Cyberwar explodes in Syria

A familiar digital chime rang on the computer. Someone was calling via Skype from Syria.

It was a law student and opposition activist from the city of Homs who uses the pseudonym Musaab al Hussaini to protect himself from arrest. He had fresh reports that security forces were shooting guns wildly in the neighborhood Baba Amrr.

Hussaini was calling via Psiphon, an online encryption system he had just installed that morning. He said it protected him from detection by the Syrian security services, also known as mukhabarat.

“Yeah, I feel safe now, because I use software to get an encryption connection to the Internet,” Hussaini said. He said Psiphon also allowed him to circumvent government firewalls which block access to popular communications sites like Skype.

“If you want to open Skype in Syria today, we cannot, because its blocked. And if it was opened, we would be afraid of everything … of making a voice call. We are afraid to be recorded by the mukhabarat,” he said.

Psiphon is a surveillance-busting networking system designed by a Canadian company with funding from the U.S. State Department. The company’s CEO told CNN the software had been “aggressively” introduced to Syria just three weeks ago. Since then, thousands of people had begun using it.

“What we’re doing is not much different to what the airwaves provided during the Cold War to provide those citizens living behind the Iron Curtain with an ability to get information which otherwise they were not getting from their state,” said Rafal Rohozinski, CEO of two companies involved in developing Psiphon.

“Whereas shortwave radio during the Cold War was very unidirectional … with the Internet these technologies are by definition bidirectional, meaning that it gives an opportunity for citizens within these states to also communicate amongst themselves and with the outside world.”

For the past eight months, Syria has been locked in a bloody cycle of anti-regime protests and violent crackdown. The United Nations accuses government security forces of systematic torture, disappearances and the use of deadly force to crush dissent. More than 3,500 people have been killed since March. The UN’s top human rights monitoring commission has repeatedly accused the Syrian regime of carrying out crimes against humanity.

But this bloody test of wills is not only being fought in the streets. Activists, diplomats and IT specialists say there is also a high-stakes war of information being waged in cyberspace.

Since media are strictly controlled by the Syrian government, and foreign journalists are by and large prohibited from entering the country, the Internet has played a vital role for Syrian opposition activists smuggling out images of atrocities carried out by security forces.

“Regimes like that of (Syrian President) Bashar al-Assad know very well how access to information but also free expression and press freedom are a risk to him if he wants to continue to control all the power,” said Marietje Schaake, a Dutch member of the European Parliament who is an outspoken advocate for freedom of expression, particularly over the Internet.

“We’ve seen an enormous crackdown on people, but also through the information systems and communications tools that they are using, and that’s quite frightening,” Schaake said.

Some observers argue the Internet has become a battleground in an all-out Syrian cyberwar. One side in the conflict is even referred to as the Syrian electronic army.

On November 14, the European Union slapped sanctions against 18 Syrian individuals closely associated with the alleged abuses of the Damascus regime. Among those singled out to have their assets frozen were George Chaoui, Amar Ismael and Mujahed Ismail. The EU described each as a “member of (the) Syrian electronic army. Involved in the violent crackdown and call for violence against the civilian population against Syria.”

“The Syrian electronic army is basically a group of hackers built around the Syrian computer club which at one time was under the patronage of Bashar al-Assad. Its IP addresses indicate that it is collocated in facilities which belong to the Syrian government,” said Rohozinski of SecDev, who has worked closely with the University of Toronto’s Citizen Lab program documenting the Syrian conflict in cyberspace.

“They have been responsible for a number of high-level hacking attacks against a variety of targets including Syrian opposition movements,” he added.

The arsenal of IT weapons the Syrian government uses to control information apparently includes surveillance hardware and software developed by Western companies, as well as by American corporations that are barred by U.S. sanctions from selling such technology to Syria without first obtaining a license.

This month, the California-based Internet security companies NetAPP and Blue Coat announced they would cooperate with U.S. authorities, after a series of investigative reports by Citizen Lab and the Bloomberg news website revealed their web-monitoring products were being used by the Syrian government.

“We condemn the use of our storage by the Syrian government to repress it own people,” NetApp wrote in a statement on its website.

Blue Coat also confirmed that some of its ProxySG appliances were operating from IP addresses in Syria, saying they were “apparently transferred illegally to Syria.”

“We do not know who is using the appliances or exactly how they are being used,” Blue Coat announced on its corporate website this month. “Blue Coat is mindful of the violence in Syria and is saddened by the human suffering and loss of human life that may be the results of actions by a repressive regime. We don’t want our products to be used by the government of Syria or any other country embargoed by the United States.”

Subsequently, Citizen Lab, which is affiliated with the University of Toronto, said it had identified Blue Coat devices on four other IP addresses “belonging to the Syrian Communications Establishment.”

Meanwhile, the Italian company Area SpA, which works with law enforcement agencies to monitor telephone and Internet communications, and the German data encryption company Ultimaco have also issued statements announcing they were freezing their work in Syria.

In a series of articles, Bloomberg revealed Area had been contracted to install an electronic surveillance system in Damascus using products from NetAPP and Ultimaco.

In response, Area SpA’s CEO, Andrea Formenti, was quoted in Italy’s Corriere della Sera newspaper this month announcing that his company had no employees in Syria and that the project had not made any progress in the last two months.

“The interception system has never been activated and cannot be under current circumstances. There has been no repression carried out thanks to our equipment,” Formenti told Corriere della Sera.

“These technologies can be as effective as weapons,” argued Schaake, the European Parliament member. She has called for a broad inquiry into the role that information and technology companies are playing in countries like Syria.

“We cannot turn a blind eye to the serious human rights violations that happen with Western-made technologies,” Schaake said.

Schaake said activists have described being confronted during interrogations with Syrian security forces with detailed transcripts of their conversations, which are evidence of electronic eavesdropping.

And a Western diplomat stationed in Ankara, the Turkish capital, said on the eve of a planned Internet video conference between Syrian exiles in Turkey and dissidents in Syria, many of the Syrian participants were raided by security forces.

“The day before, the Syrian regime went in and killed ten of them and the whole thing fizzled out,” said the diplomat, who has been in close contact with the Syrian opposition. “If we would have had Psiphon then, I think we could have avoided that.”

The Syrian government clearly has far greater technological resources than the opposition. But the Syrian cyberwar is not a one-sided conflict.

Damascus accuses foreign governments, as well as international broadcasters like Al Jazeera, CNN and the BBC, of aiding and abetting “armed terrorist groups,” the term the Syrian government often uses to describe the opposition movement.

Syrian security forces recently announced they seized large numbers of police radio scanners and satellite phones, according to a report published by Syria’s state news agency, SANA.

Confiscated communication devices included “Thuraya satellite mobile phone sets which were used for satellite communication among the terrorists and those who work with them and between them and the misleading satellite TV channels,” SANA wrote.

SANA accused foreign governments of smuggling communication devices across borders and of strengthening cell phone signals to allow opposition members to roam on foreign phone networks as far as 50 kilometers into Syrian territory.

Last summer, as thousands of Syrians fled across the border to Turkey to escape Syrian security forces, some Syrian opposition members used Turkish 3G data connections to share images of terrified families camping in the countryside and of Syrian security forces shooting at civilians.

SANA also published photos of seized satellite technology it claimed was used by the Israeli and U.S. military.

“The existence of these devices in Syria indicates the clear involvement of these countries … to back the terrorists in Syria with advanced internet and communications systems,” SANA wrote.

While a growing number of Western and Arab governments have denounced the Syrian regime’s pattern of human rights abuses and held meetings with Syrian dissidents, so far none has admitted to supplying communication devices directly to the opposition.

However, the U.S. government has publicly declared it supports freedom of access to the Internet globally. Washington has also supported the development of encryption technologies for use in authoritarian countries, including Psiphon, which is now being used in Syria.

Psiphon creator Rohozinski said he and his company had been in direct contact with Syrian opposition activists to deliver the networking system.

Rohozinski said Psiphon establishes a private connection between a person’s phone or computer “to a part of the Internet cloud that makes it very difficult for the authorities to know where that person is going through. Moreover, it usually both encrypts and obfuscates that connection.”

Rohozinski said Psiphon is distributed through the discrete delivery of a link.

“It can be an SMS message, it can be an e-mail, it can be a link to a website that says ‘go here to get a secure tool,’” Rohozinski said. “They go there, and either that tool opens when they click on the link, or they download a small application which will run natively on their device and provide that kind of service.”

In Homs, activist Musaab al Husaini told CNN he had just shared Psiphon with two of his friends. Previously, he said, opposition groups had used several other similar systems to avoid authorities, the most well-known network probably being TOR.

Psiphon appeared faster and easier to use, Husaini said. Connectivity was essential, he added, because most of the activists were communicating across Syria and abroad via Facebook and Skype.

Despite the advantages offered by online social networking, demonstrators continued to risk life and limb protesting in the streets.

“My cousin has been arrested. There are more than five or six of my friends that have been killed,” Hussaini said. But the risks were worth the sacrifice, he said.

“We are fighting for freedom, for democracy, for dignity,” Hussaini concluded. He said goodbye, and the encrypted Skype call from Syria ended with a digital burble.

CNN’s Jill Dougherty and journalists Gul Tuysuz and Omar al Muqdad contributed to this report.