Comment by mehdix | Hacker News Reader

Comment by mehdix | Hacker News Reader

[IMPORTANT EDIT]: as stated numerous times in comments, this is fine. It is often done to protect victim's account from being further compromised by the adversary, for example for protecting their DMs, or collecting further material from their online activities. So, no need to try unsuspend his account. Thank you.

Jadi (Amirhossein Mirmirani) had 133K Twitter followers. He is a lovely computer geek and open source veteran from Tehran, Iran. He has been active educating youth for many years. He was arrested yesterday.

His account is suspended after his arrest, which is most probably due to fake reports from the cyber army. If you work at Twitter or Facebook, please help unsuspending his account which is vital for him to reach his audience and give him visibility, even when he is arrested. They want to remove his internet presence.

Profile screenshot: https://twitter.com/KavehMadani/status/1577695715131899904/p...

His Website in Persian: https://jadi.net

Instagram (suspended): https://www.instagram.com/jadijadinet/

My understanding is that when someone is arrested in Iran, other activists try to shut down that person's social media accounts in order to prevent Iranian authorities going through his/her profiles and gather more incriminating evidence against them. Isn't that what is happening here?

I don't think, if you want arrest somebody, you would crawl everything as a part of acquiring evidence before it.

I believe suspending their account also blocks access to private messages.

It would also prevent their account being used to access any private accounts they may follow.

The arrests are not premeditated. They arrest you first, then ask questions

How do they even know who to arrest if they supposedly collect evidence after the fact?

There is no due process in authoritarian states. Being suspected by someone on the police that you might hold subversive views is enough to get you arrested, tortured, and murdered.

Right, but as soon as they suspect someone they probably run tools like these. They can be ran faster than it takes to find someone and throw then in a van for sure.

If you are an authoritarian state you don't give too much worry about that, if you grab the wrong person "oh well another day another murder."

It's about terror and control, not about justice. If you think that's bad wait till you see what the Khmer Rogue did in Cambodia. The precious framework of individual rights, a relatively functioning justice system, and constitutional guarantees may not be perfect here in the US of A, there are issues, and those rights are still being eroded, and we have work to do, but people who draw comparisons between places like the US and China or Iran clearly have no idea what they are talking about, and it's a decent chance they may in fact be part of state sponsored psychological warfare apparatuses.

Do you have intimate knowledge of Iranian policing playbooks or intinate knowledge of Iranian activists playbooks or are you guessing?

I'm not sure why your being downvoted (or whatever it's called on here). It's a legitimate question. It looks like one person in here claims to have some amount of knowledge on the matter, but it would be good to get some kind of confirmation in either direction before endorsing one tactic, or another.

This is probably a very US-centric (or insert-your-country-here-centric) viewpoint that does not hold true everywhere else in the world. Even if it does, it would be idealistic to assume these things continue to hold true during moments of crisis for a state..

It's not idealistic, it's basic spycraft. Grab what you can before people know they need to hide it.

In some countries, you arrest people first, then find/manufacture evidence later.

we (activists) actually ask social media platforms to suspend the account and publicize it. to avoid the activist being tortured to extract passwords. twitter is doing the right thing

So actually trying to “help” by getting Twitter to reverse the suspension, may actually be the worst thing you can do to him and his fellow activists.

Yet another example of how good intentions aren’t enough. You need to fully understand the situation before you act, especially when dealing with a situation that is different from what you are familiar with.

Good comment that should be on the top. Like another comment said, the suspension might even be to protect him.

The thing is we don‘t know either way.

Yes, I stand corrected. I can't edit my top-level comment, otherwise I would have added an explanation.

Yes, this most like is what happened, linked to a news source here to independently support this:

https://news.ycombinator.com/item?id=33106622

This stinks of false-flag psyops.

A guy is quietly abducted by an authoritarian regime.

Naturally, the smart response would be for "activists" to "help" him by erasing all public record of his existence.

Please feel free to provide evidence of how deleting the accounts has made anyone less safe.

Folks use Twitter for tweets and for DMs. I have no knowledge here but this could be an attempt to remove all private messages.

I did not know this. It is fine, then. Also another comment mentions blocking access to DMs, which makes sense.

I was unable to edit my top-level comment, otherwise I would have added an explanation. Thanks.

maybe @dang can help with this. it's an urgent situation

I wrote him to edit the top-level comment. Thanks.

Just paving the road with some good intentions.

It may be a good idea to flag this entire submission until some other action can be taken. It's not great to have all of this discussion about social profile circumvention in the open IMO.

I'm doing my part!

Activists are apparently unfamiliar with how the internet works: [web archive link redacted]

Hopefully the authorities in Iran are similarly ignorant

I think the authorities are stupider than what you think.

When they arrest someone in a demonstration, they will confiscate their phone and open the apps on the device. If the account is inactive, they can not see anything.

May I ask you to delete your comment if that is not a problem? You basically gave the regime an evidence we said the activists are trying to hide away.

If I was kidnapped, beaten and probably in a mass grave don't you dare take down what I said that put me in that position. (Frankly we may be in that spot sooner than you think in the US) That's exactly what the regime wants, to shut him up. He gave his freedom at a minimum, probably his life to say what he said, the least we can do is listen to him.

The suspension is temporary. Presumably when the person is released, Twitter will reinstate the account. The other reason for suspension is to not compromise DMs and followers. But I also understand your point of view in not wanting to delete it.

So in this hypothetical scenario they don't know about the Internet Archive but they do happen to browse Hacker News? This probably isn't their first rodeo. I'm sure they're aware of the archives that exist.

No that hypothetical scenario can't be right. I understand the reasoning behind why not wanting to delete the comment.

I've redacted the link from the parent comment because we got emails suggesting that it might put someone at risk. We can eventually add it back later if that would be helpful—but I think the comment makes the point either way.

That sounds stupid. Iran is an official government agency, they can just ask twitter or some ally like UAE or China to hand over all the information in a form a lot easier for searching through than logging into their account.

What evidence do you have that Twitter will comply with a request like that from Iran? Even when redirected via a government that doesn't have anything to do with the account?

Twitter hired KSA spies that helped kill Jamal Khashoggi. Twitter "compliance" is irrelevant because they have no internal data security.

They have to follow the laws of the countries they operate in. Keep in mind that business operations and server locations (and incorporation locations) are not the same thing.

If you serve customers in another country, their laws apply. You can either follow the law or not serve in that country. This is pretty much how it has worked forever.

This is obviously not great if you have a set of less-restrictive and more-restrictive laws that contradict each other. And it's not great if values, politics and rights in general aren't compatible. As much as we can disagree with what mass-murdering authoritarian regimes are up to, unless we go to war (after we have already applied all the sanctions we can think of) there isn't much you can do about it.

I don't think any company officially operates in Iran due to sanctions. In any case, Twitter isn't going to comply with a sanctioned country's requests, especially ones for censorship.

Yet they did? Also might not be a case of "scary sanctions" but "don't want more cyberattacks".

So practically speaking, what will happen if Twitter ignores Iranian law and allows IPs from that country to use their platform anyway? I don't think the US govt will enforce Iranian law for them...

The consequence within Iran is Twitter will be sanctioned if they ever attempt to create and operate a legal entity there. So who cares, right?

More like the IRG doing cybers on you. Iran doesn't have much leverage besides that.

As for who might care: twitter might. They may have to spend more money on defence, on screening people when hiring them, and on legal to make sure they aren't getting sued in the US for discrimination, data leaks or whatever else people might come up with if they keep (accidentally) hiring foreign intelligence officers without checking who they are.

Attacks on their digital infrastructure, either remotely or by getting their agents hired.

> They have to follow the laws of the countries they operate in. Keep in mind that business operations and server locations (and incorporation locations) are not the same thing. > If you serve customers in another country, their laws apply. You can either follow the law or not serve in that country. This is pretty much how it has worked forever.

You are right.

Now, Twitter is free to not follow this law and expect consequences: a law suit from Iran, or retaliation towards Twitter operations on Iranian ground.

Or cyberattacks and getting their agents hired by twitter.

The paradigm you're describing is only a convenient fiction for countries that have made treaties with each other to create such environment. It's prevalence has more to do with the fact there's really only three and a half major sovereign bases of power in the world (soon to be two and a half), than the actual physical reality. The actual physical reality is that communication over borders doesn't violate the Schelling point of borders (ie it's not an act of war), hence Radio Free Europe etc.

Unless you can point to a treaty between the US and Iran that lets Iran sue US companies, or some other way that Iran can actually enforce a judgement on Twitter, then no, Twitter has no need to respect Iran's laws. About the only way I see is for Iran to firewall Twitter wholesale, but isn't the wholesale end-user Internet shutdown basically doing that?

You don't need a lawsuit if you're Iran, you just use your APTs to perform cyberattacks on US-hospitals and send your Iranan secret agents to work at Twitter and do your bidding from the inside out. Both have happened and are happening.

This isn't really a "but it's the law!"-case, it's a country A wants something, and they might use whatever they have to get it. The US has sanctions, but Iran doesn't except maybe oil production, but there are other places where you can get oil. So if Iran has nothing they can deny anyone else, they resort to attacks.

So when Iran says "do this because it is our law", you might not do it because you are interested in their laws nor do you have to follow them (legally), but you might not want the expense of being targeted by them.

Isn't that the exact opposite of what you said above? "If you serve customers in another country, their laws apply. You can either follow the law or not serve in that country." That would seem to imply some overarching legal enforcement regime, rather than law of the jungle.

As to the law of the jungle, if embedded Iranian agents have enough power to do anything to Twitter, then the right framing is that Twitter has a massive security problem. Also it would be foolish of Iran to burn such resources on damaging Twitter rather than continuing to silently exfiltrate data that interests them.

If Iran performs arbitrary attacks on hospitals in "retaliation" for Twitter's actions, then that still doesn't affect Twitter. And similarly, that's best framed as said hospitals having abysmal security, rather than focusing blame on Iran. The Internet is hostile noise.

> That would seem to imply some overarching legal enforcement regime, rather than law of the jungle.

No, it implies that if you respect the laws of the countries the people you serve reside in, you can choose to follow the law by not serving them, and therefore not having to "do what they say", or serve them, but then by their laws "do what they say".

Regarding effects on Twitter: it costs them money. Their share prices drop and jo-jo a ton when stuff like this gets out. Legally, not much effects twitter, it's not a person after all, and legal departments weasel their way around plenty to make sure a company keeps existing and keeps making money. If it's cheaper to censor some random person on your private platform then compared against shoring up your cyber defences, that's an easy choice for the people in charge with somewhat cartoonish dollar signs in their eyes.

The reality is that nothing is truly isolated from side-effects and circumstances in the world. Even if there are no diplomatic ties, and no physical violence, it's all happening on the same globe with the same internet. So ignoring laws is not always the cheapest way to deal with countries, and not dealing with countries is generally not an option when you're connected online.

> it implies that if you respect the laws of the countries the people you serve reside in, you can choose to follow the law by not serving them, and therefore not having to "do what they say", or serve them, but then by their laws "do what they say".

This is only a real dichotomy if there is a legal enforcement regime forcing one to choose.

You're substituting a few handwavey indirections to profit-based incentives. While partially true, this mainly functions to absolve Twitter from not taking a more principled stand - the same argument could be made if they started doing more deplorable things with user data.

So sure, the stock market is fickle and irrational, like every herd. But the fundamental analysis for Iran being able to attack Twitter is that Twitter has poor security, period. I'd rather focus on the real problem than merely shoot today's messenger.

So are you claiming that Twitter has an office in Iran? It's been some years since I worked for Twitter, but as far as I know they do not operate in Iran except to the extent which their services are available to anybody with an IP.

This makes no sense. When governments go after their targets, they gather all they can as soon as they define them as targets.

Twitter, on the other hand, is known to be a massive censor, just like Youtube/Google.

The Iran situation is in a lot of flux, so while that may be possible when being methodical about one person, it is less so if you are trying to rapidly detain hundreds or thousands per day.

They probably have a script that creates an archive of all social media posts. Not hard to do. As soon as you have a name to point it to you can run this sort of tool.

You would think the regime already did this before the arrest

> His account is suspended after his arrest, which is most probably due to fake reports from the cyber army

If this is actually the case, then the reporting system is incredibly broken.

It's not like commonly targeted groups have been saying this for years or anything, though.

Telling that the personal website is the most resistant. Interesting idea that social media accounts could be taken down by good actors as a form of damage control.

Probably for the best until at least when/if he's released.

Reply on news.ycombinator.com