Share story


Not long after the uprising in Syria turned bloody late in the spring of 2011, the Pentagon and the National Security Agency (NSA) developed a battle plan that featured a sophisticated cyberattack on the Syrian military and President Bashar Assad’s command structure.

The military’s ability to launch airstrikes was a particular target, along with missile-production facilities. “It would essentially turn the lights out for Assad,” said one former official familiar with the planning.

For President Obama, who has been adamantly opposed to direct U.S. intervention in a worsening crisis in Syria, such methods would seem to be an obvious, low-cost, low-casualty alternative. But after briefings on variants of the plans, most of which are part of traditional strikes as well, he has, so far, turned them down.

This week, save 90% on digital access.

Syria was not a place where he saw the strategic value in U.S. intervention, and even such covert attacks — of the kind he had ordered against Iran during the first two years of his presidency — involved a variety of risks.

The Obama administration has been engaged in a largely secret debate about whether cyberarms should be used like ordinary weapons, whether they should be rarely used covert tools, or whether they ought to be reserved for extraordinarily rare use against the most sophisticated, hard-to-reach targets.

And looming over the issue is the question of retaliation: whether such an attack on Syria’s air power, its electric grid or its leadership would prompt Syrian, Iranian or Russian retaliation in the United States.

It is a question Obama has never spoken about publicly. He has put the use of such arms largely in the hands of the NSA, which operates under the laws guiding covert action.

Obama’s National Security Council met Thursday to explore what one official called “old and new options.”

One of the issues is whether such a strike on Syria would be seen as a justified humanitarian intervention, less likely to cause civilian casualties than airstrikes, or whether it would only embolden U.S. adversaries who have been debating how to use the new weapons.

Jason Healey, the director of the Cyber Statecraft Initiative at the Atlantic Council, argues that it is “worth doing to show that cyberoperations are not evil witchcraft but can be humanitarian.”

But others caution whether that would really be the perception.

“Here in the U.S. we tend to view a cyberattack as a de-escalation — it’s less damaging than airstrikes,” said Peter Singer, a Brookings Institution scholar who has recently published a book titled “Cybersecurity and Cyberwar: What Everyone Needs to Know.” “But elsewhere in the world it may well be viewed as opening up a new realm of warfare.”

Internally, Obama has made no secret of his concerns about using such weapons. He narrowed Olympic Games, the name of the program involving use of the Stuxnet computer worm against the Iranian nuclear-enrichment program, to make sure that it did not cripple civilian facilities like hospitals.

What he liked about the program was that it was covert, and that, if successful, it could help buy time to force the Iranians into negotiations. And that is exactly what happened.

But when a technological error resulted in the broadcast of Stuxnet around the world, ultimately leading to the revelation of the program’s origins with the NSA and Unit 8200 of Israel, Obama’s hopes of keeping such programs at arm’s length were dashed.

Since then, there has been no clear evidence that the United States has used the weapons in another major attack. It was considered during the NATO attacks on Libya in the spring of 2011, but it was dismissed after Obama’s advisers warned him that there was no assurance that they would work against Moammar Gadhafi’s antiquated, pre-Internet air defenses.

In Syria, the humanitarian impulse to do something, without putting Americans at risk or directly entering the civil war, is growing inside the administration. Most of that discussion focuses on providing more training and arms for what are seen as moderate rebel groups. But in the conversations about stepping up covert action, cyberweapons are one tool under discussion.

Part of the argument is that Syria is a place where the United States could change its image, using its most advanced technology for a humanitarian purpose.

“The United States has been caught using Stuxnet to conduct a covert cybercampaign against Iran as well as trawling the Internet with the massive PRISM collection operation,” Healey wrote recently, referring to the NSA’s data-mining program. “The world is increasingly seeing U.S. cyberpower as a force for evil in the world. A cyberoperation against Syria might help to reverse this view.”

Yet that would require openly taking credit for such an attack, something the United States has never done. “The question is whether the president would be willing to give the kind of speech he gave about why it would be justified to shoot off missiles in response to Assad’s use of chemical weapons,” a senior administration official said. Obama pulled back from that strike at the last moment.

Even if the United States wanted to act covertly, a cyberattack on Syria would be hard to keep secret. Anything that grounded the air fleet, or turned out the lights at key facilities in Damascus and at major military outposts, would be instantly noticed — and would not necessarily be accomplished quickly.

U.S. military planners concluded, after putting together options for Obama during the past 2½ years, that any meaningful attack on Syria’s facilities would have to be both long enough to make a difference and targeted enough to keep from making an already suffering population even worse off.

For those and other reasons there are doubters throughout the military and intelligence establishment. “It would be of limited utility, frankly,” one senior administration official said.

For instance, an attack could disrupt or shut down the navigational systems for Syria’s aircraft, including the Russian-designed Mi-8 and Mi-17 helicopters that are carrying out many of the so-called barrel-bomb attacks against civilians in Homs and Aleppo.

But Syrian commanders would probably just shift to other weapons in their arsenal, such as an array of rockets and missiles, including longer-range Scud missiles, that Assad’s forces have already employed.

Syria is no stranger to these attacks, either on the receiving or the giving end.

A September 2007 strike by Israel that destroyed a nuclear reactor being built in the Syrian desert was accompanied by an ingenious cyberattack that blinded the country’s air defenses. When the Syrian military awoke the next morning, the reactor being built with North Korean help was a smoking hole in the ground, as were some associated facilities.

On the offensive end, the Electronic Frontier Foundation, which follows such issues, assembled evidence in a report last year that the Syrians had used a “spear phishing” ploy, which gets the target to click on a link in an email, in this case videos of war atrocities, to identify people who are aiding the rebel groups and get inside their computers.

And the Syrian Electronic Army, which U.S. intelligence officials suspect is actually Iranian, has conducted strikes against targets in the U.S. during the past year, including the website of The New York Times. Mostly, these have been denial-of-service attacks, annoying and disruptive, but not truly sophisticated.

The chances that Syria could manage a significant response is low, U.S. officials and outside experts said. But the precedent could embolden the Russians and the Iranians — who also have stakes in the Syrian war, and far more ability — into taking a greater part in a new and rapidly escalating form of warfare.

Custom-curated news highlights, delivered weekday mornings.