WATCH: Psaki Mocks Reporter Who Asks Why Russian Ransomware Attacks Increasing Under Biden

REPORTER 1:  I have a couple of questions.  First, on JBS, can you confirm that a ransom demand came from REvil?  I know it’s a criminal organization likely based in Russia.  And was the ransom paid?

And then, can you speak a little bit about — have you seen any progress on this call from the government for business and private sector to work with the federal government in updating their cybersecurity measures?

PSAKI:  Sure.  On the last part, I’m not in a place to confirm the specifics of the ransom request or the origin.  Obviously, our team is continuing to evaluate.  And I would send you to the company for any specific questions about the ransom request.

I will say that this attack is a reminder about the importance to private sector entities of hardening their cybersecurity and ensuring that they take the necessary steps to prepare for this threat, which we’ve seen rising even over the last few weeks.

As it relates to actions we’re taking in the federal government, the President has launched a rapid strategic review to address the increased threat of ransomware, to include four major lines of effort:

Disruption of ransomware infrastructure and actors.  Working closely with the private sector — we will work in partnership with them.  That is something that this administration has done a bit differently than in the past in working to find best practices, ensuring that private sector entities have a seat at the table, and we can work in close coordination.

Building an international coalition to hold countries who harbor ransom actors accountable.  I mean, this attack is an example of how this is not just a problem in the United States.  These are actors that are working to get into systems around the world.  This was a company obviously based in Brazil, but Australia was a major — was impacted also by this.

Expanding cryptocurrency analysis — obviously, this has been an increasing question out there — to find and pursue criminal transactions.

And reviewing our own ransomware policies.

So this is an internal policy process — essentially, one that’s looking at all of these entities within our national security/economic team.

…

REPORTER 2:  Thank you.  Back on the ransomware attack, is the U.S. going to retaliate?  And, realistically, what options are on the table?  Is a counterattack an option?

PSAKI:  Sure.  Well, one, let me say — not to get ahead of your line of questioning, but I assume this will be a question.  So we do expect this to be one of the issues that the President will discuss with President Putin at the summit.  That will be two weeks from today, if my — if my calendar is correct in my mind.

And in terms of considerations of — you know, we’re not taking any options off the table, in terms of how we may respond.  But, of course, there’s an internal policy review process to consider that.  We’re in direct touch with the Russians, as well, to convey our concerns about these reports.

REPORTER 2: You mentioned the meeting.  When it comes to this issue, what does success look like at that discussion?  I mean, what are you looking to accomplish when the President walks away from that table, when it comes to cybersecurity?

PSAKI:  Well, first, let me say that, you know, this is an issue that we have discussed with the Russian government — this specific issue — and we’ve discussed it in the past, and delivered the message that responsible states do not harbor ransomware criminals.

As we’ve also noted from here, and I noted in the beginning: Obviously, ransomware attacks — we’ve seen them increase over a period of time.  It’s an increasing threat to the private sector and to our critical infrastructure.  And there are other countries, many of whom we will see when the President is in Europe, who have similar concerns.  So we expect this to be an issue of discussion throughout the President’s trip, I will say.

In terms of what success looks like coming out of the summit, I can’t predict that at this point in time.  But I can convey to you that this will certainly be a topic of discussion — that harboring criminal entities that are intending to do harm, that are doing harm to the critical infrastructure in the United States is not acceptable.  We’re not going to stand by that; we will raise that, and we are not going to take options off the table.

REPORTER 2: And in those conversations with the Russian government so far, do you get a sense that they are taking this seriously?  Are they going to be taking steps to try and stop these bad actors?

PSAKI:  I am — as I’ve said before, I’m blissfully not a spokesperson for the Kremlin, so I will let them speak for themselves.  But I can assure you that we are raising this through the highest levels of the U.S. government.  It will be a topic of discussion in direct, one-on-one discussions — or direct discussions with President Putin and President Biden happening in just a couple of weeks.

And certainly, protecting our own infrastructure in the United States is of the utmost national security importance.

…

REPORTER 3:  Just to put a fine point on this very quickly: Is it President Biden’s view that President Putin can stop these attacks, these hacks, from occurring if he wanted to?

PSAKI:  Well, I would say the President — President Biden certainly thinks that President Putin and the Russian government has a role to play in stopping and preventing these attacks; hence, it’s a — it will be a topic of discussion when they meet in two weeks.

REPORTER 3: Does the President believe that Vladimir Putin is testing him right now, ahead of the summit?

PSAKI:  I’m not going to give any further analysis on that other than to tell you that our view is that when there are criminal entities within a country, they certainly have a responsibility, and it is a role that the government can play.  And, again, that will be a discussion at the summit.

REPORTER 3: Of all the threats that the White House has to juggle right now — and, of course, there are a lot — how high does ransomware fall on that list right now?  Has it gone dramatically higher in the course of this administration?  Does it need to be higher than it is right now?  Where is it?

PSAKI:  You know how I love rank ordering our focuses and our threats.  (Laughs.)

REPORTER 3: How — but it’s been growing dramatically, obviously.  Right?

PSAKI:  That is true.  And I —

REPORTER 3: This is now a bigger issue.

PSAKI:  And, Peter, I just said that.  I think that this is — this attack that we’ve seen over the last couple of days, and certainly following the attack that we saw several weeks ago, is also a reminder to the private sector about the need and the importance of hardening their own cybersecurity protections, of investing in and putting in place protections in their own systems.

We have given guidance for some time, from the federal government, and it is up to a number of these private sector entities to protect themselves as well.

REPORTER 3: The Steamship Authority in Massachusetts reports that they were just the victims of a hack.  Has that been communicated to the White House?  Are you involved?  Do you have any comment or message, or anybody to attribute that to?

PSAKI:  I have seen those reports.  They — they just came out.

REPORTER 3: They just reported it.  Yeah.

PSAKI:  Yes, exactly.  I just don’t have anything more for you on it, but we can see if there’s more later this afternoon.

REPORTER 3: All good.  Last one, if I can, then.  In March, we heard from the National Security Advisor, Jake Sullivan.  He came in here and told us that the U.S., “in the near future” — to his words — would name who’s responsible for the hack on the Microsoft Exchange.

So can you tell us who that is — multiple — several months have passed — and what the holdup might be?

PSAKI:  I’m happy to check with our national security team and see if they have an update.  As you know, they are quite careful and thorough — I should say, “thorough” is probably the right word — in how they review and assess and provide public guidance.  But we can see if there’s anything more they can report out.

REPORTER 3: Is the prevailing theory still that it’s China?  Or are you — can you not go any further than he did then?

PSAKI:  I don’t think I have an update on it from what we’ve provided in the past.

…

REPORTER 4: On the JBS hack, these hackers based in Russia have disrupted American gas supplies and American meat supplies.  Why do you think that these ransomware attacks have been rising since President Biden took office?

PSAKI:  Well, first, I would say these are private sector entities who have a responsibility to put in place measures to protect their own cybersecurity.

As it relates to why criminal actors are taking actions against private sector entities, I don’t think I’m the right one to speak to that.

REPORTER 4: So, a total coincidence?

PSAKI:  I think you could certainly go track down those cyber criminals in Russia and have a good chat with them.

REPORTER 4: Okay.  If you have any leads, we’ll take that.

PSAKI:  Okay.

…

REPORTER 5: Thank you, Jen.  Just a couple of follow-ups on JBS.  Obviously, the White House is engaging directly with Russia on this, and we were wondering if Russia has offered any cooperation or help in tracking down these hackers.

PSAKI:  I’m just not going to be reading out Russia’s view or their role here.  You can certainly ask them those questions.

REPORTER 5: And considering — this is obviously the third Russia-linked attack this year, and we understand that the President will bring this up in his meeting with President Putin — but is the administration really considering any actions in addition to that, just to make sure that this doesn’t happen?  Sanctions or any other actions that are perhaps on the table?

PSAKI:  Sure.  I mean, as I said, I think, in response to an earlier question: We’re not taking options off of the table.

But it’s just an opportunity — there will be an opportunity for the President to discuss this directly with President Putin, to reiterate the fact that we believe that responsible states do not harbor ransomware criminals and that — and as he said, as we said, around Colonial and the Colonial hack — or the Colonial ransomware attack — we will continue to be in direct touch with Moscow.  We will continue to make the case that responsible countries need to take decisive action against ransomware networks.

At the same time, as I noted a little bit earlier too, we’re doing our own review of a range of options as well from here.