Cyberwar: The ISIL Threat & Resiliency in Operational Technology Thesis Presented to the Faculty of the Department of Information and Logistics Technology University of Houston In Partial Fulfillment of the Requirements for the Degree Master’s of Information Systems Security By Gregory S. Anderson May 2017 Cyberwar: The ISIL Threat & Resiliency in Operational Technology ____________________________________ Gregory S. Anderson Approved: Committee Chair: ____________________________________ Wm. Arthur Conklin, PhD Computer Information Systems and Information System Security Committee Member: ____________________________________ Chris Bronk, PhD Computer Information Systems and Information System Security Committee Member: ____________________________________ Paula deWitte, PhD Computer Information Systems and Information System Security ____________________________________ ____________________________________ Rupa Iyer, PhD Dan Cassler Associate Dean for Research and Graduate Interim Chair for Department of Information Studies, College of Technology and Logistics Technology THIS PAGE INTENTIONALLY LEFT BLANK Acknowledgments First, I would like to thank Dr. Chris Bronk and Dr. Art Conklin for their support and guidance throughout my time at the University of Houston. Their dedication to students is unparalleled for any other professor I have come across during my education. I would also like to thank my family for their ongoing encouragement and love. The fostering environment to peruse knowledge and “never settle for less” has been a constant inspiration throughout my life. Lastly, to my partner of 7 years, Lorelei. None of my achievements these past few years would have come to fruition without her continuous love, support, and willingness to sacrifice for the greater good is deeply appreciated. Thank you for being the most patient and steadfast person I have ever known, I love you. Cyberwar: The ISIL Threat Cyberwar: The ISIL Threat Table of Contents Introduction ..................................................................................................................................... 2 Contemporary Counter Insurgency Operations in the Middle East ................................................ 3 An Appraisal of Contemporary Cyber Operations ......................................................................... 6 Why They Fight – ISIL Social Media & Propaganda ................................................................... 11 ISIL’s Cyber Capabilities and Intent ............................................................................................ 15 The ISIL Cyber Complex.............................................................................................................. 18 Policy Options – Cyber Offense Against ISIL ............................................................................. 21 Glossary of Abbreviations ............................................................................................................ 26 References ..................................................................................................................................... 28 Page 1 of 35 Cyberwar: The ISIL Threat Introduction Although the United States withdrew its last remaining significant military forces from Iraq in December 2011, a significant insurgency spanning the territory of Iraq and Syria has evolved under a variety of names including the Islamic State, Islamic State in Syria (ISIS) and the Islamic State in Iraq and the Levant (ISIL). (For the purposes of this work, we choose to employ the title ISIL.) Since its inception coming on the heels of a break with the al-Qaeda in February 2014, it has come to be the chief standard bearer of a Salafi Jihadist movement set upon forming a trans-regional caliphate. In its activities, ISIL has extended its territorial reach across North Africa and the Arabian Peninsula as well as claiming credit for terror attacks from Belgium to Bangladesh. As much as a movement, ISIL is the contemporary brand for Jihadist insurgency in the Middle East and beyond. While ISIL forces have made impressive territorial gains in Iraq and maintained a viable resistance to the Assad government in Syria, it is now extending its reach into the digital domain, cyberspace, to further its ambitions in intelligence collection, propaganda, and recruitment. In addition, ISIL is perhaps the first violent insurgent or terror group to seriously consider developing at least modest cyber-attack capabilities as well as developing strength in sophisticated computing and communications technologies designed to defend the identity of its adherents and the security of their digitally-mediated interactions. (Paganini, 2015) For the United States, the fight against ISIL also represents a significant test of its own offensive cyber capabilities. Yes, ISIL has put US forces on the defensive, but if Cyber Command (CyberCom) is to be a viable part of the Department of Defense’s mix of forces going forward, it will need to demonstrate how it can be of utility in the counter-insurgency and counter-terrorism Page 2 of 35 Cyberwar: The ISIL Threat struggle against ISIL and its confederates. The fight against ISIL will represent a significant test of how CyberCom can operationalize tactical capabilities in line with strategic goals on marginalizing and eventually defeating this organization. Provided here are observations of ISIL cyber power, from digital information operations and intelligence, to operational security and desired future capabilities. We also examine openly available reporting on US cyber operations against ISIL and declarations of leadership intent from the Defense Department and national leadership here in the United States. Finally, we offer a prescriptive component which mates desired outcomes for diplomatic activities and military operations aimed against ISIL in the US Central Command area of responsibility with cyber options, both known and desired. Contemporary Counter Insurgency Operations in the Middle East Although ISIL’s roots are tied to the al-Qaeda terror organization, it has embarked upon a far more ambitious agenda for Islamic statehood that combines previous operational tradecraft in terror operations with a clear desire to capture and hold significant territory and generate economic activity sufficient to challenge state authority in its primary operating theater – Iraq and Syria. Combat operations against ISIL by outside military forces, including those of Iran, the United States (along with coalition allies), and Russia began in the summer of 2014. Russia deployed its contingent of air and ground forces to Syria in 2015, however. Fighting against ISIL has created a coalition of rather unusual bedfellows. Iran, a traditional foe of the United States since the 1979 Revolution, has a significant stake in supporting the coalition government of Iraq, with its large representation of Shia political leaders. (Nader, 2015) To this end, it has provided both air power and advisers on the ground to Page 3 of 35 Cyberwar: The ISIL Threat forces of the Iraqi army and pro-government militias. In parallel with the Iranian intervention, the United States has gradually reintroduced forces into Iraq, a number which stands at 4,650 as of July 2016. In addition to advisers and logistical support, the US maintains significant numbers of manned and unmanned aircraft in the region that have been employed in intelligence, surveillance and reconnaissance (ISR) missions as well as air strikes against ISIL forces. Russia’s involvement appears confined to Syria, in the form of air power and limited numbers of ground forces. Russia has also aided autonomous Kurdish forces in Syria. (Grove & Kesling, 2016) The Kurdish dimension to the ISIL conflict in Iraq and Syria further broadens the set of interested parties, most significant among them, Turkey. Considerable US and coalition resources have gone into supporting Kurdish military forces in Iraq. While the Iraqi Army collapsed in the face of the 2014 ISIL offensive, Kurdish troops have been viewed as more effective in protecting territories viewed as their own, but they are not without internal issues. (Gonzalez, 2015) In addition, Iraq’s current president, Fuad Masum, is an ethnic Kurd. While the interplay of Iraqi internal politics is of limited salience here, the Kurdish issue and the threat it presents to Turkey produces interesting information or possible cyber geopolitics relevant to the conflict as the Erdogan government has routinely found issue with the actions of its internal opponents on social media. (Taylor, 2014) Military operations against ISIL undertaken by the US-led coalition cohere well with the form of conflict summarized by now-retired admiral James Stavridis, the former commander of US forces in Europe. His view of contemporary conflict and that of the near future is that it will be dominated by drones, special operations forces (SOF), and cyber. (Stavridis, 2013) And to a great degree, that is the force mix that the US and its allies have fielded in Iraq and, to a lesser degree, Syria. Besides the US, Australia, Canada, Denmark, Germany, New Zealand, Norway, Page 4 of 35 Cyberwar: The ISIL Threat Spain, and the United Kingdom have deployed ground contingents, primarily composed of military advisers in Iraq and/or Iraqi Kurdistan. Many of these troops are the same sort of special operations forces called upon for direct action operations aimed to rescue hostages, identify targets for precision munitions,