The GCC view of cyberthreats
All GCC countries face significant ‘traditional’ threats in cyberspace, including ransomware, cybercriminal fraud, and hacktivism.27 These threats have targeted individuals, commercial organizations and state entities.28 More specifically, the GCC has been the target of many advanced persistent threats (APTs) or state-sponsored campaigns. State-sponsored threats come in several guises: for example, global energy sector cyberespionage has been traced to China and Russia, while the Snowden revelations exposed US and allied cyberespionage in the region.29 Nonetheless, the main state-sponsored cyberthreat to GCC states and organizations comes from Iran, in line with wider geopolitical cleavages.
Iran was the victim of the infamous Stuxnet virus targeting its nuclear enrichment facilities, attributed to the US and Israel, and has since then developed significant offensive cyber capabilities.30 In addition to the Shamoon data deletion cyberattack against Saudi Aramco and RasGas in 2012,31 and its reoccurrence across several Saudi government networks in late 2016 and early 2017,32 Iran’s focus in the GCC has been primarily on espionage, matching its broader cyber strategy.33 Several sophisticated cyberespionage campaigns have been publicly attributed to Iranian state-linked actors since 2016, although the exact nature of state direction varies.34 In the last two years, cybersecurity companies have identified Iran-linked campaigns targeting high-value government targets, including police, foreign ministries and intelligence agencies in the GCC and the Middle East more widely.35
Iran was the victim of the infamous Stuxnet virus targeting its nuclear enrichment facilities and has since then developed significant offensive cyber capabilities
In addition to the ‘traditional’ cyberthreats above, other elements of the information environment are a key aspect of cybersecurity in the GCC. Per capita wealth and internet penetration in the GCC are extremely high, although with significant intra-GCC and within-state variation.36 In conjunction with explicit censorship and largely restrained traditional media, this has led to the GCC public sphere operating mainly on social media platforms, especially Twitter.37 Such platforms have been used to both test and reinforce prevalent social norms on family relationships, religion and gender, as well as by international dissidents and refugees.38 Social media has also been used by various factions in nearby conflicts, including by Islamic State of Iraq and Syria (ISIS), to recruit fighters and publicize atrocities, with messages directed at GCC populations as well as governments participating in military coalitions. Overall, because social media platforms were widely seen as contributing to the Arab Spring revolutions and simultaneous protests in the GCC, monitoring and controlling social media became a key aspect of cybersecurity for GCC governments.39
Internationally, this double perception of cyberthreats matches the sovereign and controlled model of the internet put forward by Russia and China, among others, since the late 1990s.40 The GCC countries all voted in favour of two Russian-sponsored resolutions in the UN General Assembly (UNGA) First and Third Committees in December 2018, one on cyber governance and one on cybercrime. The first one created an Open-Ended Working Group (OEWG) to study the existing norms contained in the previous UN Group of Governmental Experts (GGE) reports, identify new norms, and study the possibility of establishing regular institutional dialogue under the auspices of the UN.41 The second one requests the secretary-general to present a report based on the views of member states on the challenges that they face in countering the use of information and communications technologies for criminal purposes for consideration by the General Assembly.42 More recently, all GCC countries either voted in favour of or abstained (Saudi and Bahrain) from the newest Russian resolution on cybercrime, which would establish a committee of experts to consider a new UN cybercrime treaty.43 Several states, including the US, have argued that the Russian treaty plan paves the way for an overly restrictive approach to dealing with cybercrime at the global level.44 The GCC support of these resolutions, as well as their voting pattern in other UN discussions, suggests that they sit rather firmly within the ‘cyber sovereignty’ model of internet governance rather than a multi-stakeholder version.45 GCC states have also sought to protect regional interests through internet governance mechanisms, for example by preventing the creation of .persiangulf as a top-level domain – as they objected to the geographical term – through legal action against ICANN.46
However, a clear divide between cyberthreats of intrusion and influence is difficult to maintain for two reasons. First, intrusion and influence can be combined through ‘hack-and-leak operations’. Although the leaking of hacked emails from the US Democratic National Committee before the 2016 presidential election is the clearest recent example of this tactic, hack-and-leak operations came to prominence in the Gulf a year earlier, following the release of thousands of documents from the Saudi Ministry of Foreign Affairs by the Yemen Cyber Army in May 2015.47 Hack-and-leak operations were then a central feature of the June 2017 Gulf crisis, where the ‘quartet’ states of Bahrain, Egypt, Saudi Arabia and the UAE blockaded Qatar due to accusations of support for terrorist organizations.48
Second, as argued in the previous section, due to the increasing strategic use of both intrusion and influence operations, the US and other multi-stakeholder proponents have also moved to defend their national ‘information space’ and protect their national communications technology companies. While we do not intend to imply a false equivalence between these actions and extensive internet censorship and control, these shifts have made it harder to separate analytically two clearly polarized approaches to internet governance. Instead, the double threat perception of the GCC states is thus now shared by many other states. Consequently, this paper takes a comprehensive approach to cyber resilience that recognizes this double threat perception, including both resilience to ‘traditional’ cyberattacks and to attempts to influence the information environment in a state.
27 Shires, J. (2019), ‘Cybersecurity Governance in the GCC’, in Ellis, R. and Mohan, V. (2019) (ed.), Rewired: Cybersecurity Governance, Wiley-Blackwell, p. 22.
28 Shires, J. (2019), ‘Family Resemblance or Family Argument? Three Perspectives of Cybersecurity and Their Interaction’, St Anthony’s International Review, May, 15(1).
29 McAfee Labs (2011), Global Energy Cyberattacks: ‘Night Dragon’, White Paper, https://www.heartland.org/_template-assets/documents/publications/29423.pdf (accessed 21 Feb. 2020); FireEye (2017), ‘Attackers Deploy New ICS Attack Framework ‘TRITON’ and Cause Operational Disruption to Critical Infrastructure’, 14 December 2017, https://perma.cc/HVK5-2WGB; Kaspersky Lab (2015), ‘Equation Group: Questions and Answers v1.5’, Kaspersky Lab Global Research and Analysis Team, February 2015; Symantec Security Response (2015), ‘Regin: Top-Tier Espionage Tool Enables Stealthy Surveillance v1.1’; Rosenbach, M., Schmundt, H. and Stöcker, C. (2015), ‘Source Code Similarities: Experts Unmask ‘Regin’ Trojan as NSA Tool’, Spiegel Online, 27 January 2015, https://perma.cc/SEH5-YA94.
30 Zetter, K. (2014), Countdown to Zero Day, New York: Penguin Random House.
31 Bronk, C. and Tikk-Ringas, E. (2013), ‘The Cyber Attack on Saudi Aramco’, Survival, 55(2): pp. 81–96, https://doi.org/10.1080/00396338.2013.784468.
32 Kaspersky Lab (2017), From Shamoon to Stonedrill: Wipers Attacking Saudi Organizations and Beyond, Kaspersky Lab Global Research and Analysis Team, 7 March 2017.
33 Shires, J. (2018), ‘Iran May Prioritise Cyber Espionage, Not Attack’, Oxford Analytica Daily Brief, 11 July 2018. Although it is worth noting the report in Hope, B., Strobel, W. and Volz, D. (2019), ‘High-Level Cyber Intrusions Hit Bahrain Amid Tensions With Iran’, Wall Street Journal, 7 August 2019, https://perma.cc/6ZYG-ET6H.
34 Maurer, T. (2018), Cyber Mercenaries: The State, Hackers, and Power, Cambridge New York, NY Port Melbourne New Delhi Singapore: Cambridge University Press; Anderson, C. and Sadjadpour, K. (2018), Iran’s Cyber Threat: Espionage, Sabotage, and Revenge, Carnegie Endowment for International Peace.
35 Shires, J. (2019), ‘Iran Sharpens Cyber Tools for Foreign Policy Ends’, Oxford Analytica Daily Brief.
36 Hanieh, A. (2018), Money, Markets, and Monarchies: The Gulf Cooperation Council and the Political Economy of the Contemporary Middle East, New York: Cambridge University Press.
37 See the recent collection of essays in the special issue Khamis, S. (2019), ‘The Online Public Sphere in the Gulf: Contestation, Creativity, and Change’, Review of Middle East Studies, 53(2): pp. 190–199; Murphy, E. (2009), ‘Theorizing ICTs in the Arab World: Informational Capitalism and the Public Sphere’, International Studies Quarterly, 53(1): pp. 1131–53.
38 Mohamed, E., Douai, A. and Iskandar, A. (2019), ‘Media, identity, and online communities in the Arab world’, New Media and Society, 21(5), https://doi.org/10.1177%2F1461444818821360.
39 Matthiesen, T. (2013), Sectarian Gulf: Bahrain, Saudi Arabia and the Arab Spring That Wasn’t, Stanford, California: Stanford University Press.
40 Cornish, P. (2015), ‘Governing Cyberspace through Constructive Ambiguity’, Survival, 57(3): pp. 153–76.
41 UN General Assembly Resolution A/C.1/73/L.27/Rev.1 on ‘Developments in the field of information and telecommunications in the context of international security’, 2018, https://undocs.org/A/C.1/73/L.27/Rev.1 (accessed 21 Feb. 2020).
42 UN General Assembly Resolution A/C.3/73/L.9/Rev.1, on ‘Countering the use of information and communications technologies for criminal purposes’, https://undocs.org/A/C.3/73/L.9/Rev.1 (accessed 21 Feb. 2020).
43 UN General Assembly Resolution A/C.1/73/L.27/Rev.1 on ‘Developments in the field of information and telecommunications in the context of international security’.
44 Hakmeh, J. and Peters, A. (2020), ‘A New UN Cybercrime Treaty? The Way Forward for Supporters of an Open, Free, and Secure Internet’, Net Politics, Council on Foreign Relations, 13 January 2020, https://www.cfr.org/blog/new-un-cybercrime-
treaty-way-forward-supporters-open-free-and-secure-internet (accessed 13 Jan. 2020).
45 Shires, J. (2018), ‘Between Multistakeholderism and Sovereignty: Cyber Norms in Egypt and the Gulf States’, War on the Rocks (blog), 12 October 2018, https://perma.cc/L4CL-2B8A.
46 Reed, L., Sabater, A. and van den Berg, A. J. (2016), ‘Partial Final Declaration of the Independent Review Process Panel’, GCC (Claimant) and ICANN (Respondent), International Center for Dispute Resolution, 19 October 2016.
47 Shires, J. (2019), ‘Hack-and-Leak Operations: Intrusion and Influence in the Gulf,’ Journal of Cyber Policy, 4(2): pp. 235–56.
48 Shires, J. (forthcoming), ‘The Cyber Operation against Qatar News Agency,’ in Zweri, M. (ed.), The Gulf Crisis: Origins, Implications, Repercussions, Berlin Heidelberg: Springer Nature.