By Bruce Riedel

The U.S and Iran have been adversaries since 1979; we fought an undeclared naval war in the late 1980s. The American presidential election has seen both candidates threaten Iran with military action if it does not forsake development of a nuclear arsenal and halt its nuclear enrichment program. Iran has long threatened it will retaliate dramatically and decisively if it is attacked by the U.S., Israel or both. Now it is showing some of its plans for doing just that.

 

On Aug. 15, a cyberattack hit Saudi oil giant Aramco with devastating results. According to U.S. Secretary of Defense Leon Panetta, 30,000 computer workstations were rendered useless and had to be replaced. Aramco, which Forbes magazine ranks as the world’s largest oil company and is the key to Saudi Arabia’s production, had data on many of its hard drives erased and replaced with photos of a burning U.S. flag. Panetta did not directly accuse Iran of responsibility, but other U.S. officials have pointed right at Tehran. Panetta concluded that Iran has “undertaken a concerted effort to use cyberspace to its advantage.”

 

A few days later in Qatar, a similar virus attacked the RasGas natural-gas company, a joint venture between Exxon Mobil and the state-owned Qatar Petroleum, which operates the world’s largest natural-gas field. According to Panetta, the two attacks were “probably the most destructive attack the private sector has seen to date.” Neither attack directly targeted the sensitive Aramco and RasGas computer systems that operate the oil industry itself—the attacks were more aimed at its management systems.

 

The timing was significant. The attack was launched on the eve of the Islamic holy “night of power,” or Lailat al Qadr, which commemorates when the Quran was first revealed to the Prophet Muhammad by the angel Gabriel. Shia Muslims believe it also coincides with the date on which Ali, Muhammad’s cousin and son-in-law, was fatally wounded by a poison-coated sword in Iraq. The Saudi and Qatari governments would understand the message clearly; Iran can attack your economy. In effect: we don’t need to shut the Strait of Hormuz, we will shut down your computer instead.

 

At least the Saudi attack was an inside job. According to The New York Times, a company insider or insiders probably inserted a memory stick that contained the virus. Aramco has almost 60,000 employees, about 70 percent of which are Shia Muslims from the kingdom’s Eastern Province along the Persian Gulf, and where almost all of Saudi Arabia’s oil is found. The Saudi Shia community has been in a state of growing unrest since the start of the Arab Awakening in 2011. There have been increasingly violent protests against the House of Saud in the Shia community, which has long faced discrimination by the Saudis. Since Saudi troops crossed the King Fahd Causeway last year to suppress demonstrations in neighboring Bahrain by the Shia majority there, anger at the Saudi royal family has become even more pronounced among Shia in Eastern Province. Aramco, in short, is a target-rich environment for angry Saudi Shia with ties to Iran. Only a tiny minority would need to seek Iranian technical help to penetrate the digital heart of the kingdom’s oil industry.

 

The Saudi Ministry of Interior has long been obsessed with Iranian intelligence activity among the Shia minority. The ministry has always believed a Shia terror group with links to Iran was responsible for the 1996 attack on the U.S. air base in Khobar that killed 19 U.S. servicemen and wounded 372 Americans, Saudis, and other nationalities. The Khobar Towers are located close to Aramco headquarters in Dhahran.

 

Hizbullah followed up the cyberattack with a drone mission on Oct. 6. An Iranian-built surveillance drone dubbed Ayoub flew from Lebanon into southern Israel before being shot down by the Israeli air force. Officials from the Iranian Revolutionary Guard Force told the Al Arabiya newspaper that the target was the Israeli nuclear reactor at Dimona, the centerpiece of Israel’s nuclear program. Hizbullah’s leader, Hassan Nasrallah, later gave a speech taking credit for the drone flight and warned Israel that more would follow.

 

Again the timing was no accident. It was the 39th anniversary of the start of the 1973 war, the devastating Arab-Israeli conflict in which 10,000 Israelis were killed or wounded. It was also a stunning failure for Israeli intelligence, which failed to see the attack coming until just hours before Egypt and Syria struck. Hizbullah was warning it, too, might surprise Israel. At the Israel Defense Forces, Major General Aviv Kochavi, director of military intelligence, estimates that Hizbullah today has some 80,000 rockets and missiles aimed at Israel from Lebanon. The Oct. 6 drone was intended to signal Israel that both Iran and Hizbullah see Dimona as an attractive target for missile attacks if Iran is attacked.

 

Iran’s capabilities to inflict substantial damage on the Saudi and other gulf-state oil industries by cyberwarfare are difficult for outsiders to assess. Iran is a relative newcomer; until now, it has been mostly a victim. Iranian and Hizbullah abilities to penetrate Israel’s anti-missile defenses are also hard to estimate. Those defenses are among the best in the world, thanks to years of U.S. military assistance and Israeli ingenuity. So it is hard to know how hard Iran can really strike back if it is attacked. Bluffing and chest-thumping are a big part of the Iranian game plan. But the virus and the drone together sent a signal, don’t underestimate Iran.