THE Politics of Cybersecurity in the Middle East

James Shires

• Publisher: Hurst Publishers
• Year: 2021
• Print ISBN: 9781787384736
• eBook ISBN: 9781787386402
• Topic: Politics & International Relations
• Subtopic: National Security
• Index: Politics & International Relations

Cybersecurity is a complex and contested issue in international politics. By focusing on the ‘great powers’—the US, the EU, Russia and China—studies in the field often fail to capture the specific politics of cybersecurity in the Middle East, especially in Egypt and the GCC states. For these countries, cybersecurity policies and practices are entangled with those of long-standing allies in the US and Europe, and are built on reciprocal flows of data, capital, technology and expertise. At the same time, these states have authoritarian systems of governance more reminiscent of Russia or China, including approaches to digital technologies centred on sovereignty and surveillance.

This book is a pioneering examination of the politics of cybersecurity in the Middle East. Drawing on new interviews and original fieldwork, James Shires shows how the label of cybersecurity is repurposed by states, companies and other organisations to encompass a variety of concepts, including state conflict, targeted spyware, domestic information controls, and foreign interference through leaks and disinformation. These shifting meanings shape key technological systems as well as the social relations underpinning digital development. But however the term is interpreted, it is clear that cybersecurity is an integral aspect of the region’s contemporary politics.

1

CONNECTING CYBERSECURITY
AND MIDDLE EAST POLITICS

The three events in summer 2012 with which I opened this book—data deletion by the Shamoon virus, the detection of FinFisher spyware, and the revision of the UAE’s cybercrime legislation—illustrate well the multifaceted nature of cybersecurity in Egypt and the Gulf states. But the interwoven and often contradictory understandings of cybersecurity in these states continue to evolve. To take one example of many, in January 2021, the instant messaging app WhatsApp was embroiled in a worldwide scandal over changes to its terms and conditions and their implications for user privacy, with millions of people worldwide migrating to alternatives. One of these alternatives was an app called “Pingme” (arsell), designed and created by a research institute connected to the Saudi government and due to launch in February 2021. The WhatsApp turmoil provided a highly useful backdrop against which to promote the benefits of this new app, and the official Pingme Twitter account took full advantage of the opportunity.¹ It remains to be seen whether Pingme is more successful than the UAE’s attempt at a similar “local” messaging app, named ToTok, just over a year earlier, which is considered in Chapter 5.

But exactly what kinds of cybersecurity benefits does Pingme provide? The director of the research institute emphasized that the app would be “free from external servers controlled by foreign agencies”, highlighting the salience of cybersecurity understood as national information control.² Another local expert argued that it was “free from any security backdoors and loopholes that allow hackers to perform cyberattacks”, suggesting that intrusion, rather than information control, was the main threat. While the privacy issues around WhatsApp helped its promotion, fears around individual rights, especially detention under cybercrime laws due to social media posts, were heightened by a local app with easier access to data. And finally, WhatsApp itself suggested that the entire issue was due to misinformation about the changes to its privacy terms. So, nine years after the three events of 2012 and their divergent conceptions of cybersecurity, a single incident—one of many that happen every week—illustrates the continued contradictions between different forms of cybersecurity in the region.

To tease apart these contradictions, this book has a foot in two areas of scholarship: Middle East politics and IR theories of cybersecurity. So far, these large, and growing, academic fields have not engaged with each other to any significant degree, even when cybersecurity scholars examine incidents that are entwined deeply in Middle East politics, or when scholars of Middle East politics see digital technological developments as crucial to broader shifts in political possibilities.³ My research has often met with a request for clarification from both audiences: is this really a study about cybersecurity? Or is it really about Middle East politics?

The answer is, perhaps unsurprisingly, that it is about both. This book lies precisely at the intersection of the two disciplines, seeking to demonstrate that their integration is fruitful. This chapter connects theories of cybersecurity and Middle East politics, placing the argument of this book in both theoretical contexts, before later chapters move on to the empirical detail of the moral maneuvers that underpin cybersecurity in the region. It first locates the argument of this book in scholarship in Middle East studies, exploring in more depth the political, economic, and social factors relevant to the development of cybersecurity in the region. It then moves to ground the concept of moral maneuvers in cybersecurity studies and international relations theory more broadly.

Cyberpolitics in the Middle East

This section explains why the Middle East is an appropriate frame of reference for this study. It connects the argument of this book to prevalent theories of Middle East politics, especially around new forms of authoritarian rule variously called persistent, upgraded, resilient, or digital authoritarianism. While these theories often claim global scope and generalize worldwide—something I deliberately avoid—they and their predecessors have proven utility in understanding the long-term development of Middle East politics at least since the colonial period. Showing how moral maneuvers support and, at times, force us to revisit the key tenets of digital authoritarianism enables this book to speak to scholars of the region familiar with these approaches.

At first sight cybersecurity seems unsuited to a regional analysis, as internet communications travel through cables stretching around the world and through space between masts and satellites. Internet protocols direct packets of data along a constantly changing definition of the most efficient path according to server and cable capacity, rather than national borders or regional alliances. Furthermore, the technologies built on these protocols enable almost instantaneous communication between people on opposite sides of the world. This enables a level of coordination, information sharing, and societal integration that is qualitatively different to those afforded by previous communications technologies and is often termed globalization.⁴

However, a simple globalization story overstates the deterritorialization of international politics in many areas, not least cybersecurity.⁵ The internet infrastructure is highly influenced by state actions, both in international internet governance bodies and through domestic strategies and laws. It is also shaped by the commercial decisions of multinational companies that install, maintain, and expand the internet infrastructure for profit within the constraints of the international political economy and often strong national ties. Consequently, even if the types of relationship between states and companies shift in the digital era, national and regional factors remain important. And, of course, individuals remain bound to territories and subject to national laws, even if their status under these laws is itself a strategic negotiation.

Regions are geographic entities, but this does not imply that they are natural or fixed. Instead, they are co-constituted by human and non-human factors. Although it has a long lineage, the term “Middle East” gained prominence early in the twentieth century, and in the following decades almost entirely replaced earlier Euro-centric concepts of the Orient and the Near East.⁶ This process was intimately connected with imperial and neo-imperial efforts to understand and exert influence over the Islamic world. Now, the Middle East region in international politics usually includes (at least) North Africa, the Arabian Peninsula, the Levant, Turkey, and the Persian Gulf.

However, in cybersecurity, “Middle East” is not always understood in the sense used by IR scholars, as many actors adopt both wider and narrower perspectives. On one hand, company structures often include an “EMEA” branch (Europe, the Middle East and Africa), absorbing the Middle East into a broad area outside the US. On the other hand, “Middle East” conferences, products and events rarely stray beyond the attractive economies of the Gulf Cooperation Council (GCC): Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates (UAE). Most of this book will focus on Egypt and the GCC states for reasons outlined below, although other developments (for example, in Israel and Iran, both also part of the Middle East as generally understood outside the narrow remit of cybersecurity conferences) will also be treated in subsequent chapters, and wider patterns across the broader region noted where appropriate. In this way, concepts of the Middle East in cybersecurity extend Bilgin’s pioneering analysis of the multiplicity of regional representation, portraying vividly the simultaneity of and divergence between different imaginaries.⁷

Communications technologies have always played a central role in Middle East politics. From the nineteenth century onwards, print media shaped popular and elite understandings of key political events, as newspapers, pamphlets, and sharply satirical cartoons appealed to different audiences, while literary journals, poetry and novels embedded political and technological divisions in cultural memories.⁸ International telegraph cables were integral to swift decision-making from afar, forming a vital part of colonial control and occupation up to and during the two World Wars, as well as post-colonial retreat. Radio broadcasts within and across national borders greatly assisted the spread of pan-Arabism in the early Cold War, with Egyptian President Gamal Abdel Nasser’s voice transmitted across the region on the station Sawt al-Arab (“voice of the Arabs”).⁹ The contemporaneous Egyptian film industry was a strong cultural influence, knitting together social and political identities across the region.¹⁰ A watershed moment for television in the Middle East was the 1991 Gulf War, which was entirely absent from many national broadcasters with widely watched coverage instead provided by the US channel Cable News Network (CNN). In a race to capture the political and economic potential of satellite broadcasts, Qatar modelled on CNN the pathbreaking current affairs channel Al-Jazeera, stimulating a range of professionally packaged media initiatives with political agendas, especially in Saudi Arabia.¹¹

Consequently, communications technologies have always been a target of political control. Censorship has been extensive in most Arab countries since the colonial period; both official and informal, external, and self-imposed.¹² State ownership of media organizations enabled direct and immediate influence, supported by broad laws suppressing different forms of critical speech, and these controls adapted easily to new communications technologies. For example, some of Egypt’s television stations have close relationships with its security and intelligence agencies, and, despite the bustling media environment, stricter censorship in films and talk shows has been evident in the last decade.¹³ Even satellite television has been subject to varying degrees of censorship: while Saudi Arabia originally banned satellite dishes and selectively confiscated signal decoders, the UAE claimed to adopt an “open-skies” approach.¹⁴

The quest for political control and influence through the media is not limited to national boundaries. The Gulf states exercise significant influence on media production in neighboring states due to the revenues that media companies in those states collect from viewers in the Gulf.¹⁵ Many states, including Iran, Turkey, and Qatar, have exploited the contrast between placid local media and aggressive state-supported international channels to project regional standing and maintain domestic narratives of authority.

However, politics in the Middle East, like elsewhere, is now also cyberpolitics, and the two cannot be separated. Young, digitally native populations communicate and socialize online as much or more than they do offline, and so nearly all political acts—finding and distributing information, organizing and documenting meetings and protests, championing or countering a particular cause—are mediated by the internet.¹⁶ The cyber aspect of Middle East politics rose to the fore dramatically in the “Arab Spring” events in the winter of 2010–2011, a series of protests beginning in Tunisia and spreading across the region. These protests mark a key juncture in the long-term political fabric of the Middle East.¹⁷ They are commonly seen as facilitated by social media platforms, dubbed “liberation technologies”, with the Egyptian revolution of January 2011 in particular often controversially described as a “Facebook revolution”.¹⁸ The changing shape of social movements in Middle East politics is inextricably linked to the growth of social media and online platforms for political actions, statements, and identities,¹⁹ even though the complex origins of the Arab Spring movements cannot be attributed only or even mostly to these new technologies.²⁰

Although the Arab Spring was heralded by many observers as a delayed turn to democracy in the Arab world, this proved an overstatement. In 2020, only Tunisia retained a government credibly elected after the protests, and even there, massive protests broke out at the beginning of 2021. Earlier social media-led protests, such as Iran’s 2009 Green Movement, did not achieve sweeping changes. Protests in Sudan, Iraq, Algeria, and Lebanon throughout 2019 and 2020 once again relied heavily on social media, as well as physical action in person, and have led to tentative political change, albeit virtually frozen or even reversed due to the COVID-19 pandemic.

This persistence of repressive regimes, variously dubbed resilient, robust or persistent authoritarianism among other terms, relies most of all on violence to disperse protests and intimidate opposition.²¹ In Egypt, continued protests and mass dissatisfaction with Muslim Brotherhood President Muhammad Morsi’s rule emboldened the armed forces to step forward from their indirect hold on power in July 2013.²² Then-defense minister and now President Abdel Fattah Al-Sisi suspended the constitution and removed Morsi, initiating the violent repression of Morsi supporters and the Muslim Brotherhood more widely, including a massacre of at least 700 individuals at Rabiʿa Al-ʿadawiyya Square in Cairo in August 2013. Following an interim government, Al-Sisi was elected president in May 2014 in disputed and boycotted elections. Physical violence, detention, and torture, and the reputation and fear these generate, lie at the heart of the resilience of authoritarianism, especially when accompanied by international support or silence.

Resilient authoritarianism also requires that the perceived “democratizing” power of the internet be turned in regimes’ favor: digital authoritarianism, in other words. Scholars have highlighted how authoritarian states—and increasingly, more democratic ones—have adopted successive generations of internet controls: from simple blocking, filtering and shutdowns, to more sophisticated surveillance at large scales and targeted at specific populations, and then manipulation, seeking to suppress, discredit, and drown out alternative voices on social media.²³ The growth of Iran’s much-debated “halal” internet and extensive, but still experimental, censorship is one obvious example.²⁴ Egypt provides another, as the cumbersome nature of the Egyptian government’s five-day internet shutdown in January 2011 has been replaced by more rapid, agile, and technologically sophisticated tactics. In September 2020, videos of a former Egyptian government contractor revealing military corruption were met by carefully calibrated local internet shutdowns and labor-intensive social m...

Table of contents

• Cover
• Half Title
• Title
• Copyright
• Contents
• Acknowledgments
• List of Tables
• Note on Transliteration
• Introduction
• 1. Connecting Cybersecurity and Middle East Politics
• 2. The Middle East in Global Cybersecurity
• 3. Cyber Conflict
• 4. Targeted Surveillance
• 5. Information Controls
• 6. Foreign Interference
• Conclusion
• List of Acronyms and Abbreviations
• Notes
• Bibliography
• Index
• Back Cover