The Zero-Day War? How Cyber is Reshaping the Future of the Most Combustible Conflicts

As tensions rage beneath the Middle East cauldron, the expanded employment of cyber operations is preventing the region from boiling over. An Oct. 17 Reuters report detailing the United States’ covert cyber operation against Iran, in response to the Sept. 14 attacks on oil facilities in Saudi Arabia, underscores the inclination of states to use cyber operations and points to broader strategic implications in the region. Israeli-Saudi security cooperation quietly incubated over mutual intolerance toward an expansionist Iran is blossoming into a gradually open relationship, with cyber at its heart. Bonds such as these, forged behind closed doors, provide options for de-escalatory approaches to regional conflict. 

Conventional wisdom would suggest that scaled-up capabilities, growing competition, and the proliferation of malware across cyberspace presents a legitimate risk of escalation in state conflict, transcending the cyber domain toward the kinetic. However, recent history has shown that states more often avail themselves of their offensive cyber arsenals to achieve surprisingly de-escalatory effects. Offensive cyber operations sit low on the escalation ladder—the figurative scale ranging from diplomatic engagement to all-out nuclear war—and provide states with means of signaling adversaries without using force, and potentially deescalating tense or provocative situations. Through this lens, there is a case to be made for the responsible diffusion of malware as a tool of statecraft to de-escalate regional conflict. 

Cyber operations have served this de-escalatory purpose throughout recent tensions in the Persian Gulf. When the Lincoln Carrier Strike Group was deployed to the Gulf in May, after intelligence detected an Iranian threat to U.S. assets in the area, Washington signaled that it was prepared to meet potential Iranian aggression with airstrikes. President Trump went as far as to tweet that the U.S. was “cocked & loaded,” alluding to a kinetic response, but instead, the U.S. deployed malware to neutralize the Iranian threat, while demonstrating that Tehran’s provocations would not go unchecked. The U.S. does not have an appetite for a large-scale deployment of ground forces, which could foreseeably succeed a major escalation, so its decision to prioritize cyber response options underscores Washington’s desire to cool things down and reassert control by using short-of-war tactics. A similar strategy is playing out some 1,400 miles away, on the eastern shores of the Mediterranean Sea.

Israel, like the U.S., is chiefly concerned with breaking Tehran’s spreading influence and power in the region, but does not want to bear the risk of doing so alone. Iran employs proxy militias to exert pressure on Israel and strain Jerusalem’s focus. This strategy forces Israel into a heightened operational tempo as it conducts interdictions against illicit Iranian-backed materiel transports in Syria, Iraq, Lebanon, Gaza, and the West Bank. This dilemma has led Israel to use unconventional tactics and seek assistance from unlikely sources.

In August, Reuters reported that Israel’s Ministry of Defense had eased export controls on certain malware, allowing Israeli companies to more quickly obtain exemptions for marketing to more countries than previously possible. Under newly relaxed regulations, not only has the approval process been shortened, but also the Defense Ministry indicated that the group of allowable buyers has expanded. While maintaining that Israel’s export controls remain more stringent than those of the U.S. and U.K., Israel’s Defense Ministry asserted that the rule change will make Israeli companies competitive in the global marketplace.

Israel has less openly discussed how the change was largely spurred by opportunities for regional security cooperation. Indications that Israeli spyware—software that enables users to surreptitiously reap information from another’s hard drive—and other forms of malware are destined for purchase by Saudi Arabia and the UAE have raised eyebrows amongst rights advocacy groups. 

In 2018, Citizen Lab assessed with “high confidence” that the phone of Saudi dissident Omar Abdulaziz was the target of spyware known as Pegasus, developed by Israeli cyber intelligence firm NSO Group. Pegasus is designed to exploit a target’s smartphone to access personal files, media, communications, and even snoop through the device’s camera and microphone. While NSO Group markets “exclusively to licensed government intelligence and law enforcement agencies to fight crime and terror,” governments have demonstrated a knack for abusing its technologies. While concerns over malware exports are justifiable, the de-escalatory and even ethical role of offensive cyber operations cannot be ignored.

Malware sales from Israeli firms to the Saudi government contribute to a growing rapprochement between the two countries and a historic opportunity to improve long-term stability in the region. In reference to utilizing technology to strengthen ties with neighbors that have avoided formal relations, Isaac Ben-Israel, top cyber expert and Chairman of the Israeli Space Agency, stated, “this is a legitimate tool of diplomacy.”

As Iran and its proxies, namely Hezbollah, aim to draw adversaries into armed conflict, the de-escalatory potential of cyber operations gives countries like Israel and Saudi Arabia off-ramps in tense situations. While kinetic options could escalate conflict and draw the ire of the international community, cyber operations can provide de-escalatory alternatives under challenging operational circumstances like southern Lebanon and Syria, where Hezbollah has embedded caches of increasingly sophisticated munitions deep within civilian population centers. With Iran’s help, Hezbollah is constructing precision missile factories in Lebanon’s Bekaa Valley, where the group is effectively baiting Israel into conducting kinetic operations where it does not want to. The Second Lebanon War did not go well for Israel, as Hezbollah’s guerrilla tactics forced the withdrawal of Israeli forces from southern Lebanon. Avoiding a similarly costly foray onto Hezbollah’s home turf remains in Israel’s best interest.

Concerns over potential misuse of cyber tools to quash internal dissent and suppress democratic values are legitimate and should be taken seriously. So, too, should the ethical case for the responsible utilization of these tools. The de-escalatory effects offensive cyber operations can bring to bear make them legitimate tools of statecraft in navigating regional conflict. In 1967, Israel disposed of its enemies in just six days. With the potentially de-escalatory effects of offensive cyber operations, could we be in the midst of the zero-day war? 

Simon Handler is a program assistant with the Atlantic Council’s Cyber Statecraft Initiative under the Scowcroft Center for Security and Strategy. He is a former special assistant in the United States Senate. Follow him on Twitter @SimonPHandler.

A longer version of this post was previously published on the Atlantic Council’s blog.