The zero-day war? How cyber is reshaping the future of the most combustible conflicts

Sr Airman Jose Rivera, infrastructure technician U.S. Air Force, works at the 561st Network Operations Squadron (NOS) at Petersen Air Force Base in Colorado Springs, Colorado July 20, 2015. REUTERS/Rick Wilking

As
tensions rage beneath the Middle East cauldron, the expanded employment of
cyber operations is preventing the region from boiling over. An October 17
Reuters report
detailing the United States’ covert cyber operation against Iran, in response
to the September 14 attacks on oil facilities in Saudi Arabia, underscores the inclination
of states to utilize cyber operations and points to broader
strategic implications in the region. Israeli-Saudi security cooperation
quietly incubated over mutual intolerance toward an expansionist Iran is
blossoming into a gradually open relationship, with cyber at its heart. Bonds
such as these, forged behind closed doors, provide options for de-escalatory
approaches to regional conflict.

Conventional
wisdom would suggest that scaled-up capabilities, growing competition, and the
proliferation of malware across cyberspace presents a legitimate risk of
escalation in state conflict, transcending the cyber domain toward the kinetic.
However, recent history has shown that states have more often availed
themselves of their offensive cyber arsenals to achieve surprisingly de-escalatory
effects. Offensive cyber operations sit low on the escalation ladder— the
figurative scale ranging from diplomatic engagement to all-out nuclear war—and
provide states with means of signaling adversaries without using force, and
potentially even deescalating tense or provocative situations. Through this
lens, there is a case to be made for the responsible diffusion of malware as a
tool of diplomacy and statecraft to de-escalate regional conflict.

Cyber
operations have served this exact de-escalatory purpose throughout recent
tensions in the Persian Gulf. When the Lincoln Carrier Strike Group was deployed
to the Persian Gulf in May 2019, after intelligence detected an Iranian threat
to US assets in the area, Washington signaled that it was prepared to meet
potential Iranian aggression with airstrikes. US President Donald J. Trump went
as far as to tweet
that the United States was “cocked & loaded,” alluding to a kinetic
response option, but instead, the US deployed malware to neutralize the Iranian
threat, while demonstrating that Tehran’s provocations would not go unchecked.
The United States does not have an appetite for a large-scale deployment of
ground forces, which could foreseeably succeed a major escalation, so its
decision to prioritize cyber response options underscores Washington’s desire
to cool things down and reassert its control by utilizing short-of-war tactics.
A similar strategy is playing out some 1,400 miles away, on the eastern shores
of the Mediterranean Sea.

While
remaining largely out of the fray, Israel is closely monitoring tensions in the
Persian Gulf. Israel, like the United States, remains chiefly concerned with
breaking Tehran’s spreading influence and power in the region, but does not
want to bear the risk of doing so alone. Iran has supplied and employed several
proxy militias to exert pressure on Israel and draw Jerusalem’s focus to
several fronts at once. This strategy has forced Israel into a heightened
operational tempo in which it is now conducting interdiction operations against
illicit Iranian-backed materiel transports in Syria, Iraq, Lebanon, Gaza, and
the West Bank. This dilemma has led Israel to utilize unconventional tactics
and seek assistance from unlikely sources.

On
August 22, 2019, Reuters reported
that Israel’s Ministry of Defense recently eased export control rules on
certain malware and will allow Israeli companies to more quickly obtain
exemptions for marketing to more countries than previously possible. Until the
Defense Ministry’s recent shift in posture, sales by Israeli companies of
advanced malware often faced intense scrutiny and a lengthy approval process
lasting upwards of a year. Permits were granted sparingly for sales to a select
group of closely vetted allied countries. Under the newly relaxed regulations,
not only has the approval process been shortened to as few as four months, but
also the Defense Ministry has indicated that the group of allowable buyers has
expanded. While maintaining that Israel’s export controls remain more stringent
than those of the United States and UK, Israel’s Defense Ministry has asserted
that the rule change will allow Israeli companies to compete in the global
marketplace.

Israel
has less openly discussed how the rule change was largely spurred by
opportunities for regional security cooperation. Indications that Israeli spyware—software
that enables users to surreptitiously reap information from another user’s hard
drive—and other forms of malware are destined for purchase by Saudi Arabia and
the United Arab Emirates have raised eyebrows amongst rights advocacy groups.

In 2018, Citizen Lab assessed with “high confidence” that the phone of Saudi dissident Omar Abdulaziz was the target of a spyware known as Pegasus, developed by the Israeli cyber intelligence firm NSO Group. Pegasus is designed to exploit a target’s Android or iPhone to gain access to personal files, media, and communication history. The spyware can also surreptitiously snoop on a target through their device’s cameras and microphones. While NSO Group markets its products “exclusively to licensed government intelligence and law enforcement agencies to fight crime and terror,” and maintains contractual obligations requiring that customers not violate human rights, governments have demonstrated a knack for abusing these technologies. While these human rights concerns over these malware exports are justifiable, the de-escalatory and even ethical role of offensive cyber operations cannot be ignored.

Malware
sales from Israeli firms to the Saudi government contribute to a growing
rapprochement between the two countries and a historic opportunity to improve
long-term stability in the region. In reference to utilizing technology as a
means to strengthen ties with neighbors that have avoided formal relations,
Isaac Ben-Israel, a top cyber expert and Chairman of the Israeli Space Agency,
stated, “this is a legitimate tool of diplomacy.”

As Iran and its proxies, namely Hezbollah, aim to draw
adversaries into armed conflict, the de-escalatory potential of cyber
operations gives countries like Israel and Saudi Arabia off-ramps in tense
situations. While kinetic options could escalate conflict and draw the ire of
the international community, cyber operations can provide de-escalatory
alternatives under challenging operational circumstances like southern Lebanon
and Syria, where Hezbollah has embedded caches of increasingly sophisticated
munitions deep within civilian population centers. With help from Iran,
Hezbollah has been constructing precision
missile factories in Lebanon’s Bekaa Valley, where the group is
effectively baiting Israel into conducting kinetic operations where it does not
want to. The Second Lebanon War did
not go well for Israel, as Hezbollah’s guerrilla tactics
forced the withdrawal of Israeli forces from southern Lebanon. Avoiding a
similarly costly foray onto Hezbollah’s home turf southern Lebanon remains in Israel’s best interest.

Concerns over potential misuse of cyber tools to quash
internal dissent and suppress democratic values are legitimate and should be
taken seriously. So, too, should the ethical case for the responsible
utilization of these tools. The de-escalatory and diplomatic effects offensive
cyber operations can bring to bear make them legitimate tools of statecraft in
navigating regional conflict. In 1967, Israel disposed of its enemies in just
six days. With the potentially de-escalatory effects of offensive cyber
operations, could we be in the midst of the zero-day war?

Simon Handler is a program assistant with the Atlantic Council’s Cyber Statecraft Initiative under the Scowcroft Center for Strategy and Security, focused on the nexus of geopolitics and national security with cyberspace. He is a former special assistant in the United States Senate. Follow him on Twitter @SimonPHandler.

Further reading:

Tue, Sep 17, 2019

The American way of cyber warfare and the case of ISIS

The Cyber Vault collection shows the complexity in design and executing offensive cyber operations which help distinguish an ‘American way’ of cyber warfare—one that is no doubt closely mirrored by many of our allies.

New Atlanticist
by
JD Work

Wed, Apr 24, 2019

Cybersecurity: Changing the model

The need to update the cybersecurity model is clear. An enhanced public-private model – based on coordinated, advanced protection and resilience – is necessary to protect key critical infrastructure sectors

Report
by
Franklin D. Kramer and Robert J. Butler

Wed, May 22, 2019

Crossing the cyber Rubicon: Views from both sides of the river

Did the IDF’s airstrike ‘cross the Rubicon’ by using lethal force in response to hacking? On the weekend of May 5, a month after a truce was agreed between Israel and Hamas forces in the Gaza Strip, violence again rose to levels not seen since 2014.

New Atlanticist
by
Jack Watson and William Loomis

Comments are closed.