PROJECT AMOS

The World That Made This Necessary

Her full name was Mahsa Jina Amini. She was twenty-two years old, from Saqqez, in Iran's Kurdistan Province. On September 13, 2022, she was arrested in Tehran by officers of the Gasht-e Ershad, the morality police, for the alleged crime of wearing her hijab incorrectly. Three days later she was dead. The official story was heart failure. Her family said she had been beaten. The country knew which version to believe.

Millions of Iranians took to the streets. They called it the Woman, Life, Freedom movement. The regime answered with live ammunition, internet shutdowns, and the systematic digital surveillance of anyone who had posted footage of what was happening. Hundreds were killed. Thousands were arrested. Some were executed. The footage that documented all of it was captured on the phones of ordinary Iranians who believed, correctly, that the only thing standing between the regime and a final erasure of what it was doing was the simple, terrifying act of holding a camera.

We do not know how many people died in those protests with footage of their deaths trapped on a phone that was later confiscated, broken, or deleted by a frightened family member. We never will. We know only that some of them did, and that the world knows a fraction of what happened because enough of the witnesses were lucky. None of them were safe.

What happened in Iran was not an aberration. It was the pattern.

In Myanmar, the Tatmadaw opened fire on unarmed protesters and shut down the internet for months. Evidence of mass atrocities sat trapped on devices that could not connect to the outside world. In Sudan, the Rapid Support Forces (successors to the Janjaweed) burned villages, killed tens of thousands, and weaponized sexual violence so systematically that the UN opened a formal investigation. International journalists are almost nowhere in the country; what the world knows, it knows because ordinary Sudanese people carried phones and were brave enough to use them. In Xinjiang, China built the most comprehensive surveillance apparatus in human history specifically to prevent documentation of what is being done to the Uyghur people. We have scraps: satellite imagery, refugee testimony, a handful of leaked documents. Most who tried to get footage out were caught. In Tigray, a near-total information blackout covered six million people for the better part of two years. Atrocities occurred during that blackout. We know some of them. We do not know most of them.

These are not edge cases. They are the world.

Every generation has had its witnesses. Every generation has had to improvise the infrastructure to carry their witness out of places where the powerful did not want it seen. Dr. King quoted Amos 5:24 at the March on Washington because he believed the truth of what was happening in Alabama would eventually compel the world. He was right. It reached the world because photographers and television cameras carried it, held by people who were not anonymous, who suffered for what they documented, and many of whom did not survive the years between Selma and the Voting Rights Act. Bonhoeffer wrote his letters from a Nazi prison on scraps of paper smuggled out one visit at a time, published only after his execution. The "samizdat" networks carried Solzhenitsyn and Sakharov and Havel across the Iron Curtain on underground typewriters and carbon paper. The smuggled record of Tiananmen, including one unnamed man standing in front of a column of tanks, was carried out of China on film by people who understood what the government would do to the images if they caught them at the border.

In every case the infrastructure was improvised. In every case it worked (when it worked) because the witnesses were willing to die to get the record out. In every case it failed (when it failed) because a frightened family member destroyed the evidence, or a border guard found the film, or the courier was killed before she reached the place she was going.

The smartphone has made every person a potential witness. Nothing has made it safe to be one.

The Cost

A child being born this morning in Khartoum will grow into a country whose history is being written today. It is being written by the forces that are burning her village, not by the people who saw the burning. A child being born this morning in Tehran will grow up knowing that her aunt was killed in the 2022 protests only if someone's witness survived long enough to reach her. A child being born this morning in Azerbaijan, in Damascus, in Kyiv, in Nigeria, in a dozen places the international news cycle no longer remembers. Every one of these children will grow up in a country whose twentieth-century history is understood through film, and whose twenty-first-century history will be understood through whatever their parents and grandparents managed to get out of their phones.

We will never see what was captured in Bucha in the days before the first Western journalists arrived: the footage not recovered from the phones of residents who were killed there. We will never see most of what was captured in the first seventy-two hours of the Myanmar coup, before the shutdowns hit and the surveillance caught up. We will never know how many of the Uyghur women, now in Xinjiang's camps, recorded what was being done to them before their phones were confiscated at the gate. We will never know what was on the memory card of the Sudanese photographer whose body was found in El Geneina in the summer of 2023, whose camera was missing.

The archive of what has not reached the world is larger than the archive of what has. We do not know how much larger. We know only that the gap exists, and that it is growing. Every week it grows is another week of evidence that will never see the light, and another week of atrocities that will be written off by history as unproven.

What we have not seen was not missing from the world. It was only missing from our eyes, because the infrastructure to carry it to us did not exist.

We are writing this protocol to make that infrastructure exist.

What AMOS Is

AMOS is the Anonymous Media Origination Standard. It is an open specification for how a piece of media captured by an ordinary person, on an ordinary phone, in the most dangerous places on earth, can travel from the moment of its capture to the desks of the people who can publish it and preserve it and use it as evidence, without ever passing through a channel that can identify its source.

It is not an application. It is not a product. It is not a company. It is a set of rules that anyone can implement, that no one owns, and that no single authority can coerce into silence.

It defines how media is prepared for delivery: stripped of the metadata that would identify the device that captured it, paired with an encrypted envelope containing the submitter's account of what they witnessed, split into fragments so that no single relay holds enough of the file to reconstruct it, and distributed across a network of ordinary devices running the same protocol.

It defines how those relay devices forward the fragments without ever learning who sent them, what they contain, or where they are going.

It defines how the institutions that will ultimately receive the media (newsrooms, human rights organizations, the ICC, academic archives, any organization that chooses to participate) reassemble the fragments and verify cryptographically that what they received is exactly what was captured, by the person who captured it, at the moment they said they captured it.

Amara's footage will travel this path. She will never know which devices carried it. The devices that carried it will never know that they were carrying it. The organizations that receive it will know exactly what she witnessed and where. They will never know who she is.

That is what the protocol does. The rest of this document is the reason we are asking the world to build it.

How It Works

The protocol has six design commitments. Each is a mathematical commitment, not a corporate promise. Each exists because somebody, somewhere, has already been harmed by the absence of it.

The Evidence Envelope

The evidence envelope is the mechanism that makes anonymous testimony admissible. At the moment of capture, the protocol seals the evidentiary metadata (location, time, the witness's own description) inside an encrypted container bound cryptographically to the media file itself. When a newsroom or tribunal opens the envelope, they can mathematically verify that the footage is unaltered, captured at the stated place and time. They can never learn who captured it.

Twenty-Two Seconds

Those twenty-two seconds are still on Amara's phone. She taps Send and types ten words:

The app strips her phone's identity, encrypts the fragments, and hands them to seven nearby devices over mesh radio. None of them know what they are carrying. The fragments spread outward through the city: one phone belongs to a mother walking her children to her sister's house across town, another to a boy riding his bicycle to a neighborhood on the city's edge that still has a working Wi-Fi network. Six hours later, the teenager's phone detects connectivity on his sister's laptop hotspot in the suburbs. Fragments begin leaving the country as ordinary encrypted web traffic. By evening, an Associated Press editor in New York watches twenty-two seconds of footage for the first time. She pulls up satellite imagery of the coordinates from the envelope. She finds the school. She matches the unit insignia against a reference database. The video is on the wire. The ICC has the evidence envelope. Amnesty has independently received the same submission through its own fragments.

Amara is never identified. The seven phones that carried the fragments have no record of having done so. The protocol was built so that they would not.

She puts her phone in her pocket and goes back to the boy whose leg she was trying to save. He is still behind the cart. He is alive. The soldiers did not look behind the cart.

A week later, the country's government issues a formal denial of the massacre. The denial is widely dismissed because of the footage. Sanctions are proposed in the European Parliament. A named general is placed on a travel ban list. The soldiers whose faces are visible in the video begin to disappear from the unit's official rosters.

But Amara is also not rescued. The protocol saved the record of what she witnessed. It did not save her. She is still in the country. The regime is still in power. Most of the soldiers have not been prosecuted. She will live or she will not, and either way the footage will exist, and either way the record will survive her. That is the limit of what the protocol can promise, and it is the most any protocol has ever been able to promise.

It turns out to be enough to matter. It is enough to begin.

What AMOS Is Not

AMOS is not an application. It is a set of rules. An application that follows the rules is a valid AMOS implementation; the specification is not, itself, an application.

AMOS is not a product or a service. There is no company to invest in, no subscription to buy, no premium tier. The specification is an open document. Implementing it requires no permission.

AMOS is not a content moderation system. The protocol cannot see what it is delivering. Editorial decisions belong at the consuming platforms and are their responsibility alone.

AMOS is not a publishing platform. It delivers media to institutions that choose to publish. Whether anything is ever published is those institutions' decision.

AMOS is not a replacement for journalism. Journalism contextualizes, verifies, interprets, and bears responsibility for what it publishes. The protocol simply gets the raw material into the hands of the people who do those things.

AMOS is not a cryptocurrency. There is no token, no blockchain, no financial incentive mechanism, nothing to trade, nothing to speculate on. The protocol has no economic layer at all.

AMOS is not a finished product. This document and its companion specification are a draft published for review, attack, implementation, and improvement. Nothing here has been audited by an independent cryptographic firm. Nothing here has been deployed at scale. Nothing here should be trusted in a life-or-death situation until people more qualified than the current authors have attacked it, improved it, and built it.

But the draft exists. The architecture is sound. The cryptography uses well-known, well-tested building blocks that have survived years of independent audit in other projects. The pieces are ready to be assembled by anyone with the engineering skill to assemble them. What the protocol needs now is builders.

An Invitation and an Enlistment

What You Can Do Today

Every reader of this document can do something today. Pick one.

• If you are a cryptographer, spend an hour with the specification and find the first thing you think is wrong. Publish what you found. Even a single issue filed on the public repository is more useful than silence.
• If you are a developer, clone the draft specification and begin sketching a reference implementation in whatever language you are most comfortable with. You do not need to finish it. You need to start.
• If you are a journalist, pitch your editor on a story about whether the infrastructure for anonymous media submission should exist, and whether the press-freedom community is moving fast enough to build it.
• If you work at a press-freedom or human-rights organization, circulate this document internally. Ask whether your existing intake workflow could accept an AMOS submission. If not yet, ask what it would take.
• If you work at a newsroom, find the person responsible for source security and ask them if they have read this.
• If you are a human rights lawyer, read the Evidence Envelope section and ask whether cryptographically bound, geolocated, timestamped media from an anonymous source would help the cases you are already working on. Tell us the answer.
• If you are a student, forward this to your most serious professor in cryptography, human rights law, journalism ethics, or distributed systems.
• If you are an activist in a country where this protocol would matter, tell us what you need from it that it does not yet have. Your requirements are more important than any cryptographer's preferences.
• If you are none of the above, donate to a press-freedom organization you trust. Then share this document with one specific person who needs to read it. Name them to yourself. Send it by the end of the day.

The protocol does not need everyone. It needs enough of the right people to begin.