Iran Document: Karroubi Responds to Threat of Arrest

From the Facebook page supporting Mir Hossein Mousavi. Karroubi's letter is in response to the claims made last week by the head of Iran's judiciary, Sadegh Larijani, that there is "enough evidence" to try the leaders of the opposition for inciting post-election unrest:

Ayatollah Sadegh Larijani, assumes that today the civil protest of the people of Iran depends or relies on an individual and, by eliminating or removing Mehdi Karroubi or Mir Hossein Mousavi, this movement will diminish or be repressed.

We witnessed that, with the same assumption, they arrested a group of political figures who have served the country and revolution, who had been ministers, deputy ministers, or members of Parliament, along with some journalists and a great number of people, in the middle of the night. They took them to prisons and put them under pressure and held show trials, but this movement not only did not stop but even strengthened. It is hard for them to accept this reality that this movement is spontaneous and is formed based on firm beliefs....

I was and will be a small servant of the people and as you know, such baseless remarks [made by the head of the judiciary] not only won’t make my determination weak in defending the rights of innocent and those who have been oppressed but rather will make it stronger....Sadegh Larijani thinks that by threatening and intimidating and talking about made-up files in the judiciary system, Mehdi Karoubi will be scared and will shiver from fear. No! Mehdi Karroubi stands behind the promise he has made to the people....

I wish instead of saying such dreadful and political remarks, Ayatollah Larijani would pay some attention to the justice and the judiciary system in the country and would take care of the Kahrizak case [the prison in which detained protesters were abused and killed] and would investigate the suspicious death of the young physician at Kahrizak [Ramin Pourandarjan]....I wish instead of all these remarks he would investigate, in the prisons of the Islamic Republic, what kind of language is being used by its interrogators.

Latest Iran Video: Night-time Rooftop Protests in Tehran (19 December)

[youtube]http://www.youtube.com/watch?v=GBqggSvNDGo[/youtube]

The Latest from Iran (19 December): After the Mythical "Millions"

1735 GMT: Making Stuff Up - The Twitter Attack. There's not much to add to Austin Heap's guest analysis for Enduring America this morning. Instead, The New York Times shows the power of pointless speculation, backed up by lack of any knowledge of important context, in an article by their technology writers:

Beth Jones, a senior threat researcher at the Internet security firm Sophos, said the attack did not look very sophisticated and probably was not the effort of a Web terrorist or other professional. “It could have been any number of people doing it,” she said. Ms. Jones said the incident may have been “hacktivism,” an attack with a social or political motivation. “The point could purely be just to prove the site is insecure,” she said

Just gonna say this one more time: if this was just "hacktivism" unrelated to the Iran internal crisis, why did the attackers first go after one of the Green Movement's primary websites for news?

(For an analysis which is more useful, and a lot funnier, see Persian Umpire's interpretation.)

NEW Iran Analysis: RegimeFail?
NEW Iran Special: Austin Heap on “The Attack on Twitter”
Latest Iran Video: Mehdi Karroubi Interview with BBC (17 December)
Iran: The Regime Takes On (Hacks?) Twitter for Moharram
Iran Analysis: The Regime’s Sword Wavers
Iran on Moharram, Day 1: The Regime Flops?
The Latest from Iran (18 December): Moharram Begins
.
1730 GMT: Today's Foreign Enemies Will Kill All Iranians Warning. Let's hand over to Revolutionary Guard Lieutenant Commander Brigadier General Hossein Salami:

Enemies will not give up their devilish moves against the Iranian nation, they have brought their front to our streets and universities today and the battle is still on....Pointing to the enemy's nonstop strategy to confront the Islamic Republic, the commander noted, "These moves form a chain of profound global plot against the Iranian nation....If we do not practice the necessary vigilance, we could (be obliged to) play in the enemy's court.

Etc., etc., etc.

1345 GMT: Confirming Torture Deaths? Mehr News reports that the judicial section of the Armed Forces has concluded that three detainees in the now-closed Kahrizak Prison died from abuse and not from meningitis, as was originally claimed. The deaths cited are those of Mohsen Ruholamini (son of the advisor to Presidential candidate Mohsen Rezaei), Amir Javadifar, and Mohammad Kamrani.

In its investigation of alleged abuses, the panel has questioned 22 people and indicted 12, three of whom are involved in the Kahrizak cases.

1315 GMT: Hashemi, Join Us. In an interview in Mizan News, conducted before Friday's events, the son of Mehdi Karroubi, Hossein, was blunt: people expect former President Hashemi Rafsanjani to distance himself from the Government and join those asking for justice.

1310 GMT: Khatami's Latest Statement. The website supporting Mir Hossein Mousavi published a statement from former President Mohammad Khatami to faculty at Hamedan University, insisting on reform and respect for protest:

The Islamic system does not respect people’s votes, those who behave like this should not claim to be on the path of Imam Khomeini and the revolution....The policy that is accepted in Islam is a moral policy. If we commit the worst actions under the name of religion we cannot claim that we are in favour of religion.

1300 GMT: Did the Clerics-Rafsanjani Initiative Reach Khamenei? Remember our analysis of recent weeks about discussions between senior clerics and former President Hashemi Rafsanjani in a bid for "unity" between the Government and the opposition?

Well, eyebrows are raised over this item from the reformist website Rah-e-Sabz, which claims secret but futile meetings of high-ranking Tehran and Qom clerics with the Supreme Leader. The website adds that the clerics warned Khamenei that many of his religious supporters, and indeed members of the Revolutionary Guard and Basij militia, are now searching for another "marjah" (source of emulation) after the brutal suppression of protest. (hat-tip to EA reader "Arshama")

1250 GMT: It Just Isn't Going Well. A public sign of doubt after the mini-marches yesterday: an EA reader points out the complaints from a pro-regime website about the "meagre popular support for yesterday’s rallies" and the focus of slogans attacking the opposition, rather than praising Ayatollah Khomeini. (And the comments aren't much more hopeful, with plenty to say about the "lying government".)

1230 GMT: Oh, Mahmoud, You Do Say the Darnedest Things.... Normally I wouldn't bother with this, but it's a relatively slow news day and the statement is kind of funny for its brazenness:

Iran's president says he will soon write to the UN Secretary-General asking for his country to be compensated for World War II damages. "We will seek compensation for World War II damages. I have assigned a team to calculate the costs," Mahmoud Ahmadinejad said at a Friday press conference in the Danish capital.

"I will write a letter to the UN Secretary-General [Ban Ki-moon] asking for Iran to be compensated for the damages," he added, pointing out that such a move is necessary to ensure that justice was served. Ahmadinejad told the reporters that the countries that won the Second World War had inflicted a lot of damage on Iran by invading the country and using its resources.

The president added that while the former Soviet Union, the United States and Britain received compensation after the conflict, Iran had been given nothing to make up for the suffering its people had endured.

Dude, I don't want to rain on your rhetorical parade, but the UN Secretary-General has no authority to order reparations. You could try the UN Security Council, I guess, but as three of its permanent members are the US, Britain, and Russia....

(And forgive me for being provocative, but wasn't there a really costly war for Iran more recently than 1945? One with a neighbour that supposedly has a bit of money from the oilfields it is auctioning?)

1020 GMT: And if you're into the Iran-Iraq border incident that is not war, Reuters indicates that Iran is seeking a "diplomatic" resolution over the alleged 11-troop occupation of the oil well.

0950 GMT: On the Nuclear Front. In case you want a break from the internal battle in Iran, the latest from Tehran, at least in the form of Ali Akhbar Salehi, the head of the Atomic Energy Organization of Iran, is good-cop/bad-cop noises.

On Friday, Salehi said that about 6,000 of Iran's centrifuges were operational. That comment was jumped on by some media in the "West" and Israel as a sign of Iran's aggressive intention. In fact, it was far from that: Iran's chief enrichment plant at Natanz has 8000 centrifuges, so Salehi was admitting that, at most, Natanz was 75% effective. (The most recent report of the International Atomic Energy Agency said that half of the centrifuges were working.) Salehi added that Iran would not be adding extra capacity soon, with a new generation of centrifuges not ready until 2011 and the heavy-water plant at Arak still "three or four years" away from service.

Today, however, Salehi is taking a tougher stance, declaring that "the IAEA Board of Governors' resolution against Iran is ineffective" and there would be no halt in the construction of the second enrichment plant at Fordoo.

0920 GMT: We've posted a guest analysis by Austin Heap of yesterday's cyber-attack on Twitter by an Iranian group.

0755 GMT: Mousavi Defiance Behind Regime Threats? One intriguing story this morning: the reformist website Rah-e-Sabz claims that Iran's judiciary pressed Mir Hossein Mousavi to withhold or at least moderate any statement of support for protests on 16 Azar (7 December). Mousavi's refusal, and indeed his publication of a high-profile message to Iranian students, angered the authorities and led to the ominous threats of arrests and trials.

0745 GMT: A morning, and possibly a day, to relax and assess after the fizzling of the regime's attempt to show strength on Friday (see our  special analysis, "RegimeFail").

No sign yet of counter-moves by the opposition, either within or outside the establishment, and Western media are likely to be wandering around after the Iran "invasion of Iraq" story (we're still treating 11 Iranian soldiers raising a flag over an oil well as a political manoeuvre which will bring more politics, rather than confrontation) and whatever pops up on the nuclear front.

Iran Special: Austin Heap on "The Attack on Twitter"

Austin Heap, one of the most prominent activists on the Internet and Iran (see, for example, "The Haystack Project" to provide unfiltered Web access to Iranians), writes a guest blog for Enduring America on yesterday's diversion of Twitter users to the page of the "Iranian Cyber Army":

There were probably a few odd text messages whizzing around in San Francisco at 11 PM on Thursday night at a place called Dyn. It's a company that most people had not heard of, even though it powers websites such as Facebook, LinkedIn, Flickr, YouTube, and Vimeo. They even have a catchy motto: "Uptime is the Bottom Line". Now, however, a group calling itself the "Iranian Cyber Army" had hacked Dyn's servers and changed only a tiny line of text. The outcome was the "occupation" of Twitter, causing a two-hour outage of service for Tweeters around the world.

Iran: The Regime Takes On (Hacks?) Twitter for Moharram
The Latest from Iran (19 December): After the Mythical “Millions”

Dyn offers a service called managed DNS hosting. Essentially a yellow pages for the Internet, DNS translates lettered website names into an IP address, like phone numbers for computers. When you type in enduringamerica.com on your browser, a request is sent out to a DNS server. The DNS server responds to your browser and says, "enduringamerica.com's IP address is XX.XX.XX.XXX", then your browser "calls" that IP.

Twitter uses Dyn's managed DNS service, so when you visit Twitter's website, your browser first asks Dyn where to find Twitter. Instead of the request being pointed to the correct location, the hackers changed the program so Dyn would tell users around the world that Twitter was now hosted on a server in Provo, Utah, run by a company called Bluehost.

For a handful of frantic hours, when someone tried to reach Twitter's site, they were diverted to a page of the "Iranian Cyber Army". The cyber-warriors greeted them with a message in Arabic and Farsi, placed atop and on a green flag:

Peace be with you. Ya Hossein! If the leader orders us to, we will attack and if he wants us to, we will lose our heads. If he wants us to have patience and wait, we shall sit down and put up with it.

It's a bold move by a group about which people knew little if anything, even though "the Iranian Cyber Army" had pulled off the same manoeuvre days earlier with the prominent Green movement website Mowj-e-Sabz, which has now suspended publication.

The question remains: who are they --- cyber-renegades or a group affiliated with the Iranian regime? Octavia Nasr, CNN's senior editor for Middle East affairs, dramatically announced yesterday, "The hackers are definitely Shiites, as indicated by the 'Ya Hussein' chant printed on their banner." That, however, is far from a solving of the mystery, since the vast majority of Iranians are Shia.

On the surface, it seems unlikely that the Government of Iran would attack a private company in America and even less likely that they would post what amounts to a ransom note with a pretty graphic on it. Sure, government hacking goes on all the time, and the US has even been caught with its hands in some of Iran's most private servers, but that did not come to light until three years after it happened. The threat of exposure of regime responsibility for this incident, with its high-profile target, is much greater.

Meanwhile, the on-line enquiry continues. Given the enormous influx in traffic to their servers from millions of tweeters, one would have expect Bluehost to notice and fix the problem at lighting speed. When asked why they had not responded faster, while the hack was still underway, Bluehost declined to answer. They have since removed the account that was used to host the attackers' message. Twitter also declined to comment beyond their initial verification, which of course came in a Tweet --- their "DNS records were temporarily compromised".

UPDATE: From Bluehost: "Bluehost is a leading Web hosting company that provides services to nearly 2 million Web sites. Bluehost discovered that Twitter.com had been the victim of a DNS compromise and, further, that the attackers had redirected some of the Twitter traffic to an account hosted on Bluehost servers. This customer account on BlueHost was setup using a stolen identity and credit card, as determined by the Bluehost verification department. The Bluehost abuse department immediately terminated this account. Contact was made by Bluehost to law enforcement agents to assist in all ongoing investigations."

UPDATE2: The kind folks at Internet Identity passed along the DNS change records for twitter.com:

2009-12-17 22:01 (PST) 2009-12-18 06:01 UTC www.twitter.com, twitter.com A Records pointed to 74.217.128.160

2009-12-17 22:14 (PST) 2009-12-18 06:14:20 UTC
twitter.com A Records pointed to 69.59.28.85

2009-12-17 22:24 (PST) 2009-12-17 06:24 UTC
twitter.com A Records pointed to 66.147.242.88

2009-12-17 23:11 (PST) 2009-12-18 07:11 UTC
A Records corrected and pointing back to allowed range for resolution

As you can see, the attackers tried three different hosts before sticking with Bluehost. First it was NetFirms, then it was CaroNet, and finally Bluehost.

UPDATE3: From Twitter: "Domain Name System or DNS is an Internet protocol used to translate IP addresses into domain names so instead of typing in a long string of numbers we can enter urls like www.twitter.com into a browser to visit our favorite web sites. Last night, DNS settings for the Twitter web site were hijacked. From 9:46pm to 11pm PST, approximately 80% of Traffic to Twitter.com was redirected to other web sites. We tweeted, blogged, and updated our status page last night.

During the attack, we were in direct contact with our DNS provider, Dynect. We worked closely to reset our DNS as quickly as possible. The motive for this attack appears to have been focused on defacing our site, not aimed at users we don’t believe any accounts were compromised."

Iran Analysis: RegimeFail?

If a demonstration occurs in the square but no one really notices, does it make a sound?

It is less than 24 hours after the Iranian regime tried to build up a mass rally on the first day of  the religious month of Moharram, not only for the pretext of protesting the burning of Ayatollah Khomeini's photograph but for the wider goal of showing the Government's political superiority over its opposition. Yet this morning, Iranian state medium Press TV, which was proclaiming that "millions" were on the streets of Iran, is not even bothering to mention the story, let alone update it. Fars News is now on the nuclear issue and promoting art about martyrs.  The Islamic Republic News Agency is trying to boost President Ahmadinejad, after his appearance at the climate change talks in Copenhagen, with his rhetoric on how Iran --- unlike European countries --- supports freedom and democracy around the world. (IRNA, further down its page, has a short, rather limp story that a million people marched in support of Khomeini and the Supreme Leader.)

Iran on Moharram, Day 1: The Regime Flops?
The Latest from Iran (18 December): Moharram Begins

We tentatively suggested yesterday afternoon that the attempted demonstrations in Tehran, let alone in other parts of  Iran where I have still not seen visual evidence, were a regime "flop". No need to be tentative now: this was a clear picture, after six months, not of a regime asserting its political strength but of a Government and even Supreme Leader struggling to maintain even a 24-hour appearance of political legitimacy. The sensational cries of "Death to Mousavi", whipped up by an Ayatollah Khamenei ally, made little more than fleeting headlines; indeed, I don't think even the base charge of "insult to Khomeini" was successfully stuck upon the opposition.

This, however, is the easy analysis to make this morning. Now the ball bounces back into the court of the opposition, be that Hashemi Rafsanjani, senior clerics, or the Green movement. Once more they have both the initiative and the burden of showing that their supporters are still ready to press their demands.

So on to Ashura (27 December), the key day of mourning and commemoration in Moharram marking the death of Imam Hossein. The Green movement rallied on Qods Day (18 September), which traditionally had been a regime day as it displayed its support of the Palestinians and their claim on Jerusalem. It rallied on National Students Day (7 December), which had marked the supremacy of the Islamic Republic over the Shah with the memory of the killing of three students in 1953. Can the opposition now mark one of the most important days on the Iranian and Shi'a Islam calendar as their own?

The regime failed yesterday, but that is far from enough to argue that it has lost. Those challenging the regime now have to prove they can make a meaningful, otherwise many Iranians (how many?) may sit on their hands in passivity and resignation.

It is eight days to Ashura.