A Thoughtful Gesture or a Deceptive Plan? A On September 8, 2010, the U.S. intelligence community launched a highly publicized cyber-attack, coordinated with Israel, on Iran’s nuclear facilities. This cyber-attack, which resulted in minimal physical damage, was designed to force Iran to curtail its uranium enrichment program or face a crippling blow from cyber-weapons. This was not the first time the United States launched a covert cyber-attack. Previous attacks have focused on disrupting Iran’s ability to build a nuclear weapon. “U.S. spy agencies successfully infiltrated computer systems in Iran used to make rockets and other weapons in violation of international sanctions, a cybersecurity firm said Monday.” (Los Angeles Times, July 23, 2008) “The CIA launched a cyberattack to disrupt Iran’s nuclear enrichment operations in 2003 and then again in 2007 in a year-long operation that successfully interrupted Iran’s efforts to produce nuclear weapons.” (Washington Post, November 26, 2010) “A National Security Agency team attacked Iran’s first-ever nuclear enrichment plant using tools honed in the U.S. war on terror, in an operation that illustrates the growing difficulty of stopping the latest digital weapons from falling into the wrong hands.” (Wall Street Journal, April 2, 2012) “U.S. cyber spies penetrated some of the most closely guarded government systems used by the U.S. military to disrupt Al Qaeda’s ability to launch attacks.” (Wall Street Journal, November 17, 2011) The United States’ latest cyber-attack against Iran is a highly successful means of pressuring the government of Iran to negotiate an end to its nuclear program. However, there is a problem with this successful strategy. The more the United States uses cyber-weapons, the greater the chance that the virus will be found, analyzed, and used against us. This would be a huge breach of U.S. intelligence procedures that would undermine the ability to carry out the cyber-attack and would allow Iran and others to determine how the attack was carried out. The cyber-attack would also likely have a deterrent effect on Iran by allowing them to demonstrate that they can thwart a cyber-attack by the United States and gain some additional bargaining chips in the nuclear negotiations. In addition, the use of cyber-weapons creates a precedent that would be difficult to resist for other countries. Iran is already developing cyber-weapons of its own and this type of attack can be expected to be an increasing threat in the future. While cyber-weapons may be a useful tool for pressuring Iran to abandon its nuclear program, the United States should avoid getting into a pattern of cyber-attack. Such actions lead to greater instability and make an effective defense more difficult to maintain. B The question of whether the United States should become involved in a major war, such as Iran’s invasion of Iraq, is a difficult one. Our ability to maintain a consistent approach to dealing with Iran’s nuclear program is threatened by our desire to develop and use the best means available. This should be a consideration before the United States engages in this type of major offensive attack against Iran’s nuclear facilities. However, it would be more dangerous for the United States to adopt a policy of inaction than to risk the negative consequences of a major attack. The idea of attacking Iran’s nuclear facilities using cyber-weapons would be to prevent Iran from developing nuclear weapons or using them to do harm. However, using cyber-weapons to attack Iran’s nuclear infrastructure would create more problems than it solves. In fact, it is not clear that even one nuclear warhead can be destroyed with the use of cyber-weapons. The nuclear facilities Iran is using to enrich uranium are protected by Russian-built computer networks. The use of cyber-weapons to disable those networks would likely only degrade Iran’s ability to carry out such operations. It would take extensive redesign and rebuilding of Iran’s computer networks to completely disable them. In addition, there are other consequences that the United States should be aware of. The use of a cyber-weapon against Iran’s nuclear facilities might make it easier for Iran to develop cyber-warfare capabilities in the future. Cyber-warfare is considered a weapon of mass destruction by some, but others believe it is not quite at that level. However, the United States’ actions against Iran could make cyber-warfare easier for Iran. It might also make it more difficult for the United States to launch another cyber-attack against Iran if needed. “Israel developed the computer viruses Stuxnet and Flame as well as other ways to secretly sabotage Iranian weapons systems. Some experts say Israel created cyber-weapons to damage or destroy its enemies’ computer systems, rather than to steal information or sabotage networks. The U.S. and Israel also have extensive cyber capabilities.” (Al Jazeera, March 20, 2012) Regardless of whether the United States does or does not use cyber-weapons in this manner, cyber-weapons will eventually be used. Therefore, the more the United States uses them, the greater the chance that they will be discovered and analyzed by other countries. This allows Iran and others to learn how the attack was carried out and what defenses were used to stop it. This knowledge will provide Iran and others with valuable knowledge about new cyber-weapons and defensive strategies. Once Iran uses this knowledge to build its own cyber-weapons they will have to figure out a way to combat those weapons in the future. This is a type of knowledge that the United States should try to keep from Iran. However, the ability to carry out cyber-warfare by using a cyber-weapon against Iran would make cyber-warfare more difficult to use in the future. In addition, the fact that the United States has cyber-weapons and is willing to use them against Iran would make it more likely that the United States would also use cyber-weapons in the future. The more the United States uses cyber-weapons, the more tempting it is for other countries to develop them as well. This raises the possibility that some of the other countries using cyber-weapons would be less willing to follow the rules of war if they are being used against them. This could result in less effective weapons and allow cyber-weapons to become a destabilizing force in world politics. The question becomes whether the United States should risk that by using cyber-weapons against Iran. C If Israel uses cyber-weapons to attack Iran’s nuclear infrastructure, this might provide an incentive for Iran to pursue the development of cyber-weapons in the future. It might also weaken Iran’s capability to respond to an Iranian nuclear attack by using cyber-warfare to stop it. The risk to the United States and Israel from a nuclear attack on Iran would be extremely high if Iran was able to develop the cyber-weapons it would need to respond. While the U.S. military is using sophisticated cyber-warfare in the field, and the Israeli military is conducting cyber-warfare in Gaza, Iran is more likely to respond to a cyber-attack with another cyber-attack. This cyber-attack would then escalate into a physical war with the risk of all-out nuclear war. This would be a much larger risk for the United States than if it relied on conventional military might in the region. In addition, Iran is developing advanced cyber-weapons as part of its military strategy. For the United States to use cyber-warfare against Iran in order to stop Iran from developing nuclear weapons may be a very dangerous option. On the other hand, if the United States was able to carry out a cyber-attack against Iran’s nuclear facilities using cyber-weapons, it would be much less risky for the United States to carry out a full-scale attack. It would be harder for Iran to defend itself against cyber-attacks than it would be against a physical attack. However, it might also be that Iran’s cyber-defenses are even stronger than its cyber-attack capabilities. If so, the United States might be able to carry out cyber-attacks against Iran without setting off a larger cyber-war. However, there is another concern. Cyber-attacks use networked computers to carry out their missions, so cyber-attackers need to control that network as well. This makes it very difficult for the United States to carry out a cyber-attack against Iran. If the United States is unable to do this, Iran could still prevent the cyber-attack from succeeding. To do this, Iran could bring all of its computers back under its control so it could stop any attack as soon as it began. This makes it possible to stop a cyber-attack at the very start. For the United States, this is an uncontrollable situation. Iran could simply wait for the cyberspace offensive to begin and then shut it down. This might prevent a cyber-attack from ever happening. While Iran might not have the capacity to respond to an offensive cyber-attack with a cyber-counter-attack, the United States might not be able to carry out a sustained cyber-attack without the threat of retaliation becoming a reality. “Tehran is not only developing and exporting more and more information technology and