Sources: CIA has conducted cyberattacks against Iran, Russia, and others since Trump signed a secret order in 2018 giving the CIA more freedom for such activity
The 2018 secret order matters because it moved cyber offense from an exception to a standing authority: where the Cyber Command strike that disabled Iran's rocket and missile launch systems was a discrete, attributed operation, the CIA's mandate under the order is a continuing campaign against Iran, Russia, and other targets with less external visibility.
The arc also runs backward: the CIA's cyber posture was rebuilt after the [[a:935253|2011 episode in which Iranians used Google search to unmask the agency's agent communications network]], so the reported campaign is as much about institutional recovery as retaliation. And it runs forward — the NSA and Cyber Command's pre-election actions against Iranian hackers show the same targets being worked from multiple US agencies at once.
First-order effects
Iran and Russia now face a two-track US offensive: Cyber Command's more visible military operations plus the CIA's covert campaign, meaning defensive resources must be split across both.
The CIA gains operational independence for cyber action without needing case-by-case White House sign-off, changing the tempo and volume of operations against named targets.
Second-order effects
Iran's response is already visible in the corpus: mobilized hacker units and suspected intrusions into water and wastewater utilities across at least 12 US states — critical infrastructure becoming the retaliatory surface for state-directed cyber campaigns.
Persistent covert pressure pushes targets like Iran to harden networks and expand their own offensive units, feeding an escalation cycle where each side's operations justify the other's.
Third-order effects
Offensive cyber is consolidating as a normalized instrument of statecraft, with intelligence agencies and military cyber commands both holding standing authorities rather than one-off approvals — raising questions about oversight and attribution that regulators and lawmakers have not yet resolved.
If critical infrastructure remains the acceptable retaliatory target, civilian operators in both countries become de facto combatants in state cyber conflict, a structural shift with lasting consequences for utility security standards.
The trend: US offensive cyber operations are shifting from episodic, attributed military strikes to standing covert campaigns run by multiple agencies, with critical infrastructure on both sides absorbing the escalation.
The Yahoo piece is well reported, caveated, clearly written. It talks about new, secret authorization for covert CIA cyber powers, including potentially the hacking and leaking style of ops. It *does not* make this attribution ZDNet claims https://www.zdnet.com/...
This is like during the Cold War when local commanders in S. Korea and Japan had the authority to launch nuke attacks if they believed there was imminent threat. “Exclusive: Secret Trump order gives CIA more powers to launch cyberattacks.” https://news.yahoo.com/... via @YahooNew…
Excellent view into expansive cyber authorities that Trump has given the CIA to conduct ops that used to require much higher approval. https://news.yahoo.com/... via @zachsdorfman @JennaMC_Laugh
Also: did the CIA give up on Sanger or something? He's usually the one handed these stories. “Exclusive: Secret Trump order gives CIA more powers to launch cyberattacks.” https://news.yahoo.com/... via @YahooNews
Which means that the House Intelligence Committee leadership was aware of these activities and yet continue to paint the narrative that no action was being taken and we were being soft on Russia. Using intelligence for political gain...again. https://twitter.com/...
Very interesting story that talks about CIA's role in hack-and-dump operations and critical infrastructure cyberattacks since 2018. There's been a series of hack and leak operations against China, Iran and Russia in recent years, but the question of who did it was never clear... …
“This has been a combination of destructive things — stuff is on fire and exploding — and also public dissemination of data: leaking or things that look like leaking.” https://twitter.com/...
Trump secretly made it easier for the CIA to conduct cyberattacks, @zachsdorfman @KimZetter @JennaMC_Laugh @SeanDNaylor report. The CIA has already used the authority at least a dozen times, for both leaking data and sabotaging infrastructure. https://news.yahoo.com/... https://t…
So Trump authorized the CIA to conduct the most aggressive, comprehensive cyber operations America's ever seen against RUSSIA (China, Iran and DPRK) .... two years ago ... https://twitter.com/... https://twitter.com/...
Some thoughts on this — 1) nat sec agencies get used to broad authority when given to them, and it can be difficult later to dial it back — officials tend to bristle at presidents exerting control over what agencies believe should fall within their discretion (see Obama and TK) h…
Exclusive: Trump signed a secret order allowing CIA to conduct cyberattacks w/o his prior approval. Since then, CIA has carried out over a dozen operations, including WikiLeaks-style hack-and-dumps. @zachsdorfman @KimZetter @JennaMC_Laugh @SeanDNaylor https://news.yahoo.com/...
Big scoop from @YahooNews : Trump signed secret finding authorizing CIA to conduct hack-and-dump cyber attacks against Iran and other targets-a significant escalation in the cyber wars. Hat tip to @zachsdorfman @KimZetter @JennaMC_Laugh @SeanDNaylor https://news.yahoo.com/...
The finding gave CIA more freedom in both the kinds of operations it conducts and who it targets, undoing many restrictions in place under prior administrations. And it effectively lets CIA self-authorize covert cyber ops, instead of needing approval from WH for each op.
The finding made it easier for CIA to launch destructive ops against critical infrastructure such as petrochemical plants, engage in the kind of hack-and-dump ops that Russian hackers and WikiLeaks popularized, and freed it to target entities previously off limits, such as banks
CIA has been conducting covert cyber ops against Iran and others ever since Trump signed secret, previously undisclosed, presidential finding in 2018 that gave sweeping authorization for such activity. Wrote w/ @zachsdorfman @JennaMC_Laugh @SeanDNaylor https://news.yahoo.com/...
CIA has wasted no time in exercising its new freedom. Since Trump signed the finding in 2018 CIA has launched at least a dozen ops: “a combination of destructive things—stuff is on fire and exploding—and also public dissemination of data: leaking or things that look like leaking”
And it made it easier for CIA to target entities like foreign media orgs, charities, religious institutions and businesses believed to be working for an adversary's intel service by reducing amount of evidence needed to prove a connection between the entity and that foreign gov