[ivan_gammel]

Proof of any damage or an apparently hostile action that could cause damage, that was confirmed to be done by Russian state actors. Crowdstrike report shows only signs of intrusion, but you would not expel 35 diplomats for a radar touching your airplanes, right?

[thomasdub]

The report shows far more than signs of intrusion - modules for credential theft, data transmission, persistence mechanisms, keylogging etc. were all discovered. I'd call that hostile.

I'm not sure I get your analogy, but no, I wouldn't expel anyone for "radar touching my planes", but in this case that's the equivalent of browsing the DNC website. If someone had broken into my airforce base, stolen security badges to get into other airforce bases, was photographing planes and stealing and leaking blueprints then you better believe I'd take action