{"id":4859,"date":"2024-02-27T15:06:35","date_gmt":"2024-02-27T15:06:35","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=4859"},"modified":"2024-05-06T15:11:58","modified_gmt":"2024-05-06T15:11:58","slug":"hackerwatch-february-2024","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2024\/02\/27\/hackerwatch-february-2024\/","title":{"rendered":"A Cyber Power That Wasn\u2019t"},"content":{"rendered":"

Iran as a Surveillance State<\/b>\u00a0<\/span><\/h4>\n

Over the past two decades, Iran has expanded its cyber capabilities for domestic control, regional influence, and retaliation against adversaries. Leaked data from seemingly hacktivist groups have repeatedly indicated the expansive scope of Iran\u2019s interest and capability to surveil citizens and dissidents. The <\/span>SIAM<\/span><\/a> network, use of <\/span>facial recognition<\/span><\/a>, <\/span>e-government services<\/span><\/a>, <\/span>surveillance tools<\/span><\/a>, and the <\/span>Nazer app<\/span><\/a> are only a few prominent examples of Iran\u2019s surveillance apparatus. Despite significant investments in cyber offense, Iran remains susceptible to cyber attacks. Since the Women Life Freedom protests began in September 2022, repeated hacktivist attacks on civilian networks and the subsequent data leaks have illustrated this point. Speculations about the affiliation of these groups continue. At best, they are dissident hackers showing sympathy with protesters. Or these hack-and-leaks are part of a larger intelligence contest by Iran\u2019s adversaries seizing the momentum to spill some of Iran\u2019s best kept secrets.\u00a0<\/span><\/p>\n

Iran showcased its surveillance capabilities during nation-wide, pro-democracy protests that erupted following the death of Mahsa Jina Amini in 2022. The protests faced challenges not only from security forces on the ground, but also an extensive state surveillance system that compromised protesters' physical safety and communication integrity. The government's tracking of smartphones, identification through device registration numbers, and collaboration with private entities underscored Iran\u2019s far-reaching surveillance capabilities, which continue to impact political dissidents, ethnic and human rights activists, and ordinary citizens.\u00a0<\/span><\/p>\n

The private sector\u2019s collaboration with Iran's security forces in this expansive state surveillance apparatus is particularly worthy of note. Leaked documents from different hacktivist groups indicate a sprawling network of front companies that serve Iran\u2019s Revolutionary Guard Corps (IRGC) and aid the government in suppressing dissent rather effectively despite U.S. sanctions. Previous <\/span>Hackerwatch<\/span><\/a> reports have underscored these connections and their implications for freedom of speech and other human rights.<\/span><\/p>\n

Misaligned Priorities Jeopardize Civilians\u2019 Security<\/b>\u00a0<\/span><\/h4>\n

Iran\u2019s consistent prioritization of offensive cyber operations over cybersecurity has come at the expense of taxpayers' money that should otherwise have protected state networks. A prominent example is the repeated intrusion of the payment system of <\/span>gas pumps<\/span><\/a> nationwide, which had significant economic implications for the public. The scale of intrusion and leaks of the past few years would present a major national security dilemma for any country and prompt investigations to identify the vulnerabilities. But, so far, the Iranian government has only dismissed these attacks as a plot by adversaries and labeled leaked files as fake. Deprioritization of domestic network security, coupled with the lack of good governance in cybersecurity, poses consequences for public resources and the collective right to safety in cyberspace.\u00a0<\/span><\/p>\n

Most network breaches of the past few years have not been conclusively attributed to a specific actor. However, a common understanding <\/span>points<\/span><\/a> to an escalation of cyber activities between Iran and Israel. Both states have been engaged in cyber attacks, accusing each other of orchestrating espionage and sabotage operations. These cyber confrontations serve as a less costly alternative to potential military conflicts, serving mainly as signaling or deterrence mechanisms amid growing tensions. The cyber domain has become a low-intensity battleground for the long-standing hostility between the two nations.\u00a0<\/span><\/p>\n

The attacks on Iran\u2019s critical infrastructure, such as the explosion at a <\/span>steel plant<\/span><\/a> in June 2022, have raised questions about the government\u2019s accountability to protect civilian networks from such invasive effects. Evidence is sparse about possible efforts to investigate and respond to cyber attacks within government bodies. Hackerwatch previously <\/span>obtained<\/span><\/a> a threat intelligence document prepared for Tehran municipality that elaborated on the details of malware that targeted the institution. The report indicates progress toward investigating and responding to cyber attacks within government bodies. Yet it also raises concerns about Iran's competence in strategic cyber defense as the report lacks key qualities of threat detection and analysis<\/span>
\n<\/span><\/p>\n

Even the <\/span>involvement<\/span><\/a> of Iran's Civilian Defense Organization (CDO) to guard civilian networks has not abated criticisms of the government for recent cybersecurity breaches. Despite proposed structural changes and increased <\/span>budget<\/span><\/a>, doubts persist about CDO's ability to lead in cybersecurity, especially given its past meager performance.<\/span><\/p>\n

Not only recent cyber attacks have highlighted Iran\u2019s vulnerabilities and lack of strategy in cyber defense, but they also challenge the National Information Network (<\/span>NIN<\/span><\/a>), a costly decades-long telecommunications project that aims to reduce reliance on international platforms. Iran\u2019s massive investment in the NIN is being put to the test through recent breaches, underscoring the challenges of centralization without adequately addressing cybersecurity needs.\u00a0<\/span><\/p>\n

Moreover, Iran is facing a <\/span>shortage<\/span><\/a> of expertise in the cybersecurity field. Government agencies often struggle to compete with the private sector for talent. There is also a significant brain drain of IT and cybersecurity professionals in other countries. An increasingly high turnover rate within the private sector leads to a loss of talent to peer companies in Europe, North America, and Australia.\u00a0<\/span><\/p>\n

The Path Forward<\/b>\u00a0<\/span><\/h4>\n

These developments illustrate the complex challenges that Iran faces in the realm of cybersecurity. Geopolitical tensions, vulnerabilities in civil defense systems, investment priorities, organizational underperformance, and a shortage of expertise all contribute to a misalignment of Iran\u2019s needs, capacity, and motives toward a robust cyber defense ecosystem. The consequences extend beyond the virtual realm. Systematic cyber vulnerabilities impact civilian networks, hinder economic development, and worsen the state of human rights. Addressing these issues requires a strategic realignment of priorities and structural changes in Iran's cybersecurity technology development and acquisition, policies, and practices.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Iran as a Surveillance State\u00a0 Over the past two decades, Iran has expanded its cyber capabilities for domestic control, regional influence, and retaliation against adversaries. Leaked data from seemingly hacktivist groups have repeatedly indicated the expansive scope of Iran\u2019s interest and capability to surveil citizens and dissidents. The SIAM network, use of facial recognition, e-governmentContinue reading \"A Cyber Power That Wasn\u2019t\"<\/span><\/a><\/p>\n","protected":false},"author":13,"featured_media":4860,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[113],"tags":[161,139,142,168,181],"class_list":["post-4859","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threat-reports","tag-cybersecurity","tag-facial-recognition-in-iran","tag-hackerwatch","tag-siam-system","tag-surveillance-tools","entry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t