Iran: Strengthening Cyber Arsenal, Asymmetric Warfare in Cyberspace

Recently, the news outlet "Christian Science Monitor" published an analytical article titled "Why Iran is Strengthening its Cyber Arsenal," stating that before Tehran could benefit from the advantages of signing the Joint Comprehensive Plan of Action (JCPOA), hardliners in the Islamic Republic increased their cyber attacks against the Obama administration. According to reports, the Islamic Revolutionary Guard Corps (IRGC) hacked several email accounts and social media networks of officials associated with the Obama administration in November of this year, marking Iran's latest effort in cyber attacks against the United States. In fact, Iran's digital attacks are so extensive that in May of this year, the U.S. State Department issued an unprecedented security report warning American overseas businesses about the growing capabilities of Iran's cyber warfare. The mentioned news outlet stated in its report: "The continuous strengthening of Iran's cyber arsenal should not be surprising, as cyberspace is considered a vital frontline for most modern countries today. However, the Islamic Republic's focus on developing cyber weapons and hacking American and Middle Eastern targets should not be seen as a reaction to the Stuxnet malware." Nevertheless, some analysts link the Islamic Republic's cyber wars to the Stuxnet malware attack, which disabled 1,000 centrifuges in Iran's Natanz nuclear facility, believing that the U.S. initiated a cyber arms race with the Stuxnet attack, the unintended consequences of which have affected everyone. However, the "Christian Science Monitor" refutes these beliefs, stating that contrary to the common perception that the Stuxnet attack caused an arms race in cyberspace, this connection historically and strategically lacks significance. The news outlet continues: "Arms races in cyberspace reflect, rather than create, competition among countries, and their unique characteristics relate to the strategies and innovations of countries in communication technology. Following the destruction of the Iraqi army in 1991 by U.S. military forces, other countries concluded that they could not compete with the conventional military capabilities of the U.S. and thus turned to ways of achieving asymmetric superiority over U.S. forces." The strategic approach and means to achieve superiority for these countries are summarized in the book "Unrestricted Warfare," written in 1999 by two Chinese army colonels. The authors of this book consider the combination of technological capabilities in various fields, such as combining financial and economic capabilities with cyber operations alongside military actions and political influence, to be effective, emphasizing that mere weaponry cannot lead to strategic victories in the future. According to this book, the general concept of war no longer relies on the use of armed forces to push back the enemy but includes utilizing all available capabilities, such as military, civilian, lethal, and non-lethal. Thus, with such recommendations, Chinese hackers infiltrated U.S. websites in 1999 and 2001 during a diplomatic crisis between the two countries, leading to the establishment of cyber units in China with government initiative. Similarly, Russian hackers and pro-Russian individuals paralyzed Estonia's banking sector in 2007 when tensions between the two countries escalated, and in 2008, these hackers disabled part of Georgia's telecommunications system to pave the way for a Russian military attack on Georgia. Iran's interest in cyber warfare has similar roots and motivations. Since the end of the eight-year Iran-Iraq war, Iran's strategic culture has emphasized using proxy agents for nefarious actions and then denying responsibility or awareness of their actions. More importantly, Iran focuses on soft targets to pursue its strategic objectives beyond the capabilities of its conventional forces. In 2005, the IRGC formed a cyber army that hacked Twitter in December 2009 and disabled the largest search engine in China in January 2010. Other hacker groups affiliated with Iran's armed forces, such as Ashiyana, reported that between 2008 and 2010, they hacked thousands of websites in the U.S., Europe, and Gulf Arab countries due to disrespect and belittling of Iran. Thus, before the Stuxnet attack in 2010, all key players in Iran had engaged in the development and use of cyber weapons, reflecting the gradual growth of necessary strategies for asymmetric warfare. The Stuxnet attacks showcased the rift between Iran and the U.S. as a backdrop for cyber wars, and from this perspective, the impact of these attacks on accelerating Iran's cyber programs cannot be overlooked. The report from "Christian Science Monitor" refutes the views of some experts who argue that Stuxnet legitimized cyber warfare, stating that a country's decision to engage in cyber warfare depends on several factors, including the potential for the opponent's response and its possible damages. Despite these challenges and probabilities, which can inherently serve as a form of deterrence for the attacker, Russian and Chinese hackers, despite having the necessary capabilities, have not yet engaged in destructive attacks because attacks that impose significant damages on the U.S. economy would also have negative effects on the economies of Russia and China. Unlike Russia and China, Iran has no economic relations with the U.S., and thus its limitations for destructive attacks are less, exemplified by the 2012 cyber attacks against Saudi Aramco (Saudi Arabia's national oil company), which disabled 30,000 of the company's computers. Another example is Iran's attacks against Las Vegas Sands Corp (the largest gambling company) in the U.S., which caused $40 million in damages. The news outlet continues, stating that with the lifting of international sanctions against Iran following the comprehensive nuclear agreement, the Islamic Republic may reconsider its approach to cyber attacks. "However, the repeated violations of international norms by the Islamic Republic, including the disrespect for embassies and their immunity from assault, the non-prohibition of terrorism and assassination abroad, etc., indicate that for Tehran, pursuing strategic interests takes precedence over economic interests." It is worth noting that conventional weapons become inoperative or destroyed upon hitting a target, but cyber weapons do not work this way, meaning that the intended target of cyber weapons can remain intact and then be utilized. For example, a few weeks after the Stuxnet attacks, an Egyptian blogger provided instructions for reproducing and copying this malware to the public. This action indicates that the Stuxnet attacks were not cost-free for the U.S. and that copying it provided an opportunity for other countries to reduce their "cyber distance" from the U.S. Therefore, caution must be exercised in using cyber weapons, and their consequences must be considered. The idea that Stuxnet fueled arms races in cyberspace and legitimized destructive cyber attacks implies that countries engaging in cyber warfare are merely reacting, and "countries that wish to challenge the U.S.-led international order will seek to have the upper hand in various methods of cyber warfare." In conclusion, the website warns American officials: "At the very least, Iran's recent cyber attacks against American targets indicate that America's peaceful efforts to change the behavior of the Islamic Republic in the virtual sphere are insufficient."