NJ Security Chief: No Credible Russian Cyber Threat, Yet

What happened

On April 8, 2022, NJ Spotlight News sat down with Laurie Doran, then director of the New Jersey Office of Homeland Security and Preparedness (NJOHSP), to discuss the state's newly released annual threat assessment and the security fallout from Russia's invasion of Ukraine 19. Doran's message was carefully calibrated: there was no credible, known threat to New Jersey's cybersecurity or infrastructure at that moment, but her agency remained on alert 9. That framing — reassurance paired with a warning to stay vigilant — echoed language coming out of Washington at the same time, where the Cybersecurity and Infrastructure Security Agency (CISA) was telling the entire country to raise its guard even though it, too, had no specific intelligence pointing to an imminent attack 101115.

The timing was not incidental. Russia had massed more than 100,000 troops on Ukraine's border, and U.S. officials were warning an invasion could come "any day now" 15. CISA Director Jen Easterly had launched a "Shields Up" campaign days earlier, on Feb. 18, urging critical-infrastructure operators and general businesses alike to adopt multi-factor authentication, test backup systems, designate incident-response teams and lower their threshold for reporting suspicious activity to the government 1011. By late February, as the invasion proceeded, CISA's warnings sharpened further with alerts about destructive Russian wiper malware — HermeticWiper and Whispergate — that could spread beyond Ukraine's borders the way the 2017 NotPetya attack once did, causing more than $10 billion in global damage 17.

What New Jersey's threat assessment actually covered

Doran's on-camera reassurance about Russian cyber risk was only one thread in a much larger document. NJOHSP's 2022 Threat Assessment ran 42 pages and rated multiple categories of danger to the state 1213. White supremacist extremism was rated "high," with the agency citing at least 28 attacks nationally over the prior five years that killed 52 people and injured 79 1214. Homegrown violent extremists inspired by foreign terrorist groups were also flagged as a top concern, with the report noting ten arrests nationwide in 2021 tied to attack planning, financial support or attempted travel to join groups like ISIS, including a New York couple who tried to board a cargo ship in Newark 12. Anti-government extremists, some connected to the Jan. 6 Capitol riot, were rated "moderate," alongside anarchist, anti-abortion, militia, sovereign-citizen and Black racially motivated extremist movements 12. Foreign terrorist organizations based abroad were judged a "low" direct threat to the state, even as they continued trying to inspire attacks from afar 12. On cyber, the report warned that foreign governments and criminal actors could target infrastructure or steal intellectual property, and noted that cyberattacks had already hit New Jersey government agencies, businesses and residents throughout 2021 12.

The report also tracked how extremist movements organize, pointing to growing use of encrypted platforms like Telegram, Parler and Gab to spread propaganda, recruit and coordinate 12. That focus on the online environment reflected a broader federal concern echoed in a June 2022 Department of Homeland Security terrorism bulletin, which warned that foreign actors including Russia, China and Iran were amplifying conspiracy theories to deepen domestic discord, and that lone offenders motivated by a mix of grievance and ideology remained the primary mass-casualty threat in the country 18.

The Russia-specific cyber warnings

Outside New Jersey, the loudest and most detailed coverage centered on federal and state-level cyber guidance tied directly to the Ukraine conflict. CISA's "Shields Up" advisory, published in mid-February 2022, cited Russia's history of using cyber operations as a tool of geopolitical pressure, including the 2015 BlackEnergy malware attacks that knocked out power in parts of Ukraine 101115. The agency recommended organizations monitor and isolate traffic connected to Ukrainian entities, keep software patched, disable unnecessary ports, and prepare crisis-response plans 11. The Department of Homeland Security had separately assessed weeks earlier that Russia might consider a cyberattack on the U.S. homeland if it believed an American or NATO response to an invasion threatened its own security interests 15.

New Jersey's own cyber arm, the NJ Cybersecurity and Communications Integration Cell (NJCCIC), issued a parallel warning on Feb. 15, cautioning that malicious cyber activity was likely to increase alongside the conflict, and that businesses with financial or operational ties to Russia or Ukraine faced heightened exposure even without being direct combatants 16. A former senior NJOHSP official quoted in that reporting suggested ordinary residents had little to fear directly, but that companies with Russian or Ukrainian business interests should be far more concerned, and predicted a back-and-forth pattern of cyberattacks tied to the conflict without ruling out unintended spillover into U.S. or New Jersey systems 16.

Where the reporting agrees

Across NJ Spotlight News, CISA's own statements, and the trade and legal coverage of the "Shields Up" campaign, the language is strikingly consistent: officials at every level said there was no specific, credible intelligence pointing to an imminent attack on U.S. or New Jersey systems, while simultaneously urging organizations not to relax 910111517. Multiple outlets — NorthJersey.com, NJOHSP's own materials, and the state's later 2024 assessment — agree that New Jersey's most persistent terrorism threats were domestic rather than foreign-directed, driven by white racially motivated extremists and homegrown violent extremists radicalized largely online 121319. There is also agreement that Russian cyber capability was real and historically demonstrated, with CISA, the trade press and legal commentary all pointing to the same reference points: the 2015 BlackEnergy attacks on Ukrainian utilities and the 2017 NotPetya worm that caused billions in global damage after escaping its intended target 10111517.

Where it doesn't

The most notable divergence is one of emphasis rather than fact. NJ Spotlight News's own framing led with Russian cyber risk and Doran's reassurance that no credible threat existed 19, while NorthJersey.com's coverage of the same underlying 2022 assessment barely engaged with Russia at all, instead foregrounding white supremacist and homegrown extremist violence as the state's defining security concern 12. Neither outlet contradicts the other on facts, but they tell readers to worry about different things from the same document. There is also a difference in how confidently sources describe risk to ordinary New Jerseyans versus businesses: the analysis piece on Russia and New Jersey's cyber exposure attributes to a former NJOHSP official the judgment that regular residents had little to worry about while companies with Russian or Ukrainian ties faced real exposure — a claim resting on a single anonymous former official's assessment rather than an official NJOHSP finding 16. Coverage of CISA's guidance also shows minor variation in tone: TechTarget and The Hill both quote CISA's "no specific credible threats" language verbatim, but The Hill places more weight on the possibility of an imminent Russian invasion driving the alert's timing, while the legal-industry commentary on the later HermeticWiper alert treats spillover into U.S. and European systems as a rising, almost expected probability rather than a remote contingency 111517.

The reading the evidence supports

Taken together, the coverage does not support treating "no credible threat" as a signal that New Jersey, or the country, faced low actual risk. Every official quoted — from Doran to CISA's Easterly to DHS's own January 2022 assessment — paired that reassurance with active preparation: patching systems, drafting incident-response plans, monitoring Ukrainian-linked traffic, and lowering the bar for reporting anomalies 9101115. That is the language of people managing an assessed but unrealized risk, not people declaring the risk absent. The more durable finding, corroborated by New Jersey's own 2024 follow-up assessment showing the region accounted for 37 percent of U.S. homegrown violent extremist activity in recent years, is that the state's most persistent and demonstrated danger was homegrown extremism rather than a Russian cyberattack that, as of this reporting, never materialized against New Jersey specifically 19. The Russia-Ukraine cyber warnings were prudent and grounded in real historical precedent, but the record available shows caution exercised against a contingency, while the extremism threat was one NJOHSP's own data said was already being realized.