At a certain point, Russian cyber penetration becomes acts of war. We are approaching that point. Sure, a “Russian criminal gang” may well have shut down Colonial Pipeline, but nothing important happens in Russia without Kremlin permission. It’s time we started saying so.

So far, our cyber wake-up calls are more like snooze alarms. We hear the rings but fall back to sleep. Do we fully appreciate the present challenge? For Colonial Pipeline (28% owned by the Koch brothers), paying the $5 million ransom was cheaper than increased cybersecurity, backup systems and manual controls. Colonial exemplifies what Daniel Yergin observed: Firms eliminate redundancy and resiliency in order to maximize economic efficiency and profits.

Such risk-taking, though, heads us straight toward catastrophe because soon hackers, many at the behest of hostile states, are really going to shut the country down.

What can be done besides, obviously, tightening cybersecurity? Eventually, we’ll need to retaliate. This, of course, is tricky and dangerous because it can easily escalate into kinetic (goes bang) warfare, even nuclear exchanges.

I therefore do not blame President Biden for acting prudently in suggesting that the “criminal gangs” may be Russian but not state-linked. The U.S. Cyber Command surely knows better. We were able to pinpoint Russia’s 2016 trolls to the Internet Research Agency in St. Petersburg, owned by a Putin stalwart. We need not, like Trump did, downplay these connections: The Russians know that we know.

We might demand that Moscow immediately arrest and extradite the ransomers to the U.S. That, of course, won’t happen; Moscow will claim to know nothing of criminal activities. If we accept that denial, we show weakness in defending ourselves.

No, we’re probably going to have to use a modicum of our cyber capabilities by shutting down something in Russia, a proportional retaliation but not trivial or symbolic. Americans tend (from playing poker) to bluff. We don’t want the conflict to escalate into total war, but we must deliver a credible foretaste of our cyber abilities.

We might dust off the old “letters of marque” concept — in the Constitution but unused since 1815 — that licensed privateers to capture enemy merchant ships (as Francis Drake practiced on Spanish gold galleons). Washington could tacitly let private American hackers plant worms and malware in Russian networks. (I suspect we’ve already done it.) Then ask Putin, “How far do you want to take this?” Neither side would have to admit anything, but they would be warned to cease.

A U.S.-Russia understanding — preferably a multinational treaty that others later join — could form the basis for a stable global cyber regime. Some might refuse to comply. Then we would have to make clear that they and the states that harbor them will suffer.

Cyber intrusions are only part of deteriorating U.S.-Russia relations. Our diplomats keep getting hit with focused energy beams that can cause permanent brain damage. This has happened in Cuba, China and even in D.C. suburbs. The nature of the targets — which include intel personnel — indicates that the assailants know whom they are targeting.

Russia’s brief experiment with democracy allowed a Radio Free Europe/Radio Liberty bureau in Moscow to file news stories. Putin always hated this and just initiated bogus charges to force RFE/RL out, in part retaliation for U.S. limits on Russian journalists.

In 2014, a major Czech ammunition depot blew up. Last month, Prague accused Russian saboteurs of the deed and expelled 18 Russian diplomats. Moscow, of course, retaliated. In 2014, Russia seized Crimea and Donbas from Ukraine with Russian “volunteers.” That Czech ammo could have supplied the Ukrainian military resisting Russian invasion. Russians, great chess players, plan their moves ahead.

Last month, Russia massed over 100,000 troops and much armor on its border with Ukraine, as if preparing for a full-scale invasion. Amid American and European outcries, Putin pulled back a few troops, but most, along with the armor and supplies, remain in place.

Kremlin behavior is not so mysterious: They’re scared. Russian energy exports boosted living standards but took a hit when oil prices collapsed. Much export revenue is stashed abroad, contributing nothing to Russia’s economy. More Russians denounce corruption and dictatorship, and Putin’s popularity is sliding. Hundreds of pro-Navalny supporters are arrested.

Putin’s hold on Donald Trump no longer helps Moscow. Upcoming U.S. legal proceedings will detail Russia’s pernicious role. Attorney General Barr can no longer block them. U.S.-Russian relations will get testier.

The cyber danger could be as big as the nuclear danger. Both can escalate without limit. Proliferations of both are hard to block; even poor countries can build nukes and hack servers. Drake’s depredations so enraged King Philip II that he ordered the gigantic Spanish Armada to invade England in 1588, but Drake’s ships and gunnery were better. Let’s make sure our cyber capabilities are also better.