Intelligence

It’s Hard to Find a Black Cat in a Dark Room, Especially If It Isn’t There: RAND on the Search for Cyber Coercion

Published

4 years ago

November 22, 2019

Pavel Karasev

What is cyber coercion and how have states used cyber operations to coerce others? These are the questions addressed in the RAND think tank’s recent report “Fighting Shadows in the Dark. Understanding and Countering Coercion in Cyberspace“. The authors discuss cyber operations conducted by four states — Russia, China, Iran and North Korea — and try to determine whether those activities amounted to cyber coercion.

Starting with the study findings, we will highlight the following points. Cyber operations intended to coerce are a small subset of overall cyber operations globally. Espionage remains the predominant purpose of states’ cyber operations. Despite that, the authors think that states like Russia and North Korea appear to be more likely to have used cyber operations as a coercive tool than China and Iran. The authors also find that, contrary to what coercion theory would predict, states do not make distinct threats with unambiguous demands for changes in behaviour often. Instead, they deny responsibility, hiding behind proxies. Despite the low probability of success, the authors anticipate states will continue to use and may, in fact, come to employ cyber operations more often in the future to coerce. To prepare for this outcome, the United States and its allies need to work now to develop methods to discern cyber coercion as it emerges and strategies to deter and counter it in the future.

Even though the report has certain scientific value, the authors have left quite a lot of space for criticism. First, we need to examine several serious methodological issues. Second, setting aside the fact that the study was sponsored by the United States Department of Defence and its affiliated entities, the authors specifically mention that they only used data from open sources. Indeed, the evidence is mostly taken from reports published by companies such as Mandiant and its eventual buyer FireEye, whose leadership has certain connections both with the Department of Defence and with the U.S. intelligence community. So the evidence of countries’ involvement in cyber operations cannot be seen as objective. Finally, it is lamentable that the ways suggested by the authors for solving problems are strikingly one-sided and do not contain the slightest hint of any possible affirmative action.

Coercion

The authors attempt to base their methodology for defining coercion in cyberspace on the seminal work by the American economist Thomas Schelling Arms and Influence, among other things. They claim that Schelling described two forms of coercion: active coercion (compellence) and passive coercion (deterrence). In their words, the former involves the active use of force in some form to compel action by another. In contrast, the latter involves the threatened use of force to either motivate action or refrain from a particular activity. Schelling himself says the following:

“… partly deterrence has been a euphemism for the broader concept of coercion, as ‘defence’ has replaced words like ‘war’ and ‘military’ in our official terminology. It is a restrictive euphemism if it keeps us from recognizing that there is a real difference between deterrence and what, in Chapter 2, I had to call ‘compellence,’ that is, a real difference between inducing inaction and making somebody perform.” [1]

“… brute force succeeds when it is used, whereas the power to hurt is most successful when held in reserve. It is the threat of damage, or of more damage to come, that can make someone yield or comply. It is latent violence that can influence someone’s choice — violence that can still be withheld or inflicted … The threat of pain tries to structure someone’s motives, while brute force tries to overcome his strength. Unhappily, the power to hurt is often communicated by some performance of it. Whether it is sheer terroristic violence to induce an irrational response, or cool premeditated violence to persuade somebody of your intent and willingness to repeat, it is not the pain and damage itself but its influence on somebody’s behaviour that matters. It is the expectation of more violence that gets the wanted behaviour, if the power to hurt can get it at all.” [2]

It is obvious that Schelling draws a clear line between deterrence and coercion and, more importantly, points out that coercion implies limited use of force: force plays a secondary part, while the central condition is threatening damage.

Further, while describing the logic of coercion, the authors quote several scholarly works that repeat the key points made by Schelling. In one of them, coercion is summarized with the phrase “if you do not do X, I will do Y.” [3] Another work states that a coercive action or threat “demands clarity in the expected result … [and to] be accompanied by some signal of urgency.” [4] These appear to be true and ought to have been taken as the basis. Yet the authors of the report choose another path: they declare that the observed practice differs from the theory of cyber coercion (which, it should be noted, was inferred from practice) and claim that demands and threats expressed as part of such coercion are sometimes ambiguous, as identification of the threatening party can be. But what remains of coercion if its defining characteristics are removed? Large-scale cyber-attacks are not just a show of force but achievement of specific objectives, so they have nothing to do with coercion.

The above seems to challenge the accuracy of the question asked at the beginning of the paper under review: “What is cyber coercion?” Let us first consider what coercion is. It appears to be primarily a form of policy aimed at maintaining or changing the existing order of distribution of power and wealth in the global community [5]. From this standpoint, the essence of coercion is to change the political behaviour of other actors in the global political arena with the possibility of a limited demonstration of force that does not escalate into full-scale warfare. To some extent, the essence of coercive policy is described in the Art of War by Chinese General Sun Tzu: “Therefore the skilful leader subdues the enemy’s troops without any fighting; he captures their cities without laying siege to them; he overthrows their kingdom without lengthy operations in the field.” Even so, coercive violence is also possible: discussing this, Schelling cites an example from the history of the Wild West: raids on some Indian settlements were intended to break the resistance of and subjugate all tribes. But here the Indians were clear about the source of the threat, the possible consequences of resistance and the demands that were put forward, as well as the ways out — either to submit or to retreat.

If we base our discussion on the above premise that coercion is a form of policy, a more appropriate question arises: can cyber-means be used to implement a coercion policy and, if so, how effectively? Based on the definition of coercion, its implementation generally requires A to demand that B change its policy in a specific way — with a demonstration of force that can be used to its full extent if the demand is not satisfied. In individual cases, demands, threats or demonstration of force can be implicit. Still, it is evident that the victimized party needs to be aware of such risks and understand them correctly. This imposes certain conditions on the means used for implementing a coercion policy.

The ICT environment has a number of properties making it an attractive medium for influence. First of all, it offers anonymity and action across borders, which complicates attribution, i.e., identification of the source of influence. The “plausible deniability” of involvement in cyber-attacks is one of their most significant benefits as a military-political tool. Experience shows that cyber-attacks can be used to project and demonstrate power. Still, the party that uses them for coercive purposes has to assume responsibility or reveal its involvement in some other way. According to some statistics, numerous cyber-attacks are carried out against the Russian public infrastructure every day (2.4 billion hostile actions were detected in 2017, rising to 4 billion in 2018). Recognizing a demonstration of force or a demand to change one’s policy within such a torrent of events appears impossible. Using the possibility of a cyber-attack as a threat also seems ineffective because it allows the potential adversary to prepare for the attack and to fend it off.

Public Policy

The authors of the report claim that, as the development of more connected and interconnected information systems and networks proceeds, the potential for actors to use cyber operations to exert influence and impact the economic, political, and social wellbeing of other states is incresing. When examining possible episodes of cyber coercion, however, the authors confine themselves to just four key global political actors identified by the U.S. Government: Russia, China, Iran and North Korea. For each country, open-source research was conducted to develop an overview of their capabilities, published doctrine on cyber operations, as well as available data on government-affiliated cyber operations groups.

The authors’ research into doctrines and documents disclosing states’ positions concerning operations in cyberspace is incomplete, inconsistent and sometimes merely erroneous. For example, when quoting strategic planning documents of the Russian Federation, the authors state that “[a]lthough Russia sees its adversaries conducting such [information] operations against it, these writings indicate how Russia thinks about the potential role for cyber operations in its operations as well.” Here it would suffice to consult the Russian Federation Armed Forces’ Information Space Activities Concept, which reads: “Cyberspace conflict settlement shall be carried out in the first place by means of negotiation, conciliation, addressing to the U.N. Security Council or regional agencies or agreements, or by other peaceful means.” The authors also quote Chinese experts, who point out a whole range of disadvantages of network deterrence and coercion operations, above all the fact that the ambiguous nature of cyber operations may reduce their efficacy [6]. Successful deterrence and coercion results from effective signalling — the adversary must first be aware of the source and motivation for the influence for it to take actions expected by the attackers. The authors conclude that China “is taking a more circumspect approach to using cyber operations for coercive purposes, focusing largely on stealing data or silencing critics of the regime. China may, however, seek to expand its use of cyber operations to coerce in the future.” It is an entirely groundless conclusion, especially considering all the disadvantages the Chinese experts have pointed out.

As for the specific cyber capabilities of each state, the work done by RAND is not based on concrete facts. For example, as corroboration of the claims of Russia’s involvement in cyber-attacks on Montenegro in 2018, they refer to an article stating that: “Three international I.T. security companies say the emails [containing malware] came from APT28, also known as Fancy Bear, which U.S. intelligence services say is connected to the Russian military intelligence service, GRU.” China’s involvement in cyber-attacks on South Korean networks and systems, as well as other episodes of cyber influence, are proven similarly. A case from 2017 is mentioned, when the U.S. Department of Justice brought cyber-espionage charges against three employees of the Chinese company Boyusec. Even though federal prosecutors deliberately avoided the question of whether Boyusec was affiliated or connected with the Chinese government, private sector representatives noted that they assumed that Boyusec had been working for the Ministry of State Security of China. Myths are born from repetition and persistent emphasis on facts long disproven. For instance, Russia is alleged to have carried out cyber-attacks on Estonian government agencies in 2008, even though this allegation has long been refuted: an independent investigation confirmed that the operation was, in fact, the work of activists with no government affiliation.

The RAND report relies on a biased selection of evidence provided by entities associated with the United States intelligence community, and it gives the impression of stretching facts to create a negative image of Russia, China, Iran and North Korea as malicious actors in cyberspace. Meanwhile, it is the current U.S. strategic planning documents that articulate a clear vision of a threat to freedom and democracy and set the goal of ensuring peace using force. This implies identifying adversaries and exerting influence using all available means. Coercion policy has already become the norm in the United States. Take, for example, this summer, when The New York Times published a piece claiming that the U.S. secret services have carried out offensive operations against the Russian electricity grid and power plants. The purpose of that publication is still unclear: was it a leak and, if so, was it intended? Or was it disinformation? U.S. President Donald Trump accused journalists of treason, and representatives of the U.S. National Security Council said there were no risks to national security. If we take the lead from RAND, however, and look at the broader context, we see that, against the backdrop of tension between Russia and the U.S., this publication was a clear signal of coercive policy.

Establishing peace through force does not provide a mutually acceptable mechanism for reducing tensions in the ICT sphere. And though, as the authors themselves note, not all of the cases examined in the report are explicit acts of cyber coercion, it is necessary to develop the means to detect early signs of cyber coercion and to craft deterrence and resilience strategies. It is assumed to be enough to respond successfully to cyber coercion. The authors see no ways of solving the problem other than developing strategies to counter this phenomenon (it may be assumed that those will include all available means, including “public attribution”).

In conclusion, the authors repeat the message that cyber operations may not be accompanied by clear signalling of a threat or expected behaviour, let alone means that can be used for coercion. It is also challenging to determine what exactly cyber operations carried out against another country are aimed at. Maybe the argument would benefit from Occam’s methodological principle: “entities should not be multiplied without necessity.” Indeed, just as the authors state, ICT tools are widely used by many states to accomplish military and political objectives. Yet, if an action is not aimed at changing the political behaviour of another country and if there is no direct threat or use of force (which would be a violation of the United Nations Charter, by the way), should we speak of so-called coercion or is it just regular cyber activity, which is now commonplace? A vivid example of a coercive policy that is mentioned, but not discussed by the authors, is the cyber-attack on Iranian nuclear programme facilities in 2010. First, specific countries demanded that Iran wind down its nuclear programme. Second, there was talk of a possible strike if the conditions were not fulfilled. As we know, Iran did not change its policy, and the cyber-attack that followed was not an act of coercion or a limited demonstration of force but fulfilled particular tasks: Iran’s nuclear programme was slowed down considerably.

What we need is not strategies against cyber coercion, which RAND experts call for, but international frameworks for precluding conflicts in cyberspace. One such framework could be built up from the norms, rules and principles of responsible behaviour in the ICT environment formulated by the international community through the United Nations Group of Governmental Experts.

From our partner RIAC

1. Thomas C. Schelling, Arms and Influence, New Haven, Conn.: Yale University Press, 1966., P. 174–175.

2. Ibid. P. 3.

3. Erica D. Borghard and Shawn W. Lonergan, “The Logic of Coercion in Cyberspace”, Security Studies, Vol. 26. No. 3, 2017, pp. 433–34.

4. Christopher Whyte, “Ending Cyber Coercion: Computer Network Attack, Exploitation and the Case of North Korea”, Comparative Strategy, Vol. 35, No. 2, 2016.

5. For a definition of policy, see Kokoshin A.A. Global politics: theory, methodology, applied analysis [Mirovaya politika: teoria, metodologia, prikladnoy analiz]. Komkniga, 2005. ISBN 5484000874 (in Russian).

6. Shou Xiaosong, ed., The Science of Military Strategy [战略学], Beijing, China: Military Science Press, 2013, p. 194.

Related Topics:China cybersecurity Russia USA

Up Next

People around the world under the shadow of Google spy

Don't Miss

A Resurging Possibility and an Increased Hope for a United Balochistan

Pavel Karasev

Research Fellow, MSU Institute of Information Security Issues

Comments

Intelligence

Voicing Against Disinformation

Published

3 hours ago

June 5, 2023

Charani Patabendige

In the digital era, information dissemination is not an arduous task. Information can reach many places even multiple times. However, not all information that is disseminated is true and accurate. Often information is inaccurately transmitted and this can be with or without intention. However, in the case of disinformation, there is always the guilty intention, it is the deliberate act of disseminating false information to deceive its recipients. Disinformation mostly happens in the online space which means it is a cross-border crime. Since it is extraterritorial, widely available and publicly accessible, the parties to disinformation are more than one. The impact of disinformation does not only affect one but society at large.

The rationale behind intentionally falsifying content is hard to ascertain, however, visible reasons are to gain monetary advancement, political reasons, acts of terrorism and extremism. With the rise of digitalization of the world disinformation is escalating on a great scale and yet to date it has become extremely hard to counter and mitigate disinformation. (Office Of Inspector General Department of Homeland Security, 2022) has stated that “the objectives of disinformation campaigns can be broad or targeted, [for example], campaigns may aim to erode public trust in our government and the Nation’s critical infrastructure sectors, negatively affect public discourse, or even sway elections. These campaigns can have foreign or domestic origins and may incorporate several different types of information”.

Disinformation can be state-sponsored or by the private sector. At present, information literacy is finely utilized by countries to wage war against one another. (Barnes and Sanger 2020) have stated that countries such as Russia and China have taken [social media platforms] such as Facebook, Twitter and YouTube to create and amplify conspiratorial content designed to undermine trust in health officials and government administrators, which could ultimately worsen the impact of the virus in Western societies”. (King et al, 2017) have stated that according to research “the Chinese government has shown to deploy disinformation campaigns, sometimes to distract and disrupt (for example, concerning events in Hong Kong, Xinjiang or the South China Sea), as to push a particular agenda (for example, to win support for its ‘Belt and Road’ initiative)”.

Disinformation affects both military and soft security aspects. A piece of disinformation can be a critical determinant to decide a victory of a state against another. There are many instances where global competition happens between countries using information advantages. Disinformation also impacts the economy since disinformation can create a bogus demand for certain products and create a market. Disinformation also undermines the rights of people. Disinformation affects democracy. An example of disinformation is election manipulations where real victory is not pronounced. Furthermore, disinformation can take the face of impersonation of world leaders and prominent figures which affects the dignity of people.

The number of countries that have criminalized disinformation, especially in online space is very low and this not only poses a threat to one country but also affects the rights of other countries at stake. There is also the ability to do fact checks and fact verification however not all matters can reach the state level. The number of people who inquire about the credibility and validity of the content is less and holding people or an authority accountable for the content is hard as well.

World leaders advocate many strategies to counter disinformation such as cyber commands. According to (CNN,2022), “US military and intelligence officials are stepping up their efforts to defend the electoral process from foreign hacking and disinformation”. (Shackelford,2020) has stated that “In Indonesia, President Joko Widodo spearheaded the creation of the new National Cyber and Encryption Agency to combat disinformation in their elections”. Sri Lanka too has a cyber command center to fight disinformation. Certain countries utilize narratives, and counter-narratives to create or rebut propaganda. (Time,2023) has stated that “As part of an effort to target Telegram, Russia co-opted popular fact-checking formats. It created a host of multilingual channels, like one named “War on Fakes,” which “verified” or “fact-checked” allegations to support pro-Kremlin narratives and defend the Russian military’s actions.”

However, one of the main mechanisms that can be utilized against disinformation is reporting disinformation. This is similar to whistleblowing. Whistleblower is “an employee who alleges wrongdoing by their employer of the sort that violates public law or tends to injure a considerable number of people. The employer can be public or private. Applying the same measure, if any person in the society comes up with a piece of disinformation which is against the morality, tranquility of the society, law and order, creating disharmony, such person or the authority must have the mechanism to report a such issue. Traditionally reporting such content can be done via phone call. Yet, since the world is digitalized and mostly disinformation happen online, reporting the by social media itself is prudent. Social media platforms gives the option to “report” content which is against community standards. However, reporting disinformation goes a step beyond. Some disinformation will not be understood by lay people and only the experts in the field will recognize it. Therefore, it is the duty of such a person to notify it. Governments all over the world therefore has an undeniable role to provide a platform to report disinformation which will encourage whistleblowing. This actually serves the purpose of fostering information literacy in people to inquire and verify the content.

Intelligence

The Failures of Russian Intelligence in the Ukraine War and the Perils of Confirmation Bias

Published

2 weeks ago

May 24, 2023

Alexander E. Gale

Emergency services are working around the clock to deal with the consequences of Russia`s strikes on Ukrainian infrastructure. October 18, 2022.Photo from the State Emergency Service of Ukraine

The Russian invasion of Ukraine defied many expectations, not least the Kremlin’s. Prior to the ‘special military operation’ launched by President Vladimir Putin last February, the Russian government expected minimal organised military resistance from the Ukrainians. A quick victory was assured, much like the 2014 annexation of Crimea but on a grander scale, with the decapitation of the Ukrainian government as a likely result. Yet, more than one year later, Ukraine remains very much in the fight, in defiance of Russian expectations. Evidently, the Russian military and political elite launched the invasion based on flawed assumptions. The question now, is what role did Russia’s intelligence services play in forming these false assumptions and why did they go unchallenged?

Much of the blame may rest on Putin himself according to a paper published in The British Journal of Politics and International Relations in December last year. Before the invasion, it was widely assumed that the Russian President’s ability to use strategic intelligence was virtually unrivalled on the world stage. Unlike other world leaders, Putin possesses a professional background in intelligence, having been both an officer in the KGB and director of the Federal Security Service (FSB), between 1998 and 1999. Russia’s swift and surprising annexation of Crimea and ability to disrupt targets with hybrid warfare was further evidence of Putin’s strategic acumen. However, the events leading up to and during the war in Ukraine cast the Russian President in a different light, as a deeply flawed intelligence manager and consumer.

One issue highlighted by the paper’s authors is that intelligence agencies within authoritarian regimes are blindsided by ‘a frequent inability to accept dissenting judgements as being offered in good faith.’ This appears to have been true of the Russian intelligence agencies prior to the invasion of Ukraine. Instead of offering their primary intelligence customer an intellectually honest assessment of the situation in Ukraine, the intelligence services appear to have disseminated intelligence that merely confirmed his biases. As explained by a group of experts in May last year, ‘Putin believes Ukraine is or ought to be Russian and whatever passed for intelligence preparation for the invasion may have confirmed this in his mind… We can infer that Russian intelligence services supported Putin’s view of Ukraine as a state ready to be absorbed.’

Ultimately, the officers of Russia’s intelligence agencies, be it the FSB, Foreign Intelligence Service (SVR), or Main Intelligence Directorate (GU), are dependent on Putin for their advancement, prosperity, and survival. This encourages a culture whereby the intelligence services compete for his approval, which is far from useful in terms of generating dispassionate and unbiased intelligence products. Years before the invasion, in 2017, Professor Brian D. Taylor argued that independent thinkers had largely left the Russian intelligence services, the implication being that they were now staffed by individuals who were content to conform with the dominant viewpoint. This has led to the formation of an institutional culture compromised by groupthink.

A very public example of the Russian intelligence community’s hesitancy to speak truth to power came in February 2022, when Director of the SVR Sergey Naryshkin was humiliated by Putin during a televised meeting of the Security Council. When questioned whether Russia should recognise the two self-proclaimed republics of Luhansk and Donetsk, Naryshkin suggested giving the West one final chance to return to the Minsk agreements. This was evidently not what Putin wanted to hear and he pressed a now visibly nervous and stuttering Naryshkin until the latter agreed that it would be the right course of action for Russia to recognise the two breakaway republics. Of course, this was a clear example of political theatre, but it does not bode well that Putin was willing to publicly humiliate one of his intelligence chiefs. Whilst it is not known what goes on behind close doors, there has been increasing scrutiny of Putin’s behaviour which suggests that the Russian leader has put an unhealthy amount of distance between himself and his top officials.

This is not to say that Putin micromanages the intelligence services or that he predetermines every decision without any recourse to their advice. Indeed, the intelligence services wield a tremendous amount of influence over high-level decision making. The problem is more so that the intelligence services are institutionally incentivised to say what they think Putin wants to hear. His views on Ukraine were well-publicised before the invasion, and no doubt senior intelligence officials would have been familiar with his frame of mind. His dismissal of there being a legitimate sense of Ukrainian nationalism and a belief that Ukrainians would be willing to join Russia and reject Western moral decadence and degradation were hardly secrets. For the intelligence services competing to win approval, there would have been few incentives to contradict this official narrative. Russian intelligence preparation for the invasion therefore likely served to confirm the Russian President’s biases.

There is some evidence to the contrary. According to US intelligence documents leaked in April, the FSB accused Russia’s Ministry of Defence of underreporting Russian casualties in Ukraine. Allegedly, the FSB was critical of the Ministry of Defence for failing to record the losses suffered by the Russian National Guard, the Wagner Group, or fighters under the command of Chechen leader Ramzan Kadyrov. The FSB’s casualty estimates were reportedly roughly double those given by Russian Defence Minister Sergei Shoigu in December. This does indicate a willingness to break bad news and contradict the official narrative. However, in this particular case, the FSB stands to enhance its own standing with Putin by undermining the Russian Ministry of Defence, thus fitting the broader pattern of institutional rivalry.

Naturally, much remains unknown about the activities and procedures of the Russian intelligence services prior to and after the invasion of Ukraine. What the available evidence does suggest however, is that Russia’s intelligence services are burdened by political considerations and biases which interfere with their ability to plan, direct, collect, process, analyse, and disseminate valid and useful intelligence. The Russian President bears much of the blame for the creation of a professional culture which does nor prioritise the truth as the highest good. Consequently, Russia initiated its invasion of Ukraine based on faulty assumptions and was unable to forecast the Ukrainian reaction with much accuracy.

Intelligence

Iran Threat to National Security 2023

Published

2 weeks ago

May 23, 2023

Antonio Graceffo

The annual Threat Assessment of the U.S. Intelligence Community for 2023, identified Iran as the third greatest national security threat to the United States, after China and Russia. As those two countries have been covered in other reports, this paper will focus on the Iran threat, evaluating it within the framework of a PMESII analysis. PMESII is an acronym used in military and intelligence services which analyses threat countries across six dimensions: Political, Military, Economic, Social, Infrastructure, and Information.

1. Political: This dimension examines political systems, governance structures, institutions, and decision-making within a country, as well as the effectiveness of these systems and institutions. It also considers the stability or instability of the government.

The Islamic Republic of Iran (Jomhuri-ye Eslami-ye Iran), formerly known as Persia, has a population of around 88 million, and is located in Western Asia, bordering on Iraq, Turkey, Azerbaijan and Armenia, the Caspian Sea and Turkmenistan, Afghanistan, and Pakistan, and by the Gulf of Oman and the Persian Gulf. The country is a theocratic republic, with a Shia Islamic legal framework.

Iran regularly holds elections, but the quality of democracy is limited because of the influence of the Guardian Council, an unelected body with the power to disqualify candidates on religious grounds. Iran has a president who is elected by the people, but the president is only the head of government, not the head of state. As head of government, the president oversees the operations and implementation of government. True executive power rests in the head of state, the Supreme Leader, Ayatollah Ali Khamenei. The Supreme Leader controls numerous unelected institutions, including the security forces and the judiciary, which are used to suppress dissent and to restrict civil liberties.

Since the establishment of the Islamic Republic of Iran in 1979, the Supreme Leader has always been an Ayatollah. The founder of the Islamic Republic was Ayatollah Ruhollah Khomeini, who maintained the title of Supreme Leader until his death in 1989. He was succeeded by Ayatollah Ali Khamenei, the current Supreme Leader.

The Supreme Leader presides over the Guardian Council, which interprets legislation and elections to determine if they are consistent with the principles of Islam and the Iranian Constitution. The Guardian Council has twelve members, six of whom are appointed by the Supreme Leader. The remaining six are nominated by the Judiciary and approved by the Parliament (Majlis).

In terms of political rights, Freedom House assigns Iran a score of 4 out of 40 and civil liberties 10 out of 60. Citizens have the right to form political parties, but those parties must be loyal to the current government. Change is unlikely to come within the existing governmental framework because of the influence of the unelected bodies. In 2021, for example, the former vice president Jahangiri, was disqualified from running for president because he was determined to be a reformist.

The government is largely dominated by men from the Shiite Muslim majority. Women hold some appointed positions, but generally not powerful ones. In the parliament, five seats are reserved for recognized non-Muslim minority groups: Jews, Armenian Christians, Assyrian and Chaldean Christians, and Zoroastrians. However, members of these groups would generally not be appointed to high-level government posts.

Corruption is rife in Iran. Transparency International assigns Iran a score of 25/100 for corruption, whereby a lower score denotes higher levels of corruption. Iran ranks 147^th out of 180 nations. Much of this corruption is attributable to the Islamic Revolutionary Guard Corps (IRGC) which is above scrutiny in practice, and is protected from criticism by the media and civil society.

The Islamic Revolutionary Guard Corps (IRGC) is a military/paramilitary organization with vast political and economic power. The IRGC was formed immediately after the 1979 Iranian Revolution, tasked with safeguarding the principles of the Islamic Republic and protecting the country’s sovereignty. Under the direct control of the Supreme Leader, the IRGC controls large sectors of the economy helping fund Tehran’s activities. The IRGC also provides military assistance to entities beyond Iran’s borders, as it has done for various groups in Afghanistan, Iraq, Lebanon, Palestine, Syria, and Yemen.

The group’s mandate includes defending the nation against external threats and maintaining internal security. The IRGC is also assigned the duty of preserving the Islamic Republic’s revolutionary ideals and ensuring compliance with Islamic principles. Additionally, it has significant influence on Iran’s foreign policy, including supporting regional proxies and paramilitary groups, by providing training, weapons, and logistics. On the economic front, the IRGC is involved in a broad array of businesses, including construction, infrastructure development, energy, telecommunications, and others. It owns and operates numerous conglomerates and companies which augment the groups financing and influence.

2. Military: The military dimension of PMESII assess a country’s military strength. It is not comprehensive, however, as it mostly considers personnel and hardware. It does not consider alliances, overseas bases, or the quality of equipment or quality and experience of personnel. All of this will be covered in greater detail in a separate report.

The U.S. ranks first in global firepower. Iran ranks 17^th. The U.S. population is 337 million, compared to Iran’s 88 million. The U.S. is the world’s number-two nuclear power. While it is widely suspected that Iran is working on a nuclear weapons program, to date, it seems they do not possess any nuclear weapons.

The number of active-duty troops is1.39 million for the U.S. and 575,000 for Iran. Additionally, Iran has about 90,000 paramilitary personnel. Comparing the defense budgets, the U.S. spends $762 billion and Iran $25 billion.

Aircraft – US 13,300 to Iran’s 541

fighter aircraft -1,914 to 196

Transports – 962 to 86

Helicopters – 5,584 to 126

Attack helicopters – 983 to 12

Tanks – 5,500 to 4,071

Armored vehicles – 303,553 to 69,685

Self-propelled artillery – 1,000 to 580

Towed artillery – 1,339 to 2050

Ships – 484 to Iran’s 101

Aircraft carriers – 11 to 0

Helicopter carriers – 9 to 0

Submarines – 68 to 19

Destroyers – 82 to 0

Frigates 0 to 7

3. Economic: Wars are costly to wage. Existing assets have to be deployed, possibly overseas, which is expensive. Factories need to begin churning out exhaustible resources, such as ammunition and artillery shells, as well as replacement vehicles, planes and ships. Uniforms and weapons for new recruits must also be produced en masse. Wars are generally funded by debt, with governments issuing war bonds. The ability to sell those bonds and the interest rate the government has to pay is determined by the nation’s creditworthiness, its economic condition before the war, and whether or not the country is under sanctions. The Ukraine War has underscored the power of sanctions and their ability to prevent dollars from flowing into a country deemed the aggressor. Iran would be incapable of levying meaningful sanctions against the U.S. The U.S., by contrast would be able to bring sanctions against Iran. China would most likely help Iran bypass sanctions, but in the end, the U.S. would be able to reduce the amount of money flowing into Iran, while Iran would not be able to do the same to the U.S.

The size of the potential pool of soldiers is important, as is the number of workers available to produce war materials. The U.S. labor force consists of 163 million workers, while Iran’s comprises only 28 million.

Iran holds foreign currency reserves valued at $21.4 billion, while the U.S. holds about $37.5 billion. Roughly 60% of foreign currency reserves around the world are held in U.S. dollars. The U.S. does not hold as much foreign reserves as countries such as China and Japan, but this is because the U.S. government has access to more-or-less unlimited quantities of U.S. dollars.

Basic Indicators for Iran

GDP = $352.2

GDP Per capita = $5344.96

Inflation rate = 43.3%

Unemployment = 9.7%

Corruption and mismanagement, including price controls and subsidies, weigh heavily on the Iran’s economy. The reliance on oil as well as government domination of numerous industrial sectors further inhibit Iran’s development. There is also a significant brain drain as many of the most qualified people flee the country, in search of a better life abroad.

The Heritage Foundation assigns Iran an overall economic freedom score of 42.2 out of 100, making it the 169th freest country in the world. For business freedom Iran scored 38.9 out of 100, labor freedom of 50.7, monetary freedom of 40.6 and financial freedom of 10.

Investment in new businesses, as well as economic development in general, are directly correlated with the protection of property rights and enforcement of contracts. For property rights, Iran scored 25/100, judicial effectiveness 26/100, and for government integrity 20/100.

4. Social: The social dimension looks at societal and demographic elements, including social unrest, ethnic or religious tensions, and social cohesion which might weaken a country’s ability to fight a war.

Ethnicities: Persians 61% of the population, Kurds (10%), Lurs (6%), and Balochs (2%), Azerbaijanis (16%), Arabs (2%), Turkmens and Turkic tribes (2%), followed by a small number each of Armenians, Assyrians, and Georgians.

Religion: Islam is the official religion, accounting for roughly 99.4% of the population. Shi’a Muslim (89%) and Sunni (10%). The remaining 1% is composed of Christian, Zoroastrian, Baha’i and Jewish. Christians are the largest minority religion with 250,000 to 370,000 followers, mostly of Armenian origin.

The government punishes Shi’a Muslims who they believe have failed to uphold Islamic values, while Sunnis, Christians, Jews, and other non-Muslims have all been victims of repression. Some religious minorities are effectively banned, such as Baha’i and unrecognized Christian groups. Baha’i members have been persecuted, jailed, and banned from attending university.

The Iranian constitution allows freedom of assembly, as long as gatherings are not “detrimental to the fundamental principles of Islam.” Given the state’s interpretation of detrimental, there is effectively no freedom of assembly in Iran. Protests and unauthorized gatherings are generally met with brutal force. In 2022, the government used lethal force to suppress protests against water shortages and poor living conditions in several provinces. Human rights leaders and labor rights advocates have been arrested or punished on an arbitrary basis. Activists can even be arrested without a warrant. The lawyers who defend them can also face jail time.

5. Infrastructure: an analysis of critical systems, such as transportation networks, energy systems, telecommunications, and industrial facilities can help to determine a county’s vulnerabilities, resilience, and potential risks.

The United States has 13,513 airports while Iran has 319. The U.S. has 35 ports, but Iran only 4. In oil production, the U.S. also leads with 18,000,000bbl, compared to Iran’s 3,450,000bbl.

Proven oil reserves – U.S. 50,000,000,000bbl, Iran 210,000,000,000bbl

Natural Gas Production – US 967,144,362,000bbl, Iran 237,561,415,000bbl

Coal Production – 495,130,000bbl, Iran 2,783,000bbl

6. Information: The information dimension analyzes the flow of information, as well as the communication systems, and media within a country. This analysis helps to understand how public opinion is formed and how propaganda and disinformation are disseminated.

In Iran, there is little media freedom either on or off line. Newspapers and other media are heavily censored, and the government directs journalists as to which stories to cover and which to avoid. Critics and opponents of the government are never given a platform. Many foreign websites, including news sites and social media, are blocked. Satellite dishes are illegal, and the police have actually raided homes, confiscating dishes. Persian language journalists working abroad have had their families threatened if the state did not approve of their reporting.

Reporters without Borders Ranks Iran as 177th least free country out of 180. Television is controlled by the state, and Persian language TV broadcasts from outside of the country are jammed. State television often airs confessions extracted from political prisoners by way of torture. Over the past two years, there has been a particular crackdown on journalists with an increased number of arrests and imprisonments. In one case a journalist was sentences to 90 lashes for allegedly making false news reports. The Islamic Republic has been known to target for kidnapping Iranian journalists operating abroad, as nearly happened to journalist Masih Alinejad in July 2021.

Academia is also not free and contains a great deal of indoctrination. The Supreme Leader, Ayatollah Khamenei warned that universities should not become centers for political activities. Students and professors have been jailed for speaking out against the regime or studying or teaching material which the state disapproved of.

Digital communication is monitored by state intelligence agencies. At the same time, the Iranian government utilizes online platforms and social media to disseminate propaganda and to influence the public. To this end, troll farms have been utilized, creating fake accounts and manipulating online discourse to support Tehran’s narratives. State sponsored cyber hacking is another way that Tehran controls the information space. And while the government has access to the most modern technology, the country suffers from a massive urban/rural divide, with much of the rural population unable to access the internet.

Online activism is illegal. And, the government is looking for ways to make accessing forbidden content even more difficult. In July of last year, the parliament began considering criminalizing the use and distribution of virtual private networks (VPNs) and requiring internet users to verify their legal identities. In January, 2023, it was announced that the unauthorized sale of VPNS would be banned.