Columbia International Affairs Online: Journals

CIAO DATE: 12/2011

Stuxnet and After

The Journal of International Security Affairs

A publication of:
Jewish Institute for National Security Affairs

Volume: 0, Issue: 21 (September 2011)


Brent J. Talbot

Abstract

Full Text

hile President Obama has focused much of his foreign policy efforts on jump-starting the peace process between Israel and the Palestinians, Israel has been preoccupied with what its policymakers see as a much greater, even existential, threat. Iran’s continuing efforts to acquire nuclear technology likely led to the 2010 Stuxnet cyberattack on its nuclear infrastructure, and though no one has claimed responsibility for the attack, most experts agree on two things. First, that Israel’s involvement was highly likely, and second, that the computer virus attack was the first of its kind, in that it achieved a kinetic effect—causing actual physical damage to approximately 1,000 of 8,000 or more centrifuges at the Natanz uranium enrichment facility. As a consequence, Iran’s progress towards producing a sizable amount of weapons-grade uranium is estimated to have been slowed by two or more years.1 Interestingly, speculation ran high during 2010 that some kind of Israeli attack on Iranian nuclear infrastructure was likely in the coming months, even though most defense experts were confident that such a strike—envisioned more as an airstrike (with actual kinetic damage)—on Iranian nuclear infrastructure would only delay, and not prevent, Iran’s efforts to acquire nuclear weapons.2 Even the then-current Chief of Staff of the Israel Defense Forces (IDF), Lieutenant General Gabi Ashkenazi, agreed, admitting that an aerial attack would only set back Iran’s nuclear program two or three years.3 With Iran’s ability to launch attacks against Israel through its proxies Hamas and Hezbollah, it seems unlikely that the benefits of delaying Iran’s nuclear program by such a short window outweigh the costs to Israel in terms of immediate, elevated threats within or beyond its borders. However, with the advent of the cyber attack demonstrated by Stuxnet, plausible deniability makes it more difficult for Iran to retaliate against its undetermined attacker. Iran’s shadow over Israel Israel is a state born of the Holocaust from which European Jewry fled, having no other place to go. Additionally, another 800,000 Jews migrated from Arab and Persian homelands to join them in Israel, some fleeing potential genocides of their own. The Jewish people have fought almost continuous wars against their Arab neighbors since founding the Jewish state, clashing in 1948, 1956, 1967, 1973, 1982, and 2006. They have also dealt with two major intifadas initiated by the Palestinians—as well as sporadic violence in the interim—since the 1967 occupation of the West Bank and Gaza. Israeli civil society is best described as a “national security culture,” focused upon the survival of a state ever involved in war or gearing up for war. Security has always taken priority over economics, personal concerns, or other governmental matters. Feelings of insecurity among the Israeli electorate are more likely to change the leadership at the political helm than any other concern.4 Israel’s foremost analyst of civil-military relations, Yoram Peri, confirms this view. According to him, “the centrality of security, the extensive human capital and social capital invested in the military, and the country’s institutional interests created in Israel a social structure different from that of democracies living in peace… Israel exists as a nation in arms and therefore lacks integral boundaries between its military and society.”5 Moreover, there is a lack of distinction between civil and military leadership, since so many former generals serve as politicians once retiring from military service, enabling a security-focused decision-making process at the highest levels of government.6 Recent policies, such as the construction of the security barrier or “fence,” have been aimed at ending Palestinian suicide bomber infiltrations into Israel at the expense of world opinion concerning Israel’s treatment of Palestinians. And because of its effectiveness at ending the al-Aqsa intifada, Israelis applaud the security barrier.7 Survival of the Jewish state is foremost in the minds of Israel’s politicians and citizenry, even at the expense of world acceptance. Still, Western perception would be that Israel must feel more secure now than at any time in its history. It has signed peace treaties with Jordan and Egypt (though peace with Egypt has become fragile with the advent of the Arab Spring). Moreover, the Golan front has remained quiet since 1973, even after Israel’s September 2007 attack on a suspected nuclear complex in Syria, which drew no retaliation. Iraq—its onetime principal threat—is no longer a concern since Saddam Hussein was removed from power. Lebanon’s powerful Hezbollah militia has not restarted hostilities since 2006, even though the recent Gaza War of December 2009/January 2010 left Hamas clamoring for help from its symbolic ally to the north. The Gaza operation itself has, at least temporarily, stopped Hamas support for rocket attacks on Israel, and the security barrier or “fence” has effectively ended suicide attacks in Israel. Lastly, even the Stuxnet attack has gone unanswered and achieved its purpose, whether it was launched by Israel or not. In sum, the Israeli military has proven itself the most capable in the region and its unacknowledged nuclear capability must be a deterrent to any potential nuclear-armed foe. Before Stuxnet, but with this state of affairs in mind, I interviewed Israel’s then-Director of Military Intelligence, Major General Amos Yadlin. He confirmed that Iranian nuclear efforts are Israel’s number one security concern, and that Iran is considered a much greater threat than Hezbollah or Hamas, both of which have been dealt with in the recent past, and both of which Israel feels have been deterred from further attacks, at least in the near term. Israel, according to Yadlin, is capable of dealing with these border threats even if Iran should increase its arms supplies and encouragement to harm Israel.8 Though he made no mention of any plans to attack Iran, one must consider that Iran is the only remaining existential threat to the state of Israel, that the pronouncements by Iranian President Ahmadinejad have called upon Muslim leaders to wipe Israel off the map,9 and that Israel, a state always focused upon its security first and foremost, has planned and trained for missions requiring the scale and distance to successfully attack nuclear sites in Iran. Bearing this in mind, one must consider that such an attack could be forthcoming as a follow-on to Stuxnet—and, if so, the U.S. and its coalition partners should be planning for the aftermath as it is likely to impact both regional security and U.S. and Coalition military operations in Iraq, Afghanistan, and the Persian Gulf. A post-Stuxnet offensive? In 1981, Israel successfully destroyed the Iraqi nuclear complex at Osirak. World opinion condemned the attack, yet Israel suffered no real political consequences in the attack’s aftermath, and the destruction of the reactor is widely believed to have prevented Saddam Hussein from acquiring nuclear weapons in the 1980s. Some would even say the U.S. has Israel to thank for the fact that it didn’t face a nuclear Iraq during the Gulf War in 1991. Menachem Begin, the Israeli Prime Minister who ordered the Osirak operation, pronounced what became known as the Begin Doctrine shortly thereafter: “We shall not allow any enemy to develop weapons of mass destruction.”10 Just over a quarter-century later, in September 2007, Israel again attacked a suspected nuclear complex, this time in neighboring Syria—a country that was number two on the former DMI’s threat list—and again it suffered no consequences. The event was barely mentioned in the newspapers and got little publicity, in part because the Syrians themselves were very slow to admit that any attack had occurred—perhaps embarrassed by their ineptitude in detecting or countering it, and the potential exposure of an undisclosed nuclear program erected in violation of the Nuclear Non-Proliferation Treaty. Considering that in both of these instances Israel’s nuclear-hungry regional neighbors were thwarted in their desires; that Israel suffered no real consequences from either engagement; and that Iran is now the third country in the region attempting to go nuclear, Israel’s track record—along with the continued acceptance of the Begin Doctrine by successive Israeli governments—seems to indicate that an attack on Iran will be forthcoming sooner or later, and that the first phase of such an attack may have already occurred in the form of Stuxnet. Further supporting this view is the comment made by Shaul Mofaz, former IDF Chief of Staff and then-deputy prime minister, who told an Israeli newspaper in 2008 that, “if Iran continues to develop nuclear weapons, we will attack it.”11 Though Mofaz no longer holds a cabinet office, the current Israeli government led by Likud leader Benjamin Netanyahu achieved victory over a Kadima-led coalition primarily due to increased security concerns from the Israeli electorate. Had Kadima’s disengagement plan been successful in achieving a more peaceful environment after Israel’s 2005 withdrawal from Gaza, the electorate would have left Kadima in power. But with the Hamas takeover of Gaza and the resulting surge in violence that precipitated Operation “Cast Lead,” the electorate favored the conservative parties and Likud was able to engineer the current governing coalition.12 And prior to his election, Netanyahu articulated extreme concern about Iran, arguing that it’s a “suicidal state that will be prepared to sacrifice millions of its own citizens in a nuclear exchange with Israel.”13 Thus, a more conservative, security-conscious government is in place with particular concerns about Iran’s nuclear intentions. Ehud Barak, another former IDF chief, remained as Defense Minister in Netanyahu’s government, and he is also an advocate of action against Iran.14 Thus, the likelihood of a decision to launch a preemptive strike against Iran has increased with the accession of Netanyahu, and supports Israel’s plausible involvement with Stuxnet. At the same time that the Israeli government changed hands, U.S. intelligence sources claimed (before Stuxnet) that the “earliest possible date Iran would be technically capable of producing enough highly enriched uranium (HEU) for a weapon is late 2009…” though the more probable time frame is 2010-2015.15 After Stuxnet, it may be assumed this window is pushed out by a couple of additional years—from 2012 to 2017. Iran also has demonstrated the capability to deliver an atomic weapon, having put a satellite in orbit during February 2009.16 Even more remarkable, intelligence uncovered by the London Times during August 2009 indicates that Iran has openly stated that it completed its research program to weaponize uranium and could feasibly make a bomb within one year of a decision by Supreme Leader Ayatollah Ali Khamenei. It would take six months to enrich enough uranium for a nuclear device, and another six months to assemble a warhead that could be carried aboard the Shahab-3 missile.17 Referring back to the Osirak case, Israel struck just days before the reactor was to become operational. So, if Israeli intelligence sources agree to similar assessments regarding the Iranian nuclear timetable, an IDF follow-on airstrike to Stuxnet (or perhaps a follow-on cyber attack) could occur as early as 2012.18 Targeting Iran’s nuclear program A major argument against an IDF airstrike on the Iranian nuclear infrastructure is that it is too dispersed and hardened to be successfully targeted with any high probability of success. But Efraim Inbar, Director of Israel’s Begin-Sadat Center for Strategic Studies, claims that Natanz is the key facility. Without uranium enrichment, the Iranian program cannot go forward, and Natanz serves as the lynchpin of Iran’s enrichment capabilities. As a result, Inbar concludes, “All the eggs are in one basket at Natanz.”19 In other words, one target is within Israel’s capabilities as was the case in Iraq and Syria, though a second enrichment site has been revealed at Fordo (near Qom) since Inbar’s remark and thus would also need to be targeted. Interestingly, while still in its infant stage, enrichment operations at Natanz were suspended in November 2003 after Iran signed an agreement with France, Germany and the UK (the E3). However, with Ahmadinejad’s election in 2005, Iran violated the enrichment agreement and resumed research and development efforts at Natanz against E3 and International Atomic Energy Agency (IAEA) wishes.20 In 2006, the IAEA referred the matter to the United Nations Security Council and since that time Iran has played the game of feigning cooperation with the IAEA on the matter of uranium enrichment. Natanz was designed to house nearly 50,000 centrifuges when fully operational, and at present it is estimated that some 8,000 to 9,000 are in place there. Prior to Stuxnet, analysts believed that all the centrifuge cascades—with newer and more efficient models coming in later installments—would be fitted and potentially operational by 2012.21 Of course, the Stuxnet cyber attack has changed that timeline, and damaged at least 1,000 of the centrifuges according to intelligence estimates.22 MIT nuclear experts Whitney Raas and Austin Long concur that Natanz is the most important target in the Iranian nuclear infrastructure.23 Still, other estimates state that 4,000-5,000 centrifuges would be enough to generate “one weapon’s worth of uranium every eight months or so,” which was actually less than the number on hand at the time of the Stuxnet attack; a similar number of centrifuges may eventually be (or perhaps already have been) installed at Fordo.24 Raas and Long also state that there are two more critical nodes in the nuclear infrastructure: uranium conversion facilities at Isfahan, and the heavy water plant and plutonium reactors under construction at Arak.25 Raas and Long’s target analysis indicates that 50 Israeli fighters, F-15s and F-16s, armed with appropriate GPS- or laser-guided penetrating bunker buster weapons would achieve a high probability of success against the targets of concern which they designated: Natanz, Isfahan and Arak (though Fordo must now be added to their assessment as well).26 Considering that Israel launched 100 aircraft in a contingency exercise flown over the Mediterranean in 2008—explained in greater detail below—extra fighters for the additional target at Fordo are certainly available. Three possible routes of attack are also included in Raas and Long’s analysis.27 The most likely route is across southern Turkey, as it allows refueling over the Mediterranean during the mission for all fighters departing for and returning from target(s) in Iran, ensuring adequate fuel to complete the mission. More importantly, this route mitigates the need to overfly potentially hostile Arab countries that may engage Israeli aircraft or at least prevent refueling operations over their territory. Though certainly no longer an ally after the recent rupture of military ties with Israel,28 Turkey likely was complicit in the 2007 attack upon Syria—detachable wing tanks from an Israeli fighter were found on the Turkish side of the Syrian-Turkish border during that operation—and some even speculated that the Syrian raid was a dress rehearsal for an Iranian attack.29 While such complicity is certainly not indicative that Turkey might ignore overflight of its territory, use of this route would mitigate the need to get a green light from the U.S. for the attack.30 Moreover, Turkey actually shares Israeli concerns about a nuclear Iran. And though Turkish relations with Iran have improved since his pronouncement, Turkish Prime Minister Erdogan stated in 2006 that he cannot support Iran’s nuclear program if it seeks development of weapons of mass destruction.31 Israel’s June 2008 exercise provides empirical evidence that Israel is capable of conducting a major attack on Iran. More than 100 F-15 and F-16 fighters flew over 900 miles from their bases in Israel out over the Mediterranean, refueled and returned to simulate a mission that could reach Iranian targets given straight line routes from bases in Israel.32 Though the actual distance is 1,380 miles per Raas and Long’s assessment, using the Turkish route to their farthest aim point in Isfahan,33 with the added ability to refuel on the return route there is no reason Israeli fighters would be limited by the distance to the target. And the fact that Israel was able to conduct a mass exercise, using twice the calculated numbers of fighters suggested by Raas and Long, indicates that Israel could not only destroy the three key targets in their analysis as well as Fordo, but excess capacity would be available against other targets that might be added by an Israeli intelligence assessment, including air defenses, or perhaps more of the well-dispersed Iranian nuclear infrastructure. Some might argue that though Israel has sufficient aircraft, it would be unable to penetrate Natanz and Fordo. The Iranians learned the lesson of Osirak and thus built a hardened and dispersed facility at Natanz, where two separate large halls containing the centrifuge cascades are deeply buried some eight to 23 meters underground and protected by multiple layers of concrete.34 Fordo is even more protected as it is constructed entirely inside a mountain. But sales by the U.S. of GBU-39 bunker buster bombs, along with the more capable GBU-28 (in terms of deep penetration) to the Israeli Air Force, mean that Israel has the required weapons to do the job.35 Concerns over Iranian reprisals The biggest argument against an Israeli attack is the expected reprisal that would be carried out by Iran. With influence over both Hamas and Hezbollah, Iran would likely use its proxies to launch retribution attacks against Israel. A second option would be a missile barrage aimed at Israel. More worrisome for the U.S. would be an attack on oil shipping or an effort to close the Strait of Hormuz. While these reprisals seem more than Israel would be willing to bargain for, Inbar suggests that Israel has already dealt with Hamas and Hezbollah, especially during the past five years; and that both parties have been worn down by Israeli efforts to re-establish deterrence. According to Inbar, Israel can handle terror threats from these groups, and neither is an existential threat like a nuclear-armed Iran. Furthermore, Inbar believes that Israel’s missile defense system could handle an Iranian missile volley. Finally, he notes, the oil threat is more of a U.S. problem than an Israeli one, and closing the Strait would be as much a problem for Iran—in need of hard currency through oil sales—as anyone else, particularly the Chinese, who buy 540,000 barrels of Iranian oil each day.36 For Israel, the bottom line is that a nuclear Iran is much more dangerous than Hamas, Hezbollah, or a conventional missile counter attack by Iran. Israel has the capability to set back Iran’s nuclear ambitions. It has struck both Iraqi and Syrian nuclear programs in the past, is a logical source of the Stuxnet cyber attack on Iran, and thus demonstrates a willingness to act in defiance of world opinion. It has the means to accomplish the mission without a green light from the United States. Despite U.S., UN, and European diplomatic efforts to bring Iranian facilities under the watchful eye of the IAEA, Iran continues enrichment operations at Natanz (and perhaps Fordo) and increases its likelihood of enriching uranium to weapons grade. It could essentially reach a North Korean-style nuclear threshold by the end of 2012.37 Finally, mindful of last year’s cyber attack on Iran, Professor Inbar may have been prophetic when he stated that “[President] Obama will have a six month window to do something diplomatically; then Israel will have to strike if the U.S. doesn’t.”38 So why doesn’t the U.S. carry out the attack instead of Israel? Certainly it has the greater capability to do so, and there are commonly-shared assessments regarding the Iranian threat. In a 2007 report, the Washington Institute for Near East Policy outlined the following common concerns: potential Iranian use of nuclear weapons; the threat to use nuclear weapons; proliferation of nuclear technology to radical states or terror organizations; more aggressive Iranian foreign policy fueled by a nuclear deterrent; unleashing a nuclear arms race in the Gulf region; the danger of a follow-on, even more radical Iranian regime controlling nuclear weapons; and lastly, of more specific concern to the U.S., if Iran crosses the nuclear threshold, it will be a severe blow to international nonproliferation norms championed by the U.S. in the Nuclear Non-Proliferation Treaty.39 All of these possibilities run counter to U.S. regional interests, and are deplorable outcomes should Iran cross the nuclear threshold. Still, from the U.S. perspective, Iran is not an existential threat and deterrence and containment are viable alternatives to a preventive military strike. And considering the Iranian ability to wreak havoc on Gulf oil shipments, interfere with U.S. interests in Iraq, Afghanistan and elsewhere, they are widely seen as preferable and less potentially destabilizing options. In sum, American concerns regarding Iranian reprisal are much greater than those of Israel, and are equally negative—perhaps even more so—to those presented by a nuclear Iran, especially when deterrence and containment are still practical alternatives.40 Israeli concerns are solely concentrated upon the threat of potential annihilation should Iran cross the nuclear threshold. Then what about a publicly pronounced U.S. security guarantee to Israel—a nuclear umbrella—to negate the need for Israeli preemption? This would present its own problems to Israel. First, the Washington Institute study points out, “Israel would fear that a security guarantee would diminish its freedom of action,”41 tying its hands, so to speak, in terms of limiting its options against Iran and perhaps other future threats (like a radicalized Egypt arising out of the aftermath of the Arab Spring). Secondly, Israel might fear that the United States would demand that it unveil its own strategic capabilities,42 particularly its opaque nuclear capabilities, possibly even dismantling them in the interest of nonproliferation norms. This would be unacceptable to a security-driven society like Israel. Thirdly, Israel might fear that the U.S. would not follow through with its nuclear commitments when crunch time came, if Israeli action didn’t go hand-in-hand with U.S. vital interests. And lastly, becoming a “direct American ward would lead to long-term erosion among Israel’s citizenry of its traditional and deeply held ethic of self reliance.”43 For these reasons, it’s highly unlikely that Israel would accept an American security guarantee as an alternative to eliminating the Iranian nuclear threat directly. Israel, therefore, is highly likely to launch additional efforts, be they cyber or kinetic, against the Iranian nuclear infrastructure to prevent, or at least delay, Iran reaching the nuclear threshold. This argument, of course, runs counter to the the typical Western security mind-set that a direct strike against Iran’s nuclear edifice by either the United States or Israel is by now no longer feasible. Diplomats like to believe that persuasion and appeasement are alternative tools in relations between states, but a security-driven society like Israel focuses upon military solutions to threats, especially those that are existential. Israel perceives its adversary as a target needing preemption rather than a persuadable entity. It further sees Iran’s nuclear ambitions as a direct—and potentially catastrophic—threat. The cost-benefit analysis of a state living in the shadow of another holocaust perceives only military solutions. The U.S. and its Coalition partners should prepare for the inevitable aftermath.