CSS CYBER DEFENSE PROJECT Hotspot Analysis The use of cybertools in an internationalized civil war context: Cyber activities in the Syrian conflict Zürich, October 2017 Version 1 Risk and Resilience Team Center for Security Studies (CSS), ETH Zürich The use of cybertools in an internationalized civil war context: Cyber activities in the Syrian conflict Authors: Marie Baezner, Patrice Robin © 2017 Center for Security Studies (CSS), ETH Zürich Contact: Center for Security Studies Haldeneggsteig 4 ETH Zürich CH-8092 Zürich Switzerland Tel.: +41-44-632 40 25 [email protected] www.css.ethz.ch Analysis prepared by: Center for Security Studies (CSS), ETH Zürich ETH-CSS project management: Tim Prior, Head of the Risk and Resilience Research Group; Myriam Dunn Cavelty, Deputy Head for Research and Teaching; Andreas Wenger, Director of the CSS Disclaimer: The opinions presented in this study exclusively reflect the authors’ views. Please cite as: Baezner, Marie; Robin, Patrice (2017): Hotspot Analysis: The use of cybertools in an internationalized civil war context: Cyber activities in the Syrian conflict, October 2017, Center for Security Studies (CSS), ETH Zürich. 2 The use of cybertools in an internationalized civil war context: Cyber activities in the Syrian conflict Table of Contents 1 Introduction 5 2 Background and chronology 6 3 Description 9 3.1 Attribution and actors 9 Pro-government groups 9 Anti-government groups 11 Islamist groups 11 State actors 12 Non-aligned groups 13 3.2 Targets 13 3.3 Tools and techniques 14 Data breaches 14 Website defacement 14 DDoS 15 Malware 15 4 Effects 17 4.1 Social effects 17 4.2 Economic effects 18 4.3 Technological effects 18 4.4 International effects 19 5 Policy Consequences 20 5.1 Raising awareness of propaganda and radicalization online 20 5.2 Incentivizing social media to better control content 20 5.3 Improving cybersecurity 20 5.4 Monitoring the evolution of the conflict 20 6 Annex 1 22 7 Annex 2 28 8 Glossary 29 9 Abbreviations 30 10 Bibliography 31 3 The use of cybertools in an internationalized civil war context: Cyber activities in the Syrian conflict use of cybertools in the context of conflicts. The goal is The use of cybertools also to understand how victims handled and responded to attacks in order to learn from their experiences and in an internationalized be able to prepare for similar situations. civil war context: Description During the Arab Spring, Syrian dissidents saw an Cyber activities in the opportunity to claim more freedom. However, unlike in Tunisia and Egypt, their protests did not achieve the Syrian conflict overthrow of the Syrian President Bashar al-Assad, but instead resulted in civil war. The various groups of actors involved in the war have used cyberspace not only to Targets: Government institutions and pro- promote their ideologies, but also to target their government groups, anti-government enemies or enemies’ associates and partners with groups excluding Islamist groups, website defacement, Distributed Denial of Service Islamist groups, third-party states, attacks and spying malware delivered via spear phishing third-party organizations, and media emails. outlets. Tools: Distributed Denial of Service1, website Effects defacement, data breaches, misinformation, various freely Effects of cyber activities conducted in the available malware (e.g. DarkComet context of the Syrian civil war have been observed at RAT, njRAT, XtremeRAT both the domestic Syrian level and at the international Backdoor.breut, BlackWorm, level. The effects on Syrian society were marked by NanoCore, ShadowTech RAT propaganda campaigns on social media and a blurring of DroidJack), a customized malware, a the distinction between combatants and non- malicious Android application, spear combatants. Economic effects were felt through the phishing emails, fake social media login direct and indirect costs of Distributed Denial of Service pages and fake websites with malicious attacks and website defacements, but also due to the links. drop in the stock market value after a false message was Effects: Propaganda and misinformation on posted on the hijacked Twitter account of Associated social media and defaced websites, Press. Technological impacts were limited due to the low internationalization of the conflict sophistication of the cyberattacks. through cyberspace, drop in stock At the international level, the effects were mainly market due to defacement, use of characterized by the international nature of both the malware in support of ground victims and perpetrators of cyberattacks. Also, the operations. conflict did not escalate in cyberspace and spill over into Timeframe: From spring 2011 and still ongoing with the physical realm. Cyberattacks remained of low a hot phase from 2011 to 2014. intensity and focused mainly on harassment and espionage. Syria attracted considerable international attention during the Arab Spring, when the government Consequences violently repressed protests. The demonstrations escalated into a civil war, which was simultaneously The consequences that can be derived from the conducted in cyberspace. Pro-government, anti- context of the Syrian conflict in cyberspace mostly relate government and Islamist groups fight each other online to increasing awareness of propaganda and using cybertools such as website defacement, radicalization on social media and incentivizing social Distributed Denial of Service attacks and malware. media stakeholders to better control contents posted on This report examines cyber activities in the their platforms. This report also recommends that state context of the Syrian civil war. It also studies the impacts actors improve their cybersecurity through awareness- of cyberattacks on Syrian society, the economy, building campaigns and technological solutions. Finally, technology and at the international level. the analysis suggests that the development of the Syrian The aim of this hotspot analysis is to develop a conflict and its actors both on the ground and in better understanding of the possible mechanisms of the cyberspace should be closely monitored. 1 Technical terms written in italic are explained in a glossary in Section 8 at the end of the document. 4 The use of cybertools in an internationalized civil war context: Cyber activities in the Syrian conflict Section 4 studies the effects of the cyberattacks on Syrian society. These were characterized by propaganda on social media trying to discredit enemies, 1 Introduction an internationalization of the conflict through activities During the Arab Spring in 2011, cyberspace conducted in cyberspace by sympathizers of either side played a significant role in the development of anti- to the conflict, and an increase in mistrust among government protests and the spread of democratic members of anti-government groups targeted by ideas. In 2000, when Bashar al-Assad became Syria’s impersonation of social media accounts. The second leader, only 0.2% of the Syrian population used sub-section examines the economic effects of the computers. The number of users significantly increased cyberattacks. These can be summarized as the direct to reach 22.5% in 2012 (Grohe, 2015). The growth of and indirect costs of Distributed Denial of Service (DDoS) internet users in Syria and the start of the Arab Spring in and defacement attacks and by the stock market’s Tunisia and Egypt emphasize the role of cyberspace in negative reaction to false information posted on the the Syrian conflict. The use of hotspots to evaluate each hijacked Twitter account of Associated Press. Sub- concrete case can support the theoretical and abstract section 3 investigates the technological effects of concepts of cybersecurity. This hotspot analysis cyberattacks carried out during the Syrian civil war. examines the cyber-dimension of the Syrian civil war. These technological impacts are identified as physical During the Arab Spring, it became evident that tampering with internet functionality by the Syrian cyberspace was often used to organize protests and government and the fact that cyberattacks were demonstrations against the Tunisian and Egyptian generally not sophisticated, relying on malware that is governments. This also occurred during protests in Syria, easily available online. and relevant activities evolved into platforms for gaining The last sub-section looks into the impacts of the domestic and international support for both the anti- cyberattacks at the international level. The analysis government and the pro-government groups. demonstrates that the cyberattacks taking place in the The study of this hotspot is relevant because it context of the Syrian conflict affected people and illustrates how the use of cyberspace evolved from a businesses internationally, but that perpetrators may context of domestic unrest to civil war involving a variety also have originated from outside Syria. It also shows of actors. This hotspot is also placed into the context of that the use of malware mainly focused on gathering international tensions between local rival states and information to support the battlefield and notes that major powers such as the USA and Russia. Western states imposed international economic The aim of the analysis is to describe how victims sanctions on Syria. of cyberattacks were affected and how they responded. Finally, Section 5 provides a number of This document will be updated as new elements are recommendations to state actors in order to decrease discovered or significant changes occur. The