Iran Super Thread- Merged

[GAP]

I agree.....the article is pap, pure and simple. It actually sounds like it's offering an excuse for Obama to not have to make a decision in an election year.

 

[a_majoor]

This intelligence report seems to be designed more to support a political faction than anything else. After all, the intelligence community had been reporting on Iranian progress towards making nuclear weapons on a regular basis, then abruptly swept the rug out from under President George W Bush by relaseing a very similar assessment that Iran was not working on nuclear weapons.

If there had been an honest mistake, then the next several years would not have seen a "return to normal" reporting of enhanced Iranian nuclear activity, essentially redacting the report without ever saying so.

Common sense argues against this report as well; revelations of new facilities like the deeply buried Fordo enrichment plant and Iran test launching rockets capable of reaching targets in Europe really don't square with the idea that Iran is neither close to developing a bomb, nor wants one. from a technical POV, while enriching Uranium is perhaps difficut and time consuming, building a Uranium powered "gun" bomb is actually quite simple. Once they have the enriched material, the time to actually manufacture a crude bomb is quite short (you could use a simple piece of pipe as the positive saftey and a Mickey Mouse watch as the timing device), even a sophisticated weapon that can fit on a missile isn't too much farther away.

 

[The Bread Guy]

A decent overview of the latest from the Congressional Research Service (52 pg. PDF) - this from the summary (carefully caveated at the end):

Several published reports indicate that top Israeli decision makers now are seriously considering whether to order a military strike on Iran’s nuclear facilities, and if so, when.  Twice in Israel’s history, it has conducted air strikes aimed at halting or delaying what Israeli policymakers believed to be efforts to acquire nuclear weapons by a Middle Eastern state—destroying Iraq’s Osirak reactor in 1981 and a facility the Israelis identified as a reactor under construction in Syria in 2007. Today, Israeli officials generally view the prospect of a nuclear-armed Iran as an unacceptable threat to Israeli security—with some viewing it as an existential threat.

This report analyzes key factors that may influence current Israeli political decisions relating to a possible strike on Iranian nuclear facilities. These include, but are not limited to, the views of and relationships among Israeli leaders; the views of the Israeli public; U.S., regional, and international stances and responses as perceived and anticipated by Israel; Israeli estimates of the potential effectiveness and risks of a possible strike; and responses Israeli leaders anticipate from Iran and Iranian-allied actors—including Hezbollah and Hamas—regionally and internationally.

For Congress, the potential impact—short- and long-term—of an Israeli decision regarding Iran and its implementation is a critical issue of concern. By all accounts, such an attack could have considerable regional and global security, political, and economic repercussions, not least for the United States, Israel, and their bilateral relationship. It is unclear what the ultimate effect of a strike would be on the likelihood of Iran acquiring nuclear weapons. The current Israeli government, President Barack Obama, and many Members of Congress have shared concerns about Iran’s nuclear program. They appear to have a range of views on how best to address those shared concerns. Iran maintains that its nuclear program is solely for peaceful, civilian energy purposes, and U.S. intelligence assessments say that Iran has not made a decision to build nuclear weapons. However, Iran continues to enrich uranium in militarily hardened sites and questions remain about its nuclear weapons capabilities and intentions.

Short- and long-term questions for Members of Congress to consider regarding a possible Israeli decision to strike Iranian nuclear facilities militarily might include, but are not limited to, the following:

• How might an Israeli strike affect options and debate regarding short-term and long-term U.S. relations and security cooperation with, and foreign assistance to, Israel and other regional countries?
• Would an Israeli strike be considered self-defense? Why or why not? What would be the legal and policy implications either way?
• How might a strike affect the implementation of existing sanctions legislation on Iran or options and debate over new legislation on the subject?
• How might Congress consult with the Obama Administration on and provide oversight with respect to various political and military options?

This report has many aspects that are the subject of vigorous debate and remain fully or partially outside public knowledge. CRS does not claim to independently confirm any sources cited within this report that attribute specific positions or views to various U.S. and Israeli officials.

 

[57Chevy]

According to these articles shared with provisions of The Copyright Act,
sanctions seem to be taking their toll, or are they ?

Iran Sanctions Fuel 'Junk for Oil' Barter With China, India
Bloomberg News Friday, March 30, 2012
http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2012/03/30/bloomberg_articlesM1L1AA0D9L3501-M1PDP.DTL

March 30 (Bloomberg) -- Iran and its leading oil buyers, China and India, are finding ways to skirt U.S. and European Union financial sanctions on the Islamic republic by agreeing to trade oil for local currencies and goods including wheat, soybean meal and consumer products.

India, the second-biggest importer of Iran's oil, has set up a rupee account at a state-owned bank to settle as much as much as 45 percent of its bill, according to Indian officials. China, Iran's largest oil customer, already settles some of its oil debts through barter, Mahmoud Bahmani, Iran's central bank governor, said Feb. 28. Iran also has sought to trade oil for wheat from Pakistan and Russia, according to media reports from the two countries.

The trend is growing, sanctions specialists and U.S. officials say, and is denying the Islamic Republic hard currency to prop up the plummeting value of the rial and to fund nuclear and missile programs. Iran already is starved for dollars and euros to support the rial, and barter deals will force it to spend billions of dollars of oil revenue on goods, according to Kenneth Katzman at the Congressional Research Service, a nonpartisan government-research institute in Washington.

"Iran cannot stabilize the value of its currency with such unorthodox payment methods, and that is why its economy is collapsing," Katzman, an Iran sanctions specialist, said in an interview. "Iran is essentially on a junk-for-oil program."

more at link...
                          ____________________________________________________

Kuala Lumpur seizes suitcases of counterfeit US dollars traced to Iran
DEBKAfile Special Report March 28, 2012
http://www.debka.com/article/21868/

Two suitcases crammed with counterfeit $100 bills were seized in Kuala Lumpur this week from two Iranian traders who flew in to the Malaysian capital on direct flights from Tehran. One contained 153,000 forged dollars and the second 203,000. The traders claimed they were issued the bills by tellers at the Iranian central bank CBI to finance their business transactions and had no notion they had not been dealt genuine greenbacks.

debkafile’s sources report that alert local businessmen spotted the fake currency despite its quality workmanship when they used it to pay for their purchases.
According to a Malaysian source, the bills were finely printed on special paper. The initial investigation identified the paper as made in China especially for use in printing currency and a supply recently reached Iran.
Malaysian authorities have not identified the Iranian traders who were taken in custody except by their initials – H.M. and A. G.

Kuala Lumpur finds itself in the middle of an international scandal developing around the affair and involving the US, China and Iran. The Iranian embassy is leaning hard on the government to keep it hushed up, threatening to cut off commercial ties if the story is made public, or if the two traders are forced to stay in the country until the legal proceedings take their course.

Tehran fears the embarrassment attending disclosure of its suspected traffic in counterfeit US currency as the April 13 date approaches for important nuclear negotiations with the six world powers. Iran would find itself badly compromised on world financial markets on top of the difficulties it already faces as a result of the tough international financial sanctions clamped down by America and Europe.

debkafile’s intelligence sources disclose that American undercover agents are in Malaysia trying to get hold of some of the fake bills on order to have them tested in their US laboratories for clues to their provenance. They could then be compared with other forged $100 bills seized last year in several Middle Eastern countries.

Comparison with fake bills impounded recently in Iraq, for example, or in the Persian Gulf countries, might shed light on dark corners of Iran’s industry for the counterfeiting and circulation of American dollars and establish whether it is run by criminal mafias or clandestine elements tied to the Revolutionary Guards Corps.

Chinese secret agents have also arrived to track the paper’s trail to Iran The special paper used for the dollar bills seized in Kuala Lumpur is exported from China only under special license..

Evidence that the Islamic regime of Iran was responsible for the wholesale forgery of the emblematic American dollar would have harsh consequences. Washington would not pull its punches and would convince a widening circle of world governments to step up sanctions against Tehran for the crime of undermining international currency.

Since the international money transfer firm SWIFT severed its ties with most of Iran’s banks, the traders have had to travel abroad in person carrying suitcases full of cash for contracting their business operations.

Five months ago, Western intelligence circles issued a warning that Iran would try and overcome the shortage of available foreign currency reserves caused by sanctions by printing counterfeit $100 bills.

In 2010, when US forces were still present in Iraq, they captured several million American dollars suspected to have been forged in Iran and smuggled into Iraq.
In 2010, the US Federal Reserve Board had a new $100 bill designed to defeat counterfeiters. Its release was delayed by printing defects.

 

[Pelliparius]

Fairly interesting article from Chatham House. 
http://www.chathamhouse.org/sites/default/files/public/The%20World%20Today/2012/april/0412lewis.pdf

Another from aviationweek concerning Syria's strategic importance to Iran and Russia's role in upgrading their defense systems.
http://www.aviationweek.com/aw/generic/story_channel.jsp?channel=defense&id=news/awst/2012/03/05/AW_03_05_2012_p28-431083.xml

 

[Kirkhill]

I didn't know where to put this.  It could go under Iran, China, India or Afghanistan.  This was the best that my poker dice could come up with.

Looking at the first map below, from the Washington Post, drove home to me the strategic imperatives of the region and the rationales for the discussions about the Russian/British Great Game, the Afghanistan Oil Pipeline, the Chinese support of Pakistan and in particular the Gwadar harbour. 

It also suggested to me a geopolitical strategy that Canada could/should support.

Iran, as ancient as it is, is a nation of indigenous peoples that have been subsumed over the millenia by a variety of horse oriented cultures originating in the steppes now largely identified with Russia but actually also held by Kazakhstan, Uzbekistan, Kyrgyzstan and Tajikistan, not to mention Mongolia and Xinjiang Province. 

Those horsemen dominated the interior of the country but became progressively less effective as the terrain moved to the mountains and to the seas.  Consequently the borders of Iran are very ragged.  By this I mean that, for example, in the North West Iran couldn't dominate the Anatolian mountains any more than their northern brethren the Turks could.  Consequently they had to settle for accepting a situation that left in place a border community that survived like many other borderers, on the fault lines.  For the Iranians, Syrians and Turks this problem community is the Kurds.

The Iranians have an identical problem in the South East.  The community down there is the Balochi.  There the problem is shared by Pakistan.  It is in Pakistani Balochistan that China is buiding the port at Gwadar.  That is the port that Russia always wanted, probably still does, and which Britain struggled so hard to deny Russia.  It is also the reason that Iranian horsemen and Afghan hillmen have fought so often over the millenia. 

That harbour would allow whoever owns it to do an end run around the choke point known as the Straits of Hormuz and permit direct access to the Indian Ocean via the Gulf of Oman.  Oman and the Balochis have a shared history.  They are both sea going peoples.  The Balochis supplied many of the Lascars that kept the old British merchant steam fleet going.  The Arabs and Iranians both have had hates on for them because traditionally they kept them bottled up on the back side of Hormuz.  The British exploited this from the late 18th century by co-opting the Omani control of the Indian Ocean using various carrots and sticks to keep the Omanis on side.

All this background is to support the basic suggestion.

In Northern Iran the west (US and UK) supported the rise of an identifiable Kurdish polity under an enforced No Fly zone.  That polity has gained some autonomy within Iraq and is considered a threat to the governments of Iraq, Iran, Turkey and Syria.  For a variety of reasons I can see that state being supported by Turkey and a Post-Assad Syria, as well as various western states and Israel.  Turkey, I think, could be convinced of the value of a Kurdish buffer state between it and the Arabs.  This would/could reduce their expenditures on trying to keep the Kurds under control.  It would be cheaper to have them on side. 

The No-Fly policy has also been effective in the Libyan context.

It could be argued that the Post 9/11 strategy in Afghanistan was an extension of the same strategy. Western domination of the skies permitted indigenous forces freedom of movement, so long as they moved in directions approved by the Flyers.

In the case of Libya Canada has asserted the Canadian sponsored, UN-sanctioned policy of R2P or "Right to Protect".  This is the same policy that is anathema to Russia, China and all other non-democratic governments.

Suggestion:

Canada, under the auspices of R2P, should join with India (a rising trading partner) and the West (US, UK, France) in supporting the Independent Balochistan Movement and agitate for the establishment of a No-Fly Zone over Baluchistan.  It could be supported from land bases in Oman and India as well as from Carriers in the Gulf of Oman.

There might be a bit of pushback from the Pakistanis, Iranians, Chinese and Russians, and the fact that 3 out of the 4, and possibly 4 out of 4, have nukes does present a complication or two.

More broadly:

It appears to me to be in Canada's interest to continue to act on the world scene in support of small, independent nation-states loosely associated by trade agreements (as they appear to be doing in Asia).  Supplying those small nation-states the freedom to act independently can be achieved by the use of free trade agreements, diplomatic pressure and contributing to multi-national efforts like No-Fly Zones and "Anti-Piracy" Patrols.

In that context a strong expeditionary Navy and Air Force makes sense, and I would argue, assists in justifying the purchase of the F-35 to be able to operate in "non-permissive" environments.

(As an aside, in my opinion, it would also be in Canada's interest to use its free trade negotiations with the EU to promote the "Anglo-Saxon" or Viking vision of the EU as a free-trade association and not another attempt to establish an empire.)

The effect of this particular strategy in the Iran/Afghan/Pakistan context would be to establish a Pro-Trade (not necessarily a Pro-Western) government on the north shore of the Gulf of Oman which would reduce Iran's influence on the Straits of Hormuz, reduce the geo-political importance of Pakistan, take the pressure off of Indo-Pakistani-Chinese relations with Pakistan being, and eliminate the isolation of Afghanistan, permitting the government of Afghanistan more flexibility in dealing with internal problems because of less outside interference.

Where many of the players in the game, especially China, Russia, Iran and the EU, are hard-wired to solve problems by exerting  dominating force and centralized control, the "Anglo-Saxon" vision of loose association should be more appealing to many people around the world.

Canada can and should support that vision.  Not to impose democracy at the local level, but to give the locals breathing room to make their own choices (and mistakes).

The Balochistan map is from the Wikipedia article on Balochistan
The Kurdistan map is from this site

 

[Old Sweat]

This link is to a long and rather pessimistic - but plausible - look at the probability of war in the Middle East. Read 'er and weep.

http://fullcomment.nationalpost.com/2012/04/07/goodspeed-analysis-middle-east-could-collapse-into-full-conflict-if-international-talks-fail-next-week/

 

[Edward Campbell]

This link is to a long and rather pessimistic - but plausible - look at the probability of war in the Middle East. Read 'er and weep.

http://fullcomment.nationalpost.com/2012/04/07/goodspeed-analysis-middle-east-could-collapse-into-full-conflict-if-international-talks-fail-next-week/

I find the scenario very plausible; I think Col (ret'd) Sam Gardner is right: when Israel perceives its very existence to be threatened it will strike, boldly, massively, over great distances and without regard to America's wishes or Russia's posturing.

 

[a_majoor]

There are so many pieces on the board that shifting one piece (such as the projected Israeli attack on Iran) could set off multiple reactions and realignments in the region.

On the top tier is the ancient antagonism between the Shia and Sunni Muslims.
Next level is the three traditional Imperial powers of the region all flexing their muscles at roughly the same time: Turkey, Egypt and Iran. Ancient ethnic rivalries also underlie the regional conflicts
Below that are the shifting religious, tribal and ethnic sub groups, including Christians, Kurds and a host of other, smaller distinct groupings. (This is the level Kirkhill was talking about, and many of these peoples were exploited by one or more of the major Imperial Powers in the past. Courting them to make trouble for the rival empires or at least working for the minorities to remain neutral is probably going to be the major effort by the would be hegemons in the coming decades).

Since their economies are small and not very diversified, and the numbers of trained and skilled personell are limited, the shiny modern weapons systems they have bought over the years won't last too long. We will probably see battlefields and butchery rivaling the First World War as the various factions start taking up arms. Iranian human wave attacks during the Iran-Iraq war are probably a foretaste of the coming wars in the next decades.

Now intervening on the side of smaller nations and ethnic minorities might be an inexpensive way of preventing any single power from gaining outright victory, but in the larger sense use of the upcoming American "oil weapon" and collapsing the demand and price of Middle Eastern Oil will do a lot to contain the battles to the region and preventing it from spreading too far beyond.

 

[Trick]

http://www.bbc.co.uk/news/world-middle-east-17716241

"Iran nuclear talks in Istanbul 'constructive'"

Seemingly good news from the initial talks. That said, neither party would have anything to gain by taking a belligerent stance at the talks, so take the superficial optimism with a grain of salt. All the smiles and hand-shakes in the world don't really change the fact that unless actual actions are taken soon, the government of Israel is likely to act on its own.

 

[GAP]

Latest cyberattack on Iran targets oil export facilities

Computer servers at the government oil ministry and the National Iranian Oil Co. are the apparent target of a cyberattack via a data-deleting virus, Iranian officials have acknowledged. Previous attacks struck at Iran's nuclear program.

By Mark Clayton, Staff writer / April 23, 2012
Article Link

Iran's oil export facilities are the apparent target of computer malware, an attack that penetrated computer servers at both the government oil ministry and the National Iranian Oil Co.

The cyberattack – one of several Iran has endured over the past few years – comes as Iran and an international coalition of six nations, including the US, prepare for more talks next month over the extent of Iran's nuclear ambitions. To put pressure on Iran to cooperate with efforts to verify the scope of its nuclear program, the United States has been discouraging the international community from buying Iranian oil.

Initial reports from Iran are that a computer virus, dubbed "Viper," wiped data from the targeted servers.

Alireza Nikzad, a spokesman for Iran's oil ministry, told the Fars news agency, which has ties to the government, that Sunday's attack was a "virus" that "attempted to delete data on oil ministry servers." Another Iranian news agency cited Mr. Nikzad as identifying the virus as Viper.

"This cyberattack has not damaged the main data of the oil ministry and the National Iranian Oil Company (NIOC) since the general servers are separate from the main servers; even their cables are not linked to each other and are not linked to Internet service," Nikzad said in the reports. "We have a backup from all our main or secondary data, and there is no problem in this regard."

But in another statement posted on the oil ministry's news website, SHANA, Nikzad said the virus did indeed wipe some data from official servers – but with limited damage, Agence France Presse reported.

"To say that no data was harmed is not right. Only data related to some of the users have been compromised," Nikzad said, according to AFP. Websites of the Iranian oil ministry and NIOC were also knocked offline, reports said.

Authorities told Iranian news agencies that oil exports were not disrupted. At least 80 percent of Iranian oil is shipped from Kharg Island, the nation's big export terminal.

The cyberattack on Iran's oil facilities could be perpetrated by a nation sending Iran a not-too-subtle message: Start negotiating with the international community over your nuclear weapons program or lose the ability to export oil, say some US cyberwarfare experts. Or, it could be the work of a lone hacker taking a digital potshot.

Either way, Iran is expected to take the attack seriously, these experts say.
More on link

 

[a_majoor]

More conventional sticks are being assembled in the region as well:

http://www.wired.com/dangerroom/2012/04/armada-masses-near-iran/

U.S. Amasses Stealth-Jet Armada Near Iran

    By David Axe
    Email Author
    April 27, 2012 |
    9:42 am |
    Categories: Air Force

The U.S. Air Force is quietly assembling the world’s most powerful air-to-air fighting team at bases near Iran. Stealthy F-22 Raptors on their first front-line deployment have joined a potent mix of active-duty and Air National Guard F-15 Eagles, including some fitted with the latest advanced radars. The Raptor-Eagle team has been honing special tactics for clearing the air of Iranian fighters in the event of war.

The fighters join a growing naval armada that includes Navy carriers, submarines, cruisers and destroyers plus patrol boats and minesweepers enhanced with the latest close-in weaponry.

It’s been years since the Air Force has maintained a significant dogfighting presence in the Middle East. During the 2003 invasion of Iraq Boeing-made F-15Cs flew air patrols from Saudi Arabia, but the Iraqi air force put up no resistance and the Eagle squadrons soon departed. For the next nine years Air Force deployments to the Middle East were handled by ground-attack planes such as A-10s, F-16s and twin-seat F-15E Strike Eagles.

The 1980s-vintage F-15Cs, plagued by structural problems, stayed home in the U.S. and Japan. The brand-new F-22s, built by Lockheed Martin, suffered their own mechanical and safety problems. When they ventured from their home bases in Virginia, Alaska and New Mexico, it was only for short training exercises over the Pacific. The F-15Cs and F-22s sat out last year’s Libya war.

The Air Force fixed the F-15s and partially patched up the F-22s just in time for the escalating stand-off over Iran’s suspected nuclear weapons program. In March the Air Force deployed the Massachusetts Air National Guard’s 104th Fighter Wing, flying 20 standard F-15Cs, to an “undisclosed” air base in Southwest Asia — probably either Al Dhafra in the United Arab Emirates or Al Udeid in Qatar. The highly-experienced Massachusetts Guardsmen, who typically have several years more experience than their active-duty counterparts, would be ready “should Iran test the 104th,” said wing commander Col. Robert Brooks.

Upgraded F-15Cs from the 18th Wing in Japan joined the Guard Eagles. The Japan-based fighters have the latest APG-63(V)2 and (V)3 radars, manufactured by Raytheon. They’re electronically-scanned radars that radiate many individual beams from fixed antenna clusters and track more targets, faster, than old-model mechanical radars that must physically swivel back and forth. The 18th Wing is working up a fleet of 54 updated Eagles spread across two squadrons. The video above, shot by an F-15 pilot, depicts some of the wing’s training.

F-22s followed this month. “Multiple” Raptors deployed to Al Dhafra, according to Amy Butler at Aviation Week. Air Force spokesman Capt. Phil Ventura confirmed the deployment. It’s not clear where the Raptors came from. If they’re from the Alaska-based 3rd Wing, they’re the latest Increment 3.1 model with boosted bombing capabilities in addition to the standard air-to-air weaponry. In any event, the Middle East mission represents the first time F-22s are anywhere near a possible combat zone.

The mix of old and upgraded F-15s and ultra-modern F-22s is no accident. When the Pentagon stopped producing the nearly $400-million-a-copy Raptor after 187 units — half as many as the Air Force said it needed — the flying branch committed to keeping 250 F-15Cs in service until 2025 at the earliest. Pilots began developing team tactics for the two fighter types.

“We have a woefully tiny F-22 fleet,” said Gen. Mike Hostage, the Air Force’s main fighter commander. So the flying branch worked out a system whereby large numbers of F-15s cover for small numbers of Raptors that sneak in around an enemy’s flank in full stealth mode. “Our objective is to fly in front with the F-22s, and have the persistence to stay there while the [F-22s] are conducting their [low-observable] attack,” Maj. Todd Giggy, an Eagle pilot, told Aviation Week.

One thing to look for is the presence in the Middle East of one of the Air Force’s handful of bizjets and Global Hawk drones fitted with the Northrop Grumman Battlefield Airborne Communications Node, or Bacon. The F-22, once envisioned as a solitary hunter, was designed without the radio data-links that are standard on F-15s and many other jets. Instead, the Raptor has its own unique link that is incompatible with the Eagle. Bacon helps translate the radio signals so the two jet types can swap information. With a Bacon plane nearby, F-22s and F-15s can silently exchange data — for example, stealthy Raptors spotting targets for the Eagles.

It’s the methods above that the U.S. dogfighting armada would likely use to wipe out the antiquated but determined Iranian air force if the unthinkable occurred and fighting broke out. The warplanes are in place. The pilots are ready. Hopefully they won’t be needed.

Of course this is a very tiny force to be called an "armada" and it is easy to think this could be quickly derailed by somthing as simple as discovering a need for a software fix or a structural issue in the F-15 or F-22 fleet.

 

[57Chevy]

                                    Shared with provisions of the Copyright Act

Iran the target for the world's most complex computer spy virus
Damien McElroy and Christopher Williams, The Daily Telegraph  28 May
http://www.montrealgazette.com/technology/Iran+target+most+complex+virus/6691435/story.html#ixzz1wDVGXLSW

The world's most complex computer virus, possessing a range of espionage capabilities, including the ability to secretly record conversations, has been exposed.

Middle Eastern states were targets and Iran ordered an emergency review of official computer installations after the discovery of the new virus, known as Flame.

Experts said the malicious software was 20 times more powerful than other known cyber warfare programs, including the Stuxnet virus, and could only have been created by a state. It is the third cyber attack aimed at systems in the Middle East to be exposed in recent years.

Iran has alleged that the West and Israel are orchestrating a secret war of sabotage using cyber warfare and targeted assassinations of its scientists as part of the dispute over its nuclear program. Stuxnet attacked Iran's nuclear program in 2010, while a related program, Duqu, named after the Star Wars villain, stole data.

Flame can gather data files, remotely change settings on computers, turn on computer microphones to record conversations, take screen shots and copy instant messaging chats.

The virus was discovered by a Russian security company that specialises in malicious computer code. It made the 20 gigabyte virus available to other researchers yesterday (Monday), claiming that it did not fully understand its scope and said its code was 100 times the size of the most malicious software.

Kaspersky Labs said the program appeared to have been released five years ago and had infected machines in Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt. "If Flame went on undiscovered for five years, the only logical conclusion is that there are other operations ongoing that we don't know about," Roel Schouwenberg, a Kaspersky security senior researcher, said.

Prof Alan Woodward, from the department of computing at the University of Surrey, said the virus was extremely invasive. It could "vacuum up" information by copying keyboard strokes and the voices of people nearby.

"This wasn't written by some spotty teenager in his/her bedroom. It is large, complicated and dedicated to stealing data whilst remaining hidden for a long time," he said.

The virus contains about 20 times as much code as Stuxnet, which attacked an Iranian uranium enrichment facility, causing centrifuges to fail.

Mr Schouwenberg said there was evidence to suggest that the code was commissioned by the same nation or nations behind Stuxnet and Duqu. Iran's computer emergency response team said it was "a close relation" of Stuxnet, which has itself been linked to Duqu, another complicated information-stealing virus which is believed to be the work of state intelligence. It said organisations had been given software to detect and remove the discovered virus at the beginning of this month

Crysys Lab, which analyses computer viruses at Budapest University. said the technical evidence for a link between Flame and Stuxnet or Duqu was inconclusive.

The newly discovered virus does not spread itself automatically but only when hidden controllers allow it.

The file, which infects Microsoft Windows computers, has five encryption algorithms, exotic data storage formats and the ability to steal documents, spy on computer users and more.

Components enable those behind it, who use a network of rapidly-shifting "command and control" servers to direct the virus, to turn microphones into listening devices, siphon off documents and log keystrokes.

Eugene Kaspersky, the founder of Kaspersky Lab, noted that "it took us six months to analyse Stuxnet. [This] is 20 times more complicated".

Once a machine is infected, additional modules can be added to the system, allowing the machine to undertake specific tracking projects.


Related threads:
U.S. sees "huge" cyber threat in the future ( http://forums.army.ca/forums/threads/97622.0.html )
+
Stuxnet 'cyber superweapon' ( http://forums.army.ca/forums/threads/97741.0.html )

The complexities of the Flame virus brings this to mind;

The robot general
Implications of Watson on military operations
BY LT. COL. ANTHONY S. CRUZ
http://www.armedforcesjournal.com/2011/06/6187209
or see thread ( http://forums.army.ca/forums/threads/105118/post-1128380.html#msg1128380 )

 

[Nemo888]

It wasn't found by Kapersky. It was found by the Iranians. That was when Kapersky started looking through their MD5 submission hashes for something similar. They did not get an exact match. But it is very close. Initial infection is by USB sticks and it can then infect entire networks. It listens on the line for network traffic containing admin logon hashes then takes over entire networks. It is obviously military grade kit. Inital payload is 6mb. Once screen capture, the module to turn on the mic and various other functions are enabled it is 20Mb. That would be 40 times as much code as Stuxnet or Duqu which were only 500Kb.  It can still infect a fully updated Win 7 machine. The exploit is as yet undiscovered.

It is most likely that AV compnaies like McAfee and Norton were already aware of it and were told not to add it to their detection list. A common practice in the industry.

 

[a_majoor]

More cyberwar systems found deployed in Iran (and spreading throughout the Middle East). What other cyberwar tools hve been deployed?

http://www.wired.com/threatlevel/2012/05/flame/

Meet ‘Flame’, The Massive Spy Malware Infiltrating Iranian Computers

    By Kim Zetter
    Email Author
    May 28, 2012 |
    9:00 am |
    Categories: Cybersecurity, DuQu, Stuxnet

Map showing the number and geographical location of Flame infections detected by Kaspersky Lab on customer machines. Courtesy of Kaspersky

A massive, highly sophisticated piece of malware has been newly found infecting systems in Iran and elsewhere and is believed to be part of a well-coordinated, ongoing, state-run cyberespionage operation.

The malware, discovered by Russia-based anti-virus firm Kaspersky Lab, is an espionage toolkit that has been infecting targeted systems in Iran, Lebanon, Syria, Sudan, the Israeli Occupied Territories and other countries in the Middle East and North Africa for at least two years.

Dubbed “Flame” by Kaspersky, the malicious code dwarfs Stuxnet in size – the groundbreaking infrastructure-sabotaging malware that is believed to have wreaked havoc on Iran’s nuclear program in 2009 and 2010. Although Flame has both a different purpose and composition than Stuxnet, and appears to have been written by different programmers, its complexity, the geographic scope of its infections and its behavior indicate strongly that a nation-state is behind Flame, rather than common cyber-criminals — marking it as yet another tool in the growing arsenal of cyberweaponry.

The researchers say that Flame may be part of a parallel project created by contractors who were hired by the same nation-state team that was behind Stuxnet and its sister malware, DuQu.

“Stuxnet and Duqu belonged to a single chain of attacks, which raised cyberwar-related concerns worldwide,” said Eugene Kaspersky, CEO and co-founder of Kaspersky Lab, in a statement. “The Flame malware looks to be another phase in this war, and it’s important to understand that such cyber weapons can easily be used against any country.”

Early analysis of Flame by the Lab indicates that it’s designed primarily to spy on the users of infected computers and steal data from them, including documents, recorded conversations and keystrokes. It also opens a backdoor to infected systems to allow the attackers to tweak the toolkit and add new functionality.

The malware, which is 20 megabytes when all of its modules are installed, contains multiple libraries, SQLite3 databases, various levels of encryption — some strong, some weak — and 20 plug-ins that can be swapped in and out to provide various functionality for the attackers. It even contains some code that is written in the LUA programming language — an uncommon choice for malware.

Kaspersky Lab is calling it “one of the most complex threats ever discovered.”

“It’s pretty fantastic and incredible in complexity,” said Alexander Gostev, chief security expert at Kaspersky Lab.

Flame appears to have been operating in the wild as early as March 2010, though it remained undetected by antivirus companies.

“It’s a very big chunk of code. Because of that, it’s quite interesting that it stayed undetected for at least two years,” Gostev said. He noted that there are clues that the malware may actually date back to as early as 2007, around the same time-period when Stuxnet and DuQu are believed to have been created.

Gostev says that because of its size and complexity, complete analysis of the code may take years.

“It took us half-a-year to analyze Stuxnet,” he said. “This is 20-times more complicated. It will take us 10 years to fully understand everything.”

Kaspersky discovered the malware about two weeks ago after the United Nations’ International Telecommunications Union asked the Lab to look into reports in April that computers belonging to the Iranian Oil Ministry and the Iranian National Oil Company had been hit with malware that was stealing and deleting information from the systems. The malware was named alternatively in news articles as “Wiper” and “Viper,” a discrepancy that may be due to a translation mixup.

Kaspersky researchers searched through their reporting archive, which contains suspicious filenames sent automatically from customer machines so the names can be checked against whitelists of known malware, and found an MD5 hash and filename that appeared to have been deployed only on machines in Iran and other Middle East countries. As the researchers dug further, they found other components infecting machines in the region, which they pieced together as parts of Flame.

Kaspersky, however, is currently treating Flame as if it is not connected to Wiper/Viper, and believes it is a separate infection entirely. The researchers dubbed the toolkit “Flame” after the name of a module inside it.

Flame is named after one of the main modules inside the toolkit. Courtesy of Kaspersky

Among Flame’s many modules is one that turns on the internal microphone of an infected machine to secretly record conversations that occur either over Skype or in the computer’s near vicinity; a module that turns Bluetooth-enabled computers into a Bluetooth beacon, which scans for other Bluetooth-enabled devices in the vicinity to siphon names and phone numbers from their contacts folder; and a module that grabs and stores frequent screenshots of activity on the machine, such as instant-messaging and email communications, and sends them via a covert SSL channel to the attackers’ command-and-control servers.

The malware also has a sniffer component that can scan all of the traffic on an infected machine’s local network and collect usernames and password hashes that are transmitted across the network. The attackers appear to use this component to hijack administrative accounts and gain high-level privileges to other machines and parts of the network.

Flame does contain a module named Viper, adding more confusion to the Wiper/Viper issue, but this component is used to transfer stolen data from infected machines to command-and-control servers. News reports out of Iran indicated the Wiper/Viper program that infected the oil ministry was designed to delete large swaths of data from infected systems.

Kaspersky’s researchers examined a system that was destroyed by Wiper/Viper and found no traces of that malware on it, preventing them from comparing it to the Flame files. The disk destroyed by Wiper/Viper was filled primarily with random trash, and almost nothing could be recovered from it, Gostev said. “We did not see any sign of Flame on that disk.”

Because Flame is so big, it gets loaded to a system in pieces. The machine first gets hit with a 6-megabyte component, which contains about half-a-dozen other compressed modules inside. The main component extracts, decompresses and decrypts these modules and writes them to various locations on disk. The number of modules in an infection depends on what the attackers want to do on a particular machine.

Once the modules are unpacked and loaded, the malware connects to one of about 80 command-and-control domains to deliver information about the infected machine to the attackers and await further instruction from them. The malware contains a hardcoded list of about five domains, but also has an updatable list, to which the attackers can add new domains if these others have been taken down or abandoned.

While the malware awaits further instruction, the various modules in it might take screenshots and sniff the network. The screenshot module grabs desktop images every 15 seconds when a high-value communication application is being used, such as instant messaging or Outlook, and once every 60 seconds when other applications are being used.

Although the Flame toolkit does not appear to have been written by the same programmers who wrote Stuxnet and DuQu, it does share a few interesting things with Stuxnet.

Stuxnet is believed to have been written through a partnership between Israel and the United States, and was first launched in June 2009. It is widely believed to have been designed to sabotage centrifuges used in Iran’s uranium enrichment program. DuQu was an espionage tool discovered on machines in Iran, Sudan, and elsewhere in 2011 that was designed to steal documents and other data from machines. Stuxnet and DuQu appeared to have been built on the same framework, using identical parts and using similar techniques.

But Flame doesn’t resemble either of these in framework, design or functionality.

Researchers aren't certain how Flame infects its initial target before spreading to other machines, but this graph suggests possible infection vectors. Courtesy of Kaspersky

Stuxnet and DuQu were made of compact and efficient code that was pared down to its essentials. Flame is 20 megabytes in size, compared to Stuxnet’s 500 kilobytes, and contains a lot of components that are not used by the code by default, but appear to be there to provide the attackers with options to turn on post-installation.

“It was obvious DuQu was from the same source as Stuxnet. But no matter how much we looked for similarities [in Flame], there are zero similarities,” Gostev said. “Everything is completely different, with the exception of two specific things.”

One of these is an interesting export function in both Stuxnet and Flame, which may turn out to link the two pieces of malware upon further analysis, Gostev said. The export function allows the malware to be executed on the system.

Also, like Stuxnet, Flame has the ability to spread by infecting USB sticks using the autorun and .lnk vulnerabilities that Stuxnet used. It also uses the same print spooler vulnerability that Stuxnet used to spread to computers on a local network. This suggests that the authors of Flame may have had access to the same menu of exploits that the creators of Stuxnet used.

Unlike Stuxnet, however, Flame does not replicate automatically by itself. The spreading mechanisms are turned off by default and must be switched on by the attackers before the malware will spread. Once it infects a USB stick inserted into an infected machine, the USB exploit is disabled immediately.

This is likely intended to control the spread of the malware and lessen the likelihood that it will be detected. This may be the attackers’ response to the out-of-control spreading that occurred with Stuxnet and accelerated the discovery of that malware.

It’s possible the exploits were enabled in early versions of the malware to allow the malware to spread automatically, but were then disabled after Stuxnet went public in July 2010 and after the .lnk and print spooler vulnerabilities were patched. Flame was launched prior to Stuxnet’s discovery, and Microsoft patched the .lnk and print spooler vulnerabilities in August and September 2010. Any malware attempting to use the vulnerabilities now would be detected if the infected machines were running updated versions of antivirus programs. Flame, in fact, checks for the presence of updated versions of these programs on a machine and, based on what it finds, determines if the environment is conducive for using the exploits to spread.

The researchers say they don’t know yet how an initial infection of Flame occurs on a machine before it starts spreading. The malware has the ability to infect a fully patched Windows 7 computer, which suggests that there may be a zero-day exploit in the code that the researchers have not yet found.

The earliest sign of Flame that Kaspersky found on customer systems is a filename belonging to Flame that popped up on a customer’s machine in Lebanon on Aug. 23, 2010. An internet search on the file’s name showed that security firm Webroot had reported the same filename appearing on a computer in Iran on Mar. 1, 2010. But online searches for the names of other unique files found in Flame show that it may have been in the wild even earlier than this. At least one component of Flame appears to have popped up on machines in Europe on Dec. 5, 2007 and in Dubai on Apr. 28, 2008.

Kaspersky estimates that Flame has infected about 1,000 machines. The researchers arrived at this figure by calculating the number of its own customers who have been infected and extrapolating that to estimate the number of infected machines belonging to customers of other antivirus firms.

All of the infections of Kaspersky customers appear to have been targeted and show no indication that a specific industry, such as the energy industry, or specific systems, such as industrial control systems, were singled out. Instead, the researchers believe Flame was designed to be an all-purpose tool that so far has infected a wide variety of victims. Among those hit have been individuals, private companies, educational institutions and government-run organizations.

Symantec, which has also begun analyzing Flame (which it calls “Flamer”), says the majority of its customers who have been hit by the malware reside in the Palestinian West Bank, Hungary, Iran, and Lebanon. They have received additional reports from customer machines in Austria, Russia, Hong Kong, and the United Arab Emirates.

Researchers say the compilation date of modules in Flame appear to have been manipulated by the attackers, perhaps in an attempt to thwart researchers from determining when they were created.

“Whoever created it was careful to mess up the compilation dates in every single module,” Gostev said. “The modules appear to have been compiled in 1994 and 1995, but they’re using code that was only released in 2010.”

The malware has no kill date, though the operators have the ability to send a kill module to it if needed. The kill module, named browse32, searches for every trace of the malware on the system, including stored files full of screenshots and data stolen by the malware, and eliminates them, picking up any breadcrumbs that might be left behind.

“When the kill module is activated, there’s nothing left whatsoever,” Gostev said.

UPDATE 9am PST: Iran’s Computer Emergency Response Team announced on Monday that it had developed a detector to uncover what it calls the “Flamer” malware on infected machines and delivered it to select organizations at the beginning of May. It has also developed a removal tool for the malware. Kaspersky believes the “Flamer” malware is the same as the Flame malware its researchers analyzed.

 

[57Chevy]

          It may not be the ideal place for this article from The Province and shared with provisions of The Copyright Act, however,

UN agency plans major warning on Flame virus risk
Jim Finkle, Reuters 30 May

http://www.theprovince.com/technology/agency+plans+major+warning+Flame+virus+risk/6702892/story.html#ixzz1wO4WUTag

BOSTON - A United Nations agency charged with helping member nations secure their national infrastructures plans to issue a sharp warning about the risk of the Flame computer virus that was recently discovered in Iran and other parts of the Middle East.

"This is the most serious (cyber) warning we have ever put out," said Marco Obiso, cyber security co-ordinator for the UN's Geneva-based International Telecommunications Union.

The confidential warning will tell member nations that the Flame virus is a dangerous espionage tool that could potentially be used to attack critical infrastructure, he told Reuters in an interview on Tuesday.

"They should be on alert," he said, adding that he believed Flame was likely built on behalf of a nation state.

The warning is the latest signal that a new era of cyber warfare has begun following the 2010 Stuxnet virus attack that targeted Iran's nuclear program. The United States explicitly stated for the first time last year that it reserved the right to retaliate with force against a cyber attack.

Evidence suggests that the Flame virus may have been built on behalf of the same nation or nations that commissioned the Stuxnet worm that attacked Iran's nuclear program in 2010, according to Kaspersky Lab, the Russian cyber security software maker that took credit for discovering the infections.

"I think it is a much more serious threat than Stuxnet," Obiso said.

He said the ITU would set up a program to collect data, including virus samples, to track Flame's spread around the globe and observe any changes in its composition.

Kaspersky Lab said it found the Flame infection after the ITU asked the Russian company to investigate recent reports from Tehran that a mysterious virus was responsible for massive data losses on some Iranian computer systems.

So far, the Kaspersky team has not turned up the original data-wiping virus that they were seeking and the Iranian government has not provided Kaspersky a sample of that software, Obiso said.


SOME SKEPTICAL

A Pentagon spokesman asked about Flame referred reporters to the Department of Homeland Security.

DHS officials declined to respond to specific questions about the virus, but an agency spokesman issued a brief written statement that said: "DHS was notified of the malware and has been working with our federal partners to determine and analyze its potential impact on the U.S."

Some industry participants appeared skeptical that the threat was as serious as the UN agency and Kaspersky had suggested.

Jeff Moss, a respected hacking expert who sits on the U.S. government's Homeland Security Advisory Council, said that the ITU and Kaspersky were "over-reacting" to the spread of Flame.

"It will take time to disassemble, but it is not the end of the Net," said Moss, who serves as chief security officer of the Internet Corporation for Assigned Names and Numbers, or ICANN, which manages some of the Internet's key infrastructure.

"We seem to be getting to a point where every time new malware is discovered it's branded 'the worst ever,"' said Marcus Carey, a researcher at with cyber security firm Rapid7.

Organizations involved in cyber security keep some of their communications confidential to keep adversaries from developing strategies to combat their defenses and also to keep other hackers from obtaining details about emerging threats that they could use to build other pieces of malicious software.

Meanwhile on Tuesday Japanese security software maker Trend Micro Inc. said it had discovered a complex cyber campaign to steal information using a piece of malicious software dubbed IXESHE. It had infected government computers in major East Asian countries along with Taiwanese electronics manufacturers and German telecommunications firms operating across Asia.

Trend Micro officials declined to identify the targets or say who they suspect was behind IXESHE (pronounced "i-sushi").

IXESHE infected PCs with tainted PDF files sent to victims via email, then stole large quantities of data from the PCs and sent it to servers in countries including Taiwan, the United States, South Korea, Brazil, Italy and Japan.

"The amount of data that the adversaries exfiltrated from these systems is astounding. These systems have essentially been colonized," Trend Micro Vice President Tom Kellermann said in an interview.

 

[Sythen]

Iran is prepared to launch missiles at US bases throughout the Gulf within minutes of an attack on the Islamic Republic, according to a commander of the country's Revolutionary Guards.

In an apparent response to reports that the US has increased its military presence in the Gulf, the commander of the Revolutionary Guards' air force said on Wednesdaythat missiles had been aimed at 35 US military bases in the Gulf as well as targets in Israel, ready to be launched in case of an attack.

The semi-official Fars news agency reported Brigadier General Amir Ali Hajizadeh as saying: "We have thought of measures to set up bases and deploy missiles to destroy all these bases in the early minutes after an attack."

http://www.guardian.co.uk/world/2012/jul/04/iran-ready-missiles-us-bases

More on link.

 

[a_majoor]

Walter Russel Mead on how the US is slowly foreclosing its options in the Persian Gulf. A cynical person might suggest the Administration is trying to orchestrate some sort of "October surprise" in the Gulf region for the election, but events have a way of developing their own momentum and the iranians have their own agenda:

http://blogs.the-american-interest.com/wrm/2012/07/12/growing-u-s-military-presence-in-the-gulf-leaves-obama-with-fewer-options/

Growing U.S. Military Presence in the Gulf Leaves Obama with Fewer Options

The sabre rattling in the Persian Gulf continues with the deployment of the USS Ponce. Up until recently, the vessel was simply an aging transport ship destined for the scrap heap, but it appears that the Navy has retrofitted the ship, turning it into a command and control station for a variety of missions designed to put pressure on the Iranian regime. The New York Times reports:

The first mission of the reborn Ponce was designed to be low profile and defensive, as an operations hub for mine clearing in the Strait of Hormuz, a counter to threats from Tehran to close the vital commercial waterway. In that role, the Ponce will be a launching pad for helicopters, a home to underwater diver teams and a seaborne service station providing fuel and maintenance for minesweeping ships.

But with the relatively simple addition of a modular barracks on the deck, the Ponce can also be a mobile base for several hundred Special Operations forces to carry out missions like hostage rescue, counterterrorism, reconnaissance, sabotage and direct strikes. Even with the addition of the barracks, there is ample room for helicopters and the small, fast boats favored by commandos.

This latest deployment, as well as last week’s report of a steadily increasing U.S. military presence, may have unintended consequences for U.S. policy. Every step forward makes it more difficult for the Obama administration to back down. There’s not a lot of news in the very slow running contest between the United States and Iran, but the fuse on this bomb is lit, and at some point either Iran is going to back down, the United States is going to back down, or there is going to be war.

 

[cupper]

If the Israelis can definitively track this back to Iran, things have just gotten very interesting, and not in a good way.

At least 6 killed in Bulgaria in blast on bus carrying Israeli tourists

http://www.washingtonpost.com/world/middle_east/at-least-6-killed-in-bulgaria-in-blast-on-bus-carrying-israeli-tourists/2012/07/18/gJQA1iUBuW_story.html?hpid=z4

JERUSALEM — At least six people were killed Wednesday when a bus carrying Israeli tourists exploded in a Bulgarian resort city, and Israeli Prime Minister Benjamin Netanyahu quickly deemed the incident a terrorist attack orchestrated by Iran.

The attack threatened to escalate tensions between Israel and Iran at a time when Israel is threatening military action to prevent Iran from developing nuclear weapons and international efforts to stop the Iranians’ alleged program are faltering. Netanyahu vowed to respond to the bus attack “firmly.”

The blast occurred in the late afternoon outside the airport in the Black Sea city of Burgas shortly after a charter flight carrying 154 people, all but three of them Israeli citizens, arrived from Tel Aviv, the Bulgarian Foreign Ministry said. Israeli and Bulgarian media reported that the travelers had boarded buses that were to take them to a hotel, and the Bulgarian interior minister told Bulgarian radio that explosives had been planted on the vehicle, perhaps in passengers’ luggage. The Foreign Ministry said in a statement that it was “working on the theory that this was a terrorist attack.”

The blast came five months after Israel blamed Iran for twin bombing attempts targeting Israeli Embassy personnel in India and Georgia, and it fell on the 18th anniversary of a suicide bombing at a Jewish organization in Buenos Aires. That attack, carried out by the Iran-backed Lebanese militia Hezbollah, killed 85 people.

“All signs point towards Iran,” Netanyahu said in a statement. Referring to the Argentina attack, he said: “Deadly Iranian terrorism continues to strike at innocent people. This is a global Iranian terror onslaught and Israel will react firmly to it.”

Israeli Defense Minister Ehud Barak also declared the Bulgarian bombing a terrorist attack, “initiated probably by Hezbollah, Hamas, Islamic Jihad or another group under the terror auspices of either Iran or other radical Islamic groups” and pledged that Israel would “settle the account.”

There was no immediate response from Tehran.

In Washington, President Obama condemned what he called “a barbaric terrorist attack” on Israelis. “As Israel has tragically once more been a target of terrorism,” he said in a statement, “the United States reaffirms our unshakeable commitment to Israel’s security, and our deep friendship and solidarity with the Israeli people.”

Israel and Iran are bitter enemies that have been engaged in an escalating rhetorical battle and, security analysts say, a covert war of attacks and assassinations. Israel considers Iran a mortal danger and has threatened to strike its nuclear facilities to prevent it from building a bomb. Although Iran has denied involvement in attacks on Israelis, many analysts believe it has carried out or planned some of them to avenge what it says are Israeli-directed assassinations of some of its nuclear scientists.

Israel had warned recently that Islamist militants might target its citizens in Bulgaria, a popular tourism destination for Israelis. Bulgaria’s Foreign Ministry said 32 people were wounded in Wednesday’s blast, and it was unclear how many of the wounded and dead were Israelis. In a brief statement, the Interior Ministry said the wounded had been taken to a local hospital and that the airport had been closed.

 

[Edward Campbell]

Here, reproduced under the Fair Dealing provisions of the Copyright Act from Foreign Affairs is an article that gets to the real goal - how to ferment a real revolution in Iran, one that will topple the current theocracy:

http://www.foreignaffairs.com/articles/137803/michael-ledeen/tehran-takedown?page=show

Tehran Takedown
How to Spark an Iranian Revolution

Michael Ledeen

July 31, 2012

The nuclear question is at the center of most countries' Iran policies. China, France, Germany, Russia, the United Kingdom, and the United States have all engaged in negotiations to convince Tehran to give up its presumed quest for the bomb. Now, with talks sputtering, Western powers have implemented increasingly tough sanctions, including the European Union's recent embargo on Iranian oil, in the hope of compelling the regime to reverse course.

Yet history suggests, and even many sanctions advocates agree, that sanctions will not compel Iran's leaders to scrap their nuclear program. In fact, from Fidel Castro's Cuba to Saddam Hussein's Iraq, hostile countries have rarely changed policy in response to Western embargoes. Some sanctions advocates counter that sanctions did work to get Chile to abandon communism, South Africa to end apartheid, and Libya to give up its nuclear program. But the Chilean and South African governments were not hostile -- they were pro-Western, and thus more amenable to the West's demands. And Libya's Muammar al-Qaddafi ended his nuclear pursuit only after the 2003 U.S. invasion of Iraq, fearing that he would suffer the same fate as Saddam Hussein.

Iran, which is clearly hostile and which watched what just happened to a disarmed Libya, will not back down. Some therefore see sanctions as only a prelude to military action -- by Israel, the United States, or both. In other words, current Iran strategy boils down to an eventual choice between appeasement and attack. Neither outcome is attractive. However, if the United States and its allies broadened their perspective and paid attention not merely to Iran's nuclear program but also to the Islamic Republic's larger assault on the West, they would see that a third and better option exists: supporting a democratic revolution in Iran.

Obsession with the nuclear question has obscured the fact that, since the 1979 Islamic Revolution, Iran has waged a low-level war on the United States. That war began in earnest in 1983, when, evidence suggests, Iranian-backed operatives bombed the U.S. Marine barracks in Beirut. Such violence continued throughout the 1980s, as Hezbollah, a terrorist organization created by Iran, kidnapped and murdered Americans in Lebanon. In addition to supporting Hezbollah, Iran started funding other terrorist groups, such as Hamas, Islamic Jihad, and the Popular Front for the Liberation of Palestine. In the last decade, Iranian agents have attacked U.S. troops in Afghanistan and Iraq. Late last year, the Obama administration revealed that Iranian agents had attempted to assassinate the Saudi Arabian ambassador to the United States and to blow up the Saudi and Israeli embassies in Washington, D.C.

In short, the nuclear program is not the central issue in Iran policymaking -- defending the United States and its allies from Iranian terrorists and their proxies is. To meet that goal, Washington must replace the Islamic Republic's regime. The theocrats in Tehran call the United States "the great Satan," and waging war against it is one of the Iranian leadership's core missions. The Ayatollah Khomeini proclaimed that as his goal very soon after the shah was overthrown in 1979. Calls of "Death to America" have been a constant refrain ever since. Regime change cannot be achieved by sanctions and diplomacy alone. And, although war might bring down the regime, it is neither necessary nor desirable. Supporting a domestic revolution is a wiser strategy.

The Iranian regime is not only at war with the United States and its allies; it is also at war with its own people. The regime represses Iranian citizens, restricting their civil liberties and imprisoning, torturing, and killing political opponents. Popular discontent boiled over into open protest after a rigged election in June 2009, as what came to be known as the Green Movement launched an open challenge to the political status quo. The regime brutally suppressed the protests and is keeping the movement's two leaders, presidential candidates Mir Hossein Mousavi and Mehdi Karroubi, along with Mr. Mousavi's wife, under house arrest.

Conventional wisdom describes the Green Movement as a spent force, citing the lack of mass demonstrations over the past year and half. Iranian authorities regularly restrict and censor the Internet and intercept and block cell phone and satellite communications, and they have increased deployments of security forces in cities across the country. In such an atmosphere, skeptics argue, there can be little opposition to speak of, let alone one with the leadership and mass support to challenge the regime.

But this was also the conventional wisdom back in early 2009, and it is as wrong now as it was then. The West was caught unawares by the explosion of popular rage after Mousavi's election was stolen, and it failed to support the opposition. The regime paid no price for its crackdown.

In fact, despite the government lockdown, dissenters today have continued to strike out against the regime through acts such as the sabotage of oil and natural gas pipelines. The disruption of the natural gas line between Iran and Turkey in late June, which was reported by the state-run Press TV, is only the latest of many such attacks. Last March, opposition activists privately claimed responsibility for attacks on two Revolutionary Guards Corps installations. One was Zarin Dasht, where missile fuel and warheads are manufactured. The other was Natanz, a major uranium enrichment center. The explosion took place deep underground, leading to a shutdown of the entire complex.

Meanwhile, although the Green Movement's leaders are still under house arrest, they continue to issue statements to their supporters. And according to a recent online government poll, the population is fed up. Nearly two-thirds of respondents said that they favored giving up the nuclear program in exchange for an end to sanctions. The poll was quickly yanked off the Web site.

For their part, Iranian authorities are worried. In January, Ali Saeedi, Khamenei's representative to the Islamic Revolutionary Guards Corps, admitted that the regime continues to fear the strength of the Green Movement. Regime leaders are at pains to reassure the public that Mousavi and Karroubi are being well treated. If Iranian Supreme Leader Ayatollah Ali Khamenei wanted to demonstrate the weakness of the opposition, he would have subjected both to the same harsh treatment that has been meted out to many of their followers. But as Saeedi told Fars, the Iranian state news agency, Mousavi and Karroubi have "supporters and followers," as well as "a few [clerics] who continue to back elements within the sedition" -- the term used by the regime to refer to the Green Movement.

The regime's anxiety about the Green Movement also led it to delay all elections in the country for three years. And when it finally held parliamentary elections this past May, it banned scores of candidates from running and deployed thousands of security forces at polling stations to prevent protests. Their fear might also be the reason that Khamenei avoided speaking at the Revolutionary Guards Day festivities in late June, the first time he had done so in over two decades. Similarly, the regime has reduced the number of anti-American protests it stages, perhaps worrying that the reformers would hijack them. When two popular (and apolitical) Iranian artists died this summer -- the actor Iraj Ghaderi and the musician Hassan Kassai -- their funerals were held without fanfare and in the middle of the night. The regime is clearly doing all it can to keep Iranians from gathering in the streets.

By themselves, the strength of the opposition and the regime's fears do not justify Western intervention. After all, several Middle Eastern dictators have fallen of late, only to be replaced by actors more hostile to U.S. interests. And some experts contend that the same could happen in Iran. Mousavi served as prime minister of Iran from 1981 to 1989 and played a key role in the creation of the Islamic Republic. Many, including U.S. President Barack Obama, have raised the possibility that his accession might not change much. So, before jumping into the fray on behalf of the opposition, the United States and its allies must ask whether the Green Movement would end Iran's support for terrorism against the United States and its allies, stop oppressing its own people, and terminate the country's nuclear weapons program.

Although it is dangerous for opposition leaders to be totally explicit about all such matters, their answers are encouraging. During the 2009 electoral campaign, and on several subsequent occasions, Mousavi promised to end Iranian backing for terrorist organizations -- a promise that resonates with large numbers of Iranian citizens. In February 2011, demonstrators carried banners decrying the regime's support for foreign terrorist groups, with slogans such as "Don't talk to us about the Palestinians, talk about us."

The Green Movement has also pledged to dismantle many oppressive practices of the Islamic Republic. Although the group's leaders claim that they want to restore the values of the 1979 revolution, during the 2009 presidential election, Mousavi's wife, Zahra Rahnavard, campaigned alongside him and declared her support of women who dispense with wearing the veil. It was a stark act of defiance against a deeply misogynistic regime. Mousavi, meanwhile, has promised tolerance of religious dissenters, the release of all political prisoners, and greater separation of church and state. As the Green leaders wrote to the Obama administration in November 2009, "religion, by the will of the Iranian people of today, has to be separated from the state in order to guarantee unity of Iran."

Even from house arrest, Mousavi has continued to send signals that he would overturn the policies of the current regime. In the past year, he urged Iranians to read two books: News of a Kidnapping, by Gabriel Garcia Marquez, and The Right to Heresy, by Stefan Zweig. The first volume, which deals with a wave of kidnappings in Colombia by drug gangs, inspired a popular Iranian Facebook page called "News of a Kidnapping, the status of a president in captivity." The second book addresses a revolt against John Calvin by the sixteenth century cleric Sebastian Castellio, after the torture and execution of the heretic Michael Servetus. It is at once a call for religious toleration and an essay on those thinkers who were crushed during their lifetime, only to emerge triumphant in death. By turning to these texts, Mousavi issued a direct challenge to Khamenei and oriented his movement with Western values.

It is hard to pinpoint the nuclear intentions of the Green Movement's leaders, but there is reason for guarded optimism; they have repeatedly condemned the regime's "adventurism" in foreign affairs, and would certainly seek better relations with the West. As Iranian crude oil production drops, a democratic Iran might opt for nuclear energy, but it seems unlikely that such a government would continue the secret weapons program. And the West, including Israel, would have far less to fear from a free Iran, whatever weapons it might possess, than it does from the current regime.

Given the potential for a successful democratic revolution in Iran -- and the potential for a democratic government to end Iran's war against us -- the question is how the United States and its allies can best support the Green Movement.

Although an Iranian revolution may seem unlikely to the casual observer, the Iranian people can be said to have revolution in their DNA, having carried out three revolutions in the twentieth century. Many skeptics argue that any Western aid to the Green Movement would delegitimize it in such a nationalist country. Yet, during the mass demonstrations in 2009 and 2010, protesters waved signs and banners saying "Obama, where are you?" Moreover, in a carefully unsigned letter to the White House in late 2009, Green Movement leaders responded to an administration query by saying that "it is up to the countries of the free world to make up their mind. Will they... push every decision to the future until it is too late, or will they reward the brave people of Iran and simultaneously advance Western interests and world peace?"

Even so, the West snubbed the uprising, insisting that the Iranian opposition did not want outside help. As far as I know,  there is no evidence to suggest that an attempt has been made since then to speak directly with the Green Movement inside the country. (Mousavi has said several times that the Green Movement does not have spokespeople or representatives outside Iran.) Unable or unwilling to engage with the opposition, the West has devoted its energy to the nuclear question alone, pursuing a policy that will produce war or diplomatic and strategic failure.

That is why the time has come for the United States and other Western nations to actively support Iran's democratic dissidents. The same methods that took down the Soviet regime should work: call for the end of the regime, broadcast unbiased news about Iran to the Iranian people, demand the release of political prisoners (naming them whenever possible), help those prisoners communicate with one another, enlist international trade unions to build a strike fund for Iranian workers, and perhaps find ways to provide other kinds of economic and technological support. Meanwhile, the West should continue nuclear negotiations and stick to the sanctions regime, which shows the Iranian people resistance to their oppressive leaders.

Iran's democratic revolutionaries themselves must decide what kind of Western help they most need, and how to use it. But they will be greatly encouraged to see the United States and its allies behind them. There are many good reasons to believe that this strategy can succeed. Not least, the Iranian people have already demonstrated their willingness to confront the regime; the regime's behavior shows its fear of the people. The missing link is a Western decision to embrace and support democratic revolution in Iran -- the country that, after all, initiated the challenge to the region's tyrants three summers ago.

Basically, Michael Ledeen is suggesting that we prevent the Iranian bomb by finding and funding those opposition movement that are most likely to rise up and overthrow the ayatollas.  Works for me!