Hacked traffic cams and hijacked TVs: How cyber operations supported the war against Iran

On Saturday, U.S. and Israeli jets began a bombing campaign against Iran, killing its supreme leader Ali Khamenei and several senior government officials. The attacks also hit military and civilian targets all across the country, including a girls’ school, where at least 168 children and adults were killed. 

After a few days of conflict, multiple reports, as well as statements from government officials, suggest that cyber operations played a significant role in the beginning of the war. This shows that in current times, hacking can be an important component of real-world conflicts and war, supporting kinetic strikes and providing intelligence from surveillance activities, as well as being used as part of psychological operations, or psyops.

The most direct confirmation of a cyber operation playing part in the war came from the U.S. chairman of the joint chiefs of staff Gen. Dan Caine, who said that “coordinated space and cyber operations effectively disrupted communications and sensor networks” in Iran ahead of the attack, “leaving the adversary without the ability to see, coordinate or respond effectively.” 

The goal, Caine said in a press conference, was to “disrupt, disorient and confuse the enemy.” 

In another example of a coordinated kinetic-cyber operation, Israel first bombed the offices of two state-owned Islamic Republic of Iran Broadcasting (IRIB) channels. 

Israel Defense Forces then hijacked the broadcast to air speeches by Donald Trump and Israeli Prime Minister Benjamin Netanyahu urging Iranians to join the fight against the regime, according to The Jerusalem Post. A similar hack against one of the channels happened in January. 

As part of the operation to kill Khamenei, Israeli spies reportedly used information from hacked traffic cameras across Tehran, according to Financial Times. Citing two anonymous sources, the paper reported that Israel had had access to the camera network for years, as well as “deeply penetrated mobile phone networks.”

There have also been reported cases of unattributed cyberattacks that strongly appear to be the work of either American or Israeli government hackers.

According to multiple reports, on the first day of the war, hackers breached a popular Iranian prayer app called BadeSaba Calendar, sending a handful of messages to all users. 

“For the freedom of our Iranian brothers and sisters, this is a call to all oppressive forces — lay down your weapons or join the forces of liberation,” read one message. “Only in this way can you save your lives. For a free Iran.”

These messages made it clear that this was a psychological operation with the goal of influencing those who might be more pro-regime than the rest of the population.

In response to these operations, at least for now, Iranian hackers have been largely ineffective, according to Bloomberg. At this point it’s unclear why Iranian government hackers have been quiet. Perhaps, an expert told Bloomberg, the fact that the internet is effectively shut down inside the country could be a factor.

It’s important to note that while these operations may very well be real, they also may have not played that significant of a role in the conflict, which makes sense given that war is about dropping bombs. There may also be a tendency from the authorities themselves to exaggerate the effect of cyber operations as a way to intimidate and scare the enemy.

That appears to have been the case in Venezuela earlier this year, where U.S. officials, including Trump himself, suggested U.S. hackers caused a power outage in Caracas during the operation to abduct President Nicolás Maduro. But, as a Cyberscoop analysis suggested, it’s much more likely that cyber activities played a small role, and it’s much more likely that the partial blackouts were instead caused by fighter jets destroying electrical substations.