Iran’s Cyber Capabilities
The recent protests in Iran and the regime’s attempts to block them shed light also on Tehran’s cyber capabilities.
Offensive cyber operations have become a core tool of Iranian statecraft, providing Tehran less risky opportunities to gather information and retaliate against perceived enemies at home and abroad.
Cyber Incidents involving Iran have been among the most sophisticated, costly, and consequential attacks. Tehran has been among the leading targets of uniquely invasive and destructive cyber operations by the United States and its allies.
At the same time, Tehran has become increasingly adept at conducting cyber espionage and disruptive attacks against opponents at home and abroad, ranging from Iranian civil society organizations to governmental and commercial institutions in Israel, Saudi Arabia, and the United States.
A new report by The Carnegie Endowment evaluates Iran’s Cyber threat environment. Just as Iran uses proxies to project its regional power, Tehran often masks its cyber operations using proxies to maintain plausible deniability.
Yet such operations can frequently be linked to the country’s security apparatus, namely the Ministry of Intelligence and Islamic Revolutionary Guard Corps.
Iran’s cyber capabilities appear to be indigenously developed, arising from local universities and hacking communities. This ecosystem is unique, involving diverse state-aligned operators with differing capabilities and affiliations. Though Iran is generally perceived as a third-tier cyber power, lacking the capabilities of China, Russia, and the United States, it has effectively exploited the lack of preparedness of targets inside and outside Iran.
The same Iranian actors responsible for espionage against the private sector also conduct surveillance of human rights defenders. These attacks on Iranian civil society often foreshadow the tactics and tools that will be employed against other targets and better describe the risks posed by Iranian cyber-warfare.
While Iran does not have a public strategic policy with respect to cyberspace, its history demonstrates a rationale for when and why it will engage in attacks.
Iran uses its capabilities in response to domestic and international events. As conflict between Tehran and Washington subsided after the 2015 nuclear deal, so too did the cycle of disruptive attacks. However, Iran’s decision making process is obscured and its cyber capabilities are not controlled by the presidency, as evident in cases of intragovernmental hacking.
The report claims that the United States is reliant on an inadequately guarded cyberspace and should anticipate that future conflicts, online or offline, could trigger cyber-attacks on US infrastructure.
The first priority should be to extend efforts to protect infrastructure and the public, including increased collaboration with regional partners and nongovernmental organisations targeted by Iran.
You Might Also Read:
Iran’s Cyberwar Could Infiltrate Your Mailbox:
