October 28, 2019
The zero-day war? How cyber is reshaping the future of the most combustible conflicts
As tensions rage beneath the Middle East cauldron, the expanded employment of cyber operations is preventing the region from boiling over. An October 17 Reuters report detailing the United States’ covert cyber operation against Iran, in response to the September 14 attacks on oil facilities in Saudi Arabia, underscores the inclination of states to utilize cyber operations and points to broader strategic implications in the region. Israeli-Saudi security cooperation quietly incubated over mutual intolerance toward an expansionist Iran is blossoming into a gradually open relationship, with cyber at its heart. Bonds such as these, forged behind closed doors, provide options for de-escalatory approaches to regional conflict.
Conventional wisdom would suggest that scaled-up capabilities, growing competition, and the proliferation of malware across cyberspace presents a legitimate risk of escalation in state conflict, transcending the cyber domain toward the kinetic. However, recent history has shown that states have more often availed themselves of their offensive cyber arsenals to achieve surprisingly de-escalatory effects. Offensive cyber operations sit low on the escalation ladder— the figurative scale ranging from diplomatic engagement to all-out nuclear war—and provide states with means of signaling adversaries without using force, and potentially even deescalating tense or provocative situations. Through this lens, there is a case to be made for the responsible diffusion of malware as a tool of diplomacy and statecraft to de-escalate regional conflict.
Cyber operations have served this exact de-escalatory purpose throughout recent tensions in the Persian Gulf. When the Lincoln Carrier Strike Group was deployed to the Persian Gulf in May 2019, after intelligence detected an Iranian threat to US assets in the area, Washington signaled that it was prepared to meet potential Iranian aggression with airstrikes. US President Donald J. Trump went as far as to tweet that the United States was “cocked & loaded,” alluding to a kinetic response option, but instead, the US deployed malware to neutralize the Iranian threat, while demonstrating that Tehran’s provocations would not go unchecked. The United States does not have an appetite for a large-scale deployment of ground forces, which could foreseeably succeed a major escalation, so its decision to prioritize cyber response options underscores Washington’s desire to cool things down and reassert its control by utilizing short-of-war tactics. A similar strategy is playing out some 1,400 miles away, on the eastern shores of the Mediterranean Sea.
While remaining largely out of the fray, Israel is closely monitoring tensions in the Persian Gulf. Israel, like the United States, remains chiefly concerned with breaking Tehran’s spreading influence and power in the region, but does not want to bear the risk of doing so alone. Iran has supplied and employed several proxy militias to exert pressure on Israel and draw Jerusalem’s focus to several fronts at once. This strategy has forced Israel into a heightened operational tempo in which it is now conducting interdiction operations against illicit Iranian-backed materiel transports in Syria, Iraq, Lebanon, Gaza, and the West Bank. This dilemma has led Israel to utilize unconventional tactics and seek assistance from unlikely sources.
On August 22, 2019, Reuters reported that Israel’s Ministry of Defense recently eased export control rules on certain malware and will allow Israeli companies to more quickly obtain exemptions for marketing to more countries than previously possible. Until the Defense Ministry’s recent shift in posture, sales by Israeli companies of advanced malware often faced intense scrutiny and a lengthy approval process lasting upwards of a year. Permits were granted sparingly for sales to a select group of closely vetted allied countries. Under the newly relaxed regulations, not only has the approval process been shortened to as few as four months, but also the Defense Ministry has indicated that the group of allowable buyers has expanded. While maintaining that Israel’s export controls remain more stringent than those of the United States and UK, Israel’s Defense Ministry has asserted that the rule change will allow Israeli companies to compete in the global marketplace.
Israel has less openly discussed how the rule change was largely spurred by opportunities for regional security cooperation. Indications that Israeli spyware—software that enables users to surreptitiously reap information from another user’s hard drive—and other forms of malware are destined for purchase by Saudi Arabia and the United Arab Emirates have raised eyebrows amongst rights advocacy groups.
Cyber Statecraft Initiative Updates
Sign up for the Cyber Statecraft Initiative newsletter to stay up to date on the program’s work.
In 2018, Citizen Lab assessed with “high confidence” that the phone of Saudi dissident Omar Abdulaziz was the target of a spyware known as Pegasus, developed by the Israeli cyber intelligence firm NSO Group. Pegasus is designed to exploit a target’s Android or iPhone to gain access to personal files, media, and communication history. The spyware can also surreptitiously snoop on a target through their device’s cameras and microphones. While NSO Group markets its products “exclusively to licensed government intelligence and law enforcement agencies to fight crime and terror,” and maintains contractual obligations requiring that customers not violate human rights, governments have demonstrated a knack for abusing these technologies. While these human rights concerns over these malware exports are justifiable, the de-escalatory and even ethical role of offensive cyber operations cannot be ignored.
Malware sales from Israeli firms to the Saudi government contribute to a growing rapprochement between the two countries and a historic opportunity to improve long-term stability in the region. In reference to utilizing technology as a means to strengthen ties with neighbors that have avoided formal relations, Isaac Ben-Israel, a top cyber expert and Chairman of the Israeli Space Agency, stated, “this is a legitimate tool of diplomacy.”
As Iran and its proxies, namely Hezbollah, aim to draw adversaries into armed conflict, the de-escalatory potential of cyber operations gives countries like Israel and Saudi Arabia off-ramps in tense situations. While kinetic options could escalate conflict and draw the ire of the international community, cyber operations can provide de-escalatory alternatives under challenging operational circumstances like southern Lebanon and Syria, where Hezbollah has embedded caches of increasingly sophisticated munitions deep within civilian population centers. With help from Iran, Hezbollah has been constructing precision missile factories in Lebanon’s Bekaa Valley, where the group is effectively baiting Israel into conducting kinetic operations where it does not want to. The Second Lebanon War did not go well for Israel, as Hezbollah’s guerrilla tactics forced the withdrawal of Israeli forces from southern Lebanon. Avoiding a similarly costly foray onto Hezbollah’s home turf southern Lebanon remains in Israel’s best interest.
Concerns over potential misuse of cyber tools to quash internal dissent and suppress democratic values are legitimate and should be taken seriously. So, too, should the ethical case for the responsible utilization of these tools. The de-escalatory and diplomatic effects offensive cyber operations can bring to bear make them legitimate tools of statecraft in navigating regional conflict. In 1967, Israel disposed of its enemies in just six days. With the potentially de-escalatory effects of offensive cyber operations, could we be in the midst of the zero-day war?
Simon Handler is a program assistant with the Atlantic Council’s Cyber Statecraft Initiative under the Scowcroft Center for Strategy and Security, focused on the nexus of geopolitics and national security with cyberspace. He is a former special assistant in the United States Senate. Follow him on Twitter @SimonPHandler.
New Atlanticist Sep 17, 2019
The American way of cyber warfare and the case of ISIS
By JD Work
The Cyber Vault collection shows the complexity in design and executing offensive cyber operations which help distinguish an ‘American way’ of cyber warfare—one that is no doubt closely mirrored by many of our allies.
Report Apr 24, 2019
Cybersecurity: Changing the model
By Franklin D. Kramer and Robert J. Butler
The need to update the cybersecurity model is clear. An enhanced public-private model – based on coordinated, advanced protection and resilience – is necessary to protect key critical infrastructure sectors
New Atlanticist May 22, 2019
Crossing the cyber Rubicon: Views from both sides of the river
By Jack Watson and William Loomis
Did the IDF’s airstrike ‘cross the Rubicon’ by using lethal force in response to hacking? On the weekend of May 5, a month after a truce was agreed between Israel and Hamas forces in the Gaza Strip, violence again rose to levels not seen since 2014.