CYBER OPERATIONS IN THE IRAN CONFLICT: INTERNET BLACKOUTS, HACKING CLAIMS AND GEOPOLITICAL SIGNALS

The Iranian internet blackout that lasted 88 days ended abruptly on Tuesday, but the restoration remains incomplete. The shutdown began in January during anti‑government protests. The regime cited security concerns. The partial return of connectivity came after US strikes on Iranian targets. The timing suggests a link between cyber‑defensive measures and conventional attacks. Two independent sources confirmed the restoration. A senior official reported that connectivity resumed in Tehran. A monitor observed traffic returning to major ISPs. The restoration was announced by the Iranian Ministry of Information and Communications Technology. The delay in full service indicates technical or political hurdles. Iran's cyber actors are implicated in a separate incident. Israeli researchers attribute a breach of the Los Angeles transit system to Iranian hackers. The breach exposed personal data of commuters. The claim was made by Reuters. The source remains unverified, but the attribution points to cross‑border cyber activity. The breach occurred in the United States, far from the Middle East, indicating global reach. The Iranian blackout and the Los Angeles breach both involve Iranian actors, but the motives differ. The blackout appears defensive, aimed at controlling information flow during conflict. The Los Angeles breach appears offensive, targeting a foreign infrastructure system. Both events show Iran's cyber capabilities are used for strategic signaling. Lithuania's warning about Russian GPS spoofing adds a third dimension. The Lithuanian foreign ministry said Russia can falsify GPS signals up to 1,000 kilometres into Europe. The statement was issued amid rising tensions with Russia. The warning highlights the potential for cyber‑physical attacks on navigation systems. It does not directly involve Iran, but it shows regional cyber threats. The pattern emerging is a dual use of cyber tools by state actors. Iran uses internet shutdowns to manage internal dissent and signal defiance. Iran also allegedly conducts offensive operations abroad. Russia's GPS spoofing warning shows another state using cyber to disrupt critical infrastructure. These actions occur in the same timeframe, suggesting a broader strategy of cyber escalation. Strategic implications are clear. The partial restoration of the Iranian internet could be a tactical move to maintain regime stability while preparing for further cyber operations. The Los Angeles breach demonstrates that Iranian actors can target critical infrastructure abroad, raising concerns for US security agencies. The GPS spoofing warning signals that European states face new cyber‑physical threats from Russia, which could affect military logistics. The timing of these events is significant. The blackout ended shortly after US strikes on Iranian targets. The Los Angeles breach was reported after a series of US‑Iran cyber exchanges. The GPS spoofing warning came during a period of heightened Russian aggression in Eastern Europe. These coincidences suggest coordinated cyber campaigns aligned with conventional military actions. Location-wise, the blackout affected all Iranian ISPs. The Los Angeles breach targeted the Metropolitan Transportation Authority. The GPS spoofing warning concerns European navigation satellites. These geographic spreads illustrate the global footprint of cyber operations. Actors involved include the Iranian government, Iranian hackers, the US, Russian state actors, and Lithuanian officials. The US is both a target and a respondent in these cyber exchanges. Russia's GPS capabilities add a new layer of threat to European security. The forward‑looking assessment points to continued cyber activity. Iran may use internet shutdowns to manage domestic unrest while conducting offensive operations abroad. US and European agencies will likely increase monitoring of GPS and critical infrastructure. The pattern of synchronized cyber and conventional attacks suggests that future conflicts will blend physical and cyber domains more tightly.