Department of Justice Statement on SolarWinds Update (justice.gov)

In effect yes, because this is an arbitrarily asymmetric environment. You can make them spend say $1Bn for every $1 you spend, if you actually put the work in. And they can't afford that.

The US President is just a man, the Russians could, in principle, shoot him in the head. But the US spends a lot of money to make that really hard, and so it isn't worth it and only random American nutjobs try. Most countries don't do that, it's certainly interesting how relatively few of their political leaders get shot in the head...

But that's the wrong mindset to have in this space, and it's how you get this outcome. The US focuses resources on protecting a few high value assets and so your opponent just seizes whatever low value assets they want and leverages those to achieve their goals. The right strategy is to jack up the baseline. That is, rather than spend more money protecting those you perceive as biggest targets, spend that money protecting everybody, including ordinary folks so that these broad attacks are too expensive to pursue.

Suppose you're an adversary today, somebody in your team figures out a way to target maybe 80% of California Department of Food & Agriculture employees for $1 each. You won't get the most senior people, or those most on the ball about security, but hey, 80% of all employees for $1 each is a bargain so of course you take that.

Now suppose the price goes up steeply due to a better approach to this problem from the US government, and they cost $1000 each. That sucks. Instead of just saying "Do it" on your own authority you need to go talk to management about budget. Nobody wants to authorise $2M for this speculative work that might not go anywhere. They authorise you to spend $100 000 identifying the best targets and attacking those instead. A month later you've identified twenty good targets at the CDFA and successfully breached twelve accounts instead of hundreds. This sucks.

Imagine if instead of $1000 it was $1M. Or $1Bn. At some point it gets escalated so that an aide is explaining to Putin that it's a choice whether to spend money on fixing the Kuznetsov or breaking into the accounts of some more US civil servants moaning about the coffee machine in their office on the hope that it helps somehow down the line. This is not a hard choice.

> I'm sure the US is guilty too but we don't have the same type of state owned/sponsored corporations that we hand over hacked materials to copy

This is startlingly naive. Of course the NSA can and goes obtain commercially sensitive information for US corporations like Boeing. Maybe the US counts as stupider for not insisting on a cut of the proceeds, who can say.

I’m tired of this assumption being treated as intellectually valid. Where is the proof? Maybe we did stuxnet, but that’s a far cry from solarwinds and other high profile incidents (OPM) that hurt innocent citizens. The US is better because we have more regard for ethics in our system than does a totalitarian or despotically ruled quasi-legitimate regime.

Can we make employees use Wireguard instead of a buggy Cisco implementation of OpenVPN?

Can we NOT put vital shit behind a webserver, and expect it to be A-OK?

If it were just the Southern district, sure. But Albany (Northern) and Buffalo (Western) are sleepy backwaters for random walks through prosecutor email. Who or what would a threat actor want to know about in Albany or Buffalo last year?