They inserted malware that, once the updates were installed by government agencies and companies, would give them broad access to computer systems. From there they could build “back doors” that would enable them to come and go, steal data and — though it apparently hasn’t happened yet — alter data or conduct destructive attacks.
“This was a cybersecurity superspreading event,’’ Brad Smith, the president of Microsoft Corporation, said in an interview on Thursday evening. “And I would argue that this is more than just spying, it is the creation of a broad supply-chain vulnerability that requires a different kind of response. It created a vulnerability for the world in a way that other espionage techniques do not.”
Mr. Smith called it “a moment of reckoning.”
While Mr. Trump began his time in office with a strong cybersecurity team in the White House, his third national security adviser, John R. Bolton, ousted them and eliminated the post of a cyber czar with direct access to the president. The new National Defense Authorization Act, which Mr. Trump is threatening to veto for other reasons, would recreate such a post. It is one of several recommendations from a bipartisan Cyberspace Solarium Commission that wrote a report earlier this year, before the Russian attack was known.
Yet until Mr. Pompeo, who ran the C.I.A. for the first two years of the Trump administration, made his assessment in an interview on “The Mark Levin Show,” the administration had all but ignored the attack in public — perhaps realizing that an administration that came into office on the heels of Russian interference in the 2016 election was leaving as the victim of one of Russia’s most well-executed cyberattacks.
“This was a very significant effort,” Mr. Pompeo said, adding that “we’re still unpacking precisely what it is.” He said he expected most of the details would remain classified.
He did not mention that the hackers had gotten into his own workplace — the State Department — nor did he say whether they were only in unclassified spaces. He also made no mention of the fact that the Treasury Department and American nuclear laboratories like Los Alamos were hit.
“We have failed to deter the Russians,” Senator Chris Coons of Delaware, a Democrat who is close to Mr. Biden, said on Thursday. “We are only going to see Putin stop this action when we stop him,” he said. “This is as aggressive to our intelligence and military systems as anything in my lifetime.”
