The gymnasium has been a clinic for three days. Twenty wounded, most of them young, most of them boys. Two who will not survive the night. Amara (not her real name) is twenty-four, a third-year medical student, and she has been awake for forty-one hours.
She hears the shouting first. Boots on tile. She looks up from the boy whose leg she is trying to save, and she sees them come through the double doors in a line: four soldiers, one officer, rifles already at the shoulder. The officer says something she cannot hear over the sudden screaming, and then he points to the wounded on the floor, and the rifles come down.
What happens next will take twenty-two seconds. She will not remember deciding to reach for her phone. She will remember the weight of it in her hand as if it were a stone. She will remember that she is the only person in this room who is going to live long enough to tell what she is about to see. Not because she is lucky, but because she is standing behind the equipment cart and they have not noticed her yet, and because the wounded are closer to the door than she is, and because soldiers who have just begun killing a room full of unarmed men tend to finish the work in front of them before they look around.
She records. The camera sees three soldiers' faces clearly. It sees the unit insignia on two of them. It sees the officer's mouth moving. It sees what the rifles do. Twenty-two seconds.
The soldiers will leave eventually. Killing on this scale is tiring even for men who have trained for it. When they go, she will still be behind the cart. She will still have the phone. She will still be in the country whose military has just done this. And she will still be twenty-four, and a medical student, and without a passport, and without internet access, and without a safe way to get what she has just recorded out of her hand and into the hands of anyone who can do anything with it.
This is where the protocol begins. This document describes why we are writing it. The specification that accompanies it is how.
Mahsa Jina Amini
Her full name was Mahsa Jina Amini. She was twenty-two years old. She was from Saqqez, in Iran's Kurdistan Province, and on September 13, 2022, she was arrested in Tehran by officers of the Gasht-e Ershad, the morality police, for the alleged crime of wearing her hijab incorrectly. Three days later she was dead in a hospital bed, and the official story was that she had collapsed of heart failure. Her family said she had been beaten. The country knew which version to believe.
Millions of Iranians took to the streets in the weeks that followed. They called it the Woman, Life, Freedom movement. The regime answered with live ammunition, internet shutdowns, and the systematic digital surveillance of anyone who had posted footage of what was happening. Hundreds were killed. Thousands were arrested. Some were executed. The footage that documented all of it was captured on the phones of ordinary Iranians who believed, correctly, that the only thing standing between the regime and a final erasure of what it was doing was the simple, terrifying act of holding a camera.
We do not know how many people died in those protests with footage of their deaths trapped on a phone that was later confiscated, broken, or deleted by a frightened family member. We never will. We know only that some of them did, and that the world knows a fraction of what happened in the streets of Tehran and Sanandaj and Mahabad because enough of the witnesses were lucky. None of them were safe.
Mahsa Jina Amini is the reason this document exists. Without AMOS, the footage that reached the world in September 2022 was a fraction of what could have reached it. With AMOS, that fraction would have been larger, and the people who captured it (the next Mahsa's sister, her roommate, the stranger across the street who happened to be filming) would have done so without fearing that their phone was now the most dangerous thing they owned.
Remember her name. Remember that she is one of many. Then keep reading.
The State of the World
What happened in Iran was not an aberration. It was the pattern.
In February 2021, the Myanmar military (the Tatmadaw, commanded by General Min Aung Hlaing) seized power in a coup. Their soldiers opened fire on unarmed protesters in Yangon, in Mandalay, in Hpakant. The Tatmadaw shut down the internet for months. Evidence of mass atrocities sat trapped on devices that could not connect to the outside world, and by the time connectivity was partially restored, much of the footage had been deleted by frightened owners, seized with confiscated devices, or lost in the chaos of families fleeing across the Thai border.
In Sudan, the Rapid Support Forces began a new civil war in April 2023. They are the paramilitary successor to the Janjaweed militias that carried out the Darfur genocide two decades earlier. They have burned villages, killed tens of thousands, and weaponized sexual violence so systematically that the UN has opened a formal investigation. International journalists are almost nowhere in the country. What the world knows of what has happened in El Geneina, in Omdurman, or in Darfur, it knows because ordinary Sudanese people carried phones and were brave enough to use them. What the world does not know is everything else.
In Xinjiang, China's Ministry of Public Security has built the most comprehensive surveillance apparatus in human history specifically to prevent documentation of what is being done to the Uyghur people. We have scraps: satellite imagery, refugee testimony, a handful of leaked documents. We do not have what we would have had if anyone inside those camps had been able to get footage out. Most who tried were caught.
In Tigray, during the Ethiopian federal government's offensive against the TPLF from 2020 to 2022, there was a near-total information blackout over a region of six million people for the better part of two years. Atrocities occurred during that blackout. We know some of them. We do not know most of them. The people who witnessed them carried that witness in their heads instead, and some of them are still carrying it today, and the rest did not survive to carry it anywhere.
These are not edge cases. They are the world. The Committee to Protect Journalists documents scores of journalists killed and hundreds imprisoned each year, the vast majority local reporters and freelancers with no institutional support and no secure submission infrastructure. Freedom House reports that global internet freedom has declined for thirteen consecutive years, with more than two hundred and eighty internet shutdowns documented in 2023 alone.
The smartphone has made every person a potential witness. Nothing has made it safe to be one.
The Witnesses Who Came Before
Every generation has had its witnesses. Every generation has had to improvise the infrastructure to carry their witness out of the places where the powerful did not want it seen.
Dr. Martin Luther King Jr. quoted Amos 5:24 at the March on Washington in 1963 because he believed, correctly, that the truth of what was happening in Alabama would eventually compel the world. He was right. The truth reached the world. It reached the world because photographers and television cameras carried it, held by people who were not anonymous, who suffered for what they documented, and many of whom did not survive the years between Selma and the Voting Rights Act. The civil rights movement was won on the strength of images its enemies could not prevent from being seen, taken by people who had no technology beyond the courage to point a camera and the luck to live long enough for the film to be developed.
Dietrich Bonhoeffer wrote his letters from a Nazi prison on scraps of paper that his family smuggled out one visit at a time, and which were not published until years after his execution in the final weeks of the Third Reich. His letters survive and are read today, across every Christian tradition and beyond, because a few people were willing to risk their own lives to carry his witness past the men who were trying to kill it.
The samizdat networks of the Soviet Union carried Solzhenitsyn and Sakharov and Havel and a thousand less famous voices across decades and across the Iron Curtain. They were built from underground typewriters, carbon-paper copies, and the hand-to-hand distribution of dissident manuscripts that Moscow could not afford to let circulate. The very word samizdat, Russian for "self-published," is what a witness infrastructure built of nothing but paper, typewriter ribbons, and enormous personal courage looks like when the state is your enemy.
The smuggled record of Tiananmen Square in June 1989, including the single image of one unnamed man standing in front of a column of tanks on Chang'an Avenue, was carried out of the country on film by journalists and travelers who understood what the Chinese government would do to the images if they caught them at the border. Beijing still spends enormous resources trying to scrub that image from the internet and from the historical memory of its own people. It does not matter. The image is permanent, because somebody got it out.
In every case the infrastructure was improvised by the courage and luck of a few people. In every case the improvisation worked (when it worked) because the witnesses were willing to die to get the record out. In every case the improvisation failed (when it failed) because a frightened family member destroyed the evidence, or a border guard found the film, or the courier was killed before she reached the place she was going.
The witnesses who came before deserved better infrastructure than they had. Bonhoeffer deserved a way to send his letters that did not depend on the physical bravery of his visitors. The samizdat networks deserved something more resilient than a chain of typewriters. The photographer who captured the Tank Man deserved a way to get the image to the world that did not require him to physically smuggle film past Chinese border officers who would have jailed him for years if they had found it.
The protocol in this document is the infrastructure we owe them and the infrastructure we owe the witnesses who have not yet been born into the regimes that will try to silence them.
The Children Who Are Alive Right Now
A child being born this morning in Khartoum will grow into a country whose history is being written today. It is being written by the forces that are burning her village, not by the people who saw the burning. A child being born this morning in Tehran will grow up knowing that her aunt was killed in the 2022 protests only if someone's witness survived long enough to reach her. A child being born this morning in Azerbaijan, in Damascus, in Kiev, in Nigeria, in a dozen places the international news cycle no longer remembers. Every one of these children will grow up in a country whose twentieth-century history is understood through film, and whose twenty-first-century history will be understood through whatever their parents and grandparents managed to get out of their phones.
We will not see most of what is happening right now. We cannot undo that loss. We can decide whether the next generation will inherit a more complete history than we did. We can decide whether the children being born today will grow up in a world where the phones in their parents' hands are trustworthy instruments of witness or as dangerous to hold as they are in most of the world today.
What We Have Already Lost
We will never see what was captured in Bucha in the days before the first Western journalists arrived: the footage that was not recovered from the phones of the residents who were killed there. We will never see most of what was captured in the first seventy-two hours of the Myanmar coup, before the shutdowns hit and the surveillance caught up. We will never know how many of the Uyghur women, now in Xinjiang's camps, recorded what was being done to them before their phones were confiscated at the gate. We will never know what was on the memory card of the Sudanese photographer whose body was found in El Geneina in the summer of 2023, whose camera was missing.
The archive of what has not reached the world is larger than the archive of what has. We do not know how much larger. We know only that the gap exists, and that it is growing. Every week it grows is another week of evidence that will never see the light, and another week of atrocities that will be written off by history as unproven.
What we have not seen was not missing from the world. It was only missing from our eyes, because the infrastructure to carry it to us did not exist.
We are writing this protocol to make that infrastructure exist.
What AMOS Is
AMOS is the Anonymous Media Origination Standard. It is an open specification for how a piece of media captured by an ordinary person, on an ordinary phone, in the most dangerous places on earth, can travel from the moment of its capture to the desks of the people who can publish it and preserve it and use it as evidence, without ever passing through a channel that can identify its source.
It is not an application. It is not a product. It is not a company. It is a set of rules that anyone can implement, that no one owns, and that no single authority can coerce into silence.
It defines how media is prepared for delivery: stripped of the metadata that would identify the device that captured it, paired with an encrypted envelope containing the submitter's contemporaneous account of what they witnessed, split into fragments so that no single relay along the path holds enough of the file to reconstruct it, and distributed across a network of ordinary devices running the same protocol.
It defines how those relay devices forward the fragments without ever learning who sent them, what they contain, or where they are going.
It defines how the institutions that will ultimately receive the media (newsrooms, human rights organizations, the ICC, academic archives, any organization that chooses to participate) reassemble the fragments and verify cryptographically that what they received is exactly what was captured, by the person who captured it, at the moment they said they captured it.
Amara's footage will travel this path. She will never know which devices carried it. The devices that carried it will never know that they were carrying it. The organizations that receive it will know exactly what she witnessed and where. They will never know who she is.
That is what the protocol does. The rest of this document is the reason we are asking the world to build it.
Key Design Properties
The protocol has six properties that matter. Each of them is a mathematical commitment, not a corporate promise. Each of them exists because somebody, somewhere, has already been killed by the absence of it.
Anonymous by architecture, not by policy. The protocol does not ask you to trust that its operators will not identify you. It makes them structurally incapable of identifying you. There are no accounts. There is no registration. Submitting nodes are indistinguishable from relay nodes to any observer. This is the difference between we promise not to look and we cannot look. Amara will not be identified by this protocol because, within the bounds of its design, the math will not permit it. She will not have to trust that a company's privacy policy will survive the next subpoena, or that a future leader of a human rights organization will not cooperate with a government that demands her name. Policy can be coerced. Math cannot.
Evidence-preserving. Every existing anonymity system faces the same trade-off: protect the source by stripping all metadata, or preserve the evidentiary value of the media by keeping it. AMOS refuses the trade-off. The first category, device-identifying metadata, includes serial numbers, cellular identifiers, file system paths, and anything else that could fingerprint the phone in Amara's hand. All of it is stripped completely. The second category, evidentiary metadata, includes the coordinates of the gymnasium, the timestamp of the twenty-two seconds, and Amara's own brief written account of what was happening. All of it is sealed in a cryptographic envelope that only the receiving platform can open and that cannot be separated from the media bytes without detection. The ICC will be able to prove where the footage was taken, and when, and what the witness said she was seeing. They will not be able to prove, or even discover, who the witness was. That is exactly the property that makes footage admissible as evidence in an international tribunal while keeping the witness alive.
Censorship-resistant by design. When the internet is shut down, the protocol does not stop. In Myanmar, in Iran, in Tigray, it has been shut down for weeks and months at a time. Fragments propagate device-to-device over Bluetooth and Wi-Fi Direct among the phones of ordinary people, most of whom have no idea they are carrying anything. When there are no nearby devices, fragments are stored on the phones that have them and carried out of the blackout region on foot, in a car, on a boat, until they reach somewhere connectivity still works. The protocol was designed from the beginning to assume that the submitter has no internet access and that the first relay might be a phone in the pocket of a stranger who walks out of the city three days later. Content can survive days or weeks of blackout and still be delivered. That was not a feature we added. It was a condition of the world the protocol is being built for.
Decentralized and ownerless. No one runs AMOS. There is no AMOS company. There is no AMOS server. The network is just the set of devices running conforming implementations of the protocol, at any given moment, anywhere in the world. A regime that wants to shut AMOS down has nothing to seize, no one to subpoena, no founder to arrest. The protocol is infrastructure in the way that mathematics is infrastructure: it cannot be owned, and it cannot be prevented from being implemented by anyone who reads the specification.
Content-neutral. The protocol does not inspect what is being transmitted. The relays cannot read the fragments because the fragments are encrypted. No one in the middle of the network (no relay operator, no exit node, no transit provider) can decide that Amara's footage is too sensitive, too graphic, too politically inconvenient, or too dangerous to forward. The protocol delivers everything equally. Editorial decisions, moderation decisions, and legal decisions belong at the receiving platforms, which are free to make them as their laws and missions require. But the pipe itself has no opinion. A regime cannot pressure the pipe to filter. The pipe cannot be pressured, because the pipe does not know what is inside it.
Multi-platform. A single submission can be delivered to multiple consuming platforms simultaneously. Amara does not have to choose between sending her footage to the Associated Press or to Amnesty International or to the ICC. She can send it to all three, and to an academic archive, and to a diaspora community newspaper, all at once, from a single act of submission. No single gatekeeper. No single point of editorial failure. No single institution that can be threatened into burying the story. If one platform declines to publish, the others still have the footage. If one platform is compromised, the others still have the footage. Amara's witness reaches the world, or it does not. But it does not depend on whether any one organization is willing to receive it.
Every property above exists because the absence of it has already cost lives.
Why Not Improve Existing Tools?
A reasonable person will ask: why build a new protocol instead of improving SecureDrop, or adding a mobile client to Tor, or persuading Signal to support anonymous submission?
SecureDrop, created by the late Aaron Swartz and maintained by the Freedom of the Press Foundation, is the gold standard for the job it was built to do. That job is protecting a technically sophisticated whistleblower with access to documents, sitting at a computer with a reliable internet connection, submitting to a single known newsroom. It has protected sources. It is rightly used by the New York Times, the Washington Post, the Guardian, and dozens of other major outlets. We are not proposing to replace it.
But SecureDrop was not designed for a twenty-four-year-old medical student in a gymnasium under fire, with sixty seconds to act, no internet, no desktop computer, no knowledge of Tor, and no specific newsroom in mind. That is a different person, in a different situation, with a different threat model. Retrofitting SecureDrop to meet her needs would require replacing its architecture while maintaining backward compatibility with the newsrooms currently using it, which is harder than building the protocol the new situation actually requires and letting the two coexist.
Tor provides anonymous web browsing. It is a foundational technology and we love it. But Tor was designed for interactive, bidirectional, low-bandwidth communication between a client and a server. It does not handle large media files well. It is blocked in most of the countries where anonymous media submission is most urgently needed. It cannot operate without an internet connection, which means it cannot operate during the blackouts that make anonymous submission most necessary. AMOS implementations can use Tor as one of their transports, and many will. But the protocol has to exist independently of Tor, because the places it has to work are places Tor cannot reach.
Signal, WhatsApp, and encrypted messengers generally assume that the source knows who they want to send to and has an account. Amara does not have the Associated Press's phone number saved in her contacts, and creating an account in the middle of a massacre is not a viable user interface. The messenger paradigm is the wrong shape for this problem.
AMOS fills the gap none of these tools were designed to address. SecureDrop protects sophisticated document whistleblowers. Tor protects browsing. Signal protects private communication.
AMOS protects media witnesses.
These are different problems. The tools are complementary, not competitive. We need all of them, and we need to build the one that is missing.
The Evidence Envelope
Every existing anonymous submission system has forced submitters to choose between two things they should not have to choose between: the safety of their own identity and the evidentiary value of the media they are submitting. Strip the metadata and the footage becomes unverifiable. Keep the metadata and the footage becomes traceable.
AMOS refuses the choice.
At the moment Amara hits the capture button, the protocol records two categories of information. The first category is everything that could identify her phone or her person: the device make, the serial number, the cellular identifiers, the EXIF data, the file system paths. This category is stripped completely and permanently and never enters the protocol. The phone that captured the footage is, from this point forward, unknowable to anyone who receives it.
The second category is everything the footage needs to be believed. The GPS coordinates of the gymnasium. The timestamp of 14:32:47 UTC. The compass bearing of the phone when Amara was recording, so that a verification team at the ICC can tell which direction she was facing when she captured the soldiers' faces. The altitude, so the location can be confirmed against satellite imagery of the school. And Amara's own brief written account, in her own words, typed into the app in the moments after the soldiers left:
Soldiers entered clinic and opened fire on wounded. Central school.
This category is sealed inside an encrypted envelope that only the receiving platform's private key can open.
The envelope contains a cryptographic hash of the media bytes themselves. When the Associated Press opens the envelope, they can compute the hash of the footage they received and compare it to the hash inside the envelope. If the hashes match (and they will), the envelope is cryptographically bound to this specific file, captured at this specific moment, by a witness who wrote this specific description. Nothing in the envelope or the file has been altered since Amara pressed the capture button in the gymnasium. That binding is a mathematical property of the protocol, not a claim any organization has to verify with its own reputation.
The ICC has been asking for exactly this kind of evidence for twenty years. They have been getting some of it: from forensic investigators, from trained journalists, from NGO field teams who can establish chain of custody from the moment of capture. They have never been able to get it from anonymous sources in active conflict zones, because the combination of anonymous and chain of custody was not available until now.
The protocol makes it possible.
End to End: Twenty-Two Seconds
This is what will happen to the twenty-two seconds of footage in Amara's hand between the moment she stops recording and the moment the world sees what she saw. The specific numbers are illustrative. The specific sequence is not.
14:32:47 UTC. She has stopped recording. The soldiers are still in the room but they are beginning to file out. Her hands are shaking. The equipment cart she is standing behind has dead men on the other side of it. She opens the AMOS app on her phone. She installed it weeks ago, after finding a QR code printed on a laminated card distributed by an Associated Press correspondent in the regional capital, before the correspondents were expelled from the country.
She taps Submit. She does not type a password. She does not confirm her identity. There is no identity to confirm. She types the brief description, ten words, and taps Send. The app takes over.
14:32:48. The app computes a cryptographic hash of the video file. This hash is the anchor of the entire chain of evidence. It will be inside the envelope the Associated Press eventually opens. It will be the same hash they compute themselves from the reassembled bytes. If they match, the footage is provably the footage she captured.
14:32:51. The app strips every trace of her phone from the video file: the make, the model, the serial number, the cellular identifiers, the thumbnail cache, the file system metadata. What remains is the visual and audio content only. Nothing in the file can identify her phone. Nothing in the file can identify her.
14:32:55. The app compresses the twenty-two-second clip to a lower-fidelity version for rapid delivery. It keeps the full-resolution original on the phone as a second layer, to be delivered later if bandwidth permits. If bandwidth never permits, the lower-fidelity version is enough for the world to see the soldiers and the insignia. The compromise is deliberate: it is better to deliver something less than perfect than to deliver nothing at all.
14:33:05. The app splits the compressed video into fragments. Each fragment is encrypted with its own key. Each fragment is individually meaningless. A single fragment, intercepted and decrypted, would reveal less than a tenth of a second of video.
14:33:10. The phone has no internet access. The government cut bandwidth to unusable levels two days ago. The app detects this and switches to mesh mode. It scans for nearby devices running AMOS. It finds seven. None of them are in the gymnasium. They belong to people in the street outside, in the apartment buildings across the way, in a teahouse around the corner where the same QR codes had been passed around weeks earlier. None of them know that a phone inside the gymnasium is about to hand them fragments of something. None of them know whose submission they are about to carry. The app does not tell them.
14:34:30. All the fragments have left Amara's phone. She puts the phone in her pocket. She goes back to the boy whose leg she was trying to save. He is still behind the cart where she left him. He is alive. The soldiers did not look behind the cart.
Across the next six hours, the fragments move. The seven phones that first received them move away from the school. Their owners walk home, or drive to neighboring towns, or take buses to relatives in the countryside. As they move, their phones encounter other AMOS-enabled phones and propagate the fragments further. The fragments spread outward through the city like rumor. One phone belongs to a man who takes a bus to the next province. Another belongs to a mother who walks her children to her sister's house across town. Another belongs to a boy who rides his bicycle to a neighborhood on the city's edge that still has a working Wi-Fi network.
18:47 UTC. The teenager's phone, now on his sister's laptop's hotspot in a suburb on the city's outskirts, detects internet connectivity. It switches to internet mode. It begins transmitting the fragments it is holding to AMOS exit nodes, computers elsewhere in the world whose operators have volunteered to accept incoming fragments and forward them to the consuming platforms. The transmission is indistinguishable from ordinary HTTPS traffic. The regime's deep packet inspection sees only an encrypted web connection to a server somewhere in Europe, which is a thing several million phones in this country do every day.
21:15 UTC. Fragments have reached exit nodes in three continents. They have been forwarded to the Associated Press and to Amnesty International, both of which had published AMOS receiving endpoints in advance. The Associated Press's server has received enough fragments to reconstruct the compressed video. It reconstructs it. It opens the envelope. It verifies the hash. The footage Amara captured six hours and forty-three minutes ago in a gymnasium under fire is now on an Associated Press server in a country seven time zones away from the gymnasium.
22:00 UTC. An Associated Press editor in New York watches the video for the first time. Twenty-two seconds. Three soldiers' faces. The unit insignia. The officer's mouth moving. The rifles coming down. The editor has seen footage like this before but not often. She pulls up satellite imagery of the coordinates from the envelope. She finds the school. She matches the school to photographs of the city center. She identifies the unit insignia against a reference database of military units in the country. The video is what it claims to be.
Before the hour is up, the video is on the Associated Press wire, and from there on the front pages of every major newspaper in the Western world by the next morning. The ICC's Office of the Prosecutor is notified. The ICC downloads the video and the sealed evidence envelope. The cryptographic binding between them meets the ICC's standards for admissible evidence from anonymous sources. Amnesty International, having independently received the same submission through its own fragments, publishes its own report citing the same footage and the same envelope.
The next morning, Amara goes back to the clinic. The gymnasium is empty. The bodies are gone. She does not know where. She never finds out. Other wounded have come, because the school is still the only clinic in the area. She treats them. She spends the day expecting the soldiers to return. They do not. She eats nothing.
A week later, the country's government issues a formal denial of the massacre. The denial is widely dismissed in international media because of the footage. Sanctions are proposed in the European Parliament. A named general is placed on a travel ban list. The soldiers whose faces are identifiable in the video begin to disappear from the unit's official rosters. One of them is found dead three months later. It is unclear what happened to the other two.
Amara is never identified. The fragments she sent from the gymnasium contained no information that could identify her. The seven phones that carried the fragments away from the gymnasium have no record of having done so, because the protocol was built so that they would not. The Associated Press and Amnesty know what happened in the gymnasium. They know when. They know where. They will never know who Amara is, because the protocol was built so that they could not learn.
But Amara is also not rescued. The protocol did not save her. It saved only the record of what she witnessed. She is still in the country. The regime is still in power. Most of the soldiers have not been prosecuted. She will live or she will not, and either way the footage will exist, and either way the record will survive her. That is the limit of what the protocol can promise, and it is the most any protocol has ever been able to promise.
It turns out to be enough to matter. It is enough to begin.
What AMOS Is Not
AMOS is not an application. It is a set of rules. An application that follows the rules is a valid AMOS implementation; the specification is not, itself, an application.
AMOS is not a product or a service. There is no company to invest in, no subscription to buy, no premium tier. The specification is an open document. Implementing it requires no permission.
AMOS is not a content moderation system. The protocol cannot see what it is delivering. Editorial decisions belong at the consuming platforms and are their responsibility alone.
AMOS is not a publishing platform. It delivers media to institutions that choose to publish. Whether anything is ever published is those institutions' decision.
AMOS is not a replacement for journalism. Journalism contextualizes, verifies, interprets, and bears responsibility for what it publishes. The protocol simply gets the raw material into the hands of the people who do those things.
AMOS is not a cryptocurrency. There is no token, no blockchain, no financial incentive mechanism, nothing to trade, nothing to speculate on. The protocol has no economic layer at all.
AMOS is not a finished product. This document and its companion specification are a draft published for review, attack, implementation, and improvement. Nothing here has been audited by an independent cryptographic firm. Nothing here has been deployed at scale. Nothing here should be trusted in a life-or-death situation until people more qualified than the current authors have attacked it, improved it, and built it.
But the draft exists. The architecture is sound. The cryptography uses well-known, well-tested building blocks that have survived years of independent audit in other projects. The pieces are ready to be assembled by anyone with the engineering skill to assemble them. What the protocol needs now is builders.
An Invitation and an Enlistment
The specification is published. It is not licensed. It is not owned. It is not controlled. Anyone who can read it can build it. That is, by design, almost no barrier to entry at all. But removing the barriers to entry is not the same thing as causing the work to happen. The work will happen because people choose to do it, and we are asking you, specifically, to be one of those people.
To the Freedom of the Press Foundation. AMOS is the source-side companion that SecureDrop was never designed to be. The architecture you built in 2013 saved lives that would otherwise have been lost. It did that work in one specific corner of the field, and that corner is shrinking. More and more of the world's journalists now work without institutional backing, in places SecureDrop was never built to reach. AMOS extends your mission into the corner you could not reach. We are not asking you to adopt AMOS. We are asking you to look at it the way Aaron Swartz would have looked at it and tell us what we got wrong. You are the people whose judgment on this work should matter most, and we are writing this document in part because we want you to read it.
To newsrooms. Your sources are increasingly people who will never install Tor Browser, never navigate to a .onion address, and never call your tip line. They are students, teachers, farmers, nurses, and bystanders with phones. If AMOS had existed in 2022, your Iran coverage would have been different. If it had existed in 2021, your Myanmar coverage would have been different. It does not yet exist in working form. You can change that. Adopt it. Fund the engineering. Publish a QR code on the front page of your paper that links to your AMOS receiving endpoint.
To the cryptography community. This protocol makes specific claims. It claims to be structurally anonymous within a specific threat model. It claims to be censorship-resistant. It claims to preserve evidentiary chain of custody. These claims are made by a draft that has not been audited, implemented, or attacked. We are asking you to attack it. Break the protocol if you can. Publish what you find. If the design survives your attacks, that is the single most valuable thing you can contribute to it. If the design does not survive, that is nearly as valuable, because it tells us where the work must go next. Do not be gentle. The people who need this protocol do not have the luxury of our gentleness.
To human rights organizations. You have been asking, for as long as you have existed, for exactly this kind of evidence: geolocated, timestamped, cryptographically authenticated, from anonymous sources in places your field teams cannot safely reach. AMOS is designed to give you what you need, in a form your legal teams can take to the ICC, to the UN Human Rights Council, to the national courts of the jurisdictions that matter. Tell us what the protocol is missing. Your voice in the design of it is worth more than any cryptographer's.
To developers. You will build many things in your career, and most of them will be forgotten by the people who did not need them. This one will be remembered by people whose names you will never know, in places you will never visit, under regimes that will try to erase them. The work is unowned. If you have the capacity and you are reading this, it belongs to you if you will take it. You do not need permission. You do not need a committee. Build it. Attack it. Fork it. Write it in a language the specification did not anticipate. But do not ignore it, because the next person who needs it is already alive, and the week you spend deciding whether to care is a week she may not have.
To the people who are reading this and are none of the above. You are not a cryptographer, not a journalist, not a lawyer, not an NGO worker, not a developer, not a press-freedom professional. You are someone who has read this document and been moved by it. You are the reason the rest of the audience above will actually do the work. Share this document with one person who you think should read it. Donate what you can to the Freedom of the Press Foundation, or Amnesty, or Bellingcat, or any press-freedom organization you trust. Follow the protocol's development. Tell the people around you that it exists. Be one of the reasons the work gets built.
To the people in the streets, in the villages, in the places where the world's most important and most dangerous truths are witnessed every day by ordinary people with extraordinary courage: this protocol is for you. It is designed, within the bounds of what a protocol can honestly promise, to protect you from identification and to carry your witness to the world reliably and without asking your permission of any gatekeeper. It cannot protect your body. It cannot guarantee delivery. It cannot guarantee that anything you submit will be believed, published, or acted on. But it can carry your witness across the gap that has, until now, swallowed most of what people like you have tried to send the world. And the people building it are building it because of you, because the record of the twenty-first century is being written right now and you are the people with your hands on it, and the technologists of the world owe you, long past due, the infrastructure to carry what you are trying to give us.
What You Can Do Today
Every reader of this document can do something today. Pick one.
- If you are a cryptographer, spend an hour with the specification and find the first thing you think is wrong. Publish what you found. Even a single issue filed on the public repository is more useful than silence.
- If you are a developer, clone the draft specification and begin sketching a reference implementation in whatever language you are most comfortable with. You do not need to finish it. You need to start.
- If you are a journalist, pitch your editor on a story about AMOS. Not a story about whether the protocol will succeed. A story about whether the infrastructure for anonymous media submission should exist, and whether the press-freedom community is moving fast enough to build it. The public conversation matters.
- If you work at a press-freedom or human-rights organization, circulate this document internally. Ask whether your organization's existing intake workflow could accept an AMOS submission. If it could not yet, ask what it would take for it to be able to. Bring the answer back to the project.
- If you work at a newsroom, find the person at your organization responsible for source security and ask them if they have read this. If they have not, print it out and hand it to them.
- If you are a human rights lawyer, read the Evidence Envelope section and ask yourself whether cryptographically bound, geolocated, timestamped media from an anonymous source would help or hurt the cases you are already working on. Tell us the answer.
- If you are a student, forward this to your most serious professor in cryptography, human rights law, journalism ethics, or distributed systems. Let them decide whether they want to engage. Many of them will.
- If you are an activist in a country where this protocol would matter for your work, tell us, through whatever channel you can safely use, what you need from the protocol that it does not yet have. Your requirements are more important than any cryptographer's preferences.
- If you are none of the above, donate to the Freedom of the Press Foundation, or to Amnesty International, or to Bellingcat, or to a press-freedom organization you trust. They are doing work this protocol is designed to feed into, and they need money to do it. Then share this document with one specific person who you think needs to read it. Name them to yourself. Send it to them by the end of the day.
The protocol does not need everyone. It needs enough of the right people to begin.
Somewhere right now, someone is holding a phone, watching something the world needs to see, and has no safe way to share it. This protocol exists so that the next time that happens, there is a way.
Remember Mahsa Jina Amini. Remember Bonhoeffer. Remember the witnesses you will never know who are alive right now, in places you will never visit, with phones in their hands and courage they cannot use safely. Then build what all of them deserved.
Let justice roll down like waters,
and righteousness like an ever-flowing stream.
The stream cannot be stopped.
PROJECT AMOS
Anonymous Media Origination Standard
projectamos.org