Defense Secretary Pete Hegseth has ordered the US Cyber Command to halt offensive operations against Russia, according to a current official and two former officials briefed on the secret instructions. The move is part of a broader effort to draw Russian President Vladimir Putin into talks on Ukraine and establish a new relationship with the United States.
Hegseth’s instructions, part of a larger re-evaluation of all operations against Russia, have not been publicly explained. However, they were issued before President Donald Trump’s public blow-up in the Oval Office with Ukrainian President Volodymyr Zelensky on February 28. The precise scope and duration of the Defense Department order remain unclear, as the line between offensive and defensive cyber operations is often blurred.
Retaining access to major Russian networks for espionage purposes is crucial to understanding Putin’s intentions as he enters negotiations and tracking internal arguments within Russia about conditions to insist upon and potential concessions.
Former officials note that it is common for civilian leaders to order pauses in military operations during sensitive diplomatic negotiations to avoid derailing them. However, for Trump and Hegseth, the retreat from offensive cyber operations against Russian targets represents a significant gamble. It essentially counts on Putin to reciprocate by easing what many call the “shadow war” against the US and its traditional allies in Europe.
US officials have reported that Russia has continued to try to penetrate US networks, including in the first weeks of the Trump administration. Over the past year, ransomware attacks on US hospitals, infrastructure, and cities have ramped up, many originating from Russia in what intelligence officials describe as largely criminal acts sanctioned or ignored by Russian intelligence agencies.
Sabotage efforts in Europe, including suspected Russian attempts to cut communication cables, mysterious explosions, and Russian-directed assassination plots, have accelerated in the past year. The US has been central in helping European nations fight back, often in covert cyber operations, but that cooperation could now be in jeopardy.
Many of these operations are run out of Britain’s Government Communications Headquarters and, to some extent, by Canada. It is possible they will continue that work while the US focuses on China, its most sophisticated adversary in cyberspace.
Russia also ran an aggressive influence campaign during the last presidential campaign, according to reports by US intelligence agencies during the Biden administration. In recent election cycles, the US Cyber Command has conducted secret operations to hamper or curtail those influence efforts.
However, the Trump administration has begun to dismantle efforts by the Federal Bureau of Investigation and other agencies to warn about Russian propaganda. The Pentagon’s order will halt, at least for now, any further Cyber Command efforts to interrupt future Russian influence campaigns.
Secretary of State Marco Rubio emphasized the urgency of getting Russia to the negotiating table over Ukraine, acknowledging that it was unclear whether Putin was ready to make a deal. Rubio defended the decision to stop offensive cyber operations, arguing that antagonistic behavior would not bring Russia to the table.
The order from Hegseth was first reported by The Record, a cybersecurity publication from Recorded Future. The Pentagon and US Cyber Command declined to comment on the record, but a senior defense official stated that Hegseth had “no greater priority” than the safety of military members, including in cyber operations.
Democratic Senate Minority Leader Chuck Schumer criticized the move, stating that Trump appeared to be giving Putin “a free pass” as Russia continues to launch cyber operations and ransomware attacks against critical American infrastructure.
As the Trump administration prepared to take office, departing Biden administration officials urged Trump’s appointees to keep the pressure on Russia, including by continuing to arm Ukraine and push back on Russian intelligence agencies responsible for aggressive cyber attacks and espionage operations.
During Trump’s first term, US cyber operations against Russia were ramped up, with the National Security Agency creating a “Russia Small Group” after Russian interference in the 2017 election. Trump gave the Cyber Command new authorities to conduct offensive cyber operations without direct presidential approval in a classified document known as National Security Presidential Memorandum 13.
One of those operations involved probing Russia’s electric power grid, likely meant as a warning to Russia not to interfere with crucial US infrastructure. Trump denounced the reporting of this operation as “a virtual act of treason,” but his former aides later said he was concerned the revelation would affect his relationship with Putin.