Monday, December 21, 2020

The Persian Gulf Crisis and the Security Dilemma

This article is by

Share this article

Article Contributor(s)

Anant Jani

Article Title

The Persian Gulf Crisis and the Security Dilemma

Publisher

Global Views 360

Publication Date

December 21, 2020

URL

American Assault Ship in the Persian Gulf

American Assault Ship in the Persian Gulf | Source: Cpl. David Gonzalez via Flickr

This article explains the recent tensions between Iran and the United States, and presents it as a case of the ‘Security Dilemma’ theory in practice.

The Persian Gulf Crisis 2019-20

To understand the current crisis in Persian Gulf, we must look at the Iran Nuclear Deal of 2015, also called the Joint Comprehensive Plan of Action (JCPOA).

The JCPOA was signed between The E3/EU+3 (France, Germany, the United Kingdom, the Russian Federation, and the United States, China, with the High Representative of the European Union for Foreign Affairs and Security Policy) and the Islamic Republic of Iran, to permit nuclear capabilities for Iran exclusively for peaceful purposes, in exchange for the lifting of crippling sanctions.

JCPOA terms:

International Atomic Energy Agency representative in Tehran, Iran for talks on JCPOA implementation | Source: Tasnim News Agency

Under this accord, Iran had to reduce its Uranium stockpile by 98% to 300kg, maintain its level of enrichment at 3.67%, reduce the number of centrifuges, and only keep one of its Uranium enrichment plants active. It also had to redesign its reactor at Arak, so it could not produce weapon’s grade Plutonium. Until 2031, Iran is not permitted to make heavy-water reactors.

Further, it was to permit itself to regular inspection of their nuclear site by the global nuclear watchdog, the International Atomic Energy Agency (IAEA).

In return, Iran gained over $100bn of frozen assets overseas, and was permitted to allow trading in oil in international markets and use the global financial system for trade.

Trump Administration’s Revoking of the JCPOA

In 2018, the Trump administration reimposed some of the sanctions in Iran, despite Trump's election promise to reduce involvement in the Middle East. Countering the re-impositions, Iran threatens to resume Uranium enrichment. In May 2019, Iran suspends nuclear deal commitments, and gives other signatories a 60-day deadline to protect it from US sanctions, before resuming Uranium enrichment. The International Atomic Energy Agency (IAEA) reported that Iran had already increased Uranium production, but is unclear by how much.

President Trump signing executive orders, imposing sanctions on Iran | Source: Shealah Craighead via White House

In May 2019, the US increased military deployment in the Persian Gulf, reportedly to prevent what the termed was a “campaign” between Iran and its proxies to threaten US oil shipping in the Strait of Hormuz.

The Tanker Crisis

In June 2019, two tankers were set ablaze in the Gulf of Oman, using mines. The US blamed Iran for these blasts, but Iran denied the charges.

In the same month, Iran Islamic Revolutionary Guard Corps (IRGC) shot down a US surveillance drone, escalating tensions and causing the US to name the IRGC as a terrorist organization.

In July 2019, the British Royal Marine Commandos seized an Iranian tanker off the coast of Gibraltar, as it was suspected to be en route to Syria, in violation of EU sanctions. The US declared that anyone assisting the ship would be considered an accomplice of terrorist groups, namely the Iran’s Islamic Revolutionary Guard.

In retaliation, Iran seized British-flagged tanker in the Strait of Hormuz.

The Iranian tanker was released six weeks later, on the condition that they do not unload their cargo of 2.1million barrels of oil in Syria.

December Air Strikes

In December 2019, the K-1 Air Base in Iraq was attacked by an unconfirmed party, killing one American contractor. This base hosts Americans (amongst other nationalities) who are responsible for training Iraqi troops in counter-terrorism. The Americans alleged that the attack was carried out by Kataib Hezbollah, which denies it. Kataib Hezbollah is a rebel group (recognized as a terrorist group by the US) backed by Iran. The Iraqi’s alleged that ISIL was responsible.

In retaliation for the killing of the American Contractor, the US launched air strikes on the weapons depot and command centres of Kataib Hezbollah in Iraq and Syria in the same month, reportedly killing 25 militiamen.

Assassination of Iranian Major General

Late Iranian General, Qasem Suleimani | Source: Tasnim News Agency

Iraq and Iran condemned the attack, and on 31 December, 2019, Iraqi militia attacked the US Embassy in Baghdad. In response, the US conducted airstrikes at the Baghdad International Airport in January 2020, killing the Commander of Iranian Quds Force, General Qasem Suleimani, the second most powerful man in Iran.

These escalations, placed within the context of US invasions of Iraq and Afghanistan, provide a good example of the Security Dilemma theory and how it plays out in practice.

What is the Security Dilemma?

Before delving into the theoretical definitions it is worth reminding ourselves that States do not behave as they do because a theoretical model demands them to. Rather, most theoretical models are based on observations of real-world behaviour of states, and seek to explain said behaviour. The Classical Realist theory, of which the Security Dilemma is a part, is amongst one of these, and I endeavour to highlight some of the key points of this theory.

The Classical Realist theory holds that States (or State-actors) are the basic unit of any international system. They are the most important actors, as there is no authority higher than them. The international system is fundamentally anarchic, with every actor left to their own devices with no supranational oversight. Each State finds it in their own self-interest to provide their own means for security. Security comes with the ability of the State to exercise its power, and thus Power Hegemony and Security are inextricably linked. In other words, since no State can rely on a supranational authority to provide security (an every-man-for-himself scenario), it is in each State’s best interest to understand the power distribution across all state-actors and maximize power for themselves, as the ultimate security. This results in a zero-sum game, with one actor’s loss being another’s gain. In providing absolute security for one’s own State, one leaves others insecure. The resulting power imbalance manifests in conflict, and for the Realist it follows, therefore, that Conflict is the natural state of affairs.

This, in essence, is the Security Dilemma: Striving for absolute security leaves others absolutely insecure, thus providing powerful incentives for an arms race, leading to further conflicts. It is little wonder that this is also called the Spiral Model, for in the very process of striving for security, one gives birth to escalating conflict.

How does this relate to the Persian Gulf Crisis?

The US has long followed the Realist model, believing that in a state of fundamental anarchy, it is justifiable to have nuclear capabilities and have intense militarization, as a means of gaining absolute security (justified by ‘offense is the best defence’). However, the US is also known for disallowing Weapons of Mass Destruction and nuclear capabilities in other countries, despite having such resources by itself. Here we see the Security Dilemma: to maintain absolute security, the US cannot allow others to be similarly armed. This is seen clearly in the signing of the JCPOA.

Consider the case from Iran’s point of view. As a result of the US war against Al Qaeda and Taliban in Afghanistan and overthrow of Saddam Hussain in Iraq, there has been constant American presence in both the countries bordering Iran since almost two decades. That this poses a threat to Iran is obvious: the US caused fundamental regime changes in Iraq after the war; with its manpower and firepower, alongside its strategic placement on both sides of the Iranian border, the US is at a vantage point to attack Iran – placements that are, paradoxically, intended to guarantee American security.

The American show of strength and the impending danger of conflict leave Iran with two choices: Forge alliances with US adversaries, such as China or Russia, to deter Iran-US conflict, or be nuclear-armed. Iran managed both, causing, in effect, a nuclear arms race that culminated in the JCPOA.  In retrospect, the JCPOA seems like the perfect solution to the Security Dilemma in US-Iran conflicts: not only does it allow Iran to benefit from its suspensions of nuclear capabilities, it also ceases the arms race and de-escalates the conflict. In short, it is the Diplomat’s way out of the Security Dilemma, guaranteeing security without arms.

The Trump administration’s call to reimpose sanctions on Iran only serves to re-ignite security concerns for both countries. With Iran having ousted its JCPOA commitments as of January 2020, we can only hope that de-escalations will soon follow to prevent the otherwise inevitable spiralling into arms race and false absolute security.

Support us to bring the world closer

To keep our content accessible we don't charge anything from our readers and rely on donations to continue working. Your support is critical in keeping Global Views 360 independent and helps us to present a well-rounded world view on different international issues for you. Every contribution, however big or small, is valuable for us to keep on delivering in future as well.

Support Us

Share this article

Read More

February 4, 2021 5:20 PM

SolarWinds Attack and its implication for U.S. Security: Sabotage or espionage?

SolarWinds, a publicly listed Texas-based company with a value of more than $6 billion, has a very reputed customer list including multiple U.S. government agencies. The company develops softwares for businesses and agencies to help manage and monitor their networks, systems and  IT infrastructure. The company is a service provider to over 425 of the Fortune 500 companies, top 5 U.S. accounting firms, all major U.S. telecom providers, the U.S. treasury, several global universities and educational institutions, the NSA and the White House.

A set of hackers managed to sneak a malicious code into the software update of SolarWinds for a tool called “Orion”. Earlier, in 2020, the hackers had injected malware into the updates of Orion which were released between March and June of 2020. On 5th of Jan, 2021, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure security Agency (CISA), the Office of the director of National Intelligence (ODNI) and the National Security Agency (NSA) made an official joint statement stating, "an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks". U.S. government agencies like The Pentagon, National institute of Health, FBI, DHS, the Department of Energy and the Department of Veterans affairs were some significant users of Orion. In fact, in August 2020, the Department of Veterans affairs renewed its Orion license in a 2.8-million-dollar order. The Department of Veterans affairs has been heavily involved in COVID-19 relief.

The Orion hack began as early as March 2020. Over 18,000 customers had installed the compromised software which implies that these customers were vulnerable to spy operations throughout 2020. The malware inserted in the updates provided remote access of an organization’s network to the elite hackers. Since the malware was undetected for months, it gave the hackers an opportunity to obtain information from their targets. In fact, the hackers could also monitor emails and other internal communications. FireEye, the cybersecurity company who were the first to discover the breach describes the capability of the malware, from initially lying dormant up to two weeks, to hiding in plain sight by masquerading its investigation as “Orion Activity”. In 2016, Russian Military hackers used a method called “supply chain” to infect companies performing business in Ukraine with a hard-drive wiping virus called NotPetya. This attack is considered to be one of the most damaging cyber-attacks till date. The infiltration tactic used in the current hack is also identified to be similar to the “supply chain” method.

The Orion software framework contained a backdoor that communicated via HTTP to third party servers. Cybersecurity firm, FireEye has been tracking the trojanized version of Orion plug-in as SUNBURST.

FireEye Logo

FireEye described the use of SUNBURST backdoor on one of its blogs published on 13th December 2020. It stated,

“After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.”

FireEye described the attack through the SUNBURST backdoor as “highly evasive”. Meanwhile, SolarWinds is facing a class action lawsuit filed by a stakeholder of the IT Infrastructure Management software company in the U.S. District Court for the Western District of Texas on 4th Jan 2021. The lawsuit is filed against SolarWinds’ ex-president, Kevin Thompson and chief financial officer, J. Barton Kalsu on the grounds of violating Federal Securities laws under Securities Exchange Act of 1934. The complaint states that SolarWinds Company failed to disclose that "since mid-2020, Orion monitoring products had a vulnerability that allowed hackers to compromise the server upon which the products ran". The complaint also mentioned that SolarWinds update server had a fairly weak and easily accessible password, ‘solarwinds123’.

Microsoft’s internal security research team found evidence that the same hackers had accessed some internal source code in their company’s systems. Microsoft mentioned that the attempted activities were beyond just the presence of malware SolarWinds code in their environment. Microsoft has “an open source like culture” which allows teams within Microsoft to view the source code. The company acknowledges that it is a threat model but they are downplaying the risk by saying “just viewing the source code should not cause any elevated risk”.

The Russian Hackers have also managed to breach the network of Austin City, Texas. The breach dates back to at-least mid of October 2020. The hackers have seemed to target the U.S. Treasury, Departments of Commerce and Homeland Security, The Pentagon, Cybersecurity firm FireEye, and SolarWinds. The breach of the network of the Austin city is an apparent win for Russian hackers. Theoretically, the compromise could have helped them access sensitive information in accordance with the city governance, elections, city police and by excavating deeper, the hackers can practically burrow inside energy, water and airport networks of the city.

Berserk Bear, the hacking outfit that is currently believed to be behind Austin’s breach appears to have used Austin’s network as grounds to stage larger attacks. Berserk Bear also known as BROMINE inter alia several names is believed to have been responsible for a series of breaches of significant U.S. infrastructures in the past year.

The attacks on SolarWinds, U.S. government and FireEye have been linked to another Russian group called APT29 also popularly known as Cozy Bear. Berserk Bear is allegedly a unit of Russian federal Security Service (FSB). Cozy Bear is known to be affiliated with the Russian Foreign Intelligence Service, or SVR. FSB and SVR are considered to be successors of the Committee of State Security of the Soviet-era which was widely known as the KGB.

The Austin Council seems to have been aware of the breach from October 2020. The FBI and CISA had published an initial advisory warning of “advanced persistent threat actors” (APTs) on October 9th, 2020. The advisory warned the city council of APTs targeting state and local governments. On October 22nd, a follow-up advisory was published in which both agencies accredited the breach to Berserk Bear. CISA published a heat map listing the types of organizations that were breached, scanned or targeted by Berserk Bear. The reputation of Berserk Bear of lurking fit their common pattern of espionage-oriented attacks. Sami Ruohonen, a researcher at Finnish cybersecurity firm F-Secure said that the adversaries have already been in the network for more than a couple of months before someone discovers their existence. Ruohonen also mentioned that this technique is specially preferred by APT groups because, the longer they go unnoticed, the longer they have a remote access to the network. F-Secure, in a report published in 2019, compared Berserk Bear and similar groups to the cyber equivalent of sleeper cells.

The cybersecurity experts have warned Austin city and the U.S that Berserk Bear hackers are not just involved in espionage and sabotage. They can gear up at any moment and create havoc in the United States. These Russian Hackers can cause city blackouts, disturbance in water supply and can even disrupt COVID-19 relief. Vikram Thakur, a technical director at Symantec who has tracked Berserk Bear for years quotes,  “We should be cognizant of the level of information that they have, turning on valves or closing valves, things of that sort — they have the expertise to do it.”

Kevin Thomson, the ex-CEO of SolarWinds | Source: SolarWinds Facebook

SolarWinds replaced their ex-CEO Kevin Thomson with Mr Sudhakar Ramakrishnan. Unlike his predecessor Thomson, who is an accountant by training, Ramakrishnan comes from a security background having led Pulse Secure in the recent past. The new CEO publicly stated that the company will be making 5 critical changes to put security front and center. The company also hired ex-CISA chief Chris Krebs and Facebook’s former security lead, Alex Stamos. Krebs and Stamos work as independent consultants to help the company coordinate its crisis response. Krebs told the Financial Times that it could even take years to uncover the full extent of the hack. On the brighter side, the new CEO mentioned that the company has engaged several cybersecurity experts to assist SolarWinds in its efforts to become more secure.  We can hope that, with better expertise, vision and understanding of threat and vulnerability management, the company is now headed towards a better future.

Read More