Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

54 5. CYBER ATTACK AGAINST INTERNAL DISSIDENTS“Infrastructure Attack” part of this book (see Chapter 13). The Iranian elections saw widespreaduse of social media among dissidents—particularly Twitter and YouTube (the accessto Facebook is usually blocked by the government)—along with dissident-launched DDoSattacks against government run sites. 87 In this section, we briefly review some of the cyberattacks that occurred in the aftermath of the 2009 election. We will further examine a significantproregime Iranian hacker group known as the “Iranian Cyber Army” that startedgaining attention in 2010. Finally, we look at the Iranian government’s formal solution to dealwith problems arising from the cyberspace: the “Cyber Police.”The 2009 ElectionsThe 10th presidential election of the Islamic Republic of Iran was held in early June, 2009. Inthe election, incumbent President Mahmoud Ahmadinejad obtained over 60% of the popularvote—besting political rival Mir Hossein Moussavi. 88 Moussavi was a former Iranian PrimeMinister who adopted a “reformist” platform that included a willingness to negotiate with theUnited States. 89 Immediately following the election, Moussavi’s supporters took to the streetsin Tehran protesting the outcome of the election—claiming irregularities securedAhmadinejad’s victory. 90In the immediate aftermath of the election, Iran seemed to drop off the Internet. There weresix providers that connected the Iranian Internet to the rest of the world. All noted that communicationbetween the Islamic Republic and the rest of the world nearly stopped the dayafter the election. 91 It is unclear what caused the outage, but some suspect that the Iraniangovernment implemented deep-packet inspection (allowing extremely selective blockingof potentially subversive communication) of all traffic entering and exiting the country. 92Such a measure would slow traffic to a crawl. However, Iranian citizens were able to workaround the restrictions imposed by the regime through the use of various proxy servers, 93including software known as Squid and Tor 94 (Tor is discussed further in Chapter 7). Essentially,a proxy server acts as an intermediary that enables the communication between twocomputer networks.Able to work their way around potential government censorship, the Iranian protestorsembraced social media—particularly using Twitter—to provide updates about their situationto the outside world. 95 In the immediate aftermath of the elections, they were producing over100,000 Tweets a day relating to the protests. 96 The U.S. government was encouraged by theanti-Ahmadinejad demonstrations. The State department requested Twitter to postpone upgradesto its software during the time of the protest in order to ensure the communication ofthe dissidents. 97 Ahmadinejad’s supporters were also present on Twitter, but they were significantlyoutnumbered by the opposition. 98Another noteworthy use of the Internet by dissidents was YouTube. On June 20, 2009 apoliticalNeda Agha-Soltan was gunned down watching a street protest. A bystander recordedher fate on his phone and posted the video to YouTube. Neda soon became the symbol of thecause of Iranian dissidents around the world. 99,100 Supposedly, her killer was a member ofpro-government Basij militia. 101Basij-e Mostaz’afin (literally “Mobilization of the Oppressed”) is a force of currentlyestimated 400,000 loyalists, which was founded by Ayatollah Khomeini in 1979 (during