When Executive Order 14024 was issued by President Biden after the invasion of Ukraine by Russia, I noticed that more than a few authorities seemed very much like thiose in “activity-based’ or “conduct-based” sanctions programs – like the Election Interference and Cyber programs. I had always assumed it was a way of creating a “universe” of malign Russian government actions (although, to be fair, those programs’ designations are usually populated by state actors, whether from Iran, North Korea or otherwise), rather than a universe of actors performing the same bad acts, regardless of affiliation.

So, I asked Gemini what it could find in online chatter:

Online sources, legal analyses, and government statements indicate the Biden administration issued Executive Order (E.O.) 14024 (“Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation”) instead of modifying existing activity-based programs for several strategic, legal, and administrative reasons.¹

The core distinction is that E.O. 14024 creates a status-based authority (targeting actors based on who they are or where they operate), whereas the Election Interference (E.O. 13848) and Cyber (E.O. 13694/13757) programs are conduct-based (targeting actors based on what they did).

Here is a breakdown of the specific reasons for this choice:

1. Lower Burden of Proof (Status vs. Conduct)

• Activity-Based Programs: To sanction someone under the Cyber or Election Interference E.O.s, the U.S. government must typically prove that a specific individual or entity engaged in, was complicit in, or materially supported a specific “bad act” (e.g., a specific hack or election influence campaign). Attribution in these areas can be technically difficult, slow, and classified.²
• E.O. 14024: This order authorizes sanctions against persons simply for “operating in” specific sectors of the Russian economy (e.g., technology, defense, financial services).³ This allows the government to designate targets based on their presence in a high-risk sector without needing to publicly prove their direct involvement in a specific cyberattack or election scheme. This creates a much faster and more flexible designation process.

2. Targeting the “Ecosystem” and Supply Chain

• Broader Reach: Existing activity-based sanctions often target the “tip of the spear”—the hackers or operatives directly carrying out attacks. E.O. 14024 was designed to target the broader ecosystem that supports them.
• Sectoral Authority: By authorizing sanctions on the Russian technology and defense sectors, the administration could target the companies that build the tools, provide the infrastructure, and fund the intelligence services that conduct these malign activities, even if those companies didn’t launch the attacks themselves.⁴

3. Consolidation and Modernization

• Unified Framework: Prior to E.O. 14024, responding to Russian aggression required a patchwork of authorities (some for Ukraine, some for Cyber, some for Election Interference, etc.). E.O. 14024 consolidated these into a single “Russian Harmful Foreign Activities” program.
• Comprehensive “National Emergency”: The order declares a distinct national emergency focused specifically on the totality of the Russian government’s malign behavior.⁵ This allows for a more holistic response where a single designation can cite multiple types of bad conduct (e.g., a target involved in both cyber espionage and election interference) under one legal roof.⁶

4. “Sword of Damocles” (Flexibility for Future Escalation)⁷

• Scalability: E.O. 14024 was written with built-in flexibility. It allows the Secretary of the Treasury (in consultation with the Secretary of State) to identify new sectors of the Russian economy for sanctions at any time without the President needing to sign a new Executive Order.⁸
• Deterrence: This structure serves as a standing threat that the U.S. can rapidly expand sanctions to other parts of the Russian economy (e.g., energy, mining, financial services) if Russian behavior continues or escalates.⁹

5. Attribution to the State

• Political Messaging: Activity-based sanctions like E.O. 13694 are global and country-agnostic—they apply to hackers in China, Iran, or North Korea equally. By issuing a Russia-specific order, the administration sent a diplomatic signal attributing these activities directly to the Government of the Russian Federation, framing them not as isolated crimes but as state-directed policy.¹⁰

Footnotes for Executive Order 14024 Analysis

1. Lower Burden of Proof (Status vs. Conduct)

• Status-Based Authority: E.O. 14024 allows for the imposition of sanctions on individuals and entities determined to “operate or have operated in the technology sector or the defense and related materiel sector of the Russian Federation economy” (Section 1(a)(i)).¹ This is a “status-based” authority, meaning designation is based on the target’s position within a sector rather than specific evidence of a malicious act.^1
• Conduct-Based Limitations: In contrast, the Cyber Sanctions program (E.O. 13694, as amended) requires the government to determine that a person is “responsible for or complicit in” specific cyber-enabled activities that harm national security.^2 Similarly, the Election Interference program (E.O. 13848) requires a determination that a person has “directly or indirectly engaged in, sponsored, concealed, or otherwise been complicit in” foreign interference in a U.S. election.^3

2. Targeting the “Ecosystem” and Supply Chain

• Sectoral Targeting: The Biden administration stated that E.O. 14024 was designed to target the “ecosystem” supporting Russia’s malign activities. By designating the technology and defense sectors, the order enables the Treasury to sanction companies that procure technology or manufacture components for the Russian intelligence services, even if those companies do not execute the attacks themselves.^4
• Supply Chain Disruption: Legal analysts note that this approach moves beyond the “tip of the spear” (the hackers) to the supply chain, allowing the U.S. to degrade the Russian government’s capabilities by cutting off access to western financial markets and technology for broad swaths of the Russian economy.^5

3. Consolidation and Modernization

• Unified Framework: Prior to E.O. 14024, sanctions authorities were fragmented across multiple emergency declarations (e.g., Ukraine-specific E.O. 13660, Cyber E.O. 13694, Election E.O. 13848). E.O. 14024 declares a new, comprehensive national emergency with respect to “specified harmful foreign activities of the Government of the Russian Federation,” creating a single legal chassis to address election interference, cyberattacks, transnational corruption, and extraterritorial activities.^6
• Holistic Response: This consolidation allows OFAC to cite multiple bases for a single designation, simplifying the administrative record and strengthening the legal defense of the designation if challenged in court.^7

4. “Sword of Damocles” (Flexibility for Future Escalation)²

• Scalability: The order grants the Secretary of the Treasury, in consultation with the Secretary of State, the authority to expand sanctions to any sector of the Russian economy without a new presidential order.^8 This was explicitly designed to provide “flexibility” and leverage, allowing the administration to ratchet up pressure by targeting additional sectors (as it later did with financial services, energy, and others following the 2022 invasion of Ukraine).^9³

5. Attribution to the State

• State-Directed Policy: The title of the order itself—”Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation“—is a deliberate diplomatic signal. Unlike the country-agnostic Cyber or Election orders, this order formally attributes these behaviors (SolarWinds, 2020 election interference) to the Russian state as a matter of U.S. policy.^10

---

Source References:

^1 Executive Order 14024, Federal Register, Vol. 86, No. 73 (April 19, 2021).

^2 Executive Order 13694, “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities” (April 1, 2015).4

^3 Executive Order 13848, “Imposing Certain Sanctions in the Event of Foreign Interference in a United States Election” (September 12, 2018).5

^4 White House Fact Sheet, “Imposing Costs for Harmful Foreign Activities by the Russian Government” (April 15, 2021).

^5 See, e.g., Miller & Chevalier, “Trade Compliance Flash: New Executive Order Expands Sanctions Risk in Russia” (April 21, 2021).6

^6 Id.

^7 Congressional Research Service, “U.S. Sanctions on Russia: Legal Authorities and Related Actions” (Updated 2024).

^8 Executive Order 14024, Section 1(a)(i).7

^9 Skadden, Arps, Slate, Meagher & Flom LLP, “US Imposes Additional Round of Sanctions on Russia” (April 22, 2021).8

^10 Id.