The Latest on Iran (29 December): A Desperate Swing of the Fist

1930 GMT: Kill Them. Abbas Vaez-Tabasi, a member of the Expediency Council and the Assembly of Experts has declared on state television, "Those who are behind the current sedition in the country ... are mohareb (enemies of God) and the law is very clear about punishment of a mohareb [execution]."

Today's Show of Support for the Regime? If you believe Peyke Iran, it wasn't much. The website reports that residents in Rasht ridiculed a demonstration of 300 plainclothes Basijis chanting slogans for the execution of reformists like Mir Hossein Mousavi, Mohammad Khatami, and Mehdi Karroubi.

1850 GMT: Javan Farda reports that Shiraz University was closed today.

1845 GMT: The Arrests Move Higher. Government forces have arrested Mir Hossein Mousavi's chief aide Alireza Beheshti. Beheshti, the son of one of Iran's most commemorated martyrs, Ayatollah Mohammad Beheshti, was also detained briefly in September when the regime tried to disrupt preparations for Qods Day demonstrations.

NEW Latest Iran Video: Today’s University Protest (29 December)
NEW Iran: A List of the Ashura Detainees
NEW Iran: The Regime's Fightback?
Latest Iran Video: Obama Condemns “Violent & Unjust Suppression” (28 December)
Iran: Ashura’s Message “Iranians Are Not Punching Bags” (Josh Shahryar)
Iran: A Point of No Return?
The Latest from Iran (28 December): The Regime’s Arresting Strategy

1830 GMT: The Karroubi Family Speaks Out (Cont.): Mehdi Karroubi's son Taghi has added to the criticisms by Karroubi's wife and son Hossein of regime restrictions on his father. He said that Government-provided security has stopped protecting Karroubi when he leaves the house. This is effectively a ''quasi-house arrest'.'

Karroubi's car was attacked on Saturday by assailants.

1815 GMT: Attacks on the Clerics. Ayatollah Sane'i now appears to be a primary target of the regime: assaults on his offices by plainclothes men have been reported in Tehran, Mashhad, Kerman, Sari, Gorgan, and Shiraz.

Attacks in Shiraz on the Qoba Mosque and the residence of Ayatollah Dastghaib have also been reported.

1730 GMT: "Western" Media and the Green Movement. A reporter from The Times of London has asked us to clarify our opening update (0710 GMT). While we mentioned the newspaper as part of "a chorus of affirmation that this opposition is on the point of victory", he/she wants to make clear that it should not be included in our preceding reference that "most of [the Western media] had written off the opposition only a month ago".

1720 GMT: The Elm-o-Sanat Protest. We've posted three clips from today's demonstration at Elm-o-Sanat University in Tehran. Gooya reports that more than 10 students were injured in clashes with security forces.

1650 GMT: Mahmoud Speaks. President Ahmadinejad has surfaced to comment on the Ashura protests: "The Iranian nation has seen a lot of such masquerades. A Zionist (Israeli), and American ordered [nauseating] masquerade."

1645 GMT: The Karroubi Family Protests. Back from a break to find that the family of Mehdi Karroubi striking out at Government restrictions. Karroubi's son Hossein has announced that his father is “partially imprisoned” because security personnel refuse to cooperate with him. Karroubi's wife Fatemeh writes that her family has been threatened by “nightly attacks of arbitrary forces” She says that she will hold the government responsible for any incident that may affect members of her family.

1225 GMT: Reading Iran from the US. We've just posted the analysis of Karim Sadjadpour and Trita Parsi of the Ashura protests on the Public Broadcasting Service.

1224 GMT: Reports that journalist Nasrin Vaziri, who works for ILNA and Khabar Online, has been arrested.

1214 GMT: Tehran's Prosecutor General Abbas Jafari Doulatabadi said that seven people were killed in Ashura clashes (which is kind of strange, since the official line on Monday was that 10 "terrorists" had been slain).

1210 GMT: Here Come the Guards. The Revolutionary Guard jump into the regime's fightback against the Ashura protests: "The...foreign media...has staged a psychological war. Trying to overthrow the system will reach nowhere...designers of the unrest will soon pay the cost of their insolence...The opposition, which has joined hands with the foreign media, is backed by foreign enemies."

1205 GMT: Only a matter of time before this "analysis" was attempted --- the editor of Kayhan, Hossein Shariatmardari, has accused Mir Hossein Mousavi of planning the assassination of his nephew.

1155 GMT: Report coming in that Reza Tajik, journalist and religious activist, was arrested today in front of the Etemaad newspaper Building. Photojournaist Sam Mahmoudi has also reportedly been arrested.

Another activist reports that Dr. Housein Mousavian, a member of the National Front, has been arrested.

1120 GMT: Did Trees Have to Die for This? A Mr Will Heaven seeks his 15 seconds of attention with this blotting of the pages of The Daily Telegraph, "Iran and Twitter". I have more important things to do, such as using Twitter as a portal to keep up with and report on the latest developments inside Iran, so let me respond Tweet-style:

@WillHeaven: U know nothing of #Twitter, #IranElection, or #Iran (& u rip off #Salon, who tried this shtick last week)

1115 GMT: We have posted a list of Ashura detainees, compiled by Tehran Bureau's Muhammad Sahimi last night before the latest reports of arrests.

1040 GMT: Arrest Them All. The latest detainees include journalist Mohammad Javad Saberi and Shahpour Kazemi, the brother of Mir Hossein Mousavi's wife Zahra Rahnavard. Kazemi was detained for months earlier in the crisis before his release in the autumn.

Journalists Badrosadat Mofidi, Nasrin Vaziri, and Keyvan Mehregan have also been detained.

1020 GMT: Ali Larijani --- No Compromise. Speaker of Parliament Larijani, commenting on the Ashura protests, has told lawmakers that officials should "arrest offenders of the religion and mete out harshest punishments to such anti-revolutionary figures with no mercy".

The rhetoric isn't significant: it matches that coming from pro-regime media and "hard-line" MPs (see 0850 GMT). The political symbolism is: Larijani --- who has clashed with President Ahmadinejad throughout this crisis and was reportedly involved in the discussion of a National Unity Plan ---is now declaring that confrontation takes priority over any attempt at a negotiated resolution.

And he is doing so even as the Supreme Leader (is Larijani serving here as a spokesman for Khamenei?) and Ahmadinejad remain publicly silent.

0850 GMT: "Cut Off Their Hands". Scattered hard-line noises out of Iran's Parliament. Mohammad Karamirad, a member of the National Security and Foreign Policy Committee, said that the committee will hold a special meeting on Wednesday to discuss the Ashura protests. Security officials from the Interior Ministry, the Intelligence Ministry, and the police will be invited.

Don't be fooled that this is an impartial enquiry into the demonstrations, however. Karamirad declared, "Rioters who took to streets are challenging the very foundations of the ruling system....They insult Islamic beliefs, and it is our duty to cut off the hands behind such seditious acts and bring an end to the events that endanger the safety and security of the people." He also called on Iran's judiciary to prosecute the leaders of the protests.

Hossein Sobhaninia, another member of the committee, joined that call. He said that events, in which the sanctities of Islam were disrespected and government officials were insulted, would not end if the judiciary did not deal with the seditious acts.

750 GMT: Which Way Forward? Following up on our snap 5-point analysis of the significance of the Ashura protests, an EA reader directs us to the thoughts of Ebrahim Nabavi in Rah-e-Sabz. Nabavi searches for a positive outcome to the conflict, advising the opposition to leave enough space for the regime to prevent a fierce confrontation.

0710 GMT: We begin this morning with a summary and analysis of the Government's attempt to restore some credibility through the rather crude tactic of arresting lots of people it does not like or trust. One of the latest names to emerge is Nushin Ebadi, the sister of the Nobel Prize laureate Shirin Ebadi.

Meanwhile, it is stunning how the Western media --- most of whom had written off the opposition only a month ago --- are now a chorus of affirmation that this opposition is on the point of victory. The Times of London proclaims "the tipping point of revolution". Abbas Milani in The Wall Street Journal announces "The Tipping Point in Iran". (Note to EA readers: if we ever use "tipping point" in an analysis, pull us aside for a journalistic flogging for the crime Resorting to Overused Cliche.) The Washington Post has the variant of "Iran's Turning Point". The New York Times offers support through an editorial denouncing "Iran's War on Its People".

The Latest from Iran (19 December): After the Mythical "Millions"

1735 GMT: Making Stuff Up - The Twitter Attack. There's not much to add to Austin Heap's guest analysis for Enduring America this morning. Instead, The New York Times shows the power of pointless speculation, backed up by lack of any knowledge of important context, in an article by their technology writers:

Beth Jones, a senior threat researcher at the Internet security firm Sophos, said the attack did not look very sophisticated and probably was not the effort of a Web terrorist or other professional. “It could have been any number of people doing it,” she said. Ms. Jones said the incident may have been “hacktivism,” an attack with a social or political motivation. “The point could purely be just to prove the site is insecure,” she said

Just gonna say this one more time: if this was just "hacktivism" unrelated to the Iran internal crisis, why did the attackers first go after one of the Green Movement's primary websites for news?

(For an analysis which is more useful, and a lot funnier, see Persian Umpire's interpretation.)

NEW Iran Analysis: RegimeFail?
NEW Iran Special: Austin Heap on “The Attack on Twitter”
Latest Iran Video: Mehdi Karroubi Interview with BBC (17 December)
Iran: The Regime Takes On (Hacks?) Twitter for Moharram
Iran Analysis: The Regime’s Sword Wavers
Iran on Moharram, Day 1: The Regime Flops?
The Latest from Iran (18 December): Moharram Begins
.
1730 GMT: Today's Foreign Enemies Will Kill All Iranians Warning. Let's hand over to Revolutionary Guard Lieutenant Commander Brigadier General Hossein Salami:

Enemies will not give up their devilish moves against the Iranian nation, they have brought their front to our streets and universities today and the battle is still on....Pointing to the enemy's nonstop strategy to confront the Islamic Republic, the commander noted, "These moves form a chain of profound global plot against the Iranian nation....If we do not practice the necessary vigilance, we could (be obliged to) play in the enemy's court.

Etc., etc., etc.

1345 GMT: Confirming Torture Deaths? Mehr News reports that the judicial section of the Armed Forces has concluded that three detainees in the now-closed Kahrizak Prison died from abuse and not from meningitis, as was originally claimed. The deaths cited are those of Mohsen Ruholamini (son of the advisor to Presidential candidate Mohsen Rezaei), Amir Javadifar, and Mohammad Kamrani.

In its investigation of alleged abuses, the panel has questioned 22 people and indicted 12, three of whom are involved in the Kahrizak cases.

1315 GMT: Hashemi, Join Us. In an interview in Mizan News, conducted before Friday's events, the son of Mehdi Karroubi, Hossein, was blunt: people expect former President Hashemi Rafsanjani to distance himself from the Government and join those asking for justice.

1310 GMT: Khatami's Latest Statement. The website supporting Mir Hossein Mousavi published a statement from former President Mohammad Khatami to faculty at Hamedan University, insisting on reform and respect for protest:

The Islamic system does not respect people’s votes, those who behave like this should not claim to be on the path of Imam Khomeini and the revolution....The policy that is accepted in Islam is a moral policy. If we commit the worst actions under the name of religion we cannot claim that we are in favour of religion.

1300 GMT: Did the Clerics-Rafsanjani Initiative Reach Khamenei? Remember our analysis of recent weeks about discussions between senior clerics and former President Hashemi Rafsanjani in a bid for "unity" between the Government and the opposition?

Well, eyebrows are raised over this item from the reformist website Rah-e-Sabz, which claims secret but futile meetings of high-ranking Tehran and Qom clerics with the Supreme Leader. The website adds that the clerics warned Khamenei that many of his religious supporters, and indeed members of the Revolutionary Guard and Basij militia, are now searching for another "marjah" (source of emulation) after the brutal suppression of protest. (hat-tip to EA reader "Arshama")

1250 GMT: It Just Isn't Going Well. A public sign of doubt after the mini-marches yesterday: an EA reader points out the complaints from a pro-regime website about the "meagre popular support for yesterday’s rallies" and the focus of slogans attacking the opposition, rather than praising Ayatollah Khomeini. (And the comments aren't much more hopeful, with plenty to say about the "lying government".)

1230 GMT: Oh, Mahmoud, You Do Say the Darnedest Things.... Normally I wouldn't bother with this, but it's a relatively slow news day and the statement is kind of funny for its brazenness:

Iran's president says he will soon write to the UN Secretary-General asking for his country to be compensated for World War II damages. "We will seek compensation for World War II damages. I have assigned a team to calculate the costs," Mahmoud Ahmadinejad said at a Friday press conference in the Danish capital.

"I will write a letter to the UN Secretary-General [Ban Ki-moon] asking for Iran to be compensated for the damages," he added, pointing out that such a move is necessary to ensure that justice was served. Ahmadinejad told the reporters that the countries that won the Second World War had inflicted a lot of damage on Iran by invading the country and using its resources.

The president added that while the former Soviet Union, the United States and Britain received compensation after the conflict, Iran had been given nothing to make up for the suffering its people had endured.

Dude, I don't want to rain on your rhetorical parade, but the UN Secretary-General has no authority to order reparations. You could try the UN Security Council, I guess, but as three of its permanent members are the US, Britain, and Russia....

(And forgive me for being provocative, but wasn't there a really costly war for Iran more recently than 1945? One with a neighbour that supposedly has a bit of money from the oilfields it is auctioning?)

1020 GMT: And if you're into the Iran-Iraq border incident that is not war, Reuters indicates that Iran is seeking a "diplomatic" resolution over the alleged 11-troop occupation of the oil well.

0950 GMT: On the Nuclear Front. In case you want a break from the internal battle in Iran, the latest from Tehran, at least in the form of Ali Akhbar Salehi, the head of the Atomic Energy Organization of Iran, is good-cop/bad-cop noises.

On Friday, Salehi said that about 6,000 of Iran's centrifuges were operational. That comment was jumped on by some media in the "West" and Israel as a sign of Iran's aggressive intention. In fact, it was far from that: Iran's chief enrichment plant at Natanz has 8000 centrifuges, so Salehi was admitting that, at most, Natanz was 75% effective. (The most recent report of the International Atomic Energy Agency said that half of the centrifuges were working.) Salehi added that Iran would not be adding extra capacity soon, with a new generation of centrifuges not ready until 2011 and the heavy-water plant at Arak still "three or four years" away from service.

Today, however, Salehi is taking a tougher stance, declaring that "the IAEA Board of Governors' resolution against Iran is ineffective" and there would be no halt in the construction of the second enrichment plant at Fordoo.

0920 GMT: We've posted a guest analysis by Austin Heap of yesterday's cyber-attack on Twitter by an Iranian group.

0755 GMT: Mousavi Defiance Behind Regime Threats? One intriguing story this morning: the reformist website Rah-e-Sabz claims that Iran's judiciary pressed Mir Hossein Mousavi to withhold or at least moderate any statement of support for protests on 16 Azar (7 December). Mousavi's refusal, and indeed his publication of a high-profile message to Iranian students, angered the authorities and led to the ominous threats of arrests and trials.

0745 GMT: A morning, and possibly a day, to relax and assess after the fizzling of the regime's attempt to show strength on Friday (see our  special analysis, "RegimeFail").

No sign yet of counter-moves by the opposition, either within or outside the establishment, and Western media are likely to be wandering around after the Iran "invasion of Iraq" story (we're still treating 11 Iranian soldiers raising a flag over an oil well as a political manoeuvre which will bring more politics, rather than confrontation) and whatever pops up on the nuclear front.

Iran Special: Austin Heap on "The Attack on Twitter"

Austin Heap, one of the most prominent activists on the Internet and Iran (see, for example, "The Haystack Project" to provide unfiltered Web access to Iranians), writes a guest blog for Enduring America on yesterday's diversion of Twitter users to the page of the "Iranian Cyber Army":

There were probably a few odd text messages whizzing around in San Francisco at 11 PM on Thursday night at a place called Dyn. It's a company that most people had not heard of, even though it powers websites such as Facebook, LinkedIn, Flickr, YouTube, and Vimeo. They even have a catchy motto: "Uptime is the Bottom Line". Now, however, a group calling itself the "Iranian Cyber Army" had hacked Dyn's servers and changed only a tiny line of text. The outcome was the "occupation" of Twitter, causing a two-hour outage of service for Tweeters around the world.

Iran: The Regime Takes On (Hacks?) Twitter for Moharram
The Latest from Iran (19 December): After the Mythical “Millions”

Dyn offers a service called managed DNS hosting. Essentially a yellow pages for the Internet, DNS translates lettered website names into an IP address, like phone numbers for computers. When you type in enduringamerica.com on your browser, a request is sent out to a DNS server. The DNS server responds to your browser and says, "enduringamerica.com's IP address is XX.XX.XX.XXX", then your browser "calls" that IP.

Twitter uses Dyn's managed DNS service, so when you visit Twitter's website, your browser first asks Dyn where to find Twitter. Instead of the request being pointed to the correct location, the hackers changed the program so Dyn would tell users around the world that Twitter was now hosted on a server in Provo, Utah, run by a company called Bluehost.

For a handful of frantic hours, when someone tried to reach Twitter's site, they were diverted to a page of the "Iranian Cyber Army". The cyber-warriors greeted them with a message in Arabic and Farsi, placed atop and on a green flag:

Peace be with you. Ya Hossein! If the leader orders us to, we will attack and if he wants us to, we will lose our heads. If he wants us to have patience and wait, we shall sit down and put up with it.

It's a bold move by a group about which people knew little if anything, even though "the Iranian Cyber Army" had pulled off the same manoeuvre days earlier with the prominent Green movement website Mowj-e-Sabz, which has now suspended publication.

The question remains: who are they --- cyber-renegades or a group affiliated with the Iranian regime? Octavia Nasr, CNN's senior editor for Middle East affairs, dramatically announced yesterday, "The hackers are definitely Shiites, as indicated by the 'Ya Hussein' chant printed on their banner." That, however, is far from a solving of the mystery, since the vast majority of Iranians are Shia.

On the surface, it seems unlikely that the Government of Iran would attack a private company in America and even less likely that they would post what amounts to a ransom note with a pretty graphic on it. Sure, government hacking goes on all the time, and the US has even been caught with its hands in some of Iran's most private servers, but that did not come to light until three years after it happened. The threat of exposure of regime responsibility for this incident, with its high-profile target, is much greater.

Meanwhile, the on-line enquiry continues. Given the enormous influx in traffic to their servers from millions of tweeters, one would have expect Bluehost to notice and fix the problem at lighting speed. When asked why they had not responded faster, while the hack was still underway, Bluehost declined to answer. They have since removed the account that was used to host the attackers' message. Twitter also declined to comment beyond their initial verification, which of course came in a Tweet --- their "DNS records were temporarily compromised".

UPDATE: From Bluehost: "Bluehost is a leading Web hosting company that provides services to nearly 2 million Web sites. Bluehost discovered that Twitter.com had been the victim of a DNS compromise and, further, that the attackers had redirected some of the Twitter traffic to an account hosted on Bluehost servers. This customer account on BlueHost was setup using a stolen identity and credit card, as determined by the Bluehost verification department. The Bluehost abuse department immediately terminated this account. Contact was made by Bluehost to law enforcement agents to assist in all ongoing investigations."

UPDATE2: The kind folks at Internet Identity passed along the DNS change records for twitter.com:

2009-12-17 22:01 (PST) 2009-12-18 06:01 UTC www.twitter.com, twitter.com A Records pointed to 74.217.128.160

2009-12-17 22:14 (PST) 2009-12-18 06:14:20 UTC
twitter.com A Records pointed to 69.59.28.85

2009-12-17 22:24 (PST) 2009-12-17 06:24 UTC
twitter.com A Records pointed to 66.147.242.88

2009-12-17 23:11 (PST) 2009-12-18 07:11 UTC
A Records corrected and pointing back to allowed range for resolution

As you can see, the attackers tried three different hosts before sticking with Bluehost. First it was NetFirms, then it was CaroNet, and finally Bluehost.

UPDATE3: From Twitter: "Domain Name System or DNS is an Internet protocol used to translate IP addresses into domain names so instead of typing in a long string of numbers we can enter urls like www.twitter.com into a browser to visit our favorite web sites. Last night, DNS settings for the Twitter web site were hijacked. From 9:46pm to 11pm PST, approximately 80% of Traffic to Twitter.com was redirected to other web sites. We tweeted, blogged, and updated our status page last night.

During the attack, we were in direct contact with our DNS provider, Dynect. We worked closely to reset our DNS as quickly as possible. The motive for this attack appears to have been focused on defacing our site, not aimed at users we don’t believe any accounts were compromised."

Today on EA - 18 December 2009

Iran: We're following the first day of the religious month of Moharram. After a slow start, state media claimed "millions" (live shots show thousands) in the streets of Tehran and across the country. We're not so sure: see our interim assessment of what appears to be disappointment for the regime.

We have Mehdi Karroubi's (rather disappointing) interview with BBC flagship current affairs programme Newsnight, broadcast last night.

We've got the latest on claims that Twitter was hacked by agents acting for the Iranian regime. Twitter continues to run slowly this morning.

President's Ahmadejad's travels abroad continue --- he's now in Copenhagen and his PR machine continues to "big him up" at every opportunity.

Afghanistan: EA's Julian Mercille analyses the politics and conflicts between Afghanistan's drug production and profits  and exposes the trail of drug money, involving not only the Taliban but also other Afghan groups, the US military and NATO forces.

Israel-Palestine: Ali Yenidunya assesses a move by Hamas to claim the "liberation" of all of Palestine, and he looks at an attempt by Israel and Turkey to repair relations.

As always, you can keep up with all the news, as it happens, on our live weblog.

Latest Iran Video: Interview of the “Basij Member” on the Election and Abuses (16 December)
Iran & The Arrest of Majid Tavakoli: “To Men Who Are Not Ashamed of Being a Woman” (Shirin Ebadi)
Latest Iran Video: The Larijani Threat to Arrest Green Leaders (16 December)
The Latest from Iran (17 December): An Uncertain Regime

Iran: The Regime Takes On (Hacks?) Twitter for Moharram

UPDATE 1320 GMT: HomyLafayette offers an important correction on the text used by the "Iranian Cyber Army" (see 0945 GMT): "The red text on the green flag in fact reads, 'O Hossein, peace be upon him,' referring to Imam Hossein, a key figure in Islam and the 3rd Imam of Shiites." It is Hossein's death that is commemorated in the month of Moharram that starts today.

UPDATE 1010 GMT: Twitter has posted, “Twitter’s DNS [Domain Name System] records were temporarily compromised but have now been fixed. We are looking into the underlying cause and will update with more information soon.”

UPDATE 0945 GMT: When FoxNews caught up with this story, they included this information:

"Above the flag, in Arabic, read: 'Hezbollah is victorious.' On the flag, in red Arabic writing: 'Yassin' (an Arabic name written in bold) then in smaller Arabic print 'the feast of peace'. Below the flag was more written in Farsi."



0755 GMT: We just found the screenshot of Twitter's website when it was "occupied" by the "Iranian Cyber Army". It is the same text and image that appeared on the Green Movement's website Mowj-e-Sabz on Wednesday.

I woke this morning to find that Twitter was running extremely slowly and sometimes grinding to a halt. Indeed, since 1200 GMT yesterday there have been serious slow-downs in delivery of messages.

Service is now picking up, but the hot story is that Twitter was hacked yesterday by the "Iranian Cyber Army" with this message:

THIS SITE HAS BEEN HACKED BY IRANIAN CYBER ARMY

iRANiAN.CYBER.ARMY@GMAIL.COM

U.S.A. Think They Controlling And Managing Internet By Their Access, But THey Don’t, We Control And Manage Internet By Our Power, So Do Not Try To Stimulation Iranian Peoples To….

NOW WHICH COUNTRY IN EMBARGO LIST? IRAN? USA?
WE PUSH THEM IN EMBARGO LIST 
Take Care.

Sharp-eyed EA readers will recognise that "Iranian Cyber Army" is the same group that took over the domain of the Green Movement's website Mowj-e-Sabz/Mowjcamp earlier this week.

The Latest from Iran (18 December): Moharram Begins

Yet, in this apparent victory for Iranian cyber-warfare, there lies I think a greater admission of defeat. If Twitter  has not been that important in the challenge to the regime's legitimacy since the Presidential election of June, why try to knock it out --- raising the ire of millions of users who so far have had little interest in the events in Iran --- at the start of Moharram? That seems more a confession of worry than an assertion of strength.

And it is one thing to take out an opposition website; another to try and still one of the most significant global shifts in the use of the Internet. For a few hours, yes, but for all of today? And the next day? And all the way to the likely mass protests on Ashura on 27 December?

So, if the Iranian Cyber Army did indeed take on and for, at least a moment, knock down Twitter....it may be time to look up the definition of "Pyrrhic victory".