President Barack Obama’s imposition of sweeping new sanctions against Russian spies is long overdue, risky and tarnished by political calculation. It is also the right thing to do.

The White House said Thursday it planned to toss 35 suspected spies and their families out of the country; sanction two intelligence agencies, four intelligence officers, three companies and two alleged hackers; shut two compounds used by Russian diplomats; and take “a variety of other actions,” some of which will be covert. The penalties were in response to a long list of Russian provocations, most recently -- and explosively -- its interference in the US presidential election. They were accompanied by a detailed report.

In espionage, as in nuclear strategy, the name of the game is risk management. And on this score, the president’s actions were properly calibrated.

Ejecting the spies has already spurred retaliation, though the exact nature is uncertain. But it also makes clear that the US does not tolerate the routine harassment of its diplomats in Moscow, and sends a message that any future electoral cyberattacks will come with very high costs. That should offer reassurance (and perhaps a model) for European countries fearful that Russia has designs on their own elections.

Likewise, the sanctions placed on intelligence officials -- including travel bans and asset freezes -- signal that cyberattacks are no longer anonymous or beyond the reach of US law, and that the humans behind them can be identified and held liable. That won’t prevent all future attacks. But it should force perpetrators to think twice: After the US indicted five Chinese military hackers in 2014 for corporate espionage, such attacks all but ceased.

The promise of covert action is harder to judge without more details. A demonstration of US power in cyberspace might well concentrate minds. But it could also reveal sources and methods that are valuable to American spies, escalate a conflict in which the US has much more to lose, and set a dangerous precedent: The disclosure in 2010 that the US had used malware to sabotage Iran’s nuclear program seemed to legitimize a new form of cyberattack, and gave potential hackers plenty of new ideas. Caution should be the byword.

More constructively, the US has to come to an accommodation with Russia about norms of behavior in cyberspace. It should offer to cooperate on issues of common interest, such as terrorism. But it should also reserve the right to widen sanctions and penalties until Russia gets the message that the costs of cyberwarfare outweigh the benefits.

Which suggests a final concern. Obama clearly waited too long to make this announcement -- it would have been far more relevant before the election than after, and he should have had the confidence to let the politics adjust to his policy, instead of the other way around. That said, part of his intention now is surely to pressure his successor into taking this issue seriously. Assuming President-elect Donald Trump sees the need to defend American elections and institutions from foreign interference, Obama’s actions give him a good foundation. He’ll have to take it from there. 

(Bloomberg)