69. Israel Attacks Iran: Mossad’s First Assault (Ep 2)

0:03Gordon Corera:For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books, join the Declassified Club at therestisclassified.com. This episode is brought to you by Facebook. So you were scrolling on Marketplace, and there it was, the bike you'd been searching for. You sent a message, and it turned out the seller was super chatty. kind of funny, and an avid cyclist. The next thing you know, you're in a cycling crew. Well, a community cycling group. The thing about Facebook, you might find more than what you're looking for.

0:42From a browse to a bike ride, this summer, find more on Facebook.

0:47Gordon Corera:Still waiting in line? Again? That's time you'll never get back. Save time and money with Stamps.com. Over 4 million businesses have skipped the line with Stamps.com. Join them to save up to 90 % off carrier rates from your computer or phone right now. Print postage for certified mail, registered mail, and packages in seconds. Then schedule a pickup right from your home or office. For a limited time, go to stamps.com and use code podcast for a free welcome gift. Taxes and fees apply. Hey, it's Ryan Reynolds here from Mint Mobile. Now, I was looking for fun ways to tell you that Mint's offer of unlimited premium wireless for$15 a month is back.

1:25Gordon Corera:So I thought it would be fun if we made$15 bills, but it turns out that's very illegal. So there goes my big idea for the commercial. Give it a try at mintmobile.com slash switch. Upfront payment of$45 for three months,$90 for six months, or$180 for 12-month plan required. $15 per month equivalent. Taxes and fees extra. Initial plan term only. Greater than 50 gigabytes may slow when network is busy. See terms.

1:54Gordon Corera:The code that struck Natanz was a work of engineering bravado every inch as much as the centrifuges it was designed to destroy. The first thing the Iranian engineers heard was a screeching sound. That's the machine skidding round inside its case as it loses control. By this point, if your control panel has not warned you of a problem, it's already too late. You'll hear one machine taking out the next and the next like dominoes. There was no explosion, just a clatter as the delicate, precious machines destroyed each other. The Iranians had already been seeing smaller problems. Machines were failing, parts breaking down.

2:32Gordon Corera:It was not always clear why. Was it poor engineering standards? Bad parts or designs? No sooner would one problem be fixed than more centrifuges would go awry, forcing them to be stopped and checked. What they did not know was that a hidden hand was remotely manipulating the controls to take advantage of the delicate nature of the devices. Welcome to The Rest is Classified. I'm David McCloskey. And I'm Gordon Carrera. And that, dear listeners, you will, of course, recognize as Carreran prose. That is Gordon Carrera writing in his book, Intercept, The Secret History of Computers and Spies, about a terrible set of accidents at the Natanz enrichment facility in Iran.

3:20Gordon Corera:Gordon, you're of course going to have to set this up, but we are getting in that rich paragraph a sense of the impact of this really history-altering cyberweapon that is developed as part of Operation Olympic Games. last time we looked at the iranian nuclear program particularly the site at natance filling up with centrifuges to enrich uranium obtained from pakistan's nuclear salesman aq khan and this dilemma for western governments you know what to do about it whether to let iran go nuclear or launch a military attack president bush wanting that third option and that's what we're going to be looking at this time this third option which is going to be a cyber attack i guess it's the origin story of what we think of as cyber warfare and cyber attacks.

4:08Gordon Corera:And as you described there, Gordon, in that prose, this is so, I guess, history altering because it is a cyber attack that bleeds into the physical world. It is not merely dealing with zeros and ones on a screen. It is physically leaping and affecting machines in the real world. And that, I think, is why this covert action program to develop it can be compared to the Manhattan Project, because it is that impactful on the world today. But of course, cyber network computers have been around for a little while prior to the early 2000s. The vulnerabilities are sort of known prior to Natanz. Yeah. I mean, people had actually been thinking about the fact that computers could be remotely accessed and that, you know, the code stolen or even altered as far back as the 60s.

5:01In the 80s, you see the first signs of what is basically cyber espionage and people stealing data. And actually, it's American computers which are the first to be on the Internet. So you start to see East German Russian hackers trying to get into those in the 80s and the 90s. And then you see American and British hackers, I'm led to believe, getting into foreign scientific programs in the 90s when they go online and you can kind of access them over this thing called the internet. But all of this, you're right, is espionage. Yeah.

5:34Gordon Corera:There's information that is on these networks that previously might have been kept in safes, right, or somewhere physical that's now online or on these computer networks that spy agencies, criminals, whoever might want to access. Yeah. And that is different from, if you like, in the Hollywood version, cyber war or sabotage or whatever you want to call it, which is having a physical destructive effect through online means. People start to think this might be possible around the 2000s. And one of the first events is actually in Australia in 2000, when raw sewage starts to pour out from a treatment works in Queensland.

6:15And they can't work out why. And it turns out that the disgruntled worker who's just been sacked and who knew how the systems worked was dialing in and opening the valves to let the sewage out all over this poor town in Queensland. So, you know, it's the insider threat. He is the kind of Snowden of cyber sabotage, but just in a sewage treatment works rather than the NSA in the 2000s. The insider does damage. It's the same impulse.

6:41Gordon Corera:It's the exact same impulse. Yeah. Let's not go back into Snowden. I would love to, Gordon. But yeah, you're right. Let's move on. You get after 9-11. There's lots of kind of loose talk about, you know, is Al-Qaeda, are the terrorists going to do cyber attacks? The crucial thing I think to say is it's really hard to do. It is not like the movies. The Australian engineer with those sewage treatment works was only basically able to do it because he'd worked in these sewage treatment works. He knew the systems intimately. He understood them. And then he is, I think, physically sat in a car outside accessing it through a radio.

7:16The idea that you could use a cyber attack to take down something much more advanced, something which you haven't got direct knowledge or access to, and is well protected, say like an Iranian nuclear program. Now, that seems beyond capabilities. But, you know, that is what, as we heard last time, President Bush has said he wants that third option. And this is a third option, because I guess the key thing about it is it could buy you time. It's sabotage rather than warfare.

7:46Gordon Corera:It's maybe now even hard, you know, 20 years later to understand how revolutionary this idea would have been or frankly, just the capability. Right. We're not talking about making it harder to use the computers at Natanz. The equivalent in industrial terms of like taking a website down or something like that, where you're dealing with a software problem that you can then fix and is presumably cleaner to fix. What we're talking about here is actually getting into the physical infrastructure of the plant. And we talked in the last episode about the centrifuges that the Iranians had acquired through bomb salesman AQ Khan.

8:27Gordon Corera:And I would wager, Gordon, it's sort of an expensive lot of equipment and highly technically complex. And so if Western intelligence services were able to wreck some of that machinery, you would potentially set the nuclear program back very significantly. And I think the interesting thing about it is they're not necessarily trying to destroy the program. They're trying to disrupt it. They're trying to do it covertly to sabotage, to undermine it. and basically to buy time i mean that's what i think is quite interesting about this operation is that it's not a kind of one shot where you're suddenly going to kind of blow the whole place up that's just not possible but the idea is to do something more covert without anyone knowing without even the iranians knowing they'd been attacked let alone by whom so it's very different from a bomb being dropped or a kind of special forces raid into the site the good news is no risk pilots or ground troops to do something like this.

9:28And if you can do it through cyber means, there is this tantalising possibility that you can delay and set back this programme without the Iranians understanding why. And I think that also makes it a very tempting option. You can imagine if you're President Bush at this time and someone says, we can buy you time and slow down this program, that is tempting, particularly, of course, when you've got the Israelis on your back who are saying, we want to bomb this, or you've got Netanyahu going, we want to attack this.

10:00Gordon Corera:We kind of set up some of this era when we did the episodes on Mosin-Fakriza Day. We talked about Mayor Dagan, who was the head of the Mossad at this period of time. And it's probably worth situating him a little bit in this story because it does seem like the whole point from Mayor Dagan's perspective was to avoid an open war with Iran. And so you want to slow the program down enough to create more options for you in the future. In this period, I mean, the cyber component of Olympic Games, right, is a piece of it. But the Israelis are doing a whole bunch of other stuff too. And this is the era where they start assassinating nuclear scientists, right?

10:42Gordon Corera:And they start killing the people who are working with Mosin Fakhriz today. And the kind of widespread nature of this shadow conflict, I think, is in part driven by the fact that the Iranians have quite ingeniously set up a target, a nuclear program that is dispersed across many different facilities, some of which are very, very hard to access physically. And importantly, and this is what distinguishes it from, you know, the Syrian attempt to get the bomb or the Iraqi attempt to get the bomb is it's kind of homegrown. They get a lot of this stuff initially from AQ Khan, but the knowledge of how to do this stuff is in the heads of Iranian scientists, right?

11:18Gordon Corera:And so the Israelis are trying to kill them, to slow the program down by making it harder for people to do the work. And I also find it interesting because even And within Israel, Mehr Dagan is the head of Mossad at this time. He is actually invariant. He's not pursuing the same policy, if you like, that his prime minister wants, which is Benjamin Netanyahu wants to attack the program with a military strike. And Mehr Dagan is not up for that. And he will talk about it after he's basically ejected from office later. And so he is actually trying to stop his own prime minister, it feels like, doing something which he thinks is dangerous, which is launching a military strike so he's invested in this idea you know Mossad that they could do a covert action to slow it down so he's also a bit like the American side trying to kind of buy time and if you like divert the pressure from going for a full military strike and I find that kind of interesting as well because you do get a sense of the tension between and you often hear about it between Netanyahu and some of his own national security officials because a lot of them at various times think this guy's going too far he's too hawkish on some of these issues and i think that was the case here and so what mayor de gan is doing by pursuing you know olympic games and by even the assassinations is actually trying to buy time and avoid you know the military option and we should say that the u.s was not involved at least as far as i can tell the u.s is not involved in the assassinations no there are pieces of this where masad and the agency or Mossad and kind of Western intelligence are joined at the hip and then other places where they're not, right?

12:56Gordon Corera:And where Mossad is pursuing its own operations, its own sense of Israeli security interests. But there's an incredible overlap, I think, of interest, obviously, in stopping an Iranian bomb, but in, frankly, what is deemed as justifiable or worthy of the risk when it comes to sabotaging the physical components of the nuclear program. Because the US at this point, Gordon, I think has already tried to sabotage some of the program by kind of getting into the supply chain. It's like they put some bad components and some kind of sabotage components into that supply chain. Allegedly. Yeah, allegedly.

13:34Including some power supplies shipped from Turkey, which explode. But I think the Iranians then work out a problem. It's kind of pretty obvious when a power supply explodes and you look where it came from, and then you kind of get it from somewhere else or you find a different way of doing it. So I think they're working out that that kind of traditional COVID action or sabotage has its limits when Iran is protecting and kind of trying to build its nuclear program very much under its own auspices rather than bringing in material elsewhere. And so, you know, this option of the cyber attack becomes suddenly possible and quite tempting for both the US and some of those in Israel, I think.

14:10But it is ambitious. It's something that has never been done before. And you've got to work out how you're going to translate something which is on computer code that you're developing into a physical destructive act within this very closed and secretive nuclear program.

14:27Gordon Corera:Well, and this gets back, Gordon, I mean, in the last episode, you gave us a wonderful tutorial on centrifuges. And I guess we're back to the centrifuge, the large rows of hot water heaters that are sitting in the basement at Natanz. These are the targets, right, of the cyber weapon that is going to be developed. And the key reason is they are obviously the thing which is enriching uranium. And crucially, they are these incredibly complex bits of engineering. The rotors inside them, you know, to separate the uranium-235 from 238, it spins so fast, it's faster than the speed of sound. Supersonic, faster than the fastest fighter jet.

15:04That's the speed at which that rotor is moving. You know, it needs to be made out of a special metal to be able to withstand the kind of stress. It needs to be perfectly balanced, this rotor, on a kind of ball bearing. It's incredibly delicate and fragile. The Iranians would find if you don't wear gloves when you assemble them and you get some dust on these rotors, they're spinning so fast, just that dust will cause an imbalance on the rotors and it will spin off and then smash into the kind of casing in which it is. So you have to maintain the speed of that rotor perfectly as well. You basically can't switch them off very easily.

15:43And it mustn't vibrate. It mustn't get any kind of dirt inside it. The slightest imbalance in this system, and it can spin out of control. And then what happens is it crashes into the casing. And then because they're in a cascade, all these centrifuges together, one will potentially crash into the others like dominoes. and you can take down a whole cascade of centrifuges. So they are incredibly vulnerable bits of engineering.

16:09Gordon Corera:So if you start from the idea that you want to wreak havoc on the centrifuge cascade at Natanz, and you want the Iranians to be confused about what's happened, you don't want something to go boom, and then they go back on the supply chain and say, oops, we're not buying from the supplier anymore. You want there to be this perpetual sort of confusion about what's happening. I mean, it seems like first off, you need a pretty detailed understanding of the facility at Natanz and exactly how it's laid out and exactly what type of machinery and software it's using to run the place, right? I mean, you need a lot of information to even get started.

16:48And all the signs are that pre the deployment of the code that's going to cause the damage there are a couple of stages of more traditional espionage and there's a couple of very advanced espionage tools called i think flame and dooku which are the kind of you know the hacker names for these packages which get inside the system and they are basically there to just collect the data about what the system is and how it's working we don't entirely know which countries were involved in that i think u.s israel looks like definitely some signs maybe some other countries as well. One of the interesting questions about that.

17:23Who knows if the Brits might have had some involvement at that stage in some suggestions of it. Of course, they wouldn't confirm it. But this is still espionage, you see. And you could imagine everyone saying, well, we need to understand this espionage. But then the next bit, which I think is really interesting. So even if you know what the centrifuges are and how the system is configured, you need to be sure how to have an effect on them. What code would allow you to have a physical impact on them? and this is where we get back to i'm not sure he is a friend of the show because i think in terms of hero villain i think aq khan is i don't think we can play that game with him i think he's in the villain category sorry pakistani patriots who love him as father of their bomb now you raise a

18:03Gordon Corera:good point gordon which i'm sure will be an ongoing conversation which is if you are a villainous character can you actually be a friend of the pod or is it just you've got to be a kind of a straight shooter i don't know i i think we need to we need to think about that you have to give me an example But I think AQ Khan, I mean, I don't think we should, as we say it out loud, I don't think he can be a friend of the pod. No, no. Last time we explained how he had sold some of the equipment, some of the designs for centrifuges to the Iranians. And they're going to basically copy those. They are going to use those designs.

18:32And the crucial thing is, in 2003, the AQ Khan network gets taken down. Again, we'll do that another time. amazing story involves the interception of some components which the Khan network was selling to Libya the US will get Pakistan's but you can't at the house arrest Libya will give up its program now the interesting bit is that means the US will get hold of a whole load of the centrifuges what were the p1 and p2 centrifuges but which are identical to the ir1 Iranian one and two centrifuges that Iran is developing. And these centrifuges are going to be shipped back to the National Security Complex at Oak Ridge Lab in Tennessee, which is one of those US National Security Labs, isn't it?

19:18Gordon Corera:That's right. And it is essentially the centerpiece of the US nuclear stockpile, right? And a tremendous amount of the research on the maintenance of that stockpile, the procurement of it. I think the kind of locus point for that is Oak Ridge, Tennessee. So it'd be a natural place if you were an officer of a Western intelligence service who was really interested in sabotaging the Iranian nuclear program to kind of go down there and have a look at these centrifuges and understand how they work. And how you might be able to play with them. Right. Yeah. Just kind of play around with them for a little while.

19:56Yeah. what's amazing is that khan has supplied the centrifuges to iran and then by his network being broken down there's an opportunity because the u.s can build its own replica of the kind of enrichment cascades that are being used in the tanks with the same controllers the same hardware around these centrifuges and work out how to sabotage them effectively and they can work out what will lead them to crash and supposedly they had a cage where they could watch them and toy with the controls and work out what would make them crash and break making this awful screeching sound and the israelis are also doing something very similar it seems making a scale model of the natance enrichment facility set up at demona which is their nuclear power facility out in the desert And they are building their own also replica of Natanz.

20:53You've got both sides trying to understand what is going on in this kind of cavernous site at Natanz and how the centrifuges specifically work and what you could do to them.

21:02Gordon Corera:Spy agencies love a good scale model. It reminds me of the replica built of the Bin Laden compound, right, at Abbottabad, that the SEALs train on. Do they have like modelers? No, they do. Do you think they recruit people? Because, you know, you get people who love, I met someone the other day who loves scale models and they were showing me pictures of a scale model village and something like that and then do you think you know you get recruited and someone says you're a really good scale model village builder do you want to come here and build models of nuclear compounds and terrorist compounds for the cia or mossad i guess they do the ones that i met worked at the uh national geospatial okay intelligence agency nga there'd be a natural connection between the imagery and the model and the modeling so they had a team of modelers there who would who that was their job.

21:47That's a great job.

21:48Gordon Corera:That's like the best job. Yeah. I'm not even into it. And I want that job, but I would be discovered on day one as an incompetent, incompetent modeler. Also Gordon, maybe they're with scale models all over the place of Natanz and alleged Western intelligence services, practicing destroying centrifuges. Let's take a break. And when we come back, we will see how they code this destructive cyber attack that's going to change the history of the Middle East. See you after the break.

22:25Gordon Corera:Well, welcome back. Gordon, we've talked about the centrifuges and the physical destruction, but you have to, I guess, design a code, right, that will actually have an impact on those centrifuges. And so there's a software coding component to this that is really, really critical. And it's thought to be done by the US and Israel, primarily. Allegedly. Allegedly. And we should say again, this is all in the public domain here, right? But nobody's taking ownership of Olympic Games. But they're writing this code, which has got to be covert, and it's got to be really precise. And it's interesting because, believe it or not, we're not going to get deep into the specific types of code that we used.

23:09I could, but I just thought, you know, too shy. Show off my knowledge of coding. Last time I coded was, I think, in the 1980s, using basic computer language. If you remember, you're too young, David, to know what basic was on a Commodore VIC-20 computer. You're probably too young to know what that is. I am too young to know what that is. Yeah, but that's my coding knowledge.

23:27Gordon Corera:I do understand a little bit, but not that much. You were not recruited to help Western intelligence and its efforts to sabotage the Iranian nuclear program. No, me playing jetpack on my computer did not qualify me to be a top cyber hacker. But by 2007, they've got some code ready. And it's worth saying there's actually not going to be just one cyber attack. And that's actually going to be important for our story. There's going to be multiple and they're going to be varied and covert to sow confusion. And the code is kind of stealthy, designed to work over an extended period without being spotted rather than being a single strike, which takes it down.

24:00And the way to think of it is as two things, a delivery system, which is, if you like, the missile, which is going to get you into the target, and then the payload, the warhead, which is actually going to do the damage. And the aim of the Olympic Games code is to be very, very targeted in its delivery system. Because they create code which is looking for something called a programmable logic controller, a PLC. and the plc is used to control industrial facilities so it's a small computer which you have at things like sewage plants gas pipelines train signaling anything industrial in a factory you know air conditioning even in a building they're not built with huge amounts of security in mind they just control a physical process so they're the controlling system and the coders are going to design something which is looking for a very specific one of these plcs built by the German company Siemens, a specific PLC, and one that's operating in a very specific setup.