Did Israel conduct cyber attack on Iran's air defences before bombing?

Claims that hacking has been used to confuse or break enemy radar systems point to a closely guarded capability

A long-range S-200 missile fired during a military drill in the Iranian port city of Bushehr. AP

Live updates: Follow the latest on Israel-Gaza

Details are still emerging on Israel’s wave of air strikes against Iran on Saturday, including a claim reported by Israel’s Kan News that Iranian air defences were hacked in advance.

The tactic was also disclosed to The Independent's Farsi edition by purported security figures in Iran on Monday. Israel and Iran regularly exchange cyber attacks, including alleged attacks on civilian infrastructure such as banks and transport systems, and most famously, a 2010 cyber attack on Iranian uranium enrichment equipment, with the Stuxnet virus.

“The defence radar systems were hacked in several places. The screens of these radars were frozen and the possibility of tracking the attackers was denied from more advanced radars in some defence systems,” The Independent reported.

Both publications said there had been an attempt to breach air defences using a cyber attack, without elaborating.

The tactic of using cyber warfare in air battles is not new. The National previously reported how Israel is thought to have used a cyber attack to disable Syrian air defences in a 2007 operation to bomb a nuclear research site in the east of the country at Deir Ezzor.

I would be amazed if there wasn't some kind of cyber effect that was used against the air defences

Thomas Withington,
expert on electronic warfare and radar

At that time, Syria’s formidable air defences had not yet been weakened by more than a decade of civil war that began in 2011, and waves of Israeli strikes that struck Iranian weapons starting in 2013. Israel also lacked the stealth F-35Is it has today, requiring novel methods for ensuring its non-stealth aircraft could safely cross Syrian airspace.

Operation Outside the Box involved F-15Is and F-16Is dropping about 20 tonnes of bombs on the Syrian scientific site before it became operational. The site was confirmed as a destroyed nuclear reactor by the International Atomic Energy Agency in 2011, ending years of speculation and claims.

However, debate on the methods used for the strike continued. Several aviation experts claimed Israel used technology similar to a US-British-developed system called Suter to hack into Syrian air defences. The aircraft-mounted system, designed by BAE, sends false information to radar displays about attacking aircraft, but its exact capabilities remain shrouded in secrecy.

The Suter device – or an Israeli equivalent – is mounted on aircraft dedicated to electronic warfare. In the US, the concept is at least 20 years old and is thought to fall under the US Air Force Big Safari electronic warfare programme, which develops highly classified new capabilities.

“The capability has transitioned to US Cyber Command,” said Thomas Withington, an independent expert on electronic warfare, radar and military communications.

“So, it's a US Air Force system. When it's used tactically, it's deployed from the EC-130H Compass Call aircraft. In terms of the Iran strike, I would be amazed if there wasn't some kind of cyber effect that was used against the air defences.”

According to a study by the International Institute for Strategic Studies, the plan for Suter envisioned using “radar or communications antennae as the entry point to plant malicious code into radars and command-and-control networks”.

This could “access and manipulate threat-system displays, to introduce false targets and to break into wider communications networks”.

It would be a logical method of attack, because many countries, including Iran, link up their air defence radars to create a national picture of air traffic, using secure fibre optic cables.

A US government image of a suspected nuclear reactor building under construction in Syria. Reuters

“I don't think they would have necessarily hit all of the air defence systems, but I think what they might have done is certainly altered track information,” Mr Withington said.

“The classic technique is, you're an air defence operator, and you're sitting at your radar, and you see contacts as they come in. You see targets. One of the things that was used in Syria when they hit the reactor was that the Israelis had recorded several Thursdays' worth of normal air traffic above Syria and the wider Mediterranean.

“They basically merged that together and injected that radar picture into the Syrian air defence system, so it looked like a normal day with nothing unusual.”

If the Iranian air defences were subjected to a cyber attack, it is not clear whether they would know it or admit to it, or whether the Israelis would disclose it. Two rumoured US cyber attacks – on Iranian air defences in 2019 after a RQ-4 reconnaissance drone was shot down, and another in 2012 on North Korean missile systems – have never been confirmed.

Israel may have simply jammed the systems causing the screens to freeze. It possesses a jamming device for aircraft which, according to maker Rafael, “simultaneously suppresses multiple integrated air defence surveillance and fire control radar using accurate, high-power directional beam”.

Alternatively, Mr Withington said the explanation could be something more normal – the systems just froze trying to process the volume of data on inbound enemy aircraft.

“If you're doing a cyber attack, and you probably don't want to freeze the screens, because you're instantly indicating to people something's up. You want things looking as normal as humanly possible. So it's possible their systems were simply overloaded.”