The new face of the Syrian Electronic Army

They were the Syrian government’s elite cyber militia. From the beginning of the Syrian conflict, the Syrian Electronic Army (SEA) led major cyber operations against foreign and opposition targets on behalf of Syria’s President Bashar al-Assad. The SEA’s cyber operations gradually subsided as the conflict progressed and by 2016 it appeared that the group had ceased to operate. Now it is back. As the Assad government reclaims territory, a new SEA is emerging — this time as the regime’s digital force for policing cyberspace.

Early in the Syrian conflict the SEA made headlines claiming responsibility for several high-profile pro-government cyber operations, among them spectacular hacks of Western media outlets, human rights organizations, communications platforms and US military websites. The SEA was behind the hacking of the Associated Press’s Twitter account in 2013, tweeting that the White House had been under attack and that President Barack Obama had been wounded — a three-minute hack that reportedly caused a $136 billion drop in stock markets. The group was also successful in spreading malware to gain access to secret communications and plans belonging to Free Syrian Army commanders and opposition figures. 

That first version of SEA focused on offensive cyber operations. Established in 2011, it was reportedly composed of loose technical teams involved in hacking attacks, spreading malware and social engineering. It aimed to attack adversaries and to gain information and intelligence on behalf of regime forces. By contrast, the late 2017 re-boot of the SEA reveals a dramatic shift in the group’s structure and focus. The new SEA is a public relations arm of the government. Offensive cyber operations continue, but overall the SEA appears less technically sophisticated and more concerned with shaping the media narrative, disinformation and restraining the public’s online behavior. The new SEA includes a media office and regional offices in various Syrian governorates. 

“We used to work covertly on the military axis,” said SEA’s self proclaimed commander Yaser al-Sadeq, who regularly appears in public in military outfit. “A year and a half ago, [the Syrian government] undoubtedly won, so [now] we want to be media auxiliaries to the Syrian Army,” he told a pro-Syrian regime radio station last December.

Unlike most other government cyber forces that tend to operate only in the shadows, the new SEA embraces publicity, disseminating recent footage of personnel parading through the streets wearing vests with its emblem. While the group remains a non-institutionalized militia, al-Sadeq asserts they operate “with the state and under the supervision of the state.”

The apparent re-launch of the SEA with its new mission as a domestic cyber police is consistent with the Assad government’s objective to reimpose sovereignty over the Syrian populations and territories that it controls. It also provides a darker picture into the future of the internet in Syria. In the past year, old internet regulations and laws have been given new teeth and are being enforced to tighten the government’s control of cyberspace. This March, new cybercrime courts were established within the ministry of justice to prosecute cases under Syria’s 2012 internet law. According to Colonel Haider Fawzi, the head of Syria’s Division for Combating Cybercrimes, since 2012, 140 individuals have been arrested, of which 29 are accused of managing social media pages or posting content that “harms the state’s symbols and institutions or provokes sectarian strife.” The message is clear: opposition to the government will not be tolerated in cyberspace. 

The Assad government is keenly aware of the power of the internet. Social media served as a powerful platform for Syrian civil society to organize opposition to the government during the 2011 uprising. Throughout the civil war and in the midst of massive infrastructure collapse, cell phones and the internet continue to provide a means for individual Syrians, as well as local NGOs, to organize the necessities of life: food supplies, healthcare and space for maintaining civic dialogue.

Controlling the internet will prove difficult for the Syrian government. Syrian civil society has grown adept at using the internet despite the hardships of war. Moreover, the government needs the internet if it has any hope of reconstructing the Syrian economy. The divisions in Syrian society have not gone away, despite the government’s success in retaking territory. These divisions will remain and are likely to find their keenest form of expression in cyberspace.

Using the re-booted SEA to police Syrian cyberspace may calm fears in Damascus over the potential of the internet to spawn a new uprising against the government in the short term. But times have changed and seeking to apply traditional Baathist methods of control to cyberspace is unlikely to succeed. Syrian civil society is now global, networked and increasingly capable in cyberspace. In the long run, the Syrian government’s attempt to dominate cyberspace may prove as tenuous and fragile as its recent territorial gains.