For half a century, anxieties around the Strait of Hormuz, the world’s most important energy chokepoint, were about whether tankers could get through. Soon after the United States and Israel began their war against Iran on February 28, that fear was realized, and shipping collapsed within days. But Iran’s closure of the strait was expected and ultimately the least imaginative thing it would do.
In fact, the instructive damage happened away from the water: A GPS spoofing campaign threw more than 1,100 vessels off their positions in a single day. Drones hit Amazon Web Services data centers in the United Arab Emirates (UAE), the first confirmed military strike on a hyperscale cloud provider, and the outage ran into banking apps and payment platforms. A wiper attack reset more than 200,000 devices at the US medical-technology firm Stryker, delaying surgeries. Iranian projectiles struck power and desalination plants in Bahrain and Kuwait, which draw about 90 percent of their water from the sea. And across the UAE, the daily volume of cyberattacks tripled to 600,000.
As one Emirati official observed, too many people “look at this conflict only through the standpoint of aircraft, fighter jets, missiles, and drones.” Indeed, the war is a stress test of the Gulf’s operating model, which is premised upon stability and prosperity in an otherwise troubled region, and the model has been pressured in places oil export volumes or missile-and-interceptor numbers cannot show. The deepest vulnerability was not in any single outage but in the way the outages traveled: the blow to the data centers landed on the banks; the threat to the strait landed on insurance premiums; the attack on potable water landed on the legitimacy of the state that promised it.
