"I do think we can say this. At this stage we have seen substantial evidence that points to the Russian foreign intelligence agency. And we have found no evidence that leads us anywhere else," Smith said in a testimony to the Senate Select Committee on Intelligence.
US officials have said they agree that Russian hackers are likely behind a massive cyberattack that targeted at least nine federal agencies and 17,000 private companies. The suspects reportedly embedded malware in SolarWinds updates and patches to penetrate the networks in search for sensitive data. Russia has denied the allegations.
"We will wait for the rest of formal steps to be taken by the government and others. But there is not a lot of suspense at this moment," Smith said.
President and CEO of the CrowdStrike cybersecurity company George Kurtz agreed that there is no information available to him that would suggest that suspicions against Russia are incorrect.
"We are aware that the US government has stated this threat actor is likely of Russian origin. While we are currently unable to corroborate that finding, we have no information to suggest it’s incorrect," he said during the Senate hearing.
Smith, whose company analyzed the attack in great detail, estimated that at least a thousand very skilled, capable engineers participated in it.
"We haven’t seen this kind of sophistication matched with this kind of scale," he said.
Smith denounced the attack as an indiscriminate "act of recklessness" without "clear analogy or precedent." He called for attribution and accountability for the culprits.
"The world relies on the patching and updating of software... for everything. For physical infrastructure, for hospitals, roads, airports, because they are all run on software. To disrupt, to damage, to temper with that kind of software updating process is my opinion to tamper with what is in effect the digital equivalent of our public health service. It puts the entire world at a greater risk," he said.
The White House confirmed on Monday that it is weeks away from responding to the SolarWinds attack.
