Iran's Deadly Ambition (21 page)

But what began as an arms bust quickly turned into something more. In subsequent interrogations, the suspects confessed to having received training from Hezbollah.
⁵⁶
One of them further detailed orders from a top Hezbollah commander to surveil several targets in the Nigerian capital, including the Israeli embassy, and to obtain an aerial photo of the city for targeting purposes.
⁵⁷
The revelations led Nigerian authorities and international observers to conclude that the country had just unearthed an active Hezbollah terror cell in the process of planning a major attack.

It was not the first time. Less than half a year earlier, in December 2012, Nigerian authorities had arrested three Nigerian nationals and charged them with being members of an Iranian terror cell intending to attack Israeli and American targets.
⁵⁸
And in May 2013, the same month as the Kano raid, a Nigerian court sentenced an Iranian and a Nigerian to five years in prison apiece for their roles in smuggling a large shipment of weapons into West Africa. The spate of activity led experts to question whether Nigeria had turned into an operations center for Hezbollah in Africa.
⁵⁹

To be sure, Hezbollah has had an African presence for the better part of a quarter century. As long ago as the late 1980s, the U.S. intelligence community took note of indications that Hezbollah had stepped up its planning for operations beyond the Middle East—including in Africa.
⁶⁰
The years that followed saw the group, operating through the continent’s numerous and well-established Shia communities, transform Africa into a major base for fund-raising, both legal and illicit. For example, the group has been implicated in the continent’s notorious blood-diamond trade, with instances of Hezbollah trading activity cropping up in Angola, Burkina Faso, Democratic Republic of the Congo, Liberia, and a host
of other countries over the past two decades.
⁶¹
Hezbollah operatives also are known to have established a number of front companies and to use these conduits to funnel money from Africa back to the Middle East. In addition, the region has become a notable recruiting base for the group, which, working in tandem with Iran’s Revolutionary Guards, has made concerted efforts to engage and enlist disaffected African Shia into its cause: resistance against Israel and the West.
⁶²

Even so, telltale signs in recent years indicate a broad—and troubling—trend. “Iran has stepped up its attempts to build a sphere of influence in Africa,” says Israeli counterterrorism expert Ely Karmon, and as part of that effort, Hezbollah has been working “to develop bases within certain states in Africa for wider terrorist and subversion activities throughout the continent, focusing on Israeli and Jewish targets.”
⁶³

These bases extend beyond Nigeria to a number of other regional states. Among them is Kenya, where two Iranian nationals were arrested in June 2012 on suspicion of planning attacks against Israeli, American, British, or Saudi targets. The suspects were found in possession of 15 kilograms of the explosive RDX, and 85 kilograms more were not recovered. A Kenyan court subsequently sentenced both men to life in prison.
⁶⁴

Hezbollah representatives and agents have also cropped up throughout West Africa, including in Sierra Leone, Côte d’Ivoire, and Senegal.
⁶⁵
In the latter country, as J. Peter Pham of the Atlantic Council pointed out, the activities of Hezbollah-aligned Lebanese in coordination with the Iranian embassy repeatedly ran afoul of both the country’s powerful Sufi brotherhoods and the Senegalese government, which, especially during the tenure of President Abdou Diouf from 1981 through 2000, accused Iranian diplomats of abusing their status to spread religious propaganda and influence the media with an eye to interfering in Senegal’s internal affairs.
⁶⁶

So far, this web of activity has not elicited much by way of a regional response. Nowhere is this more apparent than in Nigeria. Just six months after they were apprehended, a federal court in Abuja acquitted two of the three suspects in the May 2013 Kano raid, dismissing all terror-related charges.
⁶⁷
In its ruling, the court argued that the federal prosecution had not proved the suspects’ connections to Hezbollah beyond a reasonable doubt, despite the extensive case put together by prosecutors, the confession of at least one of the suspects, and the stockpile of weapons that had been uncovered. Iran and Hezbollah, it seems, continue to have what is more or less a free hand to operate on the continent.

FUELING AFRICA’S WARS

Beginning in 2006, observers of Africa’s numerous conflicts and simmering violence started noticing an unusual phenomenon. Government forces and nonstate militias were using more and more foreign-origin ammunition that bore no clear markings or manufacturer designations. This constituted a departure from regular practice, because munitions from places such as China and France—both of which have served as significant arms suppliers to Africa in the past—bore clear indications of their origin. These munitions did not, and they were spreading. Over the next several years, they cropped up in a variety of the continent’s war zones, from Sudan to Darfur. And over time, it became clear that the ammo had originated thousands of miles away, in the Islamic Republic of Iran.

That was the conclusion of a six-year study by British research firm Conflict Armament Research, which found that the Islamic Republic has been a principal contributor of small-caliber munitions circulating on the African continent in the past decade. “Iranian ammunition is in service with four African governments: Côte d’Ivoire (until 2011),
Guinea, Kenya and Sudan,” it noted. “Although the circumstances of acquisition are unclear, the quantities involved in the Sudan, Guinea and Kenya cases suggest direct supply by Iran.”
⁶⁸
That, however, is not all. “Ten additional investigations find Iranian weapons and ammunition in service with a variety of non-state entities, including foreign-backed insurgents, rebel forces, Islamist-oriented armed groups and warring civilian communities,” according to the study.
⁶⁹
Indeed, in late 2010, the government of The Gambia went so far as to sever diplomatic relations with Iran after a large weapons shipment, including mortars, rockets, and other military-grade arms, was intercepted as it was being smuggled into the West African country.
⁷⁰

In other words, the Islamic Republic has—either directly or indirectly—played a part in fueling the African continent’s conflicts in recent years. Or, as the
New York Times
put it, “even as Iran faced intensive foreign scrutiny over its nuclear program and for supporting proxies across the Middle East, its state-manufactured ammunition was distributed through secretive networks to a long list of combatants, including in regions under United Nations arms embargoes.”
⁷¹

The revelation was significant. While its exports historically have been dwarfed by major suppliers such as Russia and China (and the United States), Iran nonetheless maintains a notable presence in the global arms market. Yet those deliveries have been localized, by and large, in the Islamic Republic’s immediate periphery, taking the form of missile shipments to Hezbollah in Lebanon or Palestinian rejectionist groups in the West Bank and Gaza Strip.
⁷²
As such, news of Iran’s involvement in the provision of small-arms munitions to numerous clients in Africa indicates Iran’s expanding commercial and foreign-policy horizons and its growing interest in influencing events beyond its borders.

That interest is most certainly not a thing of the past. In
recent months, Hassan Rouhani has reaffirmed that the Islamic Republic sees Africa as an important foreign-policy priority and that his administration, like that of his predecessor, is seeking closer strategic ties to the continent.
⁷³
The message that Iran is thereby sending to Africa’s leaders is unmistakable: the Islamic Republic is in Africa to stay.

CHAPTER

IX

A New Domain for Conflict

I
n October 2013, a middle-aged Iranian government functionary named Mojtaba Ahmadi was found dead in a wooded area outside the city of Karaj, located some sixty kilometers northwest of the Iranian capital, Tehran. His death had been a violent one; Ahmadi had been assassinated, shot twice in the heart at close range by one or more unknown assailants.

The murder made headlines, both in Iran and abroad, and for good reason, although not the most likely one. Ahmadi was not an Iranian nuclear scientist, a profession that has become comparatively high-risk amid intensifying international efforts to derail the Islamic Republic’s nuclear effort. Five nuclear scientists and one ballistic missile engineer have died over the past decade under suspicious circumstances, in incidents that the Iranian regime has ascribed to foreign—specifically Israeli—“direct action.” Rather, Ahmadi was a high-ranking officer in Iran’s Revolutionary Guard Corps and a commander of its secretive Cyber War Headquarters.
¹
Ahmadi, in other words, was a “key cyber warfare commander” and quite possibly “Iran’s cyber war chief.”
²

His death shed new light on a largely unexplored dimension of Iran’s quest for global influence: its growing, and
increasingly aggressive, presence in cyberspace. It is an arena that is fast emerging as a new domain of conflict between Iran and the West.

STUXNET: A DOUBLE-EDGED SWORD

In the fall of 2010, the Iranian regime went public with a stunning admission. Over the preceding year, officials in Tehran grudgingly disclosed, their country had been the target of a major and sustained cyber attack—one that caused significant and at that time not yet fully understood difficulties for the Islamic Republic’s nuclear program.
³

The culprit was identified as Stuxnet, a piece of malicious software fashioned specifically to attack SCADA (supervisory control and data acquisition) systems designed by the German industrial conglomerate Siemens. This was the very type of system used by Iran to run its uranium enrichment centrifuges, leading computer experts to conclude relatively quickly that, despite related computer infections in China, Indonesia, India, and Azerbaijan, the software’s principal target was the Islamic Republic’s nuclear effort.
⁴
Iran’s enrichment facility at Natanz, in many ways the public face of the regime’s nuclear program, was the installation most directly affected by the attack.

The news was a bombshell. Malicious software, known as malware, is not a new phenomenon, of course. Trojan horses, worms, and other viruses are exceedingly commonplace, and risk of infection represents part of the cost of doing business on the Internet. But Stuxnet was qualitatively different, miles ahead of its predecessors in terms of both effectiveness and sophistication. It was, in the words of one leading computer expert, a “21st-century cyberweapon.”
⁵
It was also designed for a very specific purpose: to provide false readings to SCADA operators, even as it forced the centrifuges it affected to spin out of control and break down. And, at least
for a time, it raised hopes among many in Washington that a confrontation with Tehran had been avoided, and that an ingenious bit of software had done what sustained economic pressure had not been able to and successfully derailed Iran’s bid for nuclear capability.

The actual effects of Stuxnet, however, turned out to be rather modest. According to the Institute for Science and International Security, a Washington-based nonproliferation think tank, from the time of its insertion into Iran’s nuclear facilities in the second half of 2009 to its discovery the following fall, Stuxnet succeeded in destroying just 1,000 of the 9,000 uranium enrichment centrifuges at the Natanz facility in central Iran. What’s more, the same study noted, the effect of the malware was only temporary. “Assuming Iran exercises caution, Stuxnet is unlikely to destroy more centrifuges at the Natanz plant,” the institute assessed in February 2011. “Iran likely cleaned the malware from its control systems.”
⁶

Nor did Stuxnet succeed in substantially slowing the pace of Iran’s uranium enrichment activities. The Iranians “have been able to quickly replace broken machines,” one Western diplomat in the know told the
Washington Post
in the spring of 2013. “[T]he Iranians appeared to be working hard to maintain a constant, stable output” of low-enriched uranium.
⁷

The U.N.’s nuclear watchdog came to similar conclusions. In a February 2011 interview with the
Washington Post
’s Lally Weymouth, International Atomic Energy Agency chief Yukiya Amano disclosed that Stuxnet had had only a temporary impact on Iran’s ability to produce enriched uranium. Despite the damage it suffered from Stuxnet, Amano said, just six months later, “Iran is somehow producing uranium enriched to 3.5 percent and 20 percent” and is doing so “steadily, constantly.”

Stuxnet, in other words, may have been a tactical success,
buying the international community a bit more time to formulate a plan for dealing with Iran’s nuclear program. But it was a strategic failure, falling far short of meaningfully derailing the country’s nuclear endeavor, as many had hoped it would.

Indeed, the malware may actually have ended up having the opposite effect. A 2013 study published in the journal of England’s prestigious Royal United Services Institute concluded that Stuxnet objectively failed in attaining its goal of decreasing Iran’s nuclear weapons potential.
⁸
“Although calculations show that Stuxnet had the
potential
to seriously damage Iranian IR-1 centrifuges, unclassified evidence of the worm’s impact on uranium enrichment at Natanz is circumstantial and inconclusive,” the study notes.
⁹
In fact, according to the study’s author, Ivanka Barzashka, of King’s College London, the worm was actually “of net benefit to Iran if, indeed, its government wants to build a bomb or increase its nuclear-weapons potential,” making the regime “more cautious about protecting their nuclear facilities” while failing to hinder its ability to add to the number of its centrifuges.
¹⁰
It also alerted the Islamic Republic to a sobering fact: war with the West, at least on the cyber front, had been declared.