Publications

On July 14, 2020, a discussion at the Institute for National Security Studies (INSS) attended by INSS researchers and experts in the cyber realm focused on a hypothetical scenario of an Iranian cyberattack on the health systems in Israel and the United States. According to the scenario, the attack occurred against the background of events in recent months in the cyber realm between Iran and Israel; the explosion in Natanz; and other occurrences where it is questionable whether events were deliberate, and if so, who was responsible. In the scenario, most of the damage is suffered by the Israeli health system and involves the disruption of databases, and also results in the death of a number of patients. This outcome compounds the difficulties already besetting the health system (hospitals, HMOs, and the Israeli Ministry of Health) as a result of the Covid-19 pandemic, the intensive media coverage of the resulting crisis, and the lack of public faith in the ability of the health and government establishment to deal with it.

The "Iranian Attack": What Happened and What Did Iran Hope to Achieve?

Although Russian hackers are also involved in the hypothetical cyberattack on the health system, the fundamental assumption in the discussion was that Iran is fully responsible for it. The participants tended to see the Iranian operation as a response to kinetic and cyberattacks attributed to Israel and other Western parties recently carried out against Iran. The participants estimated that these actions drove the Iranian regime to respond to the actions against Iranian targets much more severely than it has in the past, in order to preserve its aggressive image abroad and, in light of the criticism at home, internally as well. Most participants assumed that Iran's preference for acting in the cyber realm is indicative of a desire to leave room for denial, to avoid a belligerent image in the international arena, and to avoid escalation in its conflict with the West and with Israel.

At the same time, the participants assessed the Iranian attack as reflecting both a troubling lack of inhibition against inflicting damage in civilian realms and Iran's potential development in the cyber realm (from destructive espionage and the use of third parties to the direct exchange of blows). The discussion analyzed two different possibilities with regard to Iran's goal: first, the attack is a failed attempt at an extremely significant attack on human life, and therefore evidence of limited ability; second, it is an attempt to cause small-scale damage as a demonstrative and deterring signal of more impressive abilities. It was agreed that either way, assessing Iran's intentions is important for deciding on an Israeli response.

Significance for Israel

In the view of the participants, the scenario highlights the vulnerability of the Israeli cybernetic home front. In this context, the health system is especially vulnerable to cyberattacks due to its reliance on open data apparatuses and old computer systems and the fact that it is relatively accessible and decentralized. Although this attack requires cyber abilities of a not particularly high level, the health system is not defined as critical infrastructure, and therefore the level of defense protecting it is relatively low. Moreover, the sensitive timing of the crisis stemming from the Covid-19 pandemic creates a strategic effect of paralyzing the system, which is currently at the forefront of a war effort and already suffering from a lack of trust on the part of the Israeli public due to criticism of its performance, particularly in the second wave of the virus. It is an example of an asymmetrical cyberattack that does not penetrate core secrets or deep critical national infrastructure, but can cause much damage on both physical and psychological levels.

There was some disagreement as to whether the attack on the health system was "more of the same" in the cyber war between Iran and Israel, or whether it reached a new level and sought to create new rules of the game. Thus some argued that because of the minimal damage to human life, Israel should contain the event as much as possible and respond in a focused manner, with an emphasis on the cyber realm and leveraging the event from a political perspective. In contrast, some participants maintained that by carrying out the attack, Iran played into Israel’s hands by ostensibly giving it grounds to take advantage of the strategic window of opportunity to strike at the Iranian nuclear program using a large-scale kinetic attack – especially in light of the uncertainty that US President Donald Trump will remain in the White House.

A major insight regarding both approaches is that regardless of Iran's intention and its operational capabilities, Israel in effect will be the one to decide the significance of the attack. That is, an absence of media coverage and a restrained response could mean that Israel chooses to interpret the Iranian attack as not crossing a line, despite the provocative attack on the health system. On the other hand, a large-scale kinetic and political response, which lends the attack attributed to Iran a high profile including statements by senior Israeli officials would award Iran global prominence and constitute recognition of its abilities.

A Counterattack as Part of a Large-Scale Campaign against the Nuclear Program

The discussion dealt more broadly with Israel's goals in its confrontation with Iran. First and foremost, Israel is interested in preventing Iran from acquiring nuclear weapons through a combination of direct damage and international pressure, such as an embargo and sanctions. Israel also seeks to prevent Iran from entrenching itself throughout the Middle East, with an emphasis on Lebanon and Syria. In addition, Israel strives to establish deterrence against Iran to prevent the recurrence of cyberattacks. During the discussion, it was argued that Israel also wishes to take cyber and/or kinetic action against Iran when the United States is party to at least part of the campaign, especially before the closure of the window of opportunity, which is estimated to exist for the duration of President Trump's current term.

Specifically with regard to the scenario of an attack against the health system, two approaches emerged on an appropriate response. The first was a reprisal measure that combines a cyber dimension with a significant political measure against Iran, with the aim of establishing deterrence in the cyber realm, reflecting the price that can be expected, and marking red lines and rules of the game for the future. The scenario of an attack on the health system, especially during the Covid-19 pandemic, constitutes a diplomatic opportunity to leverage the attack to force Iran to pay a heavy political price for its actions, and perhaps also to give Israel international legitimacy for reprisal in other realms as well. Intentionally doing damage to the health system, especially during the current period, portrays Iran as a disruptive force in the international theater and emphasizes the character of the regime, which works to undermine the world order. The United States response to attacks on health systems in the world has been severe and resolute (as reflected in the statement by Secretary of State Mike Pompeo following the attack on the health system in the Czech Republic). The second approach was to leverage the Iranian measure and take advantage of the strategic window of opportunity existing on the eve of the elections in the United States with a large-scale attack on the Iranian nuclear program combining kinetic and cyber capabilities.

The discussion raised a number of possible Israeli responses in the cyber dimension: striking at symbols of the regime and arms of government, with an emphasis on military industries, and perhaps also the nuclear program itself. Another possible direction is exposing the Iranian cyber apparatus responsible for the attack against the health system in Israel. There was evident agreement on the need to avoid damage to civilian infrastructure and civilians. It was also agreed that it is preferable that such action receive the blessing of the United States and be coordinated with it. Cyberattacks generally have few media reverberations, and it is therefore important to make sure that the Iranian public is aware of the results of the attack and its actual and potential costs.

Equally important is that an Iranian cyberattack requires reassurance to the internal Israeli system, including increased preparedness, but is careful not to provide Iran with a victory picture. It is necessary to strengthen the Israeli cyber defense apparatus, with an emphasis on the health system, and reinforce the cyber elements of the health system with outside professional elements. In addition, it is imperative to prevent the onset of public panic, which could damage the performance of the health system and force the political echelon into making strategic decisions.