cyber strategy has largely been an exercise in digital resilience: assume the networks will be probed, breached and sometimes penetrated, then build systems sturdy enough to survive those kinds of breaches. 

At the Munich Cyber Security Conference this week, senior U.S. officials signaled that this defensive crouch is giving way to something closer to Cold War–style deterrence — an effort to convince adversaries that the costs of hacking the United States will outweigh the benefits.

“I think we really need to move beyond reactive defense and set the risk calculus of adversaries in cyber space,” said Anny Vu, a senior official in the State Department’s Bureau of Cyberspace and Digital Policy. “To do that, we have to be proactive about disrupting adversaries by imposing real costs, and consequences to malicious actors.”

The language mirrors a broader shift inside Washington toward more assertive cyber operations, even as some domestic defenses have been pared back. But cyber weapons lack the visible, catastrophic clarity of nuclear arms. They can be deployed quietly, denied plausibly, and calibrated to stay below the threshold that would provoke a conventional response.

Ms. Vu’s bureau, created by Secretary of State Marco Rubio, operates as the diplomatic command center for American technology policy, negotiating rules for artificial intelligence, quantum computing and telecommunications while coordinating responses to major intrusions. 

Increasingly, U.S. officials argue that technical standards and supply chains — who builds the routers, writes the code, and controls the cloud — are as consequential as traditional military assets.

That strategy, however, is unfolding as Washington pulls back from a range of international cyber partnerships, including the Global Forum on Cyber Expertise, the Freedom Online Coalition and Europe’s Hybrid Threat Centre. The administration has cast such bodies as inefficient or misaligned with American priorities. Vu, for her part, said the step back from these organizations was to do away with redundancies.

The result, though, is a paradox: the U.S. is urging allies to align behind “trusted” technologies and coordinated responses, even as it steps away from many of the institutions designed to organize that very cooperation.