More espionage than firepower: The right analogue for understanding cyber operations

Many analysts expected cyber operations to play a major role in Iran’s response to the U.S.-Israeli military campaign. Yet Iranian-linked cyber activity initially played little visible operational role and has so far produced limited strategic effect. Activity has since become more extensive and visible—including cyber-enabled influence operations, disruptive operations, and operations against exposed infrastructure—but cyber has still not become a major instrument of Iran’s wartime response.

Strategic restraint aimed at managing escalation provides a partial explanation for why Iran did not conduct a high-profile attack on US critical infrastructure. Although parts of U.S. critical infrastructure are known to have long-standing vulnerabilities, Iran had reasons not to exploit them and create a public spectacle. U.S. public opinion toward the war, especially toward a possible large-scale ground deployment, has been strongly negative, and congressional opposition to further escalation has also been substantial. Cyberattacks, especially those that cause deaths, can increase public support for military retaliation. Therefore, a spectacular Iranian attack, especially one with lethal consequences, could have shifted attitudes and legitimized wider U.S. attacks on Iranian infrastructure—an outcome Iran had strong reasons to avoid. In other words, Iran may have favored lower-risk cyberattacks and refrained from those likely to create such a spectacle, even where opportunities may have existed.

However, potential Iranian restraint toward the United States cannot explain the limited visible effects against Israel. Iran and Israel were already exchanging large-scale kinetic strikes, including missile and drone attacks, so many forms of cyberattack against Israeli military or critical infrastructure targets would not have represented a higher step on the escalation ladder. Nor can the outcome be explained purely by an absence of Iranian cyber capability. Although Iran is not among the world’s most sophisticated cyber powers, it is widely regarded as a capable one, with growing expertise and a long record of cyber operations.

Read more at Modern War Institute