Defense Secretary Pete Hegseth has ordered U.S. Cyber Command to halt offensive operations against Russia, according to a current official and two former officials briefed on the secret instructions. The move is apparently part of a broader effort to draw President Vladimir V. Putin of Russia into talks on Ukraine and a new relationship with the United States.
Mr. Hegseth’s instructions, part of a larger re-evaluation of all operations against Russia, have not been publicly explained. But they were issued before President Trump’s public blowup in the Oval Office with President Volodymyr Zelensky of Ukraine on Friday.
The precise scope and duration of the Defense Department order is not clear, as the line between offensive and defensive cyberoperations is often a blurry one.
Still, retaining access to major Russian networks for espionage purposes is critical to understanding Mr. Putin’s intentions as he enters negotiations, and to tracking the arguments within Russia about what conditions to insist upon and what could be given up.
Former officials said it was common for civilian leaders to order pauses in military operations during sensitive diplomatic negotiations, to avoid derailing them. Still, for President Trump and Mr. Hegseth, the retreat from offensive cyberoperations against Russian targets represents a huge gamble.
It essentially counts on Mr. Putin to reciprocate by letting up on what many call the “shadow war” underway against the United States and its traditional allies in Europe. The leading European powers continue to say their support of Ukraine is undiminished even as Mr. Trump, who has sought to portray himself as a neutral arbiter in seeking to end the war in Ukraine, has at times sided openly with Mr. Putin.
U.S. officials have said Russia has continued to try to penetrate U.S. networks, including in the first weeks of the Trump administration. But that is only part of a broader Russian campaign.
Over the past year, ransomware attacks on American hospitals, infrastructure and cities have ramped up, many emanating from Russia in what intelligence officials have said are largely criminal acts that have been sanctioned, or ignored, by Russian intelligence agencies.
Sabotage efforts in Europe — including suspected Russian attempts to cut communications cables, mysterious explosions and Russian-directed assassination plots, including against the chief executive of Germany’s largest arms maker — have accelerated in the past year. The United States has, until now, been central in helping European nations fight back, often in covert cyberoperations, but that cooperation could now be in jeopardy.
Many of those operations are run out of Britain’s Government Communications Headquarters — the storied intelligence agency that broke the Enigma codes in World War II — and to some extent by Canada. It is possible they will continue that work, while the United States focuses on China, its most sophisticated adversary in cyberspace.
Russia also ran an aggressive influence campaign during the last presidential campaign, according to reports by U.S. intelligence agencies during the Biden administration. In recent election cycles, U.S. Cyber Command has conducted secret operations to hamper or curtail those influence efforts.
But the Trump administration has already begun to dismantle efforts by the F.B.I. and other agencies to warn about Russian propaganda, and the order by the Pentagon would halt, at least for now, any further Cyber Command efforts to interrupt future Russian influence campaigns.
Secretary of State Marco Rubio on Sunday described the urgency of getting Russia to the negotiating table over Ukraine, even while acknowledging that it was unclear whether Mr. Putin was ready to make a deal.
“You’re not going to bring them to the table if you’re calling them names, if you’re being antagonistic,” Mr. Rubio said on ABC’s “This Week.” “That’s just the president’s instincts from years and years and years of putting together deals as someone who’s in business.”
Mr. Rubio was not asked about the decision to stop the offensive cyberoperations, but he grew defensive when pressed on why the United States was letting up on pressure on Moscow, to the point of removing language from a United Nations resolution that described Russia as the aggressor in the war in Ukraine. Almost all of the United States’ traditional allies voted against the resolution, leaving the Trump administration siding with Russia, North Korea, Iran and Belarus, and a handful of other authoritarian states.
“If this was a Democrat that was doing this, everyone would be saying, well, he’s on his way to the Nobel Peace Prize,” Mr. Rubio said. “This is absurd. We are trying to end a war. You cannot end a war unless both sides come to the table, starting with the Russians, and that is the point the president has made. And we have to do whatever we can to try to bring them to the table to see if it’s even possible.”
The order from Mr. Hegseth was first reported by The Record, a cybersecurity publication from Recorded Future, which tracks cyberoperations. The Pentagon and U.S. Cyber Command declined to comment on the record, but a senior defense official, declining to allow use of her name, said that Mr. Hegseth had “no greater priority” than the safety of military members, including in cyberoperations.
After the publication of this article, Senator Chuck Schumer, Democrat of New York and the minority leader, said in a statement that Mr. Trump appeared to be giving Mr. Putin “a free pass as Russia continues to launch cyberoperations and ransomware attacks against critical American infrastructure.” He called the administration’s move “a critical strategic mistake.”
As the Trump administration prepared to take office, departing Biden administration officials urged Mr. Trump’s appointees to keep the pressure on Russia, including by continuing to arm Ukraine and push back on the GRU and the SVR, two Russian intelligence agencies that have been behind some of the most aggressive Russian cyberattacks and espionage operations.
They specifically briefed the Trump officials on suspected Russian efforts to cut communications cables undersea, and the U.S. effort last year to get a message to Mr. Putin about the consequences if an effort to put explosives on cargo planes resulted in an air disaster. American intelligence agencies concluded that Russia’s ultimate goal was to send those packages to the United States.
During Mr. Trump’s first term, American cyberoperations against Russia were, if anything, ramped up. The National Security Agency created a “Russia Small Group” after the Russian interference in the 2017 election
Mr. Trump gave Cyber Command new authorities in his first term to conduct offensive cyberoperations without direct presidential approval in a classified document known as National Security Presidential Memorandum 13.
One of those operations was a stepped-up effort to probe Russia’s electric power grid, an effort first disclosed by The New York Times and one likely meant as a warning to Russia not to interfere with American critical infrastructure. Mr. Trump denounced that reporting as “a virtual act of Treason,” but his former aides later said he was concerned the revelation would affect his relationship with Mr. Putin.
