Iran of late has been beset with a growing list of challenges: the withdrawal of the United States from a nuclear deal, the looming imposition of more US sanctions and Israel’s determination to attack it inside Syria to prevent its entrenchment there. Like any country intent on defending itself, Iran is compelled to retaliate against these two stronger military powers. And Iran has a baseline defensive posture from which it will not retreat, all the more as it is facing such intense pressure to change.
But because Iran is intent on retaining as many of the economic benefits as it can from the existing framework of the Joint Comprehensive Plan of Action, as the nuclear deal is formally known, it is also reticent to rapidly escalate some of its retaliatory moves for fear of alienating the European Union, which
remains in the deal. Because the United States
and Israel can harm Iran far more than Iran
can harm them, Tehran will retaliate through
asymmetric means such as cyberwarfare, that
are hard to track back to it, or by supporting
proxy forces in places such as Yemen, where it
can afford to take losses.
A gamble taken
In early May, Iranian forces launched a volley of rocket fire into Israel’s Golan Heights. Over the years, Israel had struck Iran and its allies hundreds of times inside Syria, trying to prevent Iran from establishing itself there. Feeling pressed to strike back, Iran gambled by launching its first direct strike on Israeli territory, on May 9.
It was a marked escalation and resulted in a wide-scale Israeli counterstrike that greatly harmed Iran’s position inside Syria. It also highlighted the dynamics of Iran’s challenge following the Trump administration’s withdrawal from the nuclear deal and the imposition of new sanctions. As Israel and the United States embark on a heightened pressure campaign – sometimes coordinated, sometimes not – to weaken Iran’s regional influence, Tehran is naturally compelled to retaliate. But while Iran has a large array of means to retaliate, it faces two militarily, technologically and economically superior opponents. Israel’s response to the Golan Heights confrontation and the frequent imposition of sanctions by the United States, with its enormous influence over the global financial sector, illustrates this superiority.
In deciding how to respond to the United States and Israel, Iran must calculate the diplomatic fallout of its countermoves, especially among the Europeans it is trying to court as part of its strategy to insulate itself from US sanctions. That leaves Iran with a limited set of low-risk options. In the near term, at least, Iran will focus on escalating its use of cyberwarfare against state assets and companies in Israel, the United States and the Gulf Cooperation Council (GCC) states, and will harness proxy warfare in Gaza, Yemen and Afghanistan – methods that are difficult to trace back to Iran. However, the greater the pressure Israel and the United States bring to bear on Iran, either alone or together, the more Tehran will lean toward more extreme means of retaliation.
The most likely tool
Iran possesses a number of cyberwarfare assets that it can use to hit back at its rivals while incurring manageable retaliation from them in turn. Tehran likely will target assets in or associated with Israel, the United States and the Gulf states (its primary adversaries that are working against its regional interests), but will, for now, avoid targeting European assets during all-important nuclear deal talks in the wake of the US withdrawal.
Iran has deployed its cyber capabilities in the recent past. Its major cyberattacks include the Shamoon 2012 strike on Saudi Arabia’s Aramco national oil company, the 2017 attack on a Saudi petrochemical company and a 2012 denial-of-service attack targeting 46 American banks. To carry out these kinds of
attacks, Iran often has used mercenary groups or individual hackers whose connections to Iran are difficult to track. We can expect Iran to use these tools again. The Iranian Cyber Army, the unofficial
hacking arm of the Islamic Revolutionary Guard Corps, gives Iran the option of deploying state-directed cyberwarfare.
Attacks with plausible deniability
Cyberattacks in and of themselves will not be enough to satisfy Iran’s hard-liners, especially as the remaining benefits of the nuclear deal dwindle. The hard-liners will push for stronger action against allies of Israel and the United States, and in places such as Afghanistan, Gaza and Yemen, they will have options to do so through proxies without clear links to Iran. While these proxies cannot substantially alter the balance of power, they can increase the diplomatic and political costs of confrontation with Iran for the United States and Israel.
In Afghanistan, Iran can use its connections to the Taliban to strengthen its ability to continue the insurgency against American forces and the US-supported government in Kabul. This support will help embolden the Taliban to press for further military victories, while undercutting US goals of negotiating a
settlement. Iran also will continue its support for the Houthis in Yemen, helping the rebel group maintain its ballistic missile program. It is well known that Iran is supplying the Houthis with equipment and training to fight against US-allied GCC forces and proxies,
even though Iran denies the connection.
Against Israel, Iran will lean on its connections with Hamas and, more specifically, the Palestinian Islamic Jihad to harass Israel’s southern border with rocket fire and infiltration attempts. Israel’s tight blockade of the Gaza Strip is a major barrier to Iran’s ability to equip and fund its Palestinian allies. Still, attempting to support Palestinian militants is beneficial to Iran because it forces Saudi Arabia, the United Arab Emirates and others to condemn Israeli violence against Palestinians and distance themselves from their growing alliance with Israel. It also drives a diplomatic wedge between Washington and other US allies such as Jordan, and produces unrest that increasingly challenges Jordan – home to many Palestinians.
Because of the strategic value of its position in Syria, Iran is likely to lay low there in the short term and avoid a repeat of its May confrontation with Israel. But should Israel kill Iranian commanders, or should their confrontation expand beyond Syria to Lebanon, the Persian Gulf or even to Iran itself, it is very likely Iran would try to repeat an attack on Israel’s northern front. In Syria’s northeast, American forces and its allies are exposed to attacks by Iran-linked militias, as well as Iranian forces themselves. Iranian-linked forces already have tried to advance against the US-allied Syrian Democratic Forces and endured counterstrikes by the United States.
Although it is the least likely option, Iran could use its proxy forces to hit American and Israeli embassies, consulates or other government and strategic targets around
the world. It has carried out these attacks
before, most notably with a suicide bombing
in Bulgaria in 2012 aimed at Israeli tourists,
a 1996 attack on US troops in Saudi Arabia
and suicide attacks in Argentina that targeted
the Israeli Embassy in 1992 and a Jewish
community center there in 1994. Iran could
also target US forces in the Persian Gulf, as it
has in the past. While it is an extreme measure,
Iran also retains the capability of sabotaging
trade that passes through the Strait of Hormuz.
Avoiding a crippling counterattack
As this year’s third quarter unfolds, Iran’s retaliatory decisions will affect cyber assets associated with the United States, Israel and the Gulf Arab states. Iran could target any one or a combination of entities in key sectors such as banking and energy infrastructure, or hit both government and privately run websites. The Gulf states are more vulnerable, as they lack the means to retaliate on the scale that Israel or the United States possess. Iran is capable of but less likely to target European companies or countries as long as it sees value in its diplomatic relationships with Europe.
As with all of its options, Iran could increase the scope and scale of its cyberattacks in response to moves by Israel and the United States. Should direct strikes against it pressure Iran to do so, it could expand its cyberattacks to more crucial infrastructure in both Israel and the United States, targeting power plants, hospitals and military sites. Iran also will expand its cyberattacks to European assets and companies when the post-withdrawal nuclear agreement negotiations inevitably fall apart.
The bottom line
With both the United States and Israel looking for reasons to hit Iran, and with negotiations with the Europeans ongoing, Tehran will use low-risk options to retaliate against its rivals. It will escalate its response in reaction to pressure along the way, but it will remain aware that a certain level of escalation will invite attacks it cannot readily absorb. So Iran will continue to rely on cyberattacks and certain other asymmetric strikes to retaliate against Israel and the United States as it looks for ways to stand up to them without provoking a crippling counterstrike. Iran also will take actions that avoid alienating the Europeans as much as it can – unless the nuclear deal falls apart, at which point assets in Europe will be more exposed to attacks by Iran.