A Second-Tier Cyber Power

Iran is a second tier cyber power. By the standards of other state actors, its capabilities—both offensive and defensive—are relatively modest, but they are growing steadily. Cyber operations have also become an integral component of Iranian military doctrine and strategy, which place a heavy emphasis on the principles of asymmetry and hybrid warfare. Outclassed by its adversaries in the conventional military realm, Tehran has opted to invest heavily in cyber, where the barrier to entry is relatively low and the regime can compete more effectively.

Iran was a relative latecomer to the cyber arena. Iranian officials first started to emphasize cyber warfare (jang-e saybari) as an element of military doctrine and strategy starting in the mid-2000s. Then, in 2010, an extremely advanced malicious computer worm, later dubbed Stuxnet, was used to sabotage some of the industrial control systems associated with Iran’s uranium enrichment efforts. Many assumed that the United States and/or Israel were behind the attack, the first in which a nation state had used a cyber weapon to target another state’s critical infrastructure. Although Stuxnet apparently only had a limited impact on Iran’s enrichment efforts, it bolstered the perception among regime officials that Iran had been a victim of unjustified cyber aggression by the United States and its allies, and gave impetus to Iran’s nascent cyber efforts.