Iran of late has been beset with a growing list of challenges: the withdrawal of the United States from the nuclear deal, the looming imposition of more U.S. sanctions and Israel's determination to attack it inside Syria to prevent its entrenchment there. Like any country intent on defending itself, Iran is compelled to retaliate against these two stronger military powers. And Iran has a baseline defensive posture from which it will not retreat, all the more as it is facing such intense pressure to change.
But because Iran is intent on retaining as many of the economic benefits as it can from the existing framework of the Joint Comprehensive Plan of Action (JCPOA), as the nuclear deal is formally known, it is also reticent to rapidly escalate some of its retaliatory moves for fear of alienating the European Union, which remains in the deal. Because the United States and Israel can harm Iran far more than Iran can harm them, Tehran will retaliate through asymmetric means, such as cyberwarfare, that are hard to track back to it, or by supporting proxy forces in places like Yemen where it can afford to take losses.
In preparation for Stratfor's upcoming 2018 Third-Quarter Forecast, we are releasing a series of supporting analyses, focusing on critical topics, regions and sectors. These assessments have been designed to contextualize and augment the upcoming quarterly global forecast.
Iran is intent on defending its sphere of influence in the Middle East, which has expanded steadily for the past 15 years. But the United States and its regional allies, especially Israel, are determined to contain and limit Iranian action. In response, Iran finds itself in a bind. It is trying to defend itself from the economic damage of new, potent U.S. sanctions, but it also must respond to Israeli and U.S. action against it. This constraint leaves Iran with a narrow range of options as it seeks to preserve its diplomatic relationships and insulate its economy while hitting back at its rivals.
A Gamble Taken
In early May, Iranian forces launched a volley of rocket fire into Israel's Golan Heights. Over the years, Israel had struck Iran and its allies hundreds of times inside Syria, trying to prevent Iran's from establishing itself there. Feeling pressed to strike back, Iran gambled by launching its first direct strike on Israeli territory on May 9.
It was a marked escalation, and resulted in wide-scale Israeli counterstrike that greatly harmed Iran's position inside Syria. It also highlighted the dynamics of Iran's challenge following the U.S. withdrawal from the JCPOA and the imposition of new sanctions. As Israel and the United States embark on a heightened pressure campaign — sometimes coordinated, sometimes not — to weaken Iran's regional influence, Tehran is naturally compelled to retaliate. But while Iran has a large array of means to retaliate, it faces two militarily, technologically and economically superior opponents. Israel's response to the Golan Heights confrontation and the frequent imposition of sanctions by the United States, with its enormous influence over the global financial sector, illustrates this superiority.
In deciding how to respond to the United States and Israel, Iran must calculate the diplomatic fallout of its countermoves, especially among the Europeans it is trying to court as part of its strategy to insulate itself from U.S. sanctions. That leaves Iran with a limited set of low-risk options. In the near term, at least, Iran will focus on escalating its use of cyberwarfare against state assets and companies in Israel, the United States and the Gulf Cooperation Council (GCC) states and will harness proxy warfare in Gaza, Yemen and Afghanistan — methods that are difficult to trace back to Iran. However, the greater the pressure Israel and the United States bring to bear on Iran, either alone or together, the more Tehran would lean toward more extreme means of retaliation.
Iran's Most Likely Tool: Cyberwarfare
Iran possesses a nunber of cyberwarfare assets that it can use to hit back at its rivals while incurring manageable retaliation from them in turn. Tehran likely will target assets in or associated with Israel, the United States and the Gulf states (its primary adversaries that are working against its regional interests), but will, for now, avoid targeting European assets during all-important JCPOA negotiations in the wake of the U.S. withdrawal.
Iran has deployed its cyber capabilities in the recent past. Its major cyberattacks include the Shamoon 2012 strike on Saudi Arabia's Aramco national oil company, the 2017 attack on a Saudi petrochemical company and a 2012 denial-of-service attack targeting 46 American banks. To carry out these kinds of attacks, Iran often has used mercenary groups or individual hackers whose connections to Iran are difficult to track. We can expect Iran to use these tools again. The Iranian Cyber Army, the unofficial hacking arm of the Islamic Revolutionary Guard Corps, gives Iran the option of deploying state-directed cyberwarfare.
Cyberattacks in and of themselves will not be enough to satisfy Iran's hard-liners, especially as the remaining benefits of the JCPOA dwindle.
The Next Step: Attacks With Plausible Deniability
Cyberattacks in and of themselves will not be enough to satisfy Iran's hard-liners, especially as the remaining benefits of the JCPOA dwindle. The hard-liners will push for stronger action against allies of Israel and the United States, and in places like Afghanistan, Gaza and Yemen, they will have options to do so through proxies without clear links to Iran. While these proxies cannot substantially alter the balance of power, they can increase the diplomatic and political costs of confrontation with Iran for the United States and Israel.
In Afghanistan, Iran can use its connections to the Taliban to strengthen their ability to continue the insurgency against U.S. forces and the U.S.-backed government in Kabul. This support will help embolden the Taliban to press for further military victories, while undercutting U.S. goals of negotiating a settlement. Iran also will continue its support for the Houthis in Yemen, helping the rebel group maintain its ballistic missile program. It is well known that Iran is supplying the Houthis with equipment and training to fight against U.S.-allied GCC forces and proxies, even though Iran denies the connection.
Against Israel, Iran will lean on its connections with Hamas and, more specifically, Palestinian Islamic Jihad to harass Israel's southern border with rocket fire and infiltration attempts. Israel's tight blockade of the Gaza Strip is a major barrier to Iran's ability to equip and fund its Palestinian allies. Still, attempting to support Palestinian militants is beneficial to Iran because it forces Saudi Arabia, the United Arab Emirates and others to condemn Israeli violence against Palestinians and distance themselves from their growing alliance with Israel. It also drives a diplomatic wedge between Washington and other U.S. allies, like Jordan, and produces unrest that increasingly challenges Jordan — home to many Palestinians.
Because of the strategic value of its position in Syria, Iran is likely to lay low there in the short term and avoid a repeat of its May confrontation with Israel. But should Israel kill Iranian commanders, or should their confrontation expand beyond Syria to Lebanon, the Persian Gulf or even to Iran itself, it is very likely Iran would try to repeat an attack on Israel's northern front. In Syria's northeast, U.S. forces and its allies are exposed to attacks by Iran-linked militias, as well as Iranian forces themselves. Iranian-linked forces already have tried to advance against the U.S.-allied Syrian Democratic Forces and endured counterstrikes by the United States.
Although it is the least likely option, Iran could use its proxy forces to hit U.S. and Israeli embassies, consulates or other government and strategic targets around the world. It has carried out these attacks before, most notably with a suicide bombing in Bulgaria in 2012 aimed at Israeli tourists, a 1996 attack on U.S. troops in Saudi Arabia, and suicide attacks in Argentina that targeted the Israeli Embassy in 1992 and a Jewish community center in 1994. Iran could also target U.S. forces in the Persian Gulf, as it has in the past. While it is an extreme measure, Iran also retains the capability of sabotaging trade that passes through the Strait of Hormuz.
Avoiding a Crippling Counterattack
As this year's third quarter unfolds, Iran's retaliatory decisions will affect cyber assets associated with the United States, Israel and the Gulf Arab states. Iran could target any one or a combination of entities in key sectors like banking and energy infrastructure or hit both government and privately run websites. The Gulf states are more vulnerable, as they lack the means to retaliate on the scale that Israel or the United States possess. Iran is capable of but less likely to target European companies or countries as long as it sees value in its diplomatic relationships with Europe.
As with all of its options, Iran could increase the scope and scale of its cyberattacks in response to moves by Israel and the United States. Should direct strikes against it pressure Iran to do so, it could expand its cyberattacks to more crucial infrastructure in both Israel and the United States, targeting power plants, hospitals and military sites. Iran also will expand its cyberattacks to European assets and companies when the post-withdrawal JCPOA negotiations inevitably fall apart.
The Bottom Line
With both the United States and Israel looking for reasons to hit Iran, and with negotiations with the Europeans ongoing, Tehran will use low-risk options to retaliate against its rivals. It will escalate its response in reaction to pressure along the way, but it will remain aware that a certain level of escalation will invite attacks it cannot readily absorb. So Iran will continue to rely on cyberattacks and certain other asymmetric strikes to retaliate against Israel and the United States as it looks for ways to stand up to them without provoking a crippling counterstrike. Iran also will take actions that avoid alienating the Europeans as much as it can — unless the JCPOA falls apart, at which point assets in Europe will be more exposed to attacks by Iran.