Both officials declined to specify what actions President Barack Obama has approved, but said targeted economic sanctions, indictments, leaking information to embarrass Russian officials or oligarchs, and restrictions on Russian diplomats in the United States are among steps that have been discussed.

One decision that has been made, they said, speaking on the condition of anonymity, is to avoid any moves that exceed the Russian election hacking and risk an escalating cyber conflict that could spiral out of control. One example of an excessive step might be interfering with Russian Internet messaging.

The FBI, CIA, and Office of Director of National Intelligence agree that Russia was behind hacks into Democratic Party organizations and operatives ahead of the Nov. 8 presidential election. There is also agreement, according to U.S. officials, that Russia sought to intervene in the election to help Trump, a Republican, defeat Democrat Hillary Clinton.

Get Data Sheet, Fortune’s technology newsletter.

Russia has repeatedly denied hacking accusations. Trump has dismissed the assessments of the U.S. intelligence community.

Obama, in an interview earlier this month with NPR, said, “We need to take action and we will” against Russia for interfering in the U.S. election.

Russia’s Foreign Ministry spokeswoman, Maria Zakharova, promised retaliation on Wednesday against Washington in the event of new economic sanctions.

Jim Lewis, a cyber security expert with the Center for Strategic and International Studies think tank, said further sanctions may be an effective U.S. tool in part because they would be difficult for Trump to roll back and because Russia “hates” dealing with them.

“For the rest of the world, it’s like having ‘scumball’ stamped on your forehead,” Lewis said.

How to respond to the growing problem of cyber attacks carried out or sponsored by foreign powers has bedeviled Obama, whose eight years in office witnessed a torrent of major hacks against the U.S. government and private organizations that were attributed to China, North Korea, Iran and Russia.

In past cases, administration officials have decided to publicly blame North Korea and indict members of China’s military for hacking because they decided the net benefit of public shaming—and increased awareness brought to cyber security—outweighed potential risks.

But determining an appropriate response to Russia’s actions has proven more complicated in part because Russia’s cyber capabilities are more advanced and due to fears about disrupting other geopolitical issues, such as the civil war in Syria.

Obama may choose to invoke an April 2015 executive order that empowered him to levy sanctions in response to cyber attacks perpetrated by foreign groups targeting infrastructure, such as transportation, or done for economic purposes.

One option, said a U.S. government official who has participated in discussions on possible retaliation, would be leaking material on Russian officials or actions that the United States already has obtained in a way that would “parallel what the Russians did, but be impossible to prove.”

The official compared that option to Russian military and civilian intelligence agencies providing hacked material to the anti-secrecy group Wikileaks and trying—unsuccessfully, the official said—to cover their tracks.

Another option would be further economic sanctions against Russia. Washington has already sanctioned Russia over the past two years to punish Moscow for its role in annexing Crimea. But former U.S. officials say the existing measures leave Washington plenty of room to slap new, tougher sanction on Russia in response to cyber intrusions.

The Ukraine sanctions were “narrowly tailored” to hurt specific sectors of Russian industry, such as the energy sector, without causing the nation’s economy to tank, said Juan Zarate, a former assistant secretary of the Treasury for terrorist financing and financial crimes.

The United States took a more measured approach, in part, to reserve tougher measures in case the situation worsened, said Zarate, chairman of the Financial Integrity Network, a private consulting firm that advises on financial threats.

The United States is still unlikely to impose blanket embargoes against Russia because of the danger it could harm the economies of Western Europe, said Peter Harrell, a former senior State Department official who worked on sanctions policy.

Instead, the United States may target specific Russian intelligence officials or military divisions believed to be involved in the cyber intrusions. “The Russian defense sector would be fair game,” Harrell said.

[fortune-brightcove videoid=5244893915001]

Looming over any action the Obama administration takes against Russia is whether Trump will seek to reverse course once he takes office on Jan. 20.

In addition to casting doubt on the conclusions of the U.S. intelligence community about the hacks, Trump has repeatedly praised Russian President Vladimir Putin and nominated people seen as friendly toward Moscow to senior administration posts.