Syria's Cyber Operations

The Internet is the first medium in history that supports groups and conversations at the same time. While the telephone gave us a one-to-one platform and televisions, magazines, radios, and books gave us the one-to-many platform, the Internet gave us the many-to-many platform. As a tool of communication and sharing, the Internet has proven to be an extraordinarily powerful force that is very difficult to control.

Increasingly, nation-states and corporations have tried to rein it in, to harness its potential within security and legal frameworks that exist outside the Net. But this has proven unattainable even for the most powerful organizations on the planet, precisely because the Internet is more than just a technology: it is a culture.

The Internet is characterized by two key features. One is the ability to communicate freely, and the second is to link up with the rest of the world. As recently as 1996, the first reliable worldwide survey of Internet-use counted about sixteen million users. Today, there are over five hundred million. Now in terms of the total population of the planet, we still have less than seven percent of the world connected to the Internet. Even though Internet use is growing fast, two-thirds of the planet will still be outside cyberspace by the end of this decade. That said, the speed of diffusion has been extraordinary. The Internet can combine every single medium once transformed into digital form. The Internet, therefore, is the single most important medium that can have the biggest impact on global society once a bigger percentage of the world population has access to it.

People used social media extensively during the 2011 Arab uprisings, yet it was not a one-way advantage. Activists succeeded in fostering a global culture of online activism and made the world realize the power of the Internet. Bloggers and activists have become national heroes. They have been the main engine for organizing protests, lobbying on behalf of prisoners, and reporting news to the outside world in countries where journalists are banned. The revolts have relied on two main weapons: the relentless determination of protesters and social media outlets. If we examine trends in social media, we can see that Syria has had an unprecedented share since March 2011.

The Syrian state has had a virtual monopoly over the media since the Baathist military coup of 1963. But satellite television stations and the emergence of Al-Jazeera and successive pan-Arab news channels broke the regime’s monopoly. The Internet has also emerged as an unchallenged source of news. The uprising in Syria has been progressing hand-in-hand with social media. The Syrian regime has also used the Internet, coupled with live bullets on the streets, to crack down on activists. Syrians used several  tools to access social media sites such as Facebook and Youtube, which were blocked inside the country. These tools, however, prevented the tracking down of activists, so the regime eventually responded by unblocking both sites Facebook and Youtube. Soon after doing so, official state agencies  started launching Distributed Denial of Service (DDOS) attacks by forging a fake Facebook page to steal activists’ passwords. The security forces have also used torture against captured opponents to obtain the passwords to their Facebook and email accounts. The Assad regime thus supported a network of hackers to establish the Syrian Electronic Army (SEA), which has been launching attacks against Syrian opponents and other targets, including the Al-Jazeera TV website, among others.

A new global race has emerged to obtain electronic surveillance arms. Annual revenues spent on electronic arms in 2011 were between three billion and five billion dollars, and they are rising drastically. The Syrian government built a surveillance system last year to monitor e-mails and Internet use. The surveillance equipment for this system was made by Hewlett Packard Co. and NetApp Inc., both US-based companies. The equipment, worth more than 7.2 million dollars, was sold to Syria through an Italy-based company called Area SpA. Germany’s Utimaco Safeware AG (USA) and Paris-based Qosmos SA also supplied technology for the project. European Union sanctions against Syria did not bar such sales until they adopted further legislation in December 2011 banning export of surveillance technology to Assad’s regime. Furthermore, Iran helped the Syrian regime by training state-employed technicians on cyber surveillance. The system includes probes in the traffic of mobile phone companies and Internet service providers (ISPs), capturing both domestic and international traffic. It also allows agents to archive communications for future searches or mapping of peoples’ contacts.

Each major security branch in Syria operates a 24/7 information room where young information technology (IT) students serve. These students either volunteer to become security officers, or are allocated there to complete an eighteen-month obligatory army service. As the state security apparatus jails new opponents, confiscates their computers, and tortures them to give up information from their online accounts, the IT students’ task is to scan these accounts and recover deleted information from confiscated personal computers. The scan processes are usually random and lengthy. Many IT students take a few weeks to read the details of one email account, yet students who serve in IT rooms have disparate levels of experience.

The Syrian security communications branch, codenamed “Branch 225,” is the central decision maker in relation to communications security in Syria. Branch 225 not only has direct contact with mobile phone operating companies, ISPs, and other communications companies, but also with electricity and water companies. Branch 225 is also linked to the Telecommunications Establishment (STE), which is the main communications company in Syria and controls all ISPs and landlines in the country. STE has a Central Operations Room in the Muhajireen neighborhood of Damascus directly linked to Branch 225. Since the Syrian revolt started, Branch 225 blacked out areas that government forces invaded to cover up the operations against civilians and to cut off any contact with the outside world. This branch controls the air-conditioned room at a telecom exchange building in Muhajireen, where the Area SpA surveillance system was installed. Although the Syrian government denied any links to the Syrian Electronic Army (SEA), undercover interviews with members of the SEA revealed that the Syrian government has funded SEA members and hired hackers for different operations against opponents.