In a statement underscoring the rapid evolution of modern warfare, Chairman of the Joint Chiefs of Staff Gen. Dan Caine today confirmed that US military operations against Iran commenced with a crucial phase led by US Cyber Command (USCYBERCOM) and US Space Command. These entities were the „first movers,” applying „non-kinetic effects, disrupting and degrading and blinding Iran’s ability to see, communicate and respond.” This news reaffirms the essential role of the digital domain in any contemporary military confrontation.
The Invisible Dimension of Conflict: From Blinding to Intelligence Gathering
Although General Caine did not offer specific details about CYBERCOM’s actions, informed speculation abounds. Several former officials and cyber operators anticipate that the cyber mission will evolve as Operation Epic Fury continues, an operation expected to last for several weeks. The initial disruption phase could give way to an intensive intelligence-gathering stage, reserving certain „kinetic” cyber capabilities for specific moments. A former operator indicated that the operational plan likely comprises multiple phases, each with a dedicated cyber annex capable of supporting a specific effect during that stage. However, in the long run, during sustained operations, the focus shifts to „intelligence support and indications and warning.” US Cyber Command declined to comment, citing operational security concerns.
The Battle for Access: A Long-Term Mission and Constant Effort
Any successful cyber action requires pre-positioned access to target systems or networks, a process that can take months to years to acquire and requires persistence to maintain. „You just don’t flip this switch on automatically,” explained a former military cyber lawyer, emphasizing that developing the necessary access to execute targeted operations at the right time and integrate them into a broader plan is a complex and lengthy endeavor. A former senior cyber commander noted that Epic Fury will likely be an enduring operation with numerous missions, constantly adapting to the evolving battlefield – and cyberspace – a major difference from a single strike. In such an extended campaign, support teams operate 24/7, focusing on targets from offensive, defensive, information operations, and intelligence perspectives. However, a second military lawyer specializing in cyber warned that a major concern in a prolonged campaign is the risk of losing access if Iran blocks certain networks, forcing cyber operators to find new entry points in a constantly shifting digital landscape.
The Cyber Dilemma: Intelligence or Destruction? The Viasat Lesson
Once access is gained, the question arises: use it to gather intelligence or to „break something”? Breaking something almost certainly eliminates the ability for cyber to impact that target again and closes any intelligence value the access might have offered. This is why, in long-term operations, persistent intelligence collection is often considered more valuable than creating warfighting effects, especially once the conflict has entered the kinetic phase. A former cyber operator highlighted that it is rare for a cyber effect to offer a meaningful improvement over standard munitions. Russia’s counterproductive example, which targeted the Viasat system at the beginning of its invasion of Ukraine, clearly demonstrated this dilemma. Although it caused short-term havoc in Ukrainian government and military long-range communications, the Russians „burned” a valuable intelligence collection posture and pushed Ukraine to adopt Starlink capabilities – faster, cheaper, more robust, and more portable – to which Russian intelligence had no access. „The net result was that the Russians forced a massive modernization of Ukrainian capabilities, saved their adversary money, and found themselves in an espionage deficit,” the former operator concluded.
When to Go Overt: Scenarios and Reversibility
There are, of course, scenarios where CYBERCOM might conduct operations with more overt consequences, such as interfering with public-facing government websites or turning off the lights. Another former military cyber lawyer indicated that such operations could come into play if a popular uprising coalesces in Tehran, as President Donald Trump has encouraged. Cyber operations, along with air power providing cover, could aid such a movement. Or, more broadly, it could be beneficial for specific military operations if the power goes out in a certain part of town at a certain time. Crucially, in these cases, many of the cyber effects would be reversible if the uprising succeeds or the operation has finished. „One advantage from these techniques in a longer campaign is that civilian impacts are minimized because cyber effects can be turned on and off. For example, a kinetic strike on the power grid takes it down for the foreseeable future. Not so cyber capabilities. The same applies to telecommunications, which affect emergency services,” experts stated. As the conflict enters its third day, it is likely that cyber operators are continuously updating their options, prepared to act when the opportunity arises. Beyond these speculations, CYBERCOM remains silent.
