8

Cybe
Spotlight:
Iran
By David Gewirtz
ran has long been the focal
point of American strategic
concern. Going as far back
as 1953, when the U.S.
and other allies supported
regime-change activities that
resulted in the overthrow
of the elected leadership
of Prime Mi nister Mohammad
Mosaddegh and the installation of the
Pahlavi dynasty, America's interests
have been tightly intertwined with
Iranian internal politics.
-
Josh Mayeux .
network dej(!Ilder,
works at 'he Air Force
Space Commolld Ne/ work
Operatiolls & Security Cellter 01
Peterson Ail' Force Base il/ Colorado
Springs. Colorado July 10, 2010. U.S.
I/O/i ono! security planncrs arc proposing liIol
IlJe 2 / sl cell/llI}'s critical infrastructure -- power
communications. walel'lItililies.financialllelworks
-- he shielded/rom cyber mOl'lJuders (lnd other foes.
The ramporls would be vinuol. 'heir perimeters policed by ' he
Penragon alld backed by digital weapons capable of circling the globe i ll
milliseconds 10 knock 0111 forgels. To malali Special Report USACYBERWJIR/
REUTERS/Rick Wilking
Today, Iran isn ' t r ul ed by t he I
Shah's constitutional monarchy,
but by a theocratic, fundamental-
ist Islamic for m of republi c. With I
a GOP of more than $800 billion,
Iran is the worl d's 18th largest
economy in terms of real purchas-
ing power.
Much of the country's income,
of course, is derived from oil ,
and oil fuels about 45% of the
government's yearly income. Iran
is a key energy producer, as the
world's second largest source of
natural gas and the third largest
exporter of oil.
Allhough it may seem paradoxi-
cal given Iran's fu nda mentali st
Islamic government, Iran places a
very high pri ori Ly on higher edu-
cation, science. and math. This is
going to be particularl y relevant
to our discussion of Iran 's place in
the cyberwarfare theatre. so pay at-
tention here. Iran operates 54 state
operated uni versit ies, and 42 state
medical schools, along with 289
pri vate colleges. There are more
than 3.5 million coll ege students in
Iran, along wit h more than 40,000
masters-level students and 20,000
Ph.D.-level students.
Earl y Iranians contributed heavil y
to humanity,'s understanding of
natural science. physics. medi cine.
astronomy, and mathematics. Al-
though he based much of hi s work
on earl ier developments by Greek
In Nigeria a spate of violent attacks
by militant Islamists Boko Haram
left at least 100 dead and 90,000 dis-
placed. President Goodluck Jonathan
declared a state of emergency. In
Guinea-Bissau an attempted coup by
renegade soldiers on 26 December
left at teast two dead. TIle navy chief,
fonner anny chief, and a number of
politicians suspected of orchestrating
it have been arrested.
Tensions between Pakistan's govern-
ment and militaty leadership escalated
as the Supreme Court began its probe
over a memo last May requesting
U.S. help to avert a military takeover.
The government continues to deny
ai1 egmions that its former ambas-
sador to the U.S. Hussain I-I aqqani
authorized the memo and rejects the
Supreme Court 's jurisdiction. AmlY
and inlclligence top brass have repeat-
cdly insisted on the Suprcme COLIrt
investigation, rai sing fears of a coup.
In Afghani stan bomb attacks by
Pakistani Sunni militants Lashkar-
e-Jhangvi in Kabul and Mazar-
i-Shar if killed 84 peopl e on the
Shi a holy day of Ashura. Relations
with Pakistan remained strai ned, as
Paki stan 's boycott ovcrshadowcd
the Bonn conference.
Bos nia avoided an intcnsifi ed
politi cal cri sis as leaders of the
six main political parti es agreed to
form a government at the end of
the month, ending fourteen months
of deadlock after the October 2010
elect ions. A new state budget was
adopted j ust in time to avcrt shut-
ting down state institutions.
First Quarter 2012 Trends
DClcrioratcd Sitmttions
Afghanistan , Democratic
Republic of Congo, Guinea-
Bi ssau, Iraq, Nigeri a, Sudan,
South Sudan, Senega l, Ka-
zakhstan, Paki stan
Improvcd Situations
Bosnia
Unchanged Sihmti ons
A Igeria, Armenia, Azerbaijan,
Bahrain, Bangladesh, Belarus,
Bolivia, Burundi , Cent ral
African Republi c, Chad, Co-
lombia, Cote d' ivoirc, Cy-
prus, Ecuador, Egypt, Eritrea,
Ethiopia, Georgia, Guatemala,
Guinea, Haiti , Indonesia, Iran,
Israel/Occupi ed Pal estinian
Territories, Jordan, Kashmir,
Ke nya, Kosovo, Kyrgyz-
stan, Lebanon, Liberia, li b-
ya, Macedoni a, Madagascar,
Ma lawi, Ma li, Ma uritani a,
Mexico, Moldova, Morocco,
Myanmar/ Burma, Nagorno-
Karabakh (Azerbaij an), Ne-
pal , Niger, North Caucasus
(Russia), North Korea, Papua
New Guinea, Peru, Philip-
pines, Rwanda, Serbia , So-
malia, Somalil and, Sri Lanka,
Syria, Tajikistan, Thailand,
Timor-Lestc, Tuni sia, Turkey,
Turkmeni stan, Ukraine, Uz-
bekistan, Venezuela, Western
Sahara, Yemen, Zimbabwe
Source:
At Home:
The Year In Review
A Look At FBI Cases
The FBI conducted thousands of
investigat ions in 20 11 , from ter-
rorists bent on murder and eyber
thieves hacking networks to comlpt
government officials and fraudslers
steali ng billions of dollars from in-
nocent victims.
Part I of this report focuses on our
top investi gative priority: protect-
ing the nat ion from terrorist attack.
The death of Osama bin Laden in
May was a milestone, but al Qaeda
remains committed to hi gh-profi le
attacks against the U.S. And on the
home front , lone offenders radical-
ized on the Intemet continue to pose
a seri ous threat to national security.
Here are some of the top
terror cases of 2011 , i n
reverse chronological order:
Murder of U.S. soldiers in Iraq:
A 38-year-old Canadian cit izen
was indi cted thi s month by a New
York grand jury for hi s role in the
murder of fi ve Ameri can soldi ers
in a suicide-bomb attack in Iraq in
2009. The individual was arrested
last January in Canada, and the
U.S. is seeking hi s extraditi on. De-
tail s: hltp://www.fbi.gov/newyorkf
press-releases/20 Il /alleged-tcrror-
ist -i nd icted- in-new-york -for -t he-
murder - 0 f-fi vc-a Illcri can-sold iers
Indic(mcnt of senior citizcns in
ricin plot: FOllr Georgia men in
their 60s and 70s were arrested last
month for planning to manufac-
ture the biological toxin ri ci n and
purchasing explosives for usc in
attacks against Ameri can ci ti zens.
The defendant s are all eged to be
part of a fringe mi li tia group. De-
tui I s: http: //www.fb i.gov/at lallla/
press-releases/20 Il /north-gcorgia-
m en -arrested -c ha rged- i n -p I 0 ts-to-
purchase-explosives-sil cll cer-and-
to- manufacture-a-biol ogical-toxi n
Plot aga inst Saudi ambllSSltdor:
Two indi vidua ls were charged
in October for their parti cipation
in a plot directed by element s of
the Iranian government to mur-
der the Saudi ambassador to the
U.S. with explosives whil e the
ambassador was on U.S. soil. One
of the indi vidual s is in custody;
the other is sti ll at large. Detail s:
http://www . fbi . gov Inewyorkfprcss-
releasesI20 11 / two-men-charged-
i n- a Il eged-pl ot-to-a ssass inat e-
saud i -arabian-ambassador-to-t he-
unit ed-states
AUack planned on U.S. Capitol:
A 26-year-old Massachusetls man
was arres ted in Sept ember and
charged with pl otting to bomb the
Penlagon and U.S. Capitol using re-
mote-controll ed aircraft filled with
explosives. Detail s: http://www.
Ibi.govlboston/press-releasesl20 II I
m assnc h Ll set Is-man -c ha rged -wi I h-
plot t ing-attack -on-pentagon-and-
u. s. -ca p i to I- a n d -a t te III pt i n g -to-
P rov i de-Ill a teri a I- s II pporl- t o-a-
fore i gn-I errori 51-organ i za 1 i on
Ma(erial stlPI)ort to terrorists:
An Albanian citi zcn living in New
York was charged in September
with providing material support to
tcrrorists for planning travel to Pak-
istan to j oin a radical j ihadist fi ght-
ing group. He was arrested whi le
tryi ng to catch a fli ght out of the
country. Details: http://www. fbi.
gov/newyorkJpress-releascs/20 I II
new-york -ci t y-resident -i nd icted-
for-provi d i ng-ma teri a 1- Sll pport-
to-terrori sts
Texas bomb pIol: A 2 1-year-old
soldier who was absent without
leave was charged in Jul y with
planning to detonate a bomb inside
a restaurant frequented by soldiers
from Fort Hood. When he was ar-
rested, the indi vidual was in posses-
sion of a vari ety of bomb-making
components. In November he was
charged with additi onal crimes in-
cluding attempt ed murder. Delail s:
http://www.fbi.gov/ sanantonio/
press-releases/20 Il /federal-grand-
j ury-returns-s upersedi ng -i nd ict-
iacsp.com
mcnt-against-naser-jason-abdo-in-
connection-with-bomb-plot
Plot to Mt:rck Sc:rttlc mili ta ry
insta llal ion : Two men were in-
dicted in Jul y for conspiring 10
usc a weapon of mass destruction
10 attack a military installation in
Seattle with the intention of killi ng
U.S. citi zens. Law enforcement
first became aware of the plol
when an indi vidual al erted them
that he had been approached about
parti cipat ing in the auack. Detai ls:
http://www. fb i .gov/seatt le/ press-
relcases/20 II /two-men-illdicted-
in-plot -to-att ack -seatt le-m i I itary-
processing-center
Conduit to terror organizations:
A Somali nati onal in his mid-20s
was indi cted in July for providi ng
material support to foreign terror
organizati ons al Shabaab and al
Qaeda in the Arabian Peninsul a
(AQAP). He was captured in the
Gulf region by the U.S. military
in April 20 I I and was allegedl y a
conduit between al Shabaab and
AQAP. Dctail s: http://www.fbi.
gov/newyorkl press-rel eascs/20 II I
a cc u se d - a 1- s h a b a a b-I eade r-
charged-wi th-provid i ng-material-
sllpport-to-al-shabaab-alld-al-qae-
da- in-the-arabian-pen insula
Iraq bomb attacks: An Iraqi
citizen who all egedl y carried out
numerous improvi sed ex pl os ive
device (l ED) attacks against U.S.
troops in Iraq and another Iraqi
national all ege d to have par-
tic ipated in the Iraq insurgency
were indi cted in May on terror-
ism charges in Kentucky, where
bot h were res idents. Detai ls:
http:// www. fbi . go vII Oll is vi Il el
press-rei eases120 1 lit wo-i raqi-
nat iona Is- i nd icted- on- federa l-
terrori slll -charges-in -kentucky
.Jilwdis( indi ctment: A 20-ycar-
o ld Saudi Arabia citi zen and
Texas r es ident was arrested
in February and charged with
attempted use of a weapon of
mass destructi on in connecti on
with the purchase of chemi cals
and equipment used 10 make an
l ED and his research of poten-
tial U.S. targets. The individua l
came to the U.S. in 2008 on a
st udent visa. Detail s:
hllp://www. fbi .gov/dal-
las/press-releases/ 20 11 1 -
d10224 11.htlll
The Journal of Counterterrorism & Homeland Security International
and Indian scholars, Iran 's Abu
Abdallah Muhammad ibn Musa al-
Khwari zmi is widely considered to
have been the inventor of algebra,
contributing to the foundations of
both mathematics and computer
science, and providing a source
of study Ihat helps explain the
general surl y and resentful nature
of hi gh school and college students
worldwide.
Irani an citi zens have ,I conni cted
relationship with the Internet, due
in large part to government censor-
ship effOrLs. By percentage, Iran
has the second largest percentage
of Middle Eastern citi zens onli ne,
second onl y to Israel. More 1hal1 20
million Iranians are online. In the
mid-2000s, thi s was seen by liberal
Iranians as a way of bypassing
government censorship strictures,
and enabled citi zens to reach out to
the world. However, in parti cular
after the online Twitter expl osion
around the 2009 Iranian electi ons,
Iran has acti vely censored citi zens
and has jailed and harassed bl og-
gers and online acti vists.
The point of all thi s is to showcase
that Iran has substanti al connecti v-
ity, resources, and educated citi zenry
-- more than enough to fuel forays
into cybercrime. cybert errori slll, and
cyberwarfare itself.
In a nation like Iran, it's often diflicult
to tell which nefari ous online acti vi-
ti es are done under the auspices of
government control, and which are
done by a hi ghl y connected, sophi s-
ti cated citizenry. One sllch example
comes from the exclusive investiga-
tion I did for CNN back in 2009.
Top secret plans for the U.S. presi-
dent 's Marine One helicopter cockpit
retrofi t were found on a "collector's"
computer in Iran.TIle plans were lifted
via a peer-to-peer program acting as
spyware from a U.S. defense contffic-
tor's home computer and spirited
away to the machine in han. TIle plot
twist here is that there was no evidence
that the Lranian had any government
connection. Instead, he fall s into a
class of cybercriminal that simply
fil ches anything he can get his hands
on, then offers it for sale to the hi ghest
bidder. Criminal, yes. Government-
sponsored espionage, no.
On the other hand, there are the
recent reports that Iranian hackers
brought down an Ameri can RQ-170
Sentinel drone. Unverified reports
in the Christian Sci ence Monitor
quote unnamed sources (see a trend
here?) in Iran that claim the drone
By percentage, Iran has the second
largest percentage of Middle
Eastern citizens online, second
only to Israel. More than 20 million
Iranians are online.
Seeking the Edge Through Education, Training. and Technology
was brought down aft er Irani an
engineers "spoofed" GPS signals,
which essentiall y tricked the drone
into landing in Iran.
While there's some doubt whether
Iran actuall y downed the drone
on purpose, or it j ust had a failure,
there's no doubt that the Irani an
govemment has been proudly parad-
ing their catch as a PR ding against
America.
In Ill y professional opini on, it 's
unlikel y (although possible) that
Iran downed the drone by hacking.
While every computer-based system
has naws and exploits, IllOSt systcms
like the drone work 00" encrypted
and redundant systems. The idea that
the Iranians were abl e to crack the
GPS signals, create their own GPS
transmitter, and then precisely beam
the GPS transmissions at the drone
(which was 50,000 feet in the air on
an undi sclosed ni ght path) seems
far fetched.
It seems far more plausible to me that
the system had a bug, or some sort of
failure. The Iranians are smart, but
they' d have to not onl y be smart, but
both have Batman-like aerial skills
and Spideysense to have been able
to zero in on that craft while in fli ght
and alter its perception of position.
That brings us to thc more recent talk
(at least as I write this in earl y Janu:uy
2012) of Iran, possibl y teaming up
with Venezuelans, to conduct cyber-
attacks against U.S. domesti c targets.
Claims, going through the normal
convoluted sets of unnamed sources
and disclaimers, were that Iran was
planning to (or had attempted to)
hack U.S. in frastructure target s,
including nucl ear sites.
Did they, or didn't they? That's not
something we can discllss in a publi c
venue like thi s magazine.
But what we can di scuss is the threat,
whi ch is quite real. Let's be cl ear. It
is hi ghl y likel y that virtuall y every
nati on on the planet is engaging
in some fonn of cybcr-mi schi er or
another. Whil e most nation-states
aren' t explicitl y penetrating or attack-
ing infrastnlcture of other nations,
they' re almost certainl y expl oring
the feasibility of sllch acti ons, along
with their own ability to defend their
di gital borders.
Given how oHen the U.S. has med-
dled in Iranian alTairs, threatened
them with attack or surgical strike,
and otherwise given Iranian oflici als
the hai ry eyeball , it 's certainly likely
that Iran has explored cyberwarfare
techniques as a way to strike back.
I' m not siding with Iran here. While
Illany Iranian citi zens are fine people,
Iran' s methods or governance and
national pri orities make I'or some
sleepless nights for the leaders of
many Westem nations. The idea that
fundamentalist reli gious zeal ots are
trying to create nuclear weapons is
not comforting in the sli ghtest.
But the questi on isn' t whether Iran
is in the ri ght or not. The questi on is
whether Iran is capable of mounting
a cyberaltack, whether they already
have, and whether they' re a threat
in the future. In cl osing, let 's look
at three key fact ors that help juries
delernline the possibility of guilt in
iacsp.com
---
criminal cases: means, motive, and
opportunit y. As we' ve seen, with
Iran 's well educated and hi ghly-
networked online populace, both
the nation as well as it s indi vidual
citi zens have the means to conduct
not onl y cybercrimc acti viti es, but
engage in cyberwarfare. Moti ve
is certainl y there as well. There's
a whol e lot of money to be made
from cybercrime, and as we've seen
-- not onl y recentl y but as far back
as the 1950s -- Iran and Ameri ca
have had somewhat discordant rela-
ti ons. Moti vati on gets three stars.
Finall y, there's opportunity. Any-
where there' s an Int ern et con-
necti on, an attacker is mere mil-
li seconds away from a victim,
anywhere on the planet. It 's not
as ir an allacker has to travel from
Tehran to Teaneck, New Jersey
10 conduct some sort of terrori st
acti vity. All a bad guy has to do
is sit on hi s couch in hi s pajamas,
fire up hi s laptop, and take aim at
any target, anywhere. Opportunity
certainl y ex ists.
So there' s the bottom line for Iran.
They arc, without a doubt, a di gital
threat. Whether they' ve already
caused harm is a di scussion for
a different venue, but without a
doubt they are a threat, without a
doubt, they will try to cause harm,
and without a doubt , we need to
stay di ligent in maintaining and
constantl y improving our di gital
defenses.
About the Author
David Gewirtz is the director oJthe
u.s. Strategic Perspective Illstilllte
all d editor-ill-chief of Ihe ZATZ
lechnical magazilles. He regularly
wriles commelllal), and analysisfor
Anderson Cooper 360. alld
has wrillenlllore Iltan 700 arlicles
aboullechnology. David is aforlller
professor of computer science, has
lectured at Princeloll . Berkeley.
UCLA. alld StallJord. has beel/
awarded Ihe prestigious Sigma Xi
Research Award ill Ellgilleering.
al/ c/lVas a candidate for Ihe 2008
PlIlilzer Prize ill Leiters. He is
the CyberlerrorislII Advisor Jar
IA CSP. Web sile
is al DavidGewirrz.com Read his
blog al CNN Anderson Cooper
360 fo r politics. policy, and
analysis. Read his blog (If CBS
ZDNet GOI/emlllellt
where tech meets politics
aud government. Or ,
Fol/ow him 0'1 Twiller al .
@DavidGelvirlz
The Journal of Counterterrorism & Homeland Security International