During the first weekend of May 2019, violence between Israel and Gaza escalated to a degree not seen in 5 years. While violence in the region is sadly not surprising, this time it marked an unprecedented case of immediate kinetic retaliation to a cyber threat.
The Israeli Defense Forces (IDF) tweeted this Sunday (5th): “we thwarted an attempted Hamas cyber offensive against Israeli targets. Following our successful cyber defensive operation, we targeted a building where the Hamas cyber operatives work.”
The tweet included a highlighted image of the targeted building and concluded with “HamasCyberHQ.exe has been removed.”
IDF has not provided details about the nature of the cyber attack allegedly aimed at harming Israeli civilians. But what followed were two days of rocket launching from both sides, resulting in at least four Israelis and 25 Palestinians killed.
Israel then threatened massive air strikes on Gaza backed up with American support, but a ceasefire agreement was achieved the following Monday, mediated by Egypt, ending the recent surge of violence.
What else happened that weekend?
On Friday (3rd), Palestinians in Gaza protested against the area’s blockade– which Israel says is needed to stop weapons reaching militants. During the protests, a Palestinian gunman shot and wounded two Israeli soldiers at the boundary fence, and Israel retaliated with an air strike that killed two militants.
Bombardment from Gaza started the next day. On Saturday and Sunday, Israel retaliated by targeting sites belonging to Hamas and Islamic Jihad – including the building highlighted above, which sheltered Hamas intelligence officers, according to Israel.
Why now?
Middle East Correspondent Yolande Knell points to four important reasons why this upsurge of violence might have taken stage this weekend:
The first one refers to an understanding previously arranged by Cairo, meant to see an easing of the tight blockade on Gaza with the transfer of millions of dollars of Qatari aid money in return for calm – which will now be implemented.
Secondly, the militant groups may have calculated that this was a good time to pressure Israel, as the country prepares to mark two national holidays (its memorial and independence days) and host the Eurovision song contest.
Next week also marks the anniversary of the deadliest day of protests along Gaza’s boundary fence with Israel. And finally, the holy month of Ramadan started this weekend – a time when Palestinian Muslims strongly feel the economic crisis.
What does this mean for cyber security?
International organisations and military have long debated how or when countries should use military force to respond to cyber attacks that threaten citizens.
The North Atlantic Treaty Organization (NATO), in particular, has been closely tracking the evolution of so-called ‘hybrid warfare’ since 2007, when Russian-Estonian dispute over military status led to a devastating series of cyber attacks against Estonia’s communications infrastructure.
Since then, NATO headquartered its International Cyber Defense Center in Tallinn, Estonia’s capital, and has been putting together a body of knowledge on how to handle major cyber conflicts in real time. But relatively few of such hybrid warfare incidents are known to have taken place so far.
Israel, already a cyber security world leader, is likely to stir and shift these debates on how to handle cyberattacks during war – with its actions and advanced techniques likely to be emulated by other countries in the future.
While many analysts agree that incidents of physical retaliation against hackers are inevitable as warfare continues to evolve, there are two predominant views over this recent episode of hybrid warfare: Some observe that the hacker-targeting line has likely already been crossed before by actors not interested in advertising it. Others see this as the first incident of its kind.
Either way, most agree that while this incident belongs in its unique Israeli-Palestinian context, it also sets a precedent for future military retaliation against cyber attacks – one that moves increasingly faster, is intertwined with physical violence, and blurs distinctions between legitimate and illegitimate war targets.
#
Written by Paula Magal for CS4CA Europe – the annual platform for critical infrastructure security leaders to collaborate in strengthening the cyber security of their IT and OT environments. Subscribe to our free newsletters to stay up to date about 2019’s summit, taking place in London, 1st-2nd October, and for more relevant cyber security content.
