Economic and development analysis: Perspectives on economics, society, development, freedom & social justice. Leading issues in Oromo, Oromia, Africa & world affairs. Oromo News. African News. world News. Views. Formerly Oromia Quarterly
Ethiopian children study in a classroom. (AP Photo/Sayyid Azim)
Thomas Yilma didn’t last a day as a teacher in an Ethiopian government school. After graduating from university he was packed off to a small village in a remote corner of the Ethiopian highlands with scant electricity or phone signal, let alone internet connection, where he was to begin his career. “I felt like I was being abandoned in the middle of nowhere,” he says now. After one restless night he turned around and headed back to the Ethiopian capital, Addis Ababa, leaving the country’s state education sector behind him.
Thomas’s story—extreme though it is—sheds some light on the troubles plaguing Ethiopia’s rapidly expanding school system. Though he eventually found a job in an American-owned private school, this too proved only temporary. After six years he did what many of his colleagues—and thousands of teachers across Ethiopia—so often end up doing, and quit the profession entirely. “I never had any desire to become a teacher,” he says. “You could guess what their lives were like. I wanted to be a doctor or an engineer—like everybody else.”
Few governments in Africa spend as much of their revenues on education as that of Ethiopia.At first sight this is surprising. Education in Ethiopia over the past decade is in some senses a success story. Government statistics are not wholly reliable—the ruling party does a good job of steering clear of most international surveys, making regional comparison difficult—but many of the headline figures are impressive regardless. Few governments in Africa—or elsewhere, for that matter—spend as much of their revenues on education as that of Ethiopia. In a continent which today directs a higher proportion of government expenditure towards the sector than any other—18.4%—Ethiopia has consistently been in the top rank for the past decade. Between 2000 and 2013 it almost doubled the share of its budget allocated to education, from 15% to 27%.
Measured in terms of access to primary education (which is now free), the results are striking. Ethiopia now has one of the highest enrollment rates in Africa, up from the nadir in the early 1990s when it had one of the world’s lowest. The number of primary schools almost tripled from 1996 to 2015, while student enrollment grew from less than 3 million to over 18 million within the same period—almost universal. Youth literacy meanwhile jumped from 34% in 2000 to 52% in 2011.
According to the UN’s Education For All Development Index, which provides a snapshot of the overall progress of national education systems, Ethiopia came second only to Mozambique in terms of size of the improvement over the previous decade, and made fastest progress in terms of expanding universal primary enrolment. Between 2001 and 2008, the number of out-of-school children fell by more than 60%.Compare this to Nigeria, which at the same moment experienced a lost decade: the percentage of children out of school showed no improvement whatsoever by the end of it.
Teacher status
But all this masks a deep-seated malaise. According to the government’s own figures, for every 1,000 children who begin school, around one-half will pass uninterrupted to Grade 5 and only one-fifth to completion of Grade 8. Soaring enrolment at secondary level in Addis Ababa—statistical quirks mean the figure here is actually over 100%—contrasts with less than a tenth in the sparsely populated, largely pastoralist region of Afar, which stretches eastwards towards Eritrea and Djibouti.
Those who do manage to stick it out struggle, consistently under-performing what the curriculum expects of them. According to Belay Hagos, director of educational research at Addis Ababa University, students at various grades are learning on average only 40% of the material they are supposed to master. National Learning Assessments, conducted every four years, reveal a stubborn lack of progress. The average score for a Grade 4 student, for instance, dipped from 41% to 40% between 2010 and 2014, and remains stuck below 50% in all regions except Addis Ababa. Comparing 15-year-old children who correctly answered comparable maths questions in 2009 and 2016, Young Lives, a British charity, also found no overall improvement. “I think the education system is in crisis,” says Alula Pankhurst, the charity’s country director.
Why? Part of the answer lies in Thomas’s story. Ethiopia’s brightest and best don’t want to be teachers, and those that do rarely last long. The country’s teachers were once high status: in the northern region of Tigray, the word itself is a title, used to indicate social respect. But this respect has “declined over time,” says Hagos. The profession has been progressively been de-professionalized, ever since the days of the Marxist regime known as the Derg, during which teachers were either co-opted or purged.
Today, teachers are mostly selected from poor-performing students: those who graduate Grade 10 in the top 30% or so go on to Grade 11; those in the tier below join the police; the rest who pass can go to teacher training college. “This is not a good strategy,” says Hagos. “They can’t be good teachers because weren’t good students in the first place.” His latest research has uncovered what he calls a “professional identity crisis”. 70% of those surveyed reported feeling bad about the profession, while 98% said the pay was too low. “They are teachers but they don’t want to be called teachers,” he says. “They are ashamed of it.”
Language problem
Other problems specific to Ethiopia—beyond the obvious lack of financial resources—are compounding its teaching troubles. An especially tricky one is the country’s federal constitution, which devolves a great deal of education policy to the nine regional governments, in particular language of instruction.
“The transition to English in some regions can be a very, very steep curve.” Even at university level standards can be shockingly poor.Regions tend to choose to educate their children at primary level in the local language, but after that instruction suddenly switches to English—a treacherous passage that few sail through easily. “It’s very worrying,” says Pankhurst. “The transition to English in some regions can be a very, very steep curve.” Even at university level standards can be shockingly poor.
The government knows it has itself in a bind: expanding educational access at such a fast pace was always bound to lead to a dilution in standards. “Ethiopia judiciously picked one route, which was students in rooms and bums on seats,” says Ravi Shankar of Accelerated, a company based in Addis Ababa that is working to improve teaching standards in Ethiopia and elsewhere on the continent. Now the government is making efforts to correct this: teachers wages, for instance, were increased sharply last year, and it has embarked on a large-scale program of skills training for teachers.
But whether it can ever follow in the footsteps of a country like Vietnam—whose single-minded focus on education the government has long sought to emulate—is uncertain. And what if it fails? “A crisis of expectation is a recipe for unrest,” says Pankhurst, noting that the anti-government protests which have swept across much of the country since 2014 were led by students with few prospects and even less hope.
• OCHA Director of Operations, Mr. John Ging, visited Ethiopia to review the status of the Government-led international humanitarian response to drought and conflictaffected communities, including internally displaced people.
• Humanitarian operators receive emergency logistics induction training to equip national emergency management authorities, staff from different agencies and humanitarian actors, with emergency logistics skills to ensure timely and efficient humanitarian response.
• Regional reports of the November-December national humanitarian needs assessment are currently being compiled. The humanitarian requirements for Ethiopia in 2018 will be determined once the compilation of all the regional reports is completed.
On 12-14 December 2017, Mr. John Ging, OCHA Director of Operations, visited Ethiopia to first-hand review the status of the Government-led international humanitarian response to drought and conflict-affected communities, including internally displaced people. The director met and discussed with the federal and regional Government of Ethiopia, donors, humanitarian agencies and communities affected by drought and conflict. Mr.Ging acknowledged the strong partnership the Government of Ethiopia has established over the years with the Humanitarian Country Team. He said that his visit is “a reflection of the importance of that partnership.”
The director visited Hamaressa IDP camp with over 4,000 people internally displaced by the Oromo-Somali inter-communal disputes. Following a briefing by the East Hararge zone administration about the scale of the crisis, Mr.Ging reassured authorities that he is committed to advocating for appropriate response to the crisis. The zonal authorities requested for urgent food and non-food assistance to IDPs East Hararge zone.
Meanwhile subsequent intercommunal clashes were reported in West Hararge zone of Oromia region on the 12, 15 and 16 December resulting in more than 60 deaths. OCHA will continue to work with Government to verify access conditions and impact on humanitarian operations. Conflict has left close to 857,000 people displaced throughout the country.
Visit to Somali region
During the meeting with the Somali Regional Government authorities, the region requested Mr.Ging’s advocacy support to scale up the ongoing response, particularly amidst the growing IDP needs and called for development investment in durable solutions for predictable pastoralist needs. The region also asked for the speedy implementation of cashbased assistance in all targeted woredas/districts. Mr. Ging and the Somali regional authorities discussed the need to improve accountability mechanisms, including quality needs assessment and information management.
WHAT DOES UNREST IN OROMIA SIGNIFY?
By Dr. Stephanie M. Burchard*, The Institute for Defense Analyses , Africa Watch
In mid-December, a series of violent clashes between ethnic Oromo and ethnic Somalis in the Oromia region of Ethiopia resulted in at least 61 fatalities. This outbreak of violence followed the deaths
of 16 protesters who were shot by state security forces on December 12 in Chelenko, located east of Mulu in [Eastern] Oromia. Ethiopia was previously under a state of emergency from October 2016 to August
2017 in response to waves of protest that originated in Oromia and swept the country beginning in 2014. What is driving the recent spate of violence in Oromia, and is it indicative of potential larger unrest?
Origins of Unrest
Despite commonalities in language, religion, and culture, Oromo and ethnic Somalis have experienced
intermittent conflict for at least the past 25 years. Their two regional states, Oromia and Somali, share a border that is poorly demarcated. Much of the conflict between the Oromo and Somali groups has historically centered on access to resources and land.
Both ethnic groups complain about being marginalized by the Ethiopian government, which has been
dominated by the Tigray ethnic group. Ethiopia is ethnically heterogeneous, with more than 80 recognized ethnic groups. The Tigray are one of Ethiopia’s smaller ethnic groups, representing about 6 percent of the total population.
The members of the country’s largest ethnic group, the Oromo, which comprises an estimated 35 percent to 40 percent of the population, feel particularly underrepresented by the ruling Ethiopian People’s Revolutionary Democratic Front.
Although tensions between the Oromo and ethnic Somalis are long-standing, the most recent conflict needs to be contextualized against the backdrop of previous unrest in Oromia that began in 2014. After the announcement of a development scheme in 2014 (detailed in the August 25, 2016, issue of Africa Watch) that would have enabled the government to incorporate parts of Oromia into the capital city, Addis Ababa, protests broke out across Oromia.
During the initial phases of the project, Oromo leaders accused the government of taking over land and forcibly evicting families. Protests continued and the grievances expanded to include concerns over human rights abuses, political representation, and limitations placed on freedom of expression. The government ultimately abandoned its expansion plan in January 2016 in response to the unrest, but anti-government protests continued to spread to the Amhara community, Ethiopia’s second largest ethnic group, and the capital. The government imposed a state of emergency in October 2016.
Current Conflict Details are sparse about the most recent clashes, but reports indicate that members from the Oromo ethnic group were killed first, which then triggered reprisal killings of ethnic Somalis. The clashes are alleged to involve the Somali Special Police, the Liyu. The Liyu are a paramilitary group created by the government in the mid-2000s to deal with a previous secessionist group located in the Somali region, the Ogaden National Liberation Front. The Liyu have been accused of using excessive force and engaging in extrajudicial killings. Coincidentally, in October, government forces
were accused of killing four people in Oromia who were protesting the delivery of a shipment of arms to the Liyu.
While some are attempting to define the recent clashes as primarily ethnic in nature, activists in Oromia claim that the involvement of the Liyu indicates that it is actually state-sponsored violence.
The opinions expressed in these commentaries are those of the authors and should not be viewed
as representing the official position of the Institute for Defense Analyses or its sponsors.
Links to web sites are for informational purposes only and not an endorsement.
The December 2017 clashes appear to be part of an escalation of violence and protest in the region. From
October 1 to November 30, around 118 violent events took place in Oromia, almost 50 percent of which were protests.
An estimated 200 fatalities occurred and tens of thousands are believed to have been displaced. This increase in violence follows a lull from April to July. Roughly 30 percent of all conflict activity in 2017 has involved the Liyu in some capacity; almost 50 percent has involved state security forces
(military or police).
Government Response to Unrest
The Ethiopian government responded to the 2014 Oromia security situation with a heavy hand. Ethiopian police were responsible for hundreds of deaths during protests from 2014 to 2016. In 2016, at the height of the conflict, more than 1,000 fatalities were reported in Oromia. The government arrested protesters en masse and attempted to control the flow of information into and out of Oromia. During the state of emergency, at least 29,000 persons were arrested, many of whom are still awaiting trial. The government arrested scores of journalists and frequently jammed nonstate news sources to prevent them from broadcasting. According to Human Rights Watch, the government also routinely cut cell phone service in areas where the military was deployed, presumably to prevent information about the military’s actions from being publicized widely.
Conclusion
The Ethiopian government announced in August 2017 that it was lifting the state of emergency due to an
improved security situation, but recent events suggest a resurgence of violence and protest in Oromia. The uptick in violence may signal the beginning of renewed unrest in Ethiopia. This should serve as a reminder that the core issues underlying the previous unrest, namely state repression and political representation, were never adequately addressed.
Genocide in plain sight: TPLF’s (mass-) red-terror against the Oromo people
By Aba Orma
The Ethiopian Somali state liyuu police force well trained by TPLF to kill Ogaden and Oromo civilians
The TPLF/EPRDF government has orchestrated genocide against the Oromo people with the help of TPLF’s Janjaweed, the Somali para-commando known as the “Liyu Police”. Even the ruling party admitted to that. Then why is the world community silent and allowed the regime to commit genocide after genocide against the peoples in Ethiopia? Are they afraid that declaring such will collapse the TPLF/EPRDF government and that in turn will bring chaos to the country like that of South Sudan? America is once again knowingly or unknowingly failing to stop genocide in Ethiopia. The alternative to America’s inaction is even much costly in human lives and stability of the Horn of Africa. Whether they like it or not, it is paramount to address and redress the Oromo quest for self-determination to bring peace and stability in the region.
TPLF spokpersons and representatives always represented the Oromo killings and genocide in simplistic terms as ethnic/border conflicts whereas the truth is they are the instigators. Under normal circumstances, governments spin and twist facts to fit their narratives. Medias and observers seek facts and correct spins toward justice. In the Oromo case, the TPLF government spins and the West accepts that as facts and spread it further and provides financial and military supports.
“Genocide is the deliberate and systematic extermination of a national, racial, political, or cultural group”. The violence in Oromia meets the criteria of genocide because it is racially based. The Liyu Police that TPLF generals trained, armed and advised from Somali ethnic group massacred, burned houses, confiscated properties, and displaced more than 700,000 Oromos from their homes in an ethnic cleansing. The West has spoken for much less scale of displacement and massacre as genocide.
The Oromos should not expect Colin Powel of South Sudan to rise for them or actor George Cooney to speak up on behalf of Oromos. They have only themselves and heroes like athlete Feyisa Lelisa and artist Hachalu Megersa amongst us who are willing to risk everything and speak up heroes.
If the Oromo activism we see today had started five years ago, it would have matured, crystalized and would have made a larger impact today. But we are where we are and the time is short. Without any more delay the Oromo activists put aside their difference must come together and have a unified voice to speak up for their brothers and sisters in peril.
The Oromo people had had enough and are rising up in Unisom from all corners of Oromia. From East Oromia to West Oromia, from South Oromia to North Oromia to central Oromia to change this rotten system and replace it with a bright, tolerant, and democratic system. The OPDO seems to have discovered its voice and forced by people’s fundamental human rights question started to challenge the TPLF supremacy. We should all applaud for the courage they have shown us so far and at the same time make it clear to them that the relative support they are getting from their people is not here to stay if they don’t continue to stand up for the people and stop the genocide against their people, stop the exploitation of Oromia to build and rebuild Tigray, and restore the fundamental rights of the Oromo people: the right to self-determination.
The usual TPLF machination is not acceptable. Any cosmetics changes are not acceptable to the Oromo people. Expelling and courting few corrupted TPLF members in the name of reform is not acceptable. The acceptable outcome is a total and complete accountability for each and every innocent life taken away under their command, complete and total surrender of Oromia to the Oromo people.
Any short-hand settlement with the TPLF group will not solve the problem except exposes the inferiority of OPDO to the minority Tigray group with super-size power over the Federal government. It will ignite intensified resistance to the regime and OPDO. The rank-and-file of OPDO who witnessed the horror against their people closely are echoing the Oromo people’s question. Lemma and his young team of leaders have only one choice, to stand with their people to the end. Capitulating to this group with the push of the old guards that spoiled TPLF brats and got them to where they are today is a gigantic mistake of historical proportion.
The Oromo people expect to the minimum, in order of importance, the following condition to be met before any kind of arrangement or agreement with the TPLF group:
Prime Minster H/Mariam Desalegne is incompetent and no more viable to lead the federal government and must resign from his post immediately. He failed the Oromo people when he intentionally chose to ignore the genocide against them and choose to speak selectively on the wrongful death of 31 Somali. The Parliament appoints a new prime minster with its full power.
Every non-Oromo TPLF/Agazi army should leave Oromia and the internal security must be left to the Oromia police. The Oromo members of the army are organized under the command of Oromo generals. Agazi and its TPLF generals led genocide against the Oromo people.
Immediate resettlement of the more than 700,000 Oromos displaced by the “Liyu Police”.
Oromia state government must form an independent commission to investigate and bring to justice the people responsible for the Irreechaa Massacre, the Cheelenko Massacre, and TPLF’s Janjaweed, the Liyu Police.
The composition of the country’s army and its leaders must be proportional to the population
All illegally appropriated lands in the name of investment back to the people.
All political prisoners must be released without any precondition
The Oromia state must take charge of all prisons in Oromia. No Oromo should go to prison outside Oromia.
Any machination and hand twisting will only expose the true power of OPDO as a representative of the largest people in the country and consolidates the struggle in one and only one direction. The independence of Oromia!
#Ethiopia – Addisu Arega, Oromia state communic'n head, says the Oromo people should ask to postpone the 'public hearing' called by parliament for today to discuss the thorny constitutional issue of #Oromia's special interest over #AddisAbeba. The timing is stressful, he said. pic.twitter.com/zATmoEboVA
The Ethiopian People’s Revolutionary Defence Front (EPRDF), the country’s ruling coalition is facing an internal crisis which has led to Members of Parliament (MPs) belonging to two main blocs – the Amhara and Oromia, boycotting parliament, the BBC Africa Live page has reported.
The coalition in a statement released on Wednesday admitted that it was facing gradual ‘mistrust and suspicion’ among the four main blocs. OPDO, ANDM, TPLFand SEPDM.
Twenty four later, members of the Oromo People’s Democratic Organization (OPDO) and the Amhara National Democratic Movement (ANDM) boycotted parliament calling for Prime Minister Hailemariam Desalegn to give an explanation on escalation in recent deadly violence.
The statement according to local media sources went on to assert that a weakness of the executive arm was responsible for the current state of affairs. It said the ‘weakness of the executive’ had contributed significantly to the deteriorating security across the country.
The other two EPRDF parties are the Tigrayan People’s Liberation Front (TPLF) and the Southern Ethiopian People’s Democratic Movement (SEPDM). The coalition holds 100% seats of the parliament.
Ethiopia speaker of parliament quits over govt handling of recent clashes http://bit.ly/2wESpfi
Ethiopia speaker of parliament quits over govt handling of recent clashes
The government deployed Federal security forces to bring the deadly situation under control, a decision that is said to have led to Gemeda’s …
The security situation in Ethiopia is a mix of anti-government sentiment on one hand, ethnic clashes affecting two major regions and a deadly turn of events across some universities in the Horn of Africa country.
Most universities affected by serial deaths of students have closed down due to a lack of conducive atmosphere for studies. The government has said that the deaths were politically inclined and that it was doing everything possible to remedy the situation.
Then last week, sixteen people were reportedly shot in the town of Chelenko in the Oromia region. The regional communications chief blamed it on federal security forces who opened fire on protesters unhappy about the killing of a resident. The government says it has opened a probe.
Then there is the border tensions between the Oromia and Ethiopia-Somali regional states. An escalation in the age-long tension late last week led to the deaths of 61 people on both sides. Scores were also reported to have been injured, houses burnt and hundreds internally displaced.
ONLF and OLF Holds the Ethiopian government and its ruling Coalition Parties as solely responsible for the mass killings of Oromo and Somali peoples
Joint Statement by Oromo Liberation Front (OLF) and Ogaden National Liberation Front (ONLF)
December 21, 2017
The Ethiopian government has been systematically instigating conflict between and within nations in Ethiopia to divert the attention of the stakeholders from its failing rule for the last two years. Although, the Ethiopian government has continually employed divide-and-rule tactics across the country by systematically instigating and promoting civil war among the nations; such war is specifically orchestrated between the Ogaden Somali and the Oromo nations, under the stage management of both Federal government security apparatus, and agents of both regional states.
Such Machiavellian policies of the ruling regime and its regional collaborators has costed both communities, countless lives, and it is affecting not only Oromo people and Somali people in Ethiopia, but also spreading across borders in the Horn of Africa, from Djibouti to Somalia and Kenya. Today, the situation is rapidly deteriorating as hundreds of civilians are massacred. Left unaddressed, the conflict will undoubtedly lead the two fraternal communities to a horrific civil war. Furthermore, if the
Ethiopian regime is left to succeed, such a war inevitably will cost millions of lives with dire consequences for both communities and the communities of wider Horn of Africa.
Cognizant of the fact that, the unfolding tragedies are meticulously masterminded and implemented under the leadership of the regime with the objective of staying in power, employing divide and rule methods as means of governance; the ONLF and OLF holds the Ethiopian regime and the ruling EPRDF party as solely responsible for the crimes committed against both peoples and the wider peoples of Ethiopia. Therefore, we urge the regime to unconditionally and immediately stop such criminal practices.
Furthermore, both fronts request the AU, EU the UN and the international community to urgently start an independent international investigation into the unfolding tragic and continuous massacres of civilians in both sides; that is to date worsening in the entire Somali-Oromia borders including, the other parts of Ethiopia; to be able to bring those responsible for such abhorring crimes to an international tribunal.
The OLF and ONLF call upon the Somali and Oromo people, to stop being used as agents of EPRDF regime to aide it to commit crimes against each other. ONLF and OLF further call upon the traditional elders, civil society, religious leaders, political organisations and intellectuals of both communities to come together and fight this menace against the wellbeing of both nations. ONLF and OLF also call upon all organisations, civil societies and communities in Ethiopia to condemn the current barbarous acts and desist from talking part in it.
OLF and ONLF also call upon media sources to both locally and internationally to expose this heinous crime and avoid fanning the conflict further and report responsibly.
The Oromo, Somalis and the other nations of the Horn of Africa will always remain neighbours; hence those who want to destroy the centuries old fraternal relationships between all communities in the Horn of Africa and Ethiopia are doomed to fail.
Finally, instigating ghastly killings and decapitation of the Civilians in Ogaden Somali and Oromia will never compromise our fraternity and never deviate us from our struggle for Freedom and Self-Determination.
Peace shall prevail!
Issued by The OLF and ONLF on December 21, 2017
Related:-
Ethiopian government’s attempt to blame the victims (the Oromo people) unravels TPLF’s war plans on Oromo people
It has now been more than a year since the Ethiopian government, controlled by the Tigrai People Liberation Front (TPLF), clearly and openly declared a war on Oromo people. In addition, the TPLF government has also promoted conflict between the Oromo people and its neighbors, which have lived together in peace, love and mutual respect for decades.
This TPLF orchestrated conflicts has caused a huge crisis on the life, property and overall wellbeing of hundreds-of-thousandth of Oromo people. In fact, the Ethiopian military generals and leaders have planned, trained and deployed the Somali special forces (aka Liyu Police) to carry-out the killings of the Oromo people and destruction of their homes. As a result of this war, hundredthof-thousandth of Oromos were either killed, wounded, their homes and properties were completely destroyed or displaced. While these all heinous acts have been taking place on Oromo farmers, the TPLF government has never had any saying.
The war currently declared on the Oromo people by TPLF and the Somali regional government is a well-researched and planned war for a long time. To make sure that their plans are being executed, first, they disarmed the Oromo farmers and made them defenseless. After they disarmed the Oromo farmers, TPLF ordered their well-trained and armed Liyu police to carry-out the killings, including kids and women, destroying their homes and confiscating their properties.
As one might recall that Oromo Liberation Front (OLF) has exposed the secret plan of TPLF to open war on Oromos from Eastern to all the way to the Southern Oromia border, which covers a
distance of over 1000km. Not only OLF exposed TPLF’s plan, it has also warned those who were playing political games to stop their evil act before it resulted in such a tremendous crisis. We have also pre-informed the secret plan of TPLF to the world community as well as to the Ethiopian people.
The main purpose of TPLF’s current war is to weaken the Oromo, stop the Oromo Youth-led movement for freedom and overall the Oromo people’s struggle for Freedom and justice. In addition, this is a strategy to divert the real demand of the people and maintain their power and continue their exploitation. Therefore, TPLF and their agents are the main actors of these conflicts. Nonetheless, TPLF’s strategy of promoting conflict between the regions will neither bring a shortterm nor a long-term peace to the country as well as to the region.
While conflicts were taking place in the Eastern, South Eastern and Southern Oromia for over a year, the Ethiopian government has never taken any action to resolve the issue. Contrary to this, TPLF government has trained, armed and deployed the Somali region special forces to perpetrate havoc on the Oromo farmers along the border. Though the Oromo People living along the border have requested the government to secure their peace and defend them against the perpetrators, the Ethiopian government instead continues to support Liyu police with military equipment as well as logistics. As a result, over 700,000 Oromos were displaced from their lands and their homes were burned down. The Ethiopian government did not offer any support to these displaced people.
Perhaps, the burden was left to the Oromo people themselves. Similarly, when many Oromo were massacred at Calanqo, Daaroo Labuu at a place called Hawwii Guddinaa and in many more places, we haven’t heard any press release or any condemnation of the perpetrators from the Ethiopian government, further confirming that the life of the Oromo people worth nothing for the Ethiopian government.
Contrary to these war crimes taking place on Oromo people, we have observed when the Ethiopian prime minister, Hailemariya Dessalegn in his December 17, 2017 press statement, trying to make the Oromo people accountable for the crimes that their military force and Liyu police have done. The Prime minister’s attempt to blame the victims here instead of the killer, Liyu police and military forces, is rather disgraceful. The prime minister would have asked himself, before reading his shameful statement, questions such as who started this war? Where was the war started and why? and try to get the answers.
As head of a state, the prime minister should have rather admitted the crisis and assure the people that the perpetrators will be brought to justice. At the same time, he should have also assured the Oromo people that his government will maintain their peace. But the prime minister’s statement was completely the opposite, trying hard to make the Oromo people accountable for the heinous crime done by the Liyu Police. Such Ethiopian government’s betrayal of the Oromo people has been observed on multiple occasions and thus, we should expect neither any justice nor any support from the Ethiopian government.
Therefore; The Oromo people must understand that it is their right to defend themselves from the war currently declared on them from multiple fronts by TPLF government and its agents. While admiring the generous support that the Oromo mass was giving to its fellow citizens, OLF wants to stress that there is no one for Oromo other than Oromo and nothing is more evident for this than what is currently happening in Oromia. Therefore, such support for our people must be strengthened and continue.
OLF also call upon all Oromo in diaspora to feel the pains and the crisis that the Oromo people are going through in Oromia and work hard to expose the evil acts of TPLF to the international community, and also continue to support our people. It is equally important to make sure that the support that you contribute is in fact reaches the people in need.
The Oromo people and the Somali people have lived together for so long without any issues. However, now the Liyu police and the TPLFgovernment are orchestrating a conflict between these people. We want to renew our call to our brotherly Somali people to let work together to thwart the TPLF’s evil plan.
Lastly, trying to blame the Oromo people, victims of the Liyu police, instead of the perpetrators will never solve the problems. Furthermore, the heinous killings and displacement taking place on Oromo people will not stop by simply blaming on the so-called corruption and illegal trading (contraband) that is taking place in the country. These excuses will never let the Ethiopian government be free from accountability. OLF strongly condemns those who are involved in planning, organizing, and commanding the military and Liyu police forces to open war on Oromo people, those who involved in the killings and displacement of peaceful Oromo and the Somali people.
In addition, the international community should know that ethnic cleaning is taking place in Oromia by the Ethiopian government and its surrogate Somali National government. Keeping silent, in another term, is giving a license for the Ethiopian government to continue killing and displacement of the Oromo people. Thus, OLF call upon the international community to immediately take appropriate action to stop the ethnic cleaning, establish independent enquiry to the killings and attacks that is taking place right now in Oromia-Ethiopia before it is too late.
In a statement by spokesperson released this afternoon regarding the current situation in Ethiopia, the European Union (EU) said it was “essential that independent investigations on all acts of violence are conducted.”
The statement from the EU came in the wake of increasing numbers of violence, including ethnic-based in nature, seen in various parts of Ethiopia as a result of which at least eighty people were killed in just one week
Residents of Nekemte, western Ethiopia, staging peaceful protest against the Killing in Chelenko last week.
“Recurring reports of violence in several universities and clashes in different parts of Ethiopia are deeply worrying” said the statement, adding, “in particular as regards their increasingly ethnic nature. This includes the recent incidents in Oromia-Somali regions, causing many casualties and the destruction of properties. The European Union extends its condolences to the families of the victims.”
Teaching learning processes in many universities have been disrupted following ethnic clashes in universities located in Oromia, Amhara and Tigrai regional states in which at least a dozen students were killed. Some universities are gearing up to open while other remain closed.
According to a local newspaper, Ethiopian ruling party dominated members of parliament have requested PM Hailemariam Desalegn to appear in parliament to give explanations on current pressing issues related to ethnic based violence & growing political crisis. Representatives of OPDO & ANDM, the two parties representing Oromia and Amhara regional states and are members of the ruling EPRDF were at the forefront of the request, according to the report.
“The setting up by Ethiopian Prime Minister Hailemariam Desalegne of a task force to investigate the most recent killings is a welcome step. All sides, including regional and federal police forces, should show restraint to ensure full protection and safety of all citizens,” the EU said in the statement.
It also said that the conflict resolution mechanisms enshrined in the Constitution “should be activated swiftly in order to allow for a peaceful settlement of the issues” and called for inclusive political dialogue. “We remain convinced that only an inclusive political dialogue with all stakeholders will address the grievances of the population in a peaceful and constructive manner.”
Protests have continued in various places as residents and students keep taking to the streets denouncing these killings. AS
An influential news portal in Ethiopia, Addis Standard, has shared photos of students in Oromia region’s town of Nekemte, staging what has been described as “a mass mourning” and silent protest over recent civilian deaths.
The nature of the protest which took place late last week, was of the students marching with their hands up, photos showed then also kneeling with their heads bowed and at a point sitting on streets of the town of Nekemte located in western Ethiopia.
Addis Standard said that the protest was directly linked to the deaths in Chelenko located in the country’s East Hararghe zone. Federal security forces are said to have opened fire on protesters leading to about 16 deaths.
Oromia region communications Bureau chief, Addisu Arega Kitessa, said members of the the national defense force were responsible for the deaths, adding that a probe was underway to ascertain how peaceful civilians had been killed.
Adissu Arega said people in the region’s east Hararghe zone had hit the streets to protest the killing of an individual leading to the latest clashes that have claimed more lives.
The Oromia region was the heartbeat of anti-government protests that hit Ethiopia in late 2015 through the better part of 2016. The protests spread to the Amhara region leading to deaths after a violent security crackdown.
The widening protests led to the imposition of a six-month state of emergency in October 2016. It, however, lasted 10 months after the parliament voted an extension after the initial expiration in April this year. It was eventually lifted in August 2017.
#OromoProtests (students and the public) in Haawaa Galan, Malkaa Roobii town, Oromia, 18 December 2017. Aanaa Haawwaa Galaan magaalaa gabaa roobii hiriira guyyaa har’aa barattootaaf uummata.
The TPLF regime’s military in addition to being killers they are also looters! They are looting the entire country in especial Oromia, which is the richest and largest region of Ethiopia.
TPLF’s military is deeply involved in contraband trades of wood charcoal, particularly in Oromia. They use military vehicles to transport charcoal. This military is responsible for the deforestation and environmental degradation in #Ethiopia. This was apprehended in Adama today.
At least 15 people were killed on December 11, 2017, when members of the Ethiopian Defense Force fired on peaceful protesters. The demonstration was prompted by the killing of an individual by members of security forces of Ethiopia’s Somali Region, in the latest chapter of a longstanding border dispute between Ethiopia’s two largest states — Oromia and Ethiopian Somali in Eastern Ethiopia.
According to reports from local authorities, one person died after being transferred to the hospital following the attack, and more than 12 were injured in the violence which began in Chelenko, a district town in eastern Oromia:
As journalists managed to get more details, this news from the BBC Afaan Oromoo says five people of the same family were among the #Chelenko victims in east Hararghe of #Oromia region who were shot dead by members of the national defense forces on Monday http://www.bbc.com/afaanoromoo/42348773 …
Reports on social media said that members of the Ethiopian Defense Force fired live bullets on peaceful demonstrators. The Ethiopian government has released a belated statement on the incident, but in an unusual move, the party governing Oromia — the Oromo People Democratic Organization (OPDO), a member of Ethiopia’s governing coalition, the Ethiopian People Revolutionary Democratic Front (EPRDF) — released a strong statement accusing members of the Ethiopian Defense Force of violating the Ethiopian Constitution and vowing to investigate the killing of peaceful protesters:
In a single presser, Oromia regional communication bureau slams PM Hailemariam and defense force for causing Chelenqo massacre. The bureau has called the Oromia region’s security forces to prepare for any kind of sacrifice. #Ethiopia#OromoProtests
Some suggested that the statement is merely a symbolic initiative. Others considered it as a signal of the power struggle raging within the multi-ethnic governing coalition, the EPRDF, which comprises four ethnic-based parties: the Tigrayan People Liberation Front (TPLF), the Oromo People Democratic Organization (OPDO), the Amhara National Democratic Movement (ANDM) and the Southern Ethiopian People’s Democratic Movement (SEPDM):
TPLF’s sham coalition EPRDF in disarray—OPDO walked out of the CC meeting, ANDM also followed today. This TPLF machination has certainly run out of steam. TPLF must go! The country needs orderly transition before it’s too late. #OromoProtests#OromoRevolution#Ethiopia
The power struggle involving the four EPRDF parties has been simmering since last summer. The row between the Oromo People’s Democratic Organization (OPDO) and the Tigrayan People’s Liberation Front (TPLF), was exposed when Abdula, the speaker of the Ethiopian Parliament and a prominent member of the OPDO, resigned from his position in October:
The TPLF apartheid like regime propagandist redefines the English definition of a ‘minority’. To misquote the famous saying, “two things are infinite: the universe and TPLF’S stupidity; and I’m not sure about the universe.”
Power is heavily concentrated among members of the TPLF. However, there is some fear that if the OPDO continues down this road, it will be looking to defend itself using weapons, which could plunge Ethiopia into a civil war that will make the current conflict seem like just fisticuffs:
#Ethiopia‘s TPLF leadership should seriously consider requesting US Government mediation to organize a conference among all parties that will produce new democratic dispensation – before law and order collapse completely.
Despite the fact that the Oromo and Somali people who live along the border of Oromia and the Ethiopian Somali regions share close familial, religious and cultural ties, tensions are high along most of the disputed 1,000 km border. A brutal crackdown on the Oromo community living in Ethiopia’s Somali region has triggered a massive humanitarian catastrophe in eastern Ethiopia. By now, roughly 50,000 Oromos have fled into Ethiopia’s historical town, Harar, since last August.
Protests raged elsewhere in Ethiopia as well. A clash between followers of two football clubs from Ethiopia’s northern states, Amhara and Tigray, led to the death of a football fan from Tigray, which in turn caused episodes of violence in three universities located in the Amhara, Oromia and Tigray regional states. Last week saw one particularly violent night at Adigrat University (situated in the Tigray region), where a student from the Amhara region was killed. Gruesome images of the victim subsequently went viral on social media:
Political uncertainty in #Ethiopia amid fresh Amhara, #OromoProtests
Mohammed Ademo@OPride
Over a dozen civilians, including a 10-year-old boy, and a father and son, killed by Ethiopian Defense Forces and many wounded across Oromia and in parts of Amhara state. Renewed protests reportedly…
In what appears to be reprisals, two students from Tigray were reportedly killed at Welega University, located in the Oromia region. The number of incidents and casualties, as well as the number of people involved and the ethnic tone of the conflict over the past few days, has raised the prospect of even greater violence in Ethiopia, according to analysts. The Ethiopian government grudgingly characterizes the recent unrest as ethnic conflict, but also points the finger at diaspora-based activists and social media. However, opposition groups argue that Tigrayan politicians instigatedthe violence as a tool to maintain the status quo:
He also said that the national security council will be investigating the killings and “appropriate measures will be taken.” The public should also not reflect on such incidents emotionally. He added that legal measures will be taken based on the findings of the security council pic.twitter.com/TuYYYJ3xvJ
Commenting on the recent clashes inside univ. campuses he said they were different from previous demands of univ students that were attended to by the gov. The recent clashes have taken a clear ethnic dynamics & have resulted in the killings of students, Dr. Negeri further said. pic.twitter.com/GCtAeQiNJs
On December 13, mobile internet services and social media services were cut off in most parts of the country in an attempt to avert the deepening crisis.
‘The TPLF is playing with the souls of Oromo and Somali civilians to ensure its grip onto power. Killing of civilians by any force must be condemned in the strongest of terms possible. As TPLF has pulled its last card of instigating a civil war among different ethnic groups, authorities in all regional states’ in Ethiopia must beef of their internal security to protect all communities. Oromia regional government in particularly must step up protecting of the diverse communities under its jurisdiction. It must continue to set an example by investigating, apprehending and punishing any and all who are involved in instigating and attacking civilians of any background.’
The TPLF army continues to cause death and destruction in Oromia
A few weeks ago, a contingent of the TPLF military were deployed in Hawi Gudina District of West Hararge without the knowledge of the local administration or providing an explanation on the purpose of the deployment to any of the local authorities. Upon their arrival clashes erupted between the Oromo and Somali armed local militia along the border villages of the Hawi Gudina district. The newly deployed military then arrested several officials of the local administration and businessmen. They also forced the Oromia police contingent stationed there to leave the district. They then gathered Somali residents of Gadulo town ( district capital) and instructed them that they were in danger and forcefully placed them in a warehouse facility.
Two days ago, the newly deployed army members have left unannounced, leaving the Somali civilians in the warehouse where they instructed…
The dearth of foreign currency is compelling the Ethiopian government to delay payments that should be made to international companies in US dollars.
The Reporter has learnt that the government has been unable to settle payments to oil companies that delivered petroleum products to the country in 2015-2017 according to schedule. Vitol Oil supplied diesel and gasoline to the Ethiopian Petroleum Supply Enterprise in 2015 and 2016 after winning the international tenders put up by the enterprise in two consecutive years. Vitol Oil’s second contract was terminated in December 2016.
Reliable sources told The Reporter that EPSE now owes Vitol Oil 20 million US dollars. “Though the company’s petroleum supply contract expired on December 2016 EPSE is unable to settle the remaining 20 million dollars due to foreign currency shortage. The National Bank of Ethiopia has not been able to provide dollars to settle the payment,” sources said.
Similarly the government is unable to settle a 170 million US dollars payment that was supposed to be made to Petro China, the Chinese oil company which has been supplying petroleum products to the country since January 2017. Petro China won the international bid floated by the EPSE in September 2016 and won the tender to supply diesel and gasoline for the 2017 fiscal year. Petro China’s contract will expire on December31, 2017.
Sources told The Reporter that the government now owes Petro China 170 million dollars for the petroleum products it supplied in the fiscal year. Usually payments should be settled within 90 days after the petroleum products have been delivered. According sources, the payment arears are now more than one year old.
Meanwhile international airlines flying to Addis Ababa are facing difficulty in repatriating their sales to their countries. Foreign carriers sell their tickets in the local currency Birr and repatriate their sales revenue in US dollars to their respective countries.
The International Air Transport Association (IATA) told The Reporter that Ethiopia has joined the list of African nations where international airlines face difficulties in repatriating their funds. According to IATA, Ethiopia owes foreign carriers 22 million dollars.
In an interview in his office in Geneva, Switzerland Alexander de Juniac, director general and CEO of IATA, said that nine African countries have a total of 1.1 billion dollars in airlines’ blocked funds. Angola has the largest airlines blocked fund-507 million USD, Algeria-146 million, Sudan-125 million, Nigeria-121 million, Eritrea-64 million, Zimbabwe-52 million, Mozambique-33 million, Ethiopia 22 million and Libya 20 million.
Juniac told The Reporter that most of the countries faced shortage of foreign currency due to the drop in oil price while others have their own economic challenges. “We have been working with African governments to get the airlines blocked funds released and we are successful in releasing most of the funds in Egypt and Nigeria,” Juniac said.
The Ethiopian government officials explain that the country is facing the foreign currency crunch due to the commodity price decline in the international market stunting the foreign currency earnings. The increasing fuel imports and hefty expenditures on mega infrastructure projects are among the long list of contributing factors to the foreign currency shortage. The government is taking various measures to stimulate the weakened export.
#Ethiopia defaults millions of $ in international payments due to forex crunch. https://t.co/KvJ3dhrI96 "The government has been unable to settle payments to oil companies that delivered petroleum products to the country in 2015-2017 according to schedule." pic.twitter.com/kwagist8uq
ESAT, 7 December 2017: According to a well-placed source, the foreign currency reserve in the coffers is only about 700 million dollars that could only run for three weeks.
Several mega projects have already been put on hold. Prominent among the projects is the 550 kms gas pipeline that stretches from the port of Djibouti to well inside Ethiopia.
The import of petroleum and medicines were seriously affected and businesses engaged in export trade had to wait upto a year to obtain foreign currency from banks.
The Ethiopian Shipping and Logistics Services Enterprise was unable to withdraw the 100 million dollars deposit it has with National Bank of Ethiopia.
The source also revealed that about 2000 containers were on hold at the port of Djibouti due to unpaid port fees.
The country’s annual debt payment has reached 2 million dollars of which a significant amount is due to be paid to the Chinese import export bank, China EximBank.
Meanwhile, the managing director of the International Monetary Fund Christine Lagarde is due to visit the country and is expected to talk on possible loans to help the country ease the shortage of hard currency. But the IMF, according to the source, demands the regime to halt the progress of mega projects. The IMF also requires the country privatize state-owned enterprises like Ethio-Telecom, according to the source.
A recent effort by regime officials to rekindle relationships with Qatar in hopes of getting some hard currency from the oil rich country has resulted in unintended and bad consequences. Irate over the developments, the United Arab Emirates, one of the gulf states that loves to hate Qatar, had demanded Ethiopia to pay 400 million dollars for petroleum that it had bought in loan. The UAE has for a long time been lenient on requiring Ethiopia pay the loan, the source said.
'Using fabricated economic data to seek legitimacy,… the regime then advanced narratives about its double-digit economic growth, described with such catchphrases as Ethiopia rising, the fastest growing economy in the world and African lioness.' https://t.co/gV7b30elp4
What’s the point of inheriting the Earth if it’s only going to burn (or drown)? Kids around the world are asking governments this question and demanding answers in court. For example, on Dec. 11, Juliana v. US pitted the president and American lawmakers against the very children whose future they so often invoke when seeking…
Addis Abeba, December 15/2017 – September 2017, the start of the Ethiopian New Year of 2010, had a devastating beginning, the level of which was previously unseen for at least two and a half decades. More than half a million innocent Ethiopians (mostly from the ethnic Oromo background – and to a smaller extent Ethiopian Somalis) were brutally uprooted from their homes and their ways of lives. Only a few weeks before September they all called the villages and towns bordering the Ethio-Somali and Oromia regions – in eastern, southern and south eastern part of the country – a home for decades.
This is what they now have as “home” away from home
Their displacement didn’t come alone; hundreds of men and women were killed in the process; women and girls were raped; and children were separated from their families. This violence has since long been a military violence more than an “ethnic clash” that the international media were busy calling it. It was all laid bare for the world to see in just few weeks.
But laid bare as it were, for the following months since, Addis Abeba, the capital and the center of the federal government’s power, remained as far removed emotionally as it is physically, save for few exceptions. The Oromia regional government’s effort to raise money via an SMS campaign using the country’s telecom monopoly was quickly put off , perplexing the authorities of the regional government and Ethiopians willing to support the effort. But Addis can no longer remain unaffected as more than 2,000 families of who are the victims have made the perilous journey to seek for shelter and safety are now camped inside the Rift Valley university premises located in Nifas Silk Lafto Sub-city, at the heart of the city. They are being sheltered and fed by Dinku Deyas, the owner of the university and volunteers.
Taking care of one another. A group of women cooking for a camp full of internally displaced fellows
This are their stories…
“I was celebrating the New Year with my family when suddenly some members of the Liyu Police broke in to our house,” Deyasa Dengeya, who used to a businessman in the town of Jigjiga, the capital of the Ethio-Somali region, for the last 18 year told Addis Standard. He estimated his capital to be around 3.8 million Birr. “I couldn’t save anything else but my wife and four kids; we left right away, but I wasn’t able to save my kids from the trauma they had to go through. We managed to reach to the military personnel who were around there but they told us that they couldn’t interfere as they don’t have any order.”
At the university’s compound , businessmen and women and different professionals such as teachers, doctors, engineers and more than 30 university lecturers are temporarily sheltered, as was recounted by a Jigjiga university lecturer who didn’t want to tell us his name, not his story. He escaped the attack by hiding in a toilet for five days.
Another woman, who also wanted to remain anonymous, says hat organizations such as the UNICEF and UNHCR had had their workers, whose ethnic backgrounds were Oromo, leave the area for fear that it was beyond their capacity to stay safe and didn’t want to take the risk. “My husband, who was an employee of Save the Environment Ethiopia, survived the attack and death because I locked him in the house,” she said, adding that although the organizations are now calling their employees back to their works places no one wants to go back as they don’t have a guarantee for their safety.
Among those who are now sheltered in Rift Valley University Gerji premises are those, a few years ago, used to live in the outskirts of Addis Abeba but were displaced due to the city expansion projects. Birhanu Girma is one of the people who left Addis Abeba to settle in Jigjiga because his home located in Yeka Sub-city Kotebe area was demolished for a development reason. Displacements has haunted him back.
Men like Dereje Getachew, who were once a productive part of their society, are now sitting jobless, playing cards
The story of Dereje Getachew, a father of two who owned an electronics business for the last two years, is no different. “I never thought this would happen when I started my business there. I even created some job opportunities for the locals but now I’m looking for help myself,” he told Addis Standard.
A committee of misery
Zenebe Degefew is a member of the refugees’ committee formed inside the university shelter. According to him, the committee has reached out tothe Addis Abeba city administration and the surrounding towns requesting for a permanent resettlement. They are waiting for a response, hoping all the same that their please would fall into compassionate ears. But he fears all the same that the mass killings they have seen, the disappearance of families and the large number of rape victims, (seven of those are still getting medical treatment in Sebeta town), is more than what can be compensated.
“There was this bride we have seen, they raped her on her wedding day and killed her groom right in front of her. She then took her dead groom to a place called Gara Muleta, which later became another reason for a rally in Awoday and the surrounding,” a brokenhearted Zenebe told Addis Standard.
There are currently more than 2,000 families living at this temporary camp since they first began arriving on September 22, 2010. “We have been getting supports only from volunteers since the first day we came here and we didn’t receive any meaningful support from the concerned government body,” say other members of the committee who were interviewed by Addis Standard. The lack compassion, political and material support to the victims from the federal government has been a point the authorities of the Oromia regional states have been unhappy about and have stated criticized publicly time and again.
Lack of Hygiene is the next horror awaiting them all
Escaped, just alive
Those who escaped alive and are now sheltered in the university campus are in tern haunted by lack of access to hygiene, including clean living areas, kitchen and toilets, as well as access to medical care, which could have easily been met if the federal government showed the will, according to Ebisa Tamene, a nurse by training who is working in the temporary clinic center at the camp. Ebisa is deeply worried about the dangerous possibilities of an outbreak of a disease or two. According to him, one person was recently infected by skin rash, which immediately transmitted to some 20 other people; “luckily we managed to control it. But if an outbreak such as cholera happens here, I’m afraid it’ll even spread rapidly to the local communities outside the camp,” Ebisa told Addis Standard.
Ebisa sits in this temporary clinic, unable to provide what a clinic is supposed to provide
Ebisa and his colleagues are themselves victims who escaped alive from Chelenko, a scene of another atrocity last Monday. They are now volunteering to take care of their victim friends and camp neighbors. “The Addis Abeba City Administration Health Office has promised to give us an ambulance and free medical treatment at Zewuditu Hospital, but we haven’t seen any of it so far and the refugees are paying half of their medical cost by themselves,” he added.
The refugees are currently being asked to go return to the towns and villages they have left behind. But according to the committee members many are saying they will never go back unless they first see justice served for the wrong done to them. AS
“50 #Oromo civilians massacred and hundreds wounded in Chalanko,” by Tigrean Agazi forces a statement by Australia-based Oromia Support Group says. https://t.co/OBejp6WkTd
Sources from W.Hararge, Hawi Gudina (Mechara) have it that TPLF's military massacred the ppl yet again today. Over 16 civilians and 6 Oromia militia are shot dead, the sources said. The madness of TPLF and its military continued unabated. The ppl can't stand watching the massacre
Ethiopia: Crimes Against Humanity in Oromia Needs Urgent World Community Action
HRLHA Urgent Action
Dec 13, 2017
For Immediate Release
The Human Rights League of the Horn of Africa (HRLHA) strongly condemns the brutality of the Tigray People’s Liberation Front / Ethiopian People’s Revolutionary Democratic Front (TPLF/EPRDF) Government’s military force who massacred 15 Oromo farmers who were harvesting their crops on 10 Dec, 2017 in Chalanko district, EasternHararge zone. This comes after two weeks of the TPLF/EPRDF commanders restarting fresh attacks on Oromos living in border areas near Somali State in which over sixty Oromos were killed in two weeks- since the last week of Nov 2017 to the present- in Arero district (Borana zone), Cinakseen (Easter Hararge zone) ,and Bordode(Western Hararge zone). Currently the TPLF/EPRDF led Ethiopian government has deployed thousands of heavily armed military forces all over Oromia regional, state zones and committed extrajudicial killings, and detentions in Kelem and HoroGuduru, western Oromia zone, in Bale, Arsi, Guji and Borana in southern Oromia zones and in Ambo, Walisso, and Yaya Gullale Central Oromia, Shewa zones.
Among the recent Victimsof theTPLF/EPRDF military forces:
#
Name
Zone/District
Date of Attack
Status
1
TajuYasy
East Hararge/Chalanko
Dec 10, 2017
Killed
2
AbdiSaliIbro
Hararge/Chalanko
Dec 10, 2017
Killed
3
Mhamed Abdela
Hararge/Chalanko
Dec 10, 2017
Killed
4
SaniYuya
Hararge/Chalanko
Dec 10, 2017
Killed
5
AbdelaYisak
Hararge/Chalanko
Dec 10, 2017
Killed
6
Abdumalik Uso
Hararge/Chalanko
Dec 10, 2017
Killed
7
Haru Hasen
Hararge/Chalanko
Dec 10, 2017
Killed
8
Fesal Yisak
Hararge/Chalanko
Dec 10, 2017
Killed
9
Michael Abdo
Hararge/Chalanko
Dec 10, 2017
Killed
10
Mumeadam Hasen
Hararge/Chalanko
Dec 10, 2017
Killed
11
Tofik Abdo
Hararge/Chalanko
Dec 10, 2017
Killed
12
Sali Hasen
Hararge/Chalanko
Dec 10, 2017
Killed
13
Sabaoy Haji Sani, (7th grde student)
West Harage/ Hawigudina district
Dec 7, 2017
Killed
14
Jamal Hasan (Milicia)
West Harage/ Hawigudina district
Dec 7, 2017
Killed
15
three people, no names
Borana/Moyale
Dec 7, 2017
Killed
16
Hasan Basaa
Guji/BuleHora
Dec 6, 2017
Killed
17
Kadiro Geda
Guji/BuleHora
Killed
18
13 people
Borana/Arero
Nov. 24, 2017
Killed
19
Dejen Belachew
Shewa/Yayagullale
Nov, 23, 2017
Killed
20
Dirriba Hailu
Shewa/YayaGullale
Nov, 23, 2017
Killed
21
Girma Shifera
Shewa/Yayagullale
Nov, 23, 2017
Injured
22
Adane Tibabu
Shewa/Yayaullale
Nov, 23, 2017
Injured
23
Insa Megersa
Shewa/Yayagullale
Nov, 23, 2017
Injured
HRLHA has expressed its concerns several times to the world community in general, to Western donor governments (the USA, the UK, Canada, Norway, Sweden), governmental agencies (UN, EU & AU) in particular regarding the systematic and planned killings targeting educated Oromo men and women, outstanding university students, Oromo nationalists by the Ethiopian government killing squad, Agazi force which has been deployed by the government deep into community villages of Oromia.
Advancing its plan of systematic killings of Oromos, the TPLF/EPRDF government trained another group of killers, the Liyu Police in Somali Regional State, Eastern neighbor state of Oromia and deployed them along the border between Oromia and Somali State where they have killed thousands of innocent Oromo farmers-since 2011 to the present- invading the border Oromo areas. The well trained and armed Liyu Police led by TPLF/EPRDF commanders entered into the OromiaState territory from East and West Hararge, Bale, Borana, Guji Zones and killed, evicted, abducted Oromos and occupied some areas in Bale, Hararge, Borana and Guji areas permanently. Oromos and Somali are, respectively, the two largest regions in the country by area size, sharing a border of over 1,400 km (870 miles). The attacks of the Liyu Police on Oromos took place not only across the border, they also killed many Oromos living in Somali Regional State towns of Jigjiga, Wuchale, Gode, forcefully disappeared over two hundred Oromo business men and women and displaced over seven hundred thousand (700,000) others including women, children and seniors.
The 700,000 evicted Oromos from the Somali Regional Statepushed out by the government of Somali state have been deported to Oromiaand are currently suffering in different concentration camps, including in Hamaressain Harar town, Dirredawa and other areas. They are mostly without shelter, and food and are in poor health.
Sadly enough, these displaced Oromos did not get the attention of the TPLF/EPRDF government and did not receive any humanitarian aid from the federal government of Ethiopia and other sister federal states or from international donor governments and organizations in the past over six months. They depended only on their fellow Oromo brothers and sisters. The Federal Government of Ethiopia which highly depends on Oromia resources (about 70%) for its annual income has failed to provide even emergency funding to Oromos who have been displaced and chased from Somali Regional State leaving behind their all belongings. The TPLF/EPRDF government and the Oromo People’s Democratic Organization (OPDO), the member of ruling party, the EPRDF deliberately hides the suffering of 700,000 displaced Oromos from the world society, a move equal to genocide.
Based on the violations against the Oromo nation by the Ethiopian government over the past twenty-five tears, the HRLHAhas found that the serious gross human rights violations committed by the Ethiopia Government against the Oromo nation since 1991 to the present constitute crimes against humanity under international law. Crimes against humanity are certain acts that are deliberately committed as part of a widespread or systematic attack or individual attacks directed against any civilian or an identifiable part of a civilian population. The crimes against humanity act include: a) forced population transfers and deportation, b) murder, c) rape and other sexual violence, and d) persecution as defined by the Rome Statute article 7 of the International Criminal Court (ICC) and the ad hoc international criminal courts.
Background:
The World community has witnessed in the past four or more years, since the Oromo mass movement had begun in 2014 to the present,that the Ethiopian people in general and the Oromo people in particular have suffered or are still suffering under the EPRDF government:
Over4500 Oromos, from young to old, have been brutalized, tens of thousands have been incarcerated and other thousands have been forcefully disappeared during the Oromo protests and over 700 hundred were massacred on October 2, 2016 at the Irrecha Oromo thanksgiving Festival
For the past 26 years, the world has seen that this Ethiopian government does not believe in finding peaceful and sustainable solutions through negotiations with opposition political organizations or in finding solutions for the grievances of the people.
The EPRDF government pretends in front of the world community it is practicing democracy, while the facts on the ground show that the Ethiopian government is committing a crime, a systematic campaign against Oromos that causes human suffering, or death on a large scale-a crime against humanity.
Therefore, the HRLHA urges the international community to act collectively in a timely and decisive manner – through the UN Security Council and in accordance with the UN charter on a case-by – case basis to stop the human tragedy in Oromia, Ethiopia.
The international communities and agencies (AU, EU & UN) can play a decisive role by doing the following:
Provide humanitarian aid to the displaced 700,000Oromos immediately to save the life of the people before it is too late
Put pressure on the TPLF/EPRDF government to allow neutral investigators to probe into the human rights crisis in the country as a precursor to international community intervention
Put pressure on the Ethiopian government to release all political prisoners in the country
Intervene to stop crimes against humanity by the Ethiopian military force using the principles of R2P adopted in 2005 by the UN General Assembly
Demand thatthe Ethiopian government return its military forces back to their camps from Oromia villages and towns
Copied To:
UN Security Council
Office of the Ombudsperson
Room DC2 2206
United Nations
New York, NY 10017
United States of America
Tel: +1 212 963 2671
E-mail: ombudsperson@un.org
UN Human Rights Council OHCHR address: Office of the United Nations High Commissioner for Human Rights (OHCHR)
Palais Wilson
52 rue des Pâquis
CH-1201 Geneva, Switzerland.
Africa Union (AU)
African Union Headquarters
P.O. Box 3243 | Roosevelt Street (Old Airport Area) | W21K19 | Addis Ababa, Ethiopia
Tel: (251) 11 551 77 00 | Fax: (251) 11 551 78 44Webmaster: webmaster@africa-union.org
The US Department of State WASHINGTON, D.C. HEADQUARTERS
(202) 895-3500
OFMInfo@state.gov
Office of Foreign Missions
2201 C Street NW
Room 2236
Washington, D.C. 20520
Customer Service Center
3507 International Place NW
Washington, D.C. 20522-3303
UK Secretary of State for Foreign and Commonwealth Affairs
Parliamentary
House of Commons, London, SW1A 0AA
Tel: 020 7219 4055
Fax: 020 7219 5851
Email: hammondp@parliament.ukDepartmentalStreet,(DepartmentalStreet???)
London, SW1A 2AH
Tel: 020 7008 1500
Email: fcocorrespondence@fco.gov.uk
Minister of Foreign Affairs (Canada) Write to:
Enquiries Service (BCI)
Global Affairs Canada
125 Sussex Drive
Ottawa, ON
K1A 0G2
Email: Enquiry Service – Online form
Canada
Minister for Foreign Affairs (Sweden)
Her Excellency Margot Wallström
Switchboard: +46 8 405 10 00
Street address: Rosenbad 4
Postal address: SE 103 33 Stockhol
Minister of Foreign Affairs (Norway)
His Excellency BørgeBrende
Ministry of Foreign Affairs
E-mail: post@mfa.no
Phone: + 47 23 95 00 00
Address: 7. juniplassen 1, N-0032 Oslo
#Ethiopia government's use of deadly force to deal with civilian opposition is first step to national disintegration. Nation-wide reconciliation exercise is urgently needed.
Disturbing reports coming out Chalanko in eastern Oromia say that over 50 unarmed students and civilian Oromos were massacred& tens wounded by Ethiopian military controlled by Tigirean elites. Chalanko is also a site of historic genocide against Oromo in 19th century.
It’s never been easier for governments to keep track and spy on dissidents, but now that spyware software can be bought virtually off-the-shelf, any country can get in the game. (Kacper Pempel/Reuters)
In October 2016 at the Irreecha religious festival in Bishoftu, Ethiopia, at least 55 people were killed in a stampede after police fired tear gas into the crowds.
The deaths sparked nationwide protests and within days, a different kind of countermeasure got underway: cyberattacks.
Festival goers flee during a deadly stampede in Bishoftu. Several thousand people had gathered at a sacred lake to take part in the Irreecha ceremony, in which the Oromo community marks the end of the rainy season. (Zacharias Abubeker/AFP/Getty Images)
‘The government was very nervous, the population was angry. So it was this time that they tried to hack me.’– Oromo activist Jawar Mohammed
Given the work activist Jawar Mohammed does with the Oromia Media Network (OMN) and his profile online, he figured he’d be an obvious target, but it was how he was targeted that surprised him.
“When this suspicious email came, I did not open it. I passed it to our IT department. They looked at it, and they suspected it might be spyware,” he tells The Current’s Anna Maria Tremonti
“We in the media were providing the domestic and international community with updated information from every village. So the situation was extremely intense. The government was very nervous, the population was angry. So it was this time that they tried to hack me.”
Residents of Bishoftu crossed their wrists above their heads as a symbol for the Oromo anti-government protesting movement during the Oromo new year holiday Irreechaa in Bishoftu, October 2, 2016. (Zacharias Abubeker/AFP/Getty Images)
Even before the protests, Mohammed says the government was using different hackers from Russia and China to get into his email and attack OMN’s website. What made the email suspicious?
Mohammed says the email looked like it came from people he knew. There was also a link provided and when clicked, prompted an Adobe software download.
“That was quite strange so I stopped there and contacted our IT people,” he says.
Then the University of Toronto’s Citizen Lab that studies surveillance and content filtering on the internet was contacted to investigate this email.
Bill Marczak at the University of Toronto’s Citizen Lab says rules and oversight regarding lawful intercept are lacking. (Getty Images)
Bill Marczak, senior research fellow at the facility, says upon looking at Mohammed’s email, a link that looked like it was going to a website called EastAfro.com, which is an Eritrean online video portal, was not what it seemed.
“When we looked at the link, it actually appeared that someone had registered a website to look like EastAfro.com which was called EastAfro.net. So it was a lookalike website which was our immediate clue that something was suspicious,” Marczak tells Tremonti.
A virtual machine in the lab determined that when the link in Mohammed’s email was clicked and the software downloaded and installed, “it would have started sending information from the computer back to a server on the internet which is a telltale sign of spyware,” Marczak says. Is this illegal?
While it’s typically illegal for a private individual to use spyware against someone else, Marczak says when it’s a government following this procedure, they can often use local law as a defence.
“But the problem is that governments like Ethiopia and other places, the rules and oversight regarding lawful intercept are lacking,” he says.
‘We found an IP address traced to Ethiopia.’– Bill Marczak
Marczak says the lab was able to trace a sample of the spyware from Mohammed’s email to a fake Adobe Flash update used by computer security researchers who investigate suspicious files.
“We noticed the second sample was signed by this company Cyberbit. And from there we looked at its website and found out that this is the company that claims to sell exclusively to governments,” he explains.
The spyware was traced to Ethiopia because the server attached to it had a publicly accessible log file, according to Marczak.
“This is not typically something that you want to have on your spyware server if you’re running a secret operation,” Marczak says, adding that the company probably forgot that this feature existed.
“The log file showed who was logging in to check the results of the spyware. In other words, who was logging in to download the data that was being uploaded by infected computers, and we found an IP address traced to Ethiopia.”
The Current did contact Canada’s privacy commissioner, Daniel Therrien, for comment on this story. A spokesperson replied that online surveillance by foreign governments is outside the commission’s jurisdiction, and directed The Current’s producers to Global Affairs. We contacted that department, but no one got back to us.
The Current also contacted the Ethiopian embassy in Ottawa. A spokeswoman there said no one was available to speak to this issue today.
Listen to the full conversation above — including Dmitri Vitaliev, co-founder and director of eQualit.ie, a Montreal-based nonprofit that provides support, training, and digital protection for journalists activists and civil society workers worldwide.
This segment was produced by The Current’s John Chipman and Susana Ferriera.
Two students were also killed last night at Shambu campus of Wolega university as student protests continued in several universities
By Addis Standard staffs
December 12/2017 – The number of civilians killed by security forces in Chelenko town, Meta woreda in east Haraghe zone of the oromia regional state has risen to 15; more than a dozen were also wounded, many of whom are in critical condition.
According to Addisu Arega Kitessa, head of the Oromia region communication bureau, authorities at the highest level in Oromia region were investigating why and how these killings were “taken against peaceful civilians”. Addisu implicated the role of members of the national defense force but the locals say the killings were also committed by members of the Liyu Police operating in Ethio-Somali regional state and is accused of committing perpetual violence against civilians. According to Abdulatif, a nurse in Dire Dawa hospital who only wanted to be identified by his first name, many of the wounded who are currently being treated at the hospital have “are being treated for gun shots, some of which were from a close range,” he told Addis Standard by phone.
According to Addisu Arega, the protesters in the city have went out to the streets yesterday to denounce the killing of an individual called Ahimaddinnn Ahimad Asaasaa, by members of the Liyu Police. Ahimaddinnn died on the way to a hospital, which led the town’s people to come out to the streets to protest.
Abdulatif told Addis Standard quoting “some of” the family members of the victims that the “protests were happening with the people of the town chanting ‘enough with the killings by [the] Liyu police’ when all of a sudden shots began to be fired.” According to him, protesters in other parts of the city have then begun blocking roads “to prevent the security forces access to protest areas, but the security forces have dismantled the road blocks using heavy military vehicles while at the same time shooting at the protesting civilians.”
Six people killed on the spot yesterday, according to Addisu. But that number has now risen to fifteen. Abdulatif said many of the wounded admitted at the hospital “may not survive due to the severity of their wounds.” Among them were women and children. Abdulatif couldn’t tell the exact number of civilians admitted to the hospital, but Addisu said yesterday that 14 people were wounded, six of whom seriously. On December 09/2017 residents of Babile and Moyale towns in east Hararghe and southern Ethiopia respectively have told the VOA Amharic that there were everyday killings committed by members of the Liyu police. Several pictures showing wounds of gun shots and dead bodies are circulating in Ethiopia’s social media space.
The burial of those who were killed yesterday is expected to take place today and security in the area remain tense.
University students protesting
Meanwhile, two university students were killed last night at Shambu campus of the Wolega University, 305 km west of Addis Abeba, following “fights between the students,” according to Addisu Arega. He said several suspects were detained and were under investigation. Addisu provided no further detail but said he would release further information is due course.
The news comes as students in universities of Gonder & Woldiya in Amhara regional state and Ambo and Haremaya in Oromia regional state began protesting since yesterday in the wake of the killing of a student in Adigrat University in Tigrai regional state over the past weekend as a result of a fight between two students. Officials have not released adequate information surrounding the clear circumstances of the killing of student Habtamu Yalew Sinashaw, a second year management student who was from West Gojam Zone, Dega Damot Woreda, Dikul Kana Kebele of the Amhara regional state. But the news has stirred ethnic tensions in several university campuses. Protesting students also claim that the number of casualties is more than what is admitted by authorities. A video allegedly showing the protest by Gonder university students has also surfaced.
The protests have continued until today and security forces are being dispatched to the university campuses.
#Ethiopia -a 10 year old child who was "shot in the head' & a father & a son among civilians killed by security forces in #Chelenko, east Hararghe yesterday https://t.co/5awTfAswt6 an eye witness also tells BBC Afaan Oromoo of counting 20 bodies, raising fears of more causalities
#Ethiopia– access to regular #Internet without a VPN is disrupted in many areas, including in the capital. It came amidst increasing reports of student protests in various university campuses against the killing of a student in #Adigrat Univ & at least 15 civilians in Chelenko. pic.twitter.com/Cwwk8RqY06
"Mass Funeral for victims of #ChelenkoMassacre. Four members a single family were killed when they were hit with barrage of machine gun fire inside their own farm." pic.twitter.com/sqfiWAu5zO
After having been blocked by TPLF military as they march to take part on mass funeral of those massacred yesterday at Calanqo, students from Malkaa Balloo in E. Hararge demanding the complete withdrawal of wayyaane's military from Oromia. AGAZI OUT OF OROMIA!! #OromoRevolutionpic.twitter.com/ajn4fzvU26
The Ethiopian government has allegedly carried out a spyware campaign targeting dissidents living abroad, including in the U.K., a report has claimed.
Canada-based research group Citizen Lab alleged that Ethiopian dissidents were targeted with emails containing “sophisticated commercial spyware posing as Adobe Flash updates and PDF plugins”.
The report further claimed that Ethiopia used a commercial spyware product manufactured by Israel-based Elbit Systems Ltd to spy on dissidents.
Those targeted included dissidents from the Oromo community, one of Ethiopia’s largest ethnic groups, the U.S.-based media outlet Oromo Media Network as well as one of the researchers conducting the investigation.
Etana Habte, an Oromo activist and PhD candidate and Senior Teaching Fellow at SOAS, University of London, was also targeted.
He believes the government allegedly targeted him to identify people behind protests in Ethiopia’s Oromia state, which was rocked by months-long demonstrations, some of which turned deadly.
“By spying over us they mainly want to identify a wide circle of people who communicate with us on the movement at home,” he told Newsweek.
“They wanted to break into our privacy, collect information from our communications with one another, because they believe the leadership of Oromo Protests communicates with us.
“The solution for Ethiopia is not in spying over political dissenters like us, it is in listening to the people and meeting their demands” Habte said.
The Ethiopian embassy in London has not responded to a request for a comment on the allegations.
Ethiopian Communications Minister Negeri Lencho declined to comment on the report, according to Reuters.
Researchers said their findings raised questions on Elbit’s human rights due diligence practices.
The company said in a statement: “The intelligence and defenses agencies that purchase these products are obligated to use them in accordance with the applicable law.” It added that it only sell products to defense, intelligence, national security and law enforcement agencies approved by the Israeli government.
Deadly protests explained
People mourn the death of Dinka Chala who was shot by Ethiopian forces in the Yubdo Village, about 100 kilometers from Addis Ababa in the Oromia region, on December 17, 2015. Dinka Chala was accused of protesting, but his family says he was not involved. Oromia was rocked by months-long protests, some of which turned deadly.ZACHARIAS ABUBEKER/AFP/GETTY IMAGES
Demonstrations started in Oromia in late 2015, where people initially protested over government plans to expand the territory of the capital Addis Ababa, with farmers raising concerns that increasing the size of the city would lead to forced evictions and loss of farming land.
The government later scrapped the plans, but protests continued. Oromo people argued for a greater inclusion in the political process and the release of political prisoners.
The protests, labelled as the biggest anti-government unrest the country has witnessed in recent history, later spread to Amhara and the Southern Nations, Nationalities, and Peoples’ Region (SNNPR) region.
The unrest continued throughout 2016.
Last October, the government implemented a six-month-long state of emergency, which was further extended by four months in March, to tackle the unrest.
Critics of the state of emergency claimed the government was trying to quell protests by, among other things, restricting freedoms and banning certain media outlets, including the Oromia Media Network. The government denied the allegations.
Rights groups have criticizied Ethiopia for the way it handled protests, accusing the military and the police of using excessive force to quell demonstrations.
The response to the unrest resulted in the death of at least 669 people, a figure the government confirmed in a report released in April.
While the country’s Human Rights Commission recommended prosecution of some police officers, it maintained that the overall response by security forces was adequate.
Sirba Giddii ; it is an axiom of Afaan Oromoo that states if someone isn’t too much into dance, but has to do it just to pass the unwelcomed invitation.
The Third Oromo Leadership Convention was held in the City of Houston, Texas December 1-3, 2017. The delegates participated in extensive discussions concerning the situation in Ethiopia based on analyses presented by several scholars. The delegates established that the Oromo Protest that started in 2014 has opened new possibilities for transformative change in Ethiopia. They also recognized that, because of the protests, the historic Oromo struggle has advanced from resistance against oppression to reconstruction in preparation for the imminent political transition in Ethiopia.
The country is in throes of deepening multidimensional crises. This is the conclusion of an assessment jointly prepared by Ethiopian intelligence and defence officials otherwise known as the National Security Council. There is a historic opportunity for transition to a genuinely participatory democracy that emerges from below. There is also the danger that the opportunity could be squandered. To protect the gains made and to soldier on towards ultimate victory, we urge all Oromo nationalists to do their part to deny the forces of reaction the chance to launch a counterrevolutionary offensive against the Oromo struggle.
We issue this statement as the consensus of the delegates to the Third Oromo Leadership Convention calling on all those who support the longstanding goals of the Oromo national movement to facilitate a peaceful transition to a new political dispensation of a participatory democracy.
IMMEDIATE MEASURES
Immediate steps need to be taken to reverse the deepening crisis by asserting the legitimacy of any existing constitutional body. A peaceful and democratic transition addresses the current crisis of legitimacy and sets the stage for the restoration of democratic-constitutional state. The following can be taken as steps for action.
Legislative Authority
Reasserting authority. The Tigray People’s Liberation Front (TPLF), the core of the governing party, now admits that it is responsible for the deepening political and economic crises in Ethiopia. Because of its culpability in precipitating the crisis, the TPLF incapable of addressing the profound problem of lacking of a visible, authoritative, and widely acceptable leadership that has paralyzed the country for some time must be addressed. The federal legislature is the only body where the voices of all constituencies are said to be represented on a proportional basis. It must reassert its authority to prevent harmful laws from passing. This would constitute a major step towards a smooth transition to a genuine participatory democracy.
Transparent Debate: Responding to demands of the people should be the focus of the elected representatives of the people. Parliament should debate the ongoing crisis and take steps to restore order based on the wishes of all constituencies. The parliamentary deliberations should be done publicly in order to win the support to all constituencies.
Critical First Steps: The federal parliament can institute the following confidence-building measures to give chance to an orderly transition.a. Repeal unconstitutional laws: The Anti-Terrorist Law, the Press Law and the Civil Society and Charities Law are designed expressly to prevent citizens from exercising the human rights enshrined in the constitution. They are unconstitutional and should be repealed. The law for registration of political parties, the electoral law and the various regulations and directives issued under it, and the law on public political meeting and peaceful demonstration must be revisited with a view to allowing the people maximum freedom to associate, organize, assemble, demonstrate, and express their political views, interests, and petition for their rights within the ambit of their constitutional human rights.
b. Release all political prisoners: Opposition leaders who now languish in prison are victims of these unconstitutional laws. With the repeal of these laws, it then follows that they should be released unconditionally.
c. Reform the System: The instruments of “dominant-party rule” are: a justice system that is subservient to the will of the ruling party; a security system that operates to eliminate opposition and resistance; and a national election commission whose reason for existence is to declare the ruling party’s election victories without counting the votes. Parliament must engage in a genuine and sustained justice sector reforms, security sector reforms, electoral system reform, reform of all democratic institutions of representation (House People’s Representatives), inclusion (House of Federation), human rights (Ethiopian Human Rights Commission and the Institute of the Ombudsman), and accountability (Auditor general and Anti-corruption Commission).
Outlawing Illegitimate Authority: There is widespread perception that there is a private source of power behind the public institutions. Decisions are first hammered out in private and then forwarded to the public legislature for enactment. Rendering the parliament functional can obviate the dangers that the private centres of power are likely to pose to protect their ill-gained power and privilege.
Executive Authority
There is only one way out of the present crises: the legislature should act as the true and supreme source of power [as per art 50(3) cum 54(4) of the Constitution] and stop waiting for somebody to give it direction. The incumbent executive entity has no credibility or legitimacy. Parliament must institute a governing structure that observes the rule of law.
Reformed Executive: Parliament must do everything to resuscitate the civilian governing bodies and end rule by the security organs of the state. To do this, Parliament must form a new, more inclusive, more credible, more functional, and more representative government in such a way that expresses the wishes of the people as manifested in the protests.
Marshall Support: Following the adoption of this process of peaceful and systematic transition, the legislatures of the regional states should pass resolutions in support of the reform agenda. And the residents of these administrations should be mobilized to support the actions of their legislatures.
Re-establish Security: There is increasing reliance on coercive means and institutions, which is eroding the effectiveness and legitimacy of civilian institutions. We believe the Ethiopian Defence Force (EDF) is responsible for the deteriorating security situation characterized by a “breakdown of the rule law,” “apparent lawlessness” and “episodic conflicts” and it at least complicit in the death and mayhem that is still creating havoc throughout Oromia. The legislature must assert civilian control over the EDF and arrest the deepening political and economic crises.
Internally Displaced Persons: We condemn the massive displacement of Oromo from the Somali regional state. The deliberate act of organizing the eviction of a group of people because of their identity is crime that must be investigated and the perpetrators of the crime brought to justice. The president of the Somali regional state, Abid Mohammed Omer aka Abdi Illey, should be brought to justice for the crime against humanity his forces committed against innocent Oromos. Parliament must immediately conduct inquiry into the source of funding and the legal basis for its operation. Parliament should also work towards disarming and disbanding this unruly paramilitary forces such as the Liyu Police that the regional president uses to advance his egregious agenda of ethnic cleansingand replace it with a properly recruited and trained State Police.
Reassuring stakeholders: Interested foreign powers need to be reassured that their interests would not be negatively affected. In particular, legitimate foreign investors should be reassured that their outlay is safe. It should be made abundantly clear to these parties that a sort of internal stability drawing on democratic legitimacy would render it a better guarantor of regional stability than an order that is internally challenged. This should in fact make the donor countries evaluate their uncritical support for the regime and push for a transition to a democratic order.
OROMO POLITICAL COMMUNITY
We affirm our ultimate national objective is belief stated in the OLC Charter, An Oromo Covenant, that the Oromo people shall always draw inspiration from their gadaa democratic heritage and shall remain a self-governing, participatory democracy founded on respect for fundamental human rights.
In this Convention, we concluded that a true democratic transition in Ethiopia can only be viable if it addresses the long standing demands of the Oromo national movement as expressed in our time by the Oromo protests. While they are expressed in multiple ways, the Oromo demands are captured in the all-encompassing expression, abbaa biyyummaa, which is the demand for sovereignty over the governance, the resources and the ownership of our homesteads, land and country.
As we anticipate ushering in this new political dispensation, we urge all Oromo political parties to deliberate on the current situation carefully and systematically and offer a clear roadmap for what will be implemented in the wake of the inevitable collapse of the regime in power.
CIVIL SOCIETY FORCES
The revival of the Abba Gadaa institutions is evidence of Oromo cultural renaissance and revitalization of Oromo indigenous political heritage. The Abba Gadaa councils are a genuine Oromo institution that must be strengthened. In this respect, we support the councils’ work and express our wishes for the following.
The Union of the Oromo Gadaa Council is urged to call the Oromia gadaa assembly to consider national issues once a year.
The different regional gadaa councils established at the many former gadaa assemblies should begin to legislate rules that will strengthen the functions of the gadaa institutions.
The regional gadaa councils should take measures to create institutions that take account of their adaptability to the present generation’s needs and demands.
The councils must continue to build civil society institutions, particularly the inclusion of women into gadaa structures.
Oromo communities and other peoples find the indigenous institutions of conflict resolution more expeditious and judicious than the lengthy litigation handled by formal institutions. We urge the regional gadaa councils to begin to take measures to relaunch alternative dispute resolution processes and institutions to complement the functions of formal institutions.
DONE IN HOUSTON, TEXAS, ON THIS 3rd DAY DECEMBER 2017.
The first Oromo Leadership Convention (OCL) held in Atlanta, Georgia, November 11 – 13, 2016, took place at a time of heightened risks for the Oromo protests. There was pent-up anger in the country over the Ireecha Massacre and deep apprehension concerning the just declared state of emergency in Ethiopia. The second was held in an atmosphere profound uncertainty with many Oromos wondering whether the protests movement had atrophied. There was concern that Command Post, the military unit in charge of the state of emergency had succeeded in arresting the momentum of change the Oromo protests had unleashed.
The situation today is very different. We can be more confident that the struggle has moved on to a more hopeful stage. We are on the cusp of becoming free but that outcome is not assured. It is a critical period in the history of our nation and out longstanding struggle. At this stage, the OLC needs to aim to address current challenges continue to assist the struggle at home and complete the struggle with triumph.
To contribute our part to the current phase of the Oromo national movement, the OLC Coordinating Committee to affirm the decision that was made at the Washington Convention and announce that the third convention will be held in the City of Houston from December 1-3, 2017.
AGENDA
We believe that the Oromo national movement has entered a decisive, if uncertain, stage. The OLC was organized to nudge the Oromo struggle forward, affirm the unity of the nation and organize its national politics. At this stage of the struggle, we maintain that Oromo nationalism has moved from a defensive posture to an assertive model. The delegates will evaluate the road we have traveled and chart course for the future of our nation.
1. Envisioning a Pluralistic Society: Oromo is a unified nation with a social organization that recognizes differences of age, kinship, gender, religion and region. Historically, these differences have served the purpose of organizing the society into unity. In our time, we must begin to recognize that the unified Oromo nation contains diverse groupings and must take steps to begin to live as a free, open and pluralistic society and practice a cultural of pluralism which contains the values of diversity, tolerance, commitment and communication. The Houston Convention envisages kicking off a national convention on pluralism in the Oromo context.
2. Forging of political solidarity: At this stage, the Oromo movement has overcome the distractive political divisions within the Oromo society while deepening a culture of pluralism. The Oromo movement needs to overcome divisions that obstruct cooperation and strengthen solidarity with other groups. OLC will invite Oromo scholars to discuss ways of strengthening internal diversity and external solidarity with non-Oromo groups.
3. Recognize the contribution of artists: Throughout the Oromo struggle, artists have helped inform the larger Oromo society about social issues, harmonize social activists within the movement; informed the movement ideals and goals to people outside the movement; dramatized movement goals directly to historicize, tell and retell the history of the Oromo movement. The OLC will highlight these contributions and encourage artistic expressions to advance the struggle across the finish line.
OUTCOME
The Houston convention will issue a manifesto that will reaffirm that Oromo unity is built around gadaa principles and Oromo aspirations are shaped by gadaa values; declares the principle of living together in a pluralistic society; and underscores the importance of solidarity calling for cooperation based on common purpose and common interest and establishing ways of resolving differences.
This report describes how Ethiopian dissidents in the US, UK, and other countries were targeted with emails containing sophisticated commercial spyware posing as Adobe Flash updates and PDF plugins. Targets include a US-based Ethiopian diaspora media outlet, the Oromia Media Network (OMN), a PhD student, and a lawyer. During the course of our investigation, one of the authors of this report was also targeted.
We found a public logfile on the spyware’s command and control server and monitored this logfile over the course of more than a year. We saw the spyware’s operators connecting from Ethiopia, and infected computers connecting from IP addresses in 20 countries, including IP addresses we traced to Eritrean companies and government agencies.
Our analysis of the spyware indicates it is a product known as PC Surveillance System (PSS), a commercial spyware product with a novel exploit-free architecture. PSS is offered by Cyberbit — an Israel-based cyber security company that is a wholly-owned subsidiary of Elbit Systems — and marketed to intelligence and law enforcement agencies.
We conducted Internet scanning to find other servers associated with PSS and found several servers that appear to be operated by Cyberbit themselves. The public logfiles on these servers seem to have tracked Cyberbit employees as they carried infected laptops around the world, apparently providing demonstrations of PSS to the Royal Thai Army, Uzbekistan’s National Security Service, Zambia’s Financial Intelligence Centre, the Philippine President’s Malacañang Palace, ISS World Europe 2017 in Prague, and Milipol 2017 in Paris. Cyberbit also appears to have provided other demos of PSS in France, Vietnam, Kazakhstan, Rwanda, Serbia, and Nigeria.
1. Executive Summary
This report describes a campaign of targeted malware attacks apparently carried out by Ethiopia from 2016 until the present. In the attacks we document, targets receive via email a link to a malicious website impersonating an online video portal. When a target clicks on the link, they are invited to download and install an Adobe Flash update (containing spyware) before viewing the video. In some cases, targets are instead prompted to install a fictitious app called “Adobe PdfWriter” in order to view a PDF file. Our analysis traces the spyware to a heretofore unobserved player in the commercial spyware space: Israel’s Cyberbit, a wholly-owned subsidiary of Elbit Systems. The spyware appears to be a product called PC Surveillance System (PSS), recently renamed PC 360.
The attacks we first identified were targeted at Oromo dissidents based outside of Ethiopia, including the Oromia Media Network (OMN). Oromia is the largest regional ethnic state of Ethiopia by population and area, comprised mostly of the Oromo people.
Figure 1: Oromia Region, Ethiopia
We later discovered that the spyware’s command and control (C&C) server has a public logfile that appears to show both operator and victim activity, allowing us to gain insight into the identity of the operators and the targets. Based on our analysis of the logfile, it appears that the spyware’s operators are inside Ethiopia, and that victims also include various Eritrean companies and government agencies.
We scanned the Internet for similar C&C servers and found what appear to be several servers used by Cyberbit. The public logfiles on those servers seem to have tracked Cyberbit employees as they carried infected laptops around the world, apparently providing demonstrations of PSS to various potential clients. The logfiles appear to place Cyberbit employees at IP addresses associated with the Royal Thai Army, Uzbekistan’s National Security Service, Zambia’s Financial Intelligence Centre, the Philippine President’s Malacañang Palace, ISS World Europe 2017 in Prague, and Milipol 2017 in Paris. Cyberbit also appears to have provided other demos to clients we could not identify in France, Vietnam, Kazakhstan, Rwanda, Serbia, and Nigeria.
Figure 2: Countries with Ethiopian Cyberbit targets.
This report is the latest in a growing body of work that shows the wide abuse of nation-state spyware by authoritarian leaders to covertly surveil and invisibly sabotage entities they deem political threats. After FinFisher, Hacking Team, and NSO Group, Cyberbit is the fourth vendor of nation-state spyware whose tools we have seen abused, and the second based in Israel. Cyberbit’s PSS is also not the first spyware that Ethiopia has abused outside of its borders: in 2015, we discovered that Ethiopia’s Information Network Security Agency (INSA) was using Hacking Team’s RCS spyware to target US-based journalists at the Ethiopian Satellite Television Service (ESAT). Ethiopia has also previously targeted dissidents using FinFisher’s FinSpy spyware.
Citizen Lab has published a companion post outlining some of the legal and regulatory issues raised by this investigation. We also sent letters to Cyberbit and Adobe concerning the misuse of their respective products. Cyberbit responded on December 5, 2017, stating in part: “we appreciate your concern and query and we are addressing it subject to the legal and contractual confidentiality obligations Cyberbit Solutions is bound by.” Adobe respondedon December 6, 2017, stating in part: “we have taken steps to swiftly address this issue, including but not limited to contacting Cyberbit and other relevant service providers.”
2. Background
2.1. Oromo Protests and Diaspora Media Outlets
Largely peaceful protests erupted in the Ethiopian state of Oromia in November 2015, in response to a government decision to pursue a development project involving the razing of a forest and football field. Protesters coalesced around opposition to a larger plan, the Addis Ababa Master Plan, which they feared would displace some of the 2 million Oromo residents living around Addis Ababa. The government labeled the protesters terrorists and responded with lethal force and arbitrary arrests. Over the next year, security forces killed over 1000 people, many of them from Oromia, during anti-government protests. This culminated in a state of emergency that was called in October 2016 that lasted over 10 months.
Oromia Media Network (OMN) is a US-based media channel that describes itself as an “independent, nonpartisan and nonprofit news enterprise whose mission is to produce original and citizen-driven reporting on Oromia, the largest and most populous state in Ethiopia.” OMN broadcasts via satellite, and also has an Internet and social media presence. According toHuman Rights Watch, OMN “played a key role in disseminating information throughout Oromia during the protests.” The government has “reportedly jammed OMN 15 times since it began operations in 2014” and arrested individuals for providing information to OMN or displaying the channel in their businesses.
2.2. Cyberbit and PSS
Cyberbit is an Israel-based cyber security company and a wholly-owned subsidiary of Israeli defense and homeland security manufacturer and contractor Elbit Systems. Cyberbit was established in 2015 in order to “consolidate Elbit Systems’ activities relating to the Cyber Intelligence and Cyber Security markets.” Cyberbit merged with the NICE Cyber and Intelligence Division in 2015 after Elbit acquired that entity for approximately $158 million, with Cyberbit reportedly taking on the division’s employees. Elbit had previously acquiredC4 Security in June 2011 for $10.9 million; C4 described itself as “specializ[ing] in information warfare, SCADA and military C&C systems security.“ According to one employee’s LinkedIn page, C4 also developed a product called “PSS Surveillance System,” billed as a “solution[] for intelligence and law enforcement agencies.”Cyberbit marketing materials1 refer to what appears to be the same system: “CYBERBIT PC Surveillance System (PSS).” PSS is also referenced on Elbit’s website as a solution “for collection from personal computers.” Elbit reportedly will be reorganizing Cyberbit, effective as of 2018, to separate its defense and commercial businesses, with Cyberbit continuing to operate the “C4i division and commercial cyber business.” Elbit’s major subsidiaries are located in Israel and the United States, and Elbit is listed on the NASDAQ and the Tel Aviv Stock Exchange.
Cyberbit is the second Israel-based nation-state spyware vendor we have identified and analyzed, the other being NSO Group. The two companies operate in the same market and have even been connected with the same clients. In an extradition request for former Panamanian President Martinelli, Panama alleged that Martinelli had directed the purchase of two spyware products: PSS and NSO Group’s Pegasus. Additionally, a leaked Hacking Team email about NSO claims that: “NSO only has mobile agents … Apparently the pc part is handled by another company, PSS.”
Cyberbit describes PSS as “a comprehensive solution for monitoring and extracting information from remote PCs.” As is standard in the marketing materials for spyware companies, Cyberbit represents that their design “eliminat[es] the possibility that the operation will be traced back to the origin.”
Cyberbit says that PSS “helps LEAs and intelligence organizations to reduce crime, prevent terrorism and maintain public safety by gaining access, monitoring, extracting and analyzing information from remote PCs.” Information that PSS can monitor and extract includes “VoIP calls, files, emails, audio recordings, keylogs and virtually any information available on the target device.”
3. Targeting of Jawar Mohammed
Jawar Mohammed is the Executive Director of the Oromia Media Network (OMN). He is also a prolific activist, with more than 1.2 million followers on Facebook. October 2, 2016 was the annual Irreecha cultural festival, the most important Oromo cultural festival. Millions of people each year gather at the festival site in Bishoftu, near Addis Ababa. In 2016, “scores of people”died at the festival “following a stampede triggered by security forces’ use of teargas and discharge of firearms in response to an increasingly restive crowd.” Jawar was active at the time on social media in stoking the passions of Oromo on the ground, circulating both verified and unverified information. On October 4, 2016, while in Minneapolis, USA, Jawar received the email in Figure 5. He forwarded the email to Citizen Lab for analysis.
From: sbo radio <sbo.radio88[@]gmail.com> Date: Tue, 4 Oct 2016 16:50:13 +0300 Subject: Fw: Confidential video made publicWhat do you think of this video ? In case you don’t have the right version of adobe flash and can’t watch the video, you can get the latest version of Adobe flash from Here http://getadobeplayer%5B.%5Dcom/flashplayer/download/index7371.html.———- Forwarded message ———- From: sbo radio <sbo.radio88[@]gmail.com> Date: Tue, Oct 10, 2014 at 4:23 PM Subject: Video hints Eritrea and Ethiopia war is highly likely to continueDear Excellencies,Video : Eritrea and Ethiopia war likely to continue http://www.eastafro%5B.%5Dnet/eritrea-ethiopia-border-clash-video.html
regards,Sbo Radio
Mit freundlichen Grüßen
Figure 5: An email sent to Jawar on October 4, 2016. The sender most likely crafted the email to make it appear that this was a forwarded message.
The site eastafro[.]net appears to impersonate the (legitimate) Eritrean video website eastafro.com. When a target clicks on an operator-generated link to eastafro[.]net, JavaScript on the site checks to see whether the target is using Windows and whether their Adobe Flash Player is up to date. If the script detects a Windows user with an out-of-date Flash Player, it displays a message asking the user to update their Flash Player. If clicked, or after 15 seconds, the user is redirected to a page on getadobeplayer[.]com, which offers the user a real Flash Player update bundled with spyware.
Figure 6: Message displayed when a target clicks on a link to eastafro[.]net.
If the user downloads and installs the malicious Flash update, their computer is infected. It is clear that this is a targeted attack: if a user simply types in eastafro[.]net into their browser’s address bar, they are redirected to the legitimate site, eastafro.com. If a user does the same with getadobeplayer[.]com, they are served a “403 Forbidden” message. Both sites have robots.txt files instructing search engines not to crawl them. Access to the spyware is granted only if the user clicks on a link sent by the operator.
In all, Jawar received eleven emails between 5/30/2016 and 10/13/2016, and one more than a year later on 11/22/2017. Each email contained links to what were purportedly videos on eastafro[.]net, or Adobe Flash Player updates on getadobeplayer[.]com. The 11/22/2017 email contained a link to eastafro[.]net that asked the target to install “Adobe’s PdfWriter,” a fictitious product. The download contained the same spyware as the malicious Adobe Flash Player updates, but was packaged with CutePDF Writer, “a proprietary Portable Document Format converter and editor for Microsoft Windows developed by Acro Software,” with no connection to Adobe.
Figure 7: “Adobe PdfWriter” Installation Prompt.
In many cases, the operators appear to have registered their own accounts to send the infection attempts. However, the email address sbo.radio88[@]gmail.com used by operators to target Jawar is associated with the radio station of the Oromo Liberation Front (OLF). The account may have been compromised.
Table 1: Malicious emails received by Jawar.
Date
Subject
Sender
5/30/2016
Ethiopia Struggling with inside Challenges!
eliassamare[@]gmail.com
6/15/2016
Tsorona Conflict Video!
eliassamare[@]gmail.com
6/29/2016
UN Report and Diaspora Reaction!
eliassamare[@]gmail.com
8/4/2016
Ethiopia and Current Options!
eliassamare[@]gmail.com
8/15/2016
Fwd: Triggering Ethiopia Protests!
eliassamare[@]gmail.com
9/5/2016
Saudi-Iran and the Red Sea!
eliassamare[@]gmail.com
9/6/2016
Congrats – የኢሳት ፍሬዎች
wadewadejoe[@]gmail.com
9/22/2016
Is Funding Ethiopia the Right time Now?
eliassamare[@]gmail.com
10/4/2016
Fw: Confidential video made public
sbo.radio88[@]gmail.com
10/10/2016
Egypt-Ethiopia new tension!
awetnaeyu[@]gmail.com
10/13/2016
Confidential Videos made public
wadewadejoe[@]gmail.com
11/22/2017
Gov official interrogated following leakage of national security meeting minutes
lekanuguse2014[@]gmail.com
The Ethiopian Government charged Jawar with terrorism in February 2017 under the criminal code; Jawar and OMN denied all charges.
4. Investigation to Find Additional Targets
We set out to find additional targets. We conducted targeting testing of members of the Oromo community using Himaya, our email scanning tool, to determine whether they had received any similar malicious messages. We also found a public logfile on the spyware’s C&C server (Section 5.2); the logfile listed IP addresses of infected devices and we were able to identify additional victims based on their IP.
4.1. Other Targets
Etana Habte is a PhD student at SOAS University of London. He is a frequent commentator on Ethiopian issues and appears regularly on OMN.
Table 2: Malicious emails received by Etana.
Date
Subject
Sender
12/9/2016
Let’s stop EU & the World Bank from funding $500 m to Ethiopia
shigut.gelleta[@]gmail.com
1/11/2017
Fwd: MONOSANTO (A multinational company)’s plan on Oromia
networkoromostudies2015[@]gmail.com
The address shigut.gelleta@gmail.com appears to be an account created by attackers designed to impersonate Shigut Geleta, a member of the OLF.
Dr. Henok Gabisa is a Visiting Academic Fellow who teaches at Washington and Lee University School of Law and is the founder of the Association of Oromo Public Defenders (Public Interest Lawyers Association) in Oromia.
Table 3: Malicious emails received by Henok.
Date
Subject
Sender
3/6/2017
Why did MONOSANTO target the Oromiya region?
networkoromostudies2015[@]gmail.com
3/13/2017
Democracy in Ethiopia: Can it be saved?
networkoromostudies2015[@]gmail.com
Bill Marczak is a researcher at Citizen Lab and an author of this report. Marczak was targeted after he asked another target to forward an email sent by operators. At the time, the target’s email account was compromised (the target had been previously infected with this spyware). On March 29, 2017, while in San Francisco, USA, Marczak received a message entitled “Martin Plaut and Ethiopia’s politics of famine,” from networkoromostudies2015[@]gmail.com. The email contained a link to eastafro[.]net.
Figure 8: Message received by Citizen Lab Senior Research Fellow Bill Marczak. The use of the Comic Sans font is due to the attacker’s font selection.
Other Targets: Several malicious emails we found were sent to multiple receipients, according to their headers. We found 39 additional email addresses of targets using this method; at least 12 addresses appear to be linked to targets active on Oromo issues, or working for Oromo groups.
4.2. Logfile Analysis
Peculiarly, we found a public logfile on the spyware’s C&C server; the logfile recorded activity that allowed us to geolocate (or in some cases, identify) victims. We analyzed more than a year of logs showing victim (and operator) activity. Each logfile entry contains a unique identifier (a GUID) associated with the infection, a value indicating whether the entry records victim or operator activity, the IP address that the infected device (or operator) connected to the C&C server from, and finally a timestamp showing when the communication took place (for more details on the logfile, see Section 4.3). The format of the logfile allowed us to track infections as they moved between different IP addresses, such as when an infected target carried their laptop between home and work, or while traveling.
During more than a year of monitoring the server’s logfiles, we observed 67 different GUIDs. All infections were operated by the same operator, who only ever used one IP address, which belongs to a satellite connection (except for a three hour period on a single day when the operator’s activity “failed over” to two other IP addresses, one address in Ethiopia and one VPN, perhaps due to transient satellite connection failure). We identified 11 of the 67 GUIDs as likely resulting from testing by the operator, or execution by researchers, based on their apparent short duration. Further, we noted that some GUIDs likely referenced the same infected device, as they represented consecutive, non-overlapping infections whose IP addresses corresponded with the same Internet Service Provider (ISP). This was the case for two GUIDs in the UK, two in South Sudan, and 12 in Uganda.
We arrived at 43 GUIDs that we believe represent distinct infected devices. We then sought to geolocate each infection to a country. We first ran the MaxMind GeoLite 2 Countrydatabase on each IP and associated a set of countries with each infection. For each infection that had only one country associated with it, we examined a small number of IP addresses from the infection, to see whether those IPs looked like they were actually in that country, or whether geolocation may have been incorrect due to the IP being associated with a VPN or satellite connection.
For infections that MaxMind associated with multiple countries, we determined the dominant country, based on the country with the largest number of logfile entries for that infection. For the dominant country, we checked a small number of IP addresses to make sure the geolocation was correct. For the other countries, we checked each IP in an attempt to eliminate incorrect geolocation. We noted four infections that predominantly connected from satellite connections, which MaxMind geolocated to UK or UAE; we changed the geolocation of these devices to Eritrea, as the infections either “failed over” to IPs registered to EriTel, or shared the same satellite IP address as other infections that “failed over” to EriTel IPs.
Table 4: Number of infections we geolocated to each country, for countries where we geolocated more than one infection.
Country
# Infected Devices
Eritrea
7
Canada
6
Germany
6
Australia
4
USA
4
South Africa
2
Other countries in which we saw only a single infected device were: Belgium, Egypt, Ethiopia, UK, India, Italy, Japan, Kenya, Norway, Qatar, Rwanda, South Sudan, Uganda, and Yemen.
After we eliminated VPN IPs, and geolocated the four infections that predominantly connected from satellite connections, we found that 40 of 43 infections only ever communicated from a single country. The remaining three devices appear to have travelled between several countries. The three infections that traveled internationally are as follows:
A device that twice travelled from Eritrea (via Germany) to the United Nations in Geneva. We geolocated this device to Eritrea.
A device that predominantly connected from the University of Tsukuba in Japan that travelled to Eritrea. We geolocated this device to Japan.
A device that predominantly connected from York University in Canada that travelled to Eritrea. We geolocated this device to Canada.
We were able to trace six of the infections (five in Eritrea, one abroad) to Eritrean government agencies or companies, suggesting that operators are likely targeting members of the Eritrean government in addition to Ethiopian dissidents.
4.3. Other Attacker Sites
During our analysis we, identified two other websites sharing the same IP address as getadobeplayer[.]com, which also appear to have been used by the same attackers to target victims with the same spyware: diretube.co[.]uk (impersonating diretube[.]com, an Ethiopian video site), and meskereme[.]net (impersonating meskerem[.]net, an Eritrean opposition website).
The diretube.co[.]uk site used the same Adobe Flash update ploy to direct users to malware on getadobeplayer[.]com, whereas the meskereme[.]net site displays a message saying “Problem reading Tigrinya? Install these fonts,” with links to the fonts bundled with spyware. The legitimate website, meskerem[.]net displays the same message, but links to fonts without the spyware.
5. Attribution to Cyberbit and Ethiopia
This section describes how we attributed the spyware to Cyberbit and Ethiopia.
5.1. Digital Signature Points to Cyberbit
By monitoring getadobeplayer[.]com, we found and analyzed five samples of the spyware as it was updated over time.
Table 5: The samples from getadobeplayer[.]com that we analyzed.
MD5
Name
568d8c43815fa9608974071c49d68232
flashplayer20_a_install.exe
80b7121c4ecac1c321ca2e3f507104c2
flashplayer21_xa_install.exe
8d6ce1a256acf608d82db6539bf73ae7
flashplayer22_xa_install.exe
840c4299f9cd5d4df46ee708c2c8247c
flashplayer23_xa_install.exe
961730964fd76c93603fb8f0d445c6f2
flashplayer24_xa_install.exe
Each sample communicates with two command and control (C&C) servers: time-local[.]comand time-local[.]net.
We found a structurally similar sample (see Section 7 for details on structural similarities) in VirusTotal:
That sample communicated with a C&C server at the following URL: pssts1.nozonenet[.]com/ts8/ts8.php (note the use of “PSS” in the URL). The sample also drops an EXE file containing a digital signature (valid as of the date submitted to VirusTotal) produced by a certificate with the following details:
CN = C4 Security
O = C4 Security
STREET = 13 Noach Mozes St
L = Tel aviv
S = Gush Dan
PostalCode = 67442
C = IL
RFC822 Name=tal.barash@c4-security.com
Note that c4-security.com was the official website of C4 security, according to a brochureposted on the website of the Israeli Export Institute.
5.2. Public Logfile Analysis Points to Ethiopia and Cyberbit
While monitoring additional PSS C&C servers that we discovered during scanning (Section 6.1), we found that one of these servers temporarily exposed a directory listing in response to a normal GET / HTTP/1.1 request (Figure 9). The directory listing contained the text: “Apache/2.4.7 (Ubuntu) Server at cyberbitc[.]com Port 80,” indicating that the server was associated with Cyberbit. The website cyberbitc[.]com is owned by Cyberbit and was used by Cyberbit before they acquired cyberbit[.]com in March 2017.2
Figure 9: Directory listing on one of the servers that earlier matched our fingerprint.
This directory listing also revealed the existence of several files, including a file called rec.dat, which at first glance we noticed was encoded in binary format. We suspected that rec.dat might be a logfile, as it appeared to be constantly updated on the C&C servers. We noticed that rec.dat existed on all of the C&C servers we detected in our scanning and were able to test (Section 6.1), including on time-local[.]com and time-local[.]net, the C&C servers associated with the spyware samples sent to Oromo targets.
5.2.1. Logfile Analysis Shows Ethiopian Operator
To verify our logfile hypothesis, we performed a test infection of a virtual machine using one of the samples sent to Oromo targets and we allowed the virtual machine to communicate with the C&C server. The traffic comprised HTTP POST requests (Section 7.7), each of which contained an agentid, a GUID initially {00000000-0000-0000-0000-000000000000} and later nonzero.
After the infection, we downloaded rec.dat and found that it contained a series of records, several with our IP address, and our agentid GUID, in binary form. Each record of the logfile is delimited by the string \x41\x41\x41 (‘AAA’) and can be parsed with the following regular expression:
‘(.{4})\x00\x00(.)(.{4})(.{16})AAA’
The first group of four bytes is a UNIX timestamp, the second group of 1 byte is a type value (which, in our testing was always 2, 17, 21, 33, or 37), the third group of 4 bytes is an IP address, and the fourth group of 16 bytes is a GUID. The file appears to be a circular (i.e., size-capped) logfile stored in binary format whose maximum size is defined in config.ini to be 10MB. Old entries are removed from the front of the file as new entries are written to the end.
Peculiarly, we noticed additional entries in rec.dat with our GUID but with a different IP address, 207.226.46.xxx. We noticed that 207.226.46.xxx was also associated with every other GUID in rec.dat. We determined that this IP address is associated with a satellite connection.
Over a period of more than a year, we downloaded and analyzed this file at regular intervals, obtaining a total of 388 rec.dat samples from each of time-local[.]com and time-local[.]net (we also began pulling samples of rec.dat from new servers we detected in scanning). Our rec.dat files from time-local[.]com contain more than 32 million entries (more than 28 million entries are operator interactions and approximately 4 million are victim interactions).
In all of our rec.dat samples from time-local[.]com and time-local[.]net, we noted that entries in the logfile for all GUIDs with types 2, 21, and 33 only ever involved the IP address 207.226.46.xxx (except for a brief period of three hours on a single day, where we saw the activity “fail over” between 207.226.46.xxx and two other IP addresses, one VPN address, and one address in Ethiopia). Thus, we suspect that types 2, 21, and 33 represent interaction by the operator. We suspect that types 17 and 37 correspond to interactions by infected devices.
Table 6: IP addresses that the Ethiopian operator connected from.
IP
Provider
207.226.46.xxx
Satellite Connection
197.156.86.xxx
Ethio Telecom
192.186.133.xxx
CyberGhost VPN
That the attacker’s activity “failed over” between their satellite IP and an Ethio Telecom address suggests that the operator is inside Ethiopia.
5.2.2. Thirteen Servers Show a Cyberbit Nexus
Our scanning found 15 PSS C&C servers in all. Of those, two were the Ethiopia servers. Of the remaining 13 we found, we suspect all are operated by Cyberbit, perhaps as demonstration or development servers. Ten of the servers’ logfiles included the IP address 37.142.120.xxx, which is pointed to by a subdomain of cyberbit[.]net. Two other servers’ logfiles included the IP address 64.251.13.xxx, which also appeared in the logfile of one of the seven servers, as an operator of infections connecting back from 37.142.13.xxx, an IP address pointed to by a subdomain of cyberbit[.]net.
One of the servers, pupki[.]co, was unavailable when we tried to fetch rec.dat. The domain name was registered to a “Yevgeniy Gavrikov”. An individual by this name currently works as an “integration specialist” for Cyberbit, according to LinkedIn.
6. Other PSS Activity
6.1. Scanning for More C&C Servers
We fingerprinted the command and control (C&C) servers used by the spyware, time-local[.]com and time-local[.]net, based on the fact that they typically returned the following distinctive message upon a normal GET / HTTP/1.1 request:
PHP Configuration Error. Can not fetch xml request string
Over the course of our scanning, we found a total of 15 IP addresses matching this same fingerprint.
Table 7: PSS C&C servers we found in IPv4 scanning.
By examining sites on the same IP address as eastafro[.]net, we found two additional sites: one site impersonating Download.com and one website impersonating the homepage of Avira Antivirus. These sites contained versions of several apps bundled with PSS, including Avira Antivirus, Ventrilo, Avast AntiVirus, and CCleaner. The versions of PSS we found talked to C&C servers in the list above that we identified as Cyberbit-run servers.
6.3. Public Logfile Analysis of Other Servers
In addition to the Ethiopia servers (Section 5.2), we analyzed the logfiles of 12 of the 13 other servers. We were able to identify what we believe are several product demonstrations to various clients around the world. Most of the demonstrations show similar patterns: activity during business hours from IP addresses that appear to belong to potential clients and activity off-hours at IP addresses that appear to belong to hotels. In a few cases, the activity is preceded or followed by activity from what appears to be airport Wi-Fi access points.
Figure 10: Cyberbit product demonstrations suggested by C&C logfiles.
In our analysis here, we introduce a notion of a period of activity to try and abstract away gaps between logfile entries that may be uninteresting. We say that a spyware infection is active between two logfile entries (we only include activity from the infected device here, i.e., types 17 and 37) if there is no more than an hour in between the entries. We omit periods of activity that are less than one minute from our consideration (except if they provide evidence that the infected device has moved). In each country case we present here, we are listing all the activity we found across the nine Cyberbit-operated C&C servers (perhaps excluding periods of activity less than a minute).
6.3.1. Timeline of Suspected Demonstrations
3/2016: Thailand (2 days). We found infections in Thailand from the IP 202.29.97.X, in AS4621, which appears to be an ASN used by various Thai universities. Tracerouting to 202.29.97.X yields the hop (royal-thai-army-to-902-1-5-gi-09-cr-pyt.uni.net.th). The IPs 202.29.97.(X-3) and 202.29.97.(X-1) return a TLS certificate whose CN is a subdomain of signalschool[.]net, which is registered to the Royal Thai Army’s Signal School. We did note that 202.29.97.X also appears to be a VPN. Nevertheless, it seems that the IP is under the control of the Royal Thai Army. We also observed each infection changing between several IPs that appear to belong to various mobile data providers.
The table below lists periods of activity for each infection; the first column (#) indicates the number of the infection; the second and third columns provide the minimum and maximum date and time of the period of activity (in the country’s local time, accounting for DST); the fourth column provides the duration of the period of activity (H:MM:SS); and the fifth column lists the location where the activity took place (or the likely identity of the agency receiving the demonstration).
Table 8: March 2016 suspected demo to Royal Thai Army.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 09:22:17
Day 1 10:07:05
0:44:48
Royal Thai Army
2
Day 1 14:52:10
Day 1 15:38:13
0:46:03
Royal Thai Army
3
Day 2 14:45:51
Day 2 17:01:11
2:15:20
Royal Thai Army
3/2016: Uzbekistan (3 days). We found four infections in Uzbekistan. The first two were from an IP address pointed to by a subdomain of rdhotel[.]uz, which is registered by an individual who is listed on LinkedIn as the manager of the Radisson Blu in Tashkent. The latter two were from an IP address linked to Uzbekistan’s National Security Service by the leaked Hacking Team emails.
Table 9: March 2016 suspected demo to Uzbekistan National Security Service.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 23:26:52
Day 2 00:10:00
0:43:08
Radisson Blu Tashkent
2
Day 2 08:46:20
Day 2 09:06:36
0:20:16
Radisson Blu Tashkent
3
Day 2 15:40:02
Day 2 15:45:52
0:05:50
National Security Service
3
Day 2 17:16:32
Day 2 18:24:42
1:08:10
National Security Service
4
Day 3 12:09:17
Day 3 12:41:35
0:32:18
National Security Service
4
Day 3 14:27:04
Day 3 14:53:39
0:26:35
National Security Service
10/2016: France (1 day). We found two infections in France on the same day in October 2016. The first appeared to be from an IP address associated with the airport Wi-Fi at Paris’s Charles De Gaulle (CDG) airport. The second was from what appeared to be a landline IP address in Paris, which we could not attribute.
Table 10: October 2016 suspected demo to unknown clients in France.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 11:19:15
Day 1 11:24:04
0:04:49
CDG Airport Wi-Fi
2
Day 1 15:24:55
Day 1 16:08:03
0:43:08
86.245.198.xxx
11/2016: Vietnam (2 days). We found three infections in Vietnam. One was linked to an IP address that is numerically adjacent to another IP address that returns a web interface for an “HP MSM760 Controller” that displays the following information:
System name: Hilton Gardent Inn-HANOP
Location: Hanoi
We suspect that this activity is associated with the Hilton Garden Inn Hotel in Hanoi. The other activity appears to be from mobile broadband IP addresses; the identity of the potential client is not indicated by the data.
Table 11: November 2016 suspected demo to unknown clients in Vietnam.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 16:34:36
Day 1 18:52:09
2:17:33
Hilton Garden Inn Hanoi
1
Day 1 18:52:48
Day 1 19:01:12
0:08:24
(Mobile Broadband)
1
Day 1 19:35:50
Day 1 19:41:14
0:05:24
Hilton Garden Inn Hanoi
2
Day 2 11:34:24
Day 2 12:12:26
0:38:02
(Mobile Broadband)
3
Day 2 15:32:15
Day 2 17:13:41
1:41:26
(Mobile Broadband)
12/2016: Kazakhstan (1 day). We found an infection from an IP address registered (according to WHOIS information) to “Saad Hotel LLP” with an address matching the Marriott Hotel in Astana.
Table 12: December 2016 suspected demo to unknown clients in Kazakhstan.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 14:20:07
Day 1 14:35:39
0:15:32
Marriott Hotel Astana
12/2016: Zambia (2 days). Most of the activity was from mobile broadband IPs. However, the second infection was from an IP pointed to by a subdomain of fic.gov[.]zm, the website for Zambia’s Financial Intelligence Centre.
Table 13: December 2016 suspected demo to Zambia Financial Intelligence Centre.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 21:23:21
Day 1 21:57:52
0:34:31
(Mobile Broadband)
1
Day 2 05:20:05
Day 2 05:43:38
0:23:33
(Mobile Broadband)
2
Day 2 11:00:52
Day 2 11:29:37
0:28:45
Financial Intelligence Centre
1/2017: Rwanda (2 days). We could not attribute any of the IPs in Rwanda.
Table 14: January 2017 suspected demo to unknown clients in Rwanda.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 17:10:48
Day 1 18:28:47
1:17:59
(Unknown Loc 1)
1
Day 1 22:49:12
Day 1 23:27:30
0:38:18
(Unknown Loc 2)
2
Day 1 23:30:16
Day 2 04:18:06
4:47:50
(Unknown Loc 2)
3
Day 2 09:14:59
Day 2 09:27:34
0:12:35
(Unknown Loc 1)
4
Day 2 09:54:15
Day 2 10:51:47
0:57:32
(Unknown Loc 1)
5
Day 2 10:01:45
Day 2 12:54:13
2:52:28
(Unknown Loc 1)
2/2017: Philippines (5 days). We found an infection in February 2017 at 116.50.244.15. The IPs 116.50.244.10, 116.50.244.7, and 116.50.244.8 are pointed to by manila.newworldhotels.com or subdomains thereof. 116.50.244.7 is a Cisco VPN login page, which lists the “Group” as “New_World_Makati.” We assume that the Manila New World Makati Hotel is also the owner of 116.50.244.15.
This was followed by an infection one day later at an IP address pointed to by a subdomain of malacanang.gov[.]ph, which is the website of Malacañang Palace. The palace is the primary residence and offices of the Philippine President (Rodrigo Duterte as of the date of the demo). The Malacañang Palace infection was followed by an infection from two other IP addresses in the Philippines.
Table 15: February 2017 suspected demo to Philippines Presidency.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 18:40:13
Day 1 18:55:01
0:14:48
New World Makati Hotel Manila
2
Day 2 12:01:08
Day 2 12:25:50
0:24:42
Malacañang Palace
3
Day 3 11:32:08
Day 3 11:53:13
0:21:05
112.198.102.xxx
3
Day 5 21:52:32
Day 5 22:28:55
0:36:23
202.57.61.xxx
3/2017: Kazakhstan (1 day). We found an infection from an IP address pointed to by kazimpex[.]kz. According to an article on IntelligenceOnline, Kazimpex is said to be closely linked with the “National Security Committee of the Republic of Kazakhstan” (KNB), an intelligence agency in Kazakhstan.
Table 16: March 2017 suspected demo to Kazimpex in Kazakhstan.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 11:29:55
Day 1 12:03:32
0:33:37
Kazimpex
3/2017: Serbia (2 days). We found activity from Serbia on a single IP address registered to “NBGP Properties Doo,” which is the trading name of an apartment complex and business centre located adjacent to the Crowne Plaza in Belgrade. Both NBGP and the Crowne Plaza are owned by Delta Holding, a major Serbian company. It is possible that activity from the IP 79.101.39.101 includes activity from both NBGP and the Crowne Plaza.
Table 17: March 2017 suspected demo to unknown clients in Serbia.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 12:20:42
Day 1 12:55:11
0:34:29
Delta Holding Complex
1
Day 2 00:15:30
Day 2 00:33:06
0:17:36
Delta Holding Complex
2
Day 2 00:51:04
Day 2 01:15:15
0:24:11
Delta Holding Complex
2
Day 2 06:58:53
Day 2 07:41:58
0:43:05
Delta Holding Complex
3/2017: Nigeria (2 days). We found one infection in Nigeria from two IPs. We could not identify the IPs.
Table 18: March 2017 suspected demo to unknown clients in Nigeria.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 16:38:52
Day 1 17:11:57
0:33:05
(Unknown Loc 1)
1
Day 1 18:21:41
Day 1 19:13:24
0:51:43
(Unknown Loc 1)
1
Day 2 10:26:20
Day 2 11:43:28
1:17:08
(Unknown Loc 2)
4/2017: Kazakhstan (1 day). We found an infection from the Marriott hotel in Astana, followed by an infection from an IP pointed to by a subdomain of mcmr[.]kz, the website of “Mobil Realty,” a commercial real estate management company.
Table 19: April 2017 suspected demo to unknown clients in Kazakhstan.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 12:26:04
Day 1 12:37:55
0:11:51
Marriott Hotel Astana
2
Day 1 18:09:50
Day 1 18:21:54
0:12:04
Mobil Realty
6/2017: ISS World Europe (2 days). We saw four infections between 6/14/2017 and 6/15/2017 from IP address 82.142.85.165 in the Czech Republic. ISS World Europe 2017 was held in Prague, Czech Republic from 6/13/2017 – 6/15/2017, and Cyberbit gave a presentation on 6/13/2017, according to the schedule. This same IP address appears in the headers of leaked Hacking Team emails sent by two employees on 6/3/2015 and 6/4/2015. These employees mentioned that they would be attending ISS World Europe on 6/3/2015, held at the same venue as the 2017 ISS World Europe. The IP address 82.142.85.165 may be associated with the Clarion Congress Hotel in Prague (the ISS World Europe venue).
Table 20: June 2017 suspected demo at ISS World Europe in Prague.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
2017-06-14 13:17:46
2017-06-14 13:52:04
0:34:18
ISS World Europe
3
2017-06-14 16:45:04
2017-06-14 17:27:33
0:42:29
ISS World Europe
3
2017-06-15 07:18:23
2017-06-15 07:19:38
0:01:15
ISS World Europe
4
2017-06-15 08:17:18
2017-06-15 09:36:03
1:18:45
ISS World Europe
6/2017: Zambia (2 days). Most of the activity was from mobile broadband IPs.
Table 21: June 2017 suspected demo to unknown clients in Zambia.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day 1 19:00:54
Day 1 19:38:34
0:37:40
(Mobile Broadband)
2
Day 2 09:44:48
Day 2 10:22:28
0:37:40
(Mobile Broadband)
3
Day 2 14:36:18
Day 2 15:00:00
0:23:42
(Mobile Broadband)
3
Day 2 21:59:59
Day 2 22:19:09
0:19:10
(Mobile Broadband)
11/2017: Philippines (6 days). In November 2017, we observed what appeared to be two different Cyberbit employees travelling together from Israel to the New World Makati Hotel in Manila.
The infections started out in Israel, one on 10/15/2017 and one on 11/2/2017. While in Israel, and during the workweek (Sunday to Thursday), both infections connected from what appears to be Cyberbit’s office (37.142.13.xxx, pointed to by two subdomains of cyberbit[.]net) during business hours (roughly 09:00 – 18:00 local time). After hours, the infections connected back from what we believe are home IP addresses of the employees. Each infection connected back from different home IPs during overlapping periods, which leads us to believe that the two infections represent different Cyberbit employees. It appears that each employee was carrying an infected laptop between home and the office each day (perhaps for spyware development and testing purposes).
After they last connected from Israel, one infection connected 15 hours later from Hong Kong for six minutes, between 14:52 and 14:58 local time. The infections then connected from the Philippines (116.50.244.xxx) as early as 22:41 local time, suggesting a flight itinerary from Tel Aviv to Manila, by way of Hong Kong.
Table 22: Employee #1 traveling from Israel to Manila; suspected demo to unknown clients.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
1
Day -1 15:46:24
Day -1 15:46:24
0:00:00
(DSL IP in Israel)
1
Day 1 14:52:15
Day 1 14:58:04
0:05:49
(Hong Kong)
1
Day 1 23:00:03
Day 1 23:56:11
0:56:08
New World Makati Hotel Manila
1
Day 3 20:19:20
Day 3 21:01:09
0:41:49
New World Makati Hotel Manila
1
Day 4 14:42:43
Day 4 14:44:39
0:01:56
(Mobile Broadband)
1
Day 4 16:14:21
Day 4 18:31:40
2:17:19
(Mobile Broadband)
1
Day 4 20:54:47
Day 5 08:00:09
11:05:22
New World Makati Hotel Manila
1
Day 9 09:05:14
Day 9 12:59:54
3:54:40
Cyberbit
Table 23: Employee #2 traveling from Israel to Manila; suspected demo to unknown clients.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
2
Day -1 15:00:24
Day -1 17:32:38
2:32:14
(DSL IP in Israel)
2
Day 1 22:41:32
Day 2 00:00:08
1:18:36
New World Makati Hotel Manila
2
Day 3 20:49:07
Day 3 21:07:51
0:18:44
New World Makati Hotel Manila
2
Day 4 10:30:03
Day 4 18:24:22
7:54:19
(Mobile Broadband)
2
Day 5 10:32:42
Day 5 10:56:48
0:24:06
(Mobile Broadband)
2
Day 5 13:04:42
Day 5 15:43:05
2:38:23
(Mobile Broadband)
2
Day 6 15:56:27
Day 6 17:47:18
1:50:51
New World Makati Hotel Manila
2
Day 9 09:13:20
Day 9 18:56:35
9:43:15
Cyberbit
11/2017: Milipol Paris (4 days): From 11/21/2017 – 11/24/2017, we found an infection active from an IP address 185.113.160.20, which appears to be associated with the Paris Nord Villepinte exhibition center. The IP is pointed to by several subdomains of villepinte2017.dynu[.]net and also by pnv.vipnetwork[.]fr. The Milipol Paris 2017 exhibition was held between 11/21 and 11/24 and the Paris Nord Villepinte exhibition center. Thus, it appears that Cyberbit employees were performing demos there.
Table 24: November 2017 suspected demo at Milipol Paris.
#
Activity Start (Local)
Activity End (Local)
Duration
Location
3
Day 1 08:15:24
Day 1 09:18:21
1:02:57
Milipol Paris
3
Day 1 10:44:02
Day 1 13:21:09
2:37:07
Milipol Paris
3
Day 1 14:50:25
Day 1 15:32:46
0:42:21
Milipol Paris
3
Day 2 08:29:27
Day 2 17:01:11
8:31:44
Milipol Paris
3
Day 3 08:10:28
Day 3 09:34:09
1:23:41
Milipol Paris
3
Day 3 13:02:05
Day 3 14:59:37
1:57:32
Milipol Paris
3
Day 3 15:43:03
Day 3 17:02:29
1:19:26
Milipol Paris
3
Day 4 08:31:07
Day 4 10:43:35
2:12:28
Milipol Paris
6.3.2. Suspected Researcher Activity
We found several short-lived infections on Cyberbit-operated servers that seem less likely to be purposeful infections and more consistent with activity by cybersecurity researchers or other testing activity. We group activity that is temporally similar below, though it is unclear if this activity is related.
We found one infection in the UK on 11/10/2016 lasting ~15s.
We found one infection from Google on 2/7/2017 (lasting 11m), followed by three infections in Germany on 2/7/2017 and 2/8/2017. In Germany, there was one initial infection 14 minutes after the Google infection, with a single pingback. 2h10m later, there was an infection lasting 1 minute. 13h later, there was an infection with a single pingback.
We found an infection with a single pingback from an IP address in Everett, Washington, USA on 10/17/2017. We found two overlapping infections in Russia on 10/18/2017 (~2m each), followed 20 minutes later by two infections in China, 45 minutes apart (~30s each). We found a ~20s infection in Canada on 10/19/2017.
We found an infection with a single pingback from an IP address registered to Brandon University in Canada on 10/31/2017. We found two infections in Norway on 11/1/2017 (one infection with a single pingback, and one infection 3m30s later lasting for ~20s).
6.3.3. Unexplained Activity
We found several infections on the Cyberbit-operated PSS C&C servers that were long-running, and not from VPN connections or from countries where Cyberbit has a known presence. Thus, this activity did not immediately seem to represent demonstrations or development activity. We found one infection in Iran between 9/20/2016 and 11/22/2016. We found one infection in Canada between 3/7/2017 and 11/22/2017. We found one infection in Finland between 5/26/2017 and 11/28/2017. We found one infection in Indonesia from 10/28/2017 to 11/10/2017. We found one infection in Slovakia from a single IP address active between 11/1/2017 and 12/1/2017. We found one infection in Ethiopiafrom 10/25/2017 to 12/1/2017, with no known overlap with the Ethiopia client’s IP address space.
6.4. Spoofed Code Signing Certificates?
We identified several cases where we suspect that the spyware operators, or Cyberbit themselves, obtained digital certificates in the names of real companies, including an Israeli intellectual property law firm.
One malicious Adobe Flash executable we found used by the Ethiopian operator was signed by an authenticode certificate issued by Comodo to a named entity called “Flashpoint IP.”
CN = Flashpoint IP
O = Flashpoint IP
STREET = 2nd Raban Gamliel
L = Elad
S = Israel
PostalCode = 40800
C = IL
RFC822 Name=ben.wiseman@flashpoint-ip.com
We found a company called “Flash Point IP,” with the same street address as in the digital certificate, included the Patent Attorneys Ledger published by Israel’s Ministry of Justice. The website listed by the Ministry of Justice for the firm is flashpointip.com. However, the website in the certificate’s RFC822 name appears to be a lookalike domain that is subtly different: flashpoint-ip[.]com.
We examined the WHOIS registration of the lookalike domain flashpoint-ip[.]com:
Registrant Name: BEN WISEMAN
Registrant Organization: FLASHPOINT IP LTD
Registrant Street: RABAN GAMLIEL 2
Registrant City: ELAD
Registrant State/Province: SHOMRON
Registrant Postal Code: 40800
Registrant Country: IL
Registrant Phone: +972.525649427
Registrant Email: BENWISEMAN99@GMAIL.COM
The firm’s website, flashpointip.com, has a New York registration address, a different registrant name, and a @bezeqint.net contact address.
We found one additional domain, cd-media4u[.]com, registered with the same phone number as flashpoint-ip[.]com. The WHOIS information is:
Registrant Name: DAN WISEMAN
Registrant Organization: C. D. MEDIA LTD
Registrant Street: BEN YEHUDA 60
Registrant City: TEL AVIV
Registrant State/Province: TEL AVIV
Registrant Postal Code: 6343107
Registrant Country: IL
Registrant Phone: +972.525649427
Registrant Email: DANWISEMAN99@GMAIL.COM
Note the similar names Dan Wiseman and Ben Wiseman and the similar email addresses danwiseman99@gmail.com and benwiseman99@gmail.com. We found one reference to “CD Media Ltd” which appears to be an Israeli software publisher (http://www.cd-media.co.il/).
Given that we found two instances where the same entity (WHOIS phone number +972.525649427) registered what appear to be lookalike domains for two different Israeli companies, it is possible that these certificates may have been improperly obtained. This is not the first instance in which improperly obtained digital certificates may have been used with commercial spyware. Hacking Team appears to have obtained several digital certificates in the names of people whose passport photos appeared on a now-defunct site, thewhistleblowers[.]org.4
We identified two further digital certificates used by the operators, in the names of “Etefaq Consulting Ltd,” and “Emerging European Capital.” These certificates were on samples we downloaded from getadobeplayer[.]com, as well as samples from the Avira Antivirus and Download.com impersonation websites (Section 6.2). Unfortunately, the signatures did not contain the RFC822 Name field, so we do not have any indications as to their legitimacy.
CN = Emerging European Capital
O = Emerging European Capital
STREET = Svaetoplukova 12
L = Bojnice
S = Slovakia
PostalCode = 97201
C = SK
We found what appears to be the website of “Emerging European Capital” (http://ee-cap.com), which is described as a company offering “Private Banking services to High Net Worth Individuals in Central and Eastern Europe.” The address in the digital certificate matches an address listed on the website. The individual mentioned on the website, Martin Masar, appears to be a real individual, and is listed as serving on the Supervisory Board of Petrocommerce Ukraine Bank. However, without more information, we cannot know whether the digital certificate is legitimate or not.
CN = ETEFAQ CONSULTING LIMITED
O = ETEFAQ CONSULTING LIMITED
STREET = 1 MYKONOS STREET
L = NICOSIA
S = NICOSIA
PostalCode = 1045
C = CY
We found an “ETEFAQ CONSULTING LIMITED” in the Cyprus corporate registry (# ΗΕ 329071). However, the registered address did not match the address in the digital certificate. The company’s line of business is unclear, and it appears to maintain a simple (hacked) website with a “Contact Us” form (http://etefaqconsulting.com/).
7. Technical Analysis of the Spyware
Altogether, we analyzed nine samples. This includes the sample from VirusTotal signed by the “C4 Security” certificate (Section 5.1), as well as five samples gathered from getadobeplayer[.]com, and three samples gathered from the Avira Antivirus and Download.com impersonation websites (Section 6.2).
Based on strings found during our analysis of configuration files used by the spyware, these samples cover versions of PSS ranging from v4.3.3 to 6.1.0. Major version changes contain changes to obfuscation techniques, overall structure, and general functionality, while minor version changes seem to contain smaller, less noticeable changes. The following analysis covers the general behavior and characteristics of PSS, with version-specific differences noted where appropriate.
Table 25: Versions of PSS we analyzed
MD5
Source
PSS Version
376f28fb0aa650d6220a9d722cdb108d
VirusTotal
4.3.3
568d8c43815fa9608974071c49d68232
getadobeplayer[.]com
5.7.5
80b7121c4ecac1c321ca2e3f507104c2
getadobeplayer[.]com
5.1.0
8d6ce1a256acf608d82db6539bf73ae7
getadobeplayer[.]com
5.9.7
840c4299f9cd5d4df46ee708c2c8247c
getadobeplayer[.]com
6.0.0
961730964fd76c93603fb8f0d445c6f2
getadobeplayer[.]com
6.0.0
0488cf9c58f895076311bf8e2d93bf63
Avira Antivirus Impersonation Website
6.0.0
ca782d91daea6d67dfc49d6e7baf39b0
Download.com Impersonation Website
6.0.0
f483fe294b4c3af1e3c8163200d60aae
Download.com Impersonation Website
6.1.0
7.1. Overview
Overall, the samples we analyzed are made up of four main components: the Agent, LnkProxy, Payload DLL, and Pipeserver. The Agent is the main program responsible for providing operators remote access to an infected machine and carries out most activity after infection. If the Agent is not installed with administrator privileges, then the LnkProxyfacilitates the replacement of shortcut (lnk) and executable (exe) files with malicious versions that will try to trick the user into granting administrator privileges to the Agent. The Payload DLL is a small DLL file that is used to infect certain whitelisted DLLs as a persistence mechanism, to ensure that the Agent is running. Finally, the Pipeserver is used to coordinate access to global handles and perform network communication.
Each of these four components is packed and stored inside the initial spyware payload. The earliest version we analyzed (4.3.3) stored these files as either plaintext or as zlib compressed data. Later versions added AES-256-CBC encryption and the use of different keys per dropped component for additional obfuscation (Section 7.3).
7.2. Installation and Persistence
Once a victim executes one of the initial payloads (e.g., a fake Adobe Flash update), the spyware unpacks the Agent component (described in Section 7.4) and saves it to %TEMP%\Profile. Then, the spyware checks to see if it is running with administrator privileges. If so, then the spyware executes the dropped Agent; if not, then the spyware unpacks and installs the LnkProxy component (described in Section 7.5) in an attempt to trick the user into giving it administrator privileges.
Once the dropped Agent has been executed with administrator privileges, either via the main installer or by tricking the user via the LnkProxy technique, the Agent unpacks its configuration file into memory. Next, the Agent checks to see if there is already a version of PSS installed on the victim’s system by checking for the existence of the storage directory used by the spyware. Depending on the configuration of the current and previous Agents, the Agent may either replace the existing agent or attempt to upgrade the old version. If PSS is not already installed, then the Agent begins installation.
The Agent creates its main storage directory at %CommonAppData%\Profile. Then, it writes its configuration file into the storage directory, using a name defined in the configuration file (versions 4.x and 5.x use the filename diskdrv.dll, while version 6.x uses igfxcls.cfg). The Agent then copies itself into the storage directory (versions 4.x and 5.x use the filename crisvc.exe for the agent, while version 6.x use the filename igfxcri.exe) while deleting the dropped copy from %TEMP%\Profile.
Next, the Agent unpacks and drops 32- and 64-bit versions of the PipeServer component into the storage directory. These files are named mssvt.dll and mssvt64.dll across all versions of PSS that we have analyzed.
After it has created the necessary files, the spyware sets up its persistence mechanism by infecting copies of certain DLLs on the system with the Payload DLL (which is not saved to disk as a standalone file). The infected copies are placed in the same folder as the executable that will load them, ensuring that the infected DLLs are loaded instead of their legitimate counterparts that may be in other folders (Windows will search the folder containing the application first). The DLLs we saw chosen for infection are related to common web browsers including Chrome, Firefox, and Internet Explorer. Since web browsers are some of the most commonly used applications on computers, these DLLs are a good choice to ensure that the spyware is running most of the time that the target device is being used.
Finally, the spyware initializes the appropriate PipeServer component by creating a new Desktop, referred to as a “HiddenDesktop” by the spyware and launching one or more of the EXEs whose DLLs have been replaced with infected versions on this new desktop. When an infected DLL is loaded (Section 5.6), it launches the PipeServer if not already running; the PipeServer in turn launches the Agent if not already running. The Agent then enters into its main command handling loop.
7.3. Obfuscation
The first version of the spyware we analyzed (4.3.3) stored most components as either plaintext data or as zlib compressed binary data. Version 5.x of PSS introduced the additional use of AES-256-CBC encryption for the components. Components obfuscated in this manner contain a short header struct followed by the AES-256-CBC encrypted, zlib compressed data:
In this header struct, magic_number is the magic_number for a 7z file [0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c], iv is the first 4 bytes of the initialization vector used in the AES cipher, checksum is a CRC32 checksum of the data, and length is the length of the encrypted data. The initialization vector is padded with null bytes to the correct length for the AES-256-CBC cipher. Version 6.x added an additional data format for AES-256-CBC encrypted data that removes the magic_number. For all versions, the AES key is hardcoded in the executable performing the decryption. Beginning with version 6.x, the spyware additionally began to obfuscate strings, deobfuscating them only when needed.
Version 4.x drops all of its various components directly to disk in an unpacked form when installed. Starting with version 5.x, the spyware began to drop intermediate loader executables instead of final components. These loader executables store a component, often the Agent, in the same AES-256-CBC encrypted, zlib compressed format as above. When executed, these loaders mimic the Windows executable loader by unpacking their stored payload, mapping the unpacked PE file’s sections into memory, and resolving any imports before jumping to the PE’s entrypoint. This technique of storing the unpacked component only in memory is likely an attempt to evade static, file-based analysis and detection techniques.
Within the Agent component, the configuration file is an SQLite database obfuscated using bzip compression, followed by XOR encryption using both the current and previous bytes, along with one byte from the key. This obfuscation format, and an unusual 36-byte XOR key, the string DC615DA9-94B5-4477-9C33-3A393BC9E63F, are shared across all the samples we analyzed.
7.4. The Agent
The Agent is the central component of the spyware and is responsible for carrying out most of the behavior of PSS. The Agent is a feature-rich spyware capable of a wide range of behaviors. Across all samples we analyzed, we have seen the following capabilities:
Audio/Video recording including scheduling recordings for a later time
Reading browser history and stored passwords
Filesystem operations including creating, deleting, moving, renaming, uploading, and downloading files
Editing/Querying registry keys
Geolocation based on available wifi networks
Accessing Skype databases, call logs, and contacts
Listing network connections and devices
Starting/Stopping processes
Taking screenshots
Keylogging
Accessing clipboard data
Accessing recently used file list
7.5. LnkProxy
The LnkProxy component is only used when the spyware is initially installed without Administrator privileges. In this scenario, the spyware searches through the Windows Desktop, Start Menu, and Quick Launch folders looking for lnk and exe files. Any files it finds are replaced with malicious copies designed to request administrator privileges, launch the legitimate application, and then launch the spyware. This process is designed to trick the user into giving PSS administrator privileges.
The LnkProxy makes a backup of all replaced files, which are restored upon spyware uninstallation or when the user unwittingly grants the spyware administrator privileges.
7.6. Payload DLL
The Payload component of the spyware is a short DLL that is used to infect whitelisted DLLs on the victim’s system as a persistence mechanism. During installation, the spyware searches the victim’s computer for targeted DLLs and for each that it finds it appends the Payload component to the targeted DLL’s .text section. The entrypoint of the DLL is then changed to point to this appended code and the infected file is copied to the same directory as the application that uses the DLL. This ensures that the infected DLL is loaded by the application instead of the original, uninfected version. Figure 11 shows an example of a modified binary infected with the Payload component.
Figure 11: Comparison of entrypoint before and after Payload infection.
The infected DLL starts by checking to ensure that the infected DLL is being loaded by the target program only. It does this by calling the original entrypoint for the infected DLL to get the ImagePathName field of the ProcessParameters struct in the Process Environment Block (PEB). The ImagePathName contains the path of the currently running executable. This is then compared to a hardcoded checksum value stored in the DLL as part of the infection process.
If this check succeeds, the Payload then performs its functions. It first checks to see if the PipeServer is currently loaded. It does this by decrypting an XOR-encrypted string in the DLL containing the location of the PipeServer component, calculating a checksum of this string, and then walking the InMemoryOrder list of loaded modules, checksumming the ImagePathName of each and comparing it to the checksum of the PipeServer’s path. If the PipeServer is not currently loaded, the infected DLL loads the PipeServer component and transfers execution to it.
7.7. PipeServer
The PipeServer component starts by unpacking and loading a small configuration file. This is a small file containing ASCII strings separated by \x00’s that define various config options used by the PipeServer. In version 6.x, this file is zlib compressed and encrypted using AES-256-CBC. After loading the configuration file, the PipeServer creates a series of threads, global events, and mutexes that are used to synchronize actions between components of the spyware, log messages, and communicate with the command and control server. Next, the PipeServer creates a named pipe for communication with running Agent components. Finally, the PipeServer starts an instance of the Agent if one is not already active before entering a main command handling loop. The spyware uses a XML-based networking protocol for command and control communication. Each request and response is sent as a “transaction.” An example of the XML format used is given below.
DATA is the information to be communicated and is compressed, encrypted, and encoded as described in the response attributes. The AES key used can be either a master key included in the Agent’s configuration or an individual private key created after the malware has been installed and initialized. The master key is hard-coded and is the same across all samples we analyzed.
8. Conclusion
We have uncovered the use of PC Surveillance System (PSS) spyware by what appears to be agencies of the Ethiopian government to target dozens of individuals. Our investigation shows these targets include an Oromo media outlet based in the United States, OMN, a PhD student, and a lawyer who have worked on Oromo issues, as well as a Citizen Lab Research Fellow, Bill Marczak. Our analysis also indicates apparent demonstrations of the spyware in several other countries where leaders have exhibited authoritarian tendencies, and/or where there are political corruption and accountability challenges, such as Nigeria, Philippines, Rwanda, Uzbekistan, and Zambia.
The habitual misuse of spyware by the Ethiopian government against civil society targets is testament to the lack of repercussions for such behavior by states and complicity within the commercial spyware industry that supplies them. Evidence indicating the Ethiopian government’s misuse of spyware (including Hacking Team’s RCS and Gamma Group’s FinSpy) against journalists, activists, and others has been laid out in prior research over multiple years, as well as in a lawsuit filed in US federal court. In a portentous ruling, that suit was dismissed on grounds that a tort is not committed entirely in the US — a showing of which was required to obtain jurisdiction over a foreign sovereign — when a government’s digital espionage is conceived of and operated from overseas, despite the fact that the infection occurs and harm is experienced within the US. The digital nature of the tort essentially allowed a foreign government to violate US laws with impunity. Unsurprisingly, as this report makes clear, the extraterritorial targeting continues, as do spyware sales to Ethiopia.
This report also uncovers another player in the nation-state spyware business: Cyberbit, the company that provides PSS. As a provider of powerful surveillance technology, Cyberbit has the responsibility under both Israel’s export control regime as well as the UN Guiding Principles on Business and Human Rights to concern itself with the potential for human rights abuses facilitated through use of its product. The fact that PSS wound up in the hands of Ethiopian government agencies, which for many years have demonstrably misused spyware to target civil society, raises urgent questions around Cyberbit’s corporate social responsibility and due diligence efforts, and the effectiveness of Israel’s export controls in preventing human rights abuses. The apparent locations of PSS demonstrations reinforce those concerns. Moreover, the manner in which the PSS spyware operates suggests that, to achieve infection, the spyware preys on user trust in legitimate third-party companies and software, such as Adobe Systems, or the code-signing certificate verification process. These techniques undermine security in the larger digital ecosystem and contravene terms of service as well as clear legal standards that exist in many jurisdictions to prevent appropriation of intellectual property. If spyware companies themselves incorporate such techniques in order to build a successful product, action is necessary to address the negative externalities that result. We have sent a letter to Cyberbit regarding these issues and received a response.
As we explore in a separate analysis, while lawful access and intercept tools have legitimate uses, the significant insecurities and illegitimate targeting we have documented that arise from their abuse cannot be ignored. In the absence of stronger norms and incentives to induce state restraint, as well as more robust regulation of spyware companies, we expect that authoritarian and other politically corrupt leaders will continue to obtain and use spyware to covertly surveil and invisibly sabotage the individuals and institutions that hold them to account.
9. Acknowledgements
This work was supported in part by the Center for Long Term Cybersecurity (CLTC) at UC Berkeley. Thanks also to Erik Zouave, Masashi Crete-Nishihata, Lex Gill, Etienne Maynier, Adam Senft, Miles Kenyon, Jawar Mohammed, Etana Habte, Henok Gabisa, and Felix Horne and Cynthia Wong from Human Rights Watch.
Footnotes
We found these materials in a Google search. The materials are hosted in an Amazon S3 bucket whose name is cyberbit. Inspecting the source code of Cyberbit’s website (https://web.archive.org/web/20170930094240/https://www.cyberbit.com/) yields several references to the same S3 bucket. Thus, we assume Cyberbit controls the S3 bucket named cyberbit and that the marketing materials are Cyberbit originals.
In January 2016, Cyberbit attempted to convince the WIPO Arbitration and Mediation Center to transfer the domain to it from Cyberbit A/S, but the panel refused and declared that Cyberbit had engaged in reverse domain name hijacking by bringing its complaint in bad faith. However, Cyberbit apparently purchased the domain in March 2017, judging by WHOIS records.
We redact the domain names of non-Ethiopia servers that are still online.
Egyptian MP, Abdel Hamid Kamal, along with 18 other MPs submitted an urgent memorandum to the Parliamentary Speaker, Ali Abdelaal, rejecting the scheduled visit of the Prime Minister of Ethiopia to the Egyptian Parliament, in order to discuss the potential dangers of the Grand Ethiopian Renaissance Dam.
“Due to the seriousness of the anticipated visit of the Ethiopian Prime Minister to the House of Representatives, which he [plans] in the month of December, we have reservations against the visit.”
The MPs’ memorandum went on explaining their reservations and concern about the Ethiopian PM piling pressure against Egypt, claiming he will “spare no effort against Egypt in all international forums,” in pursuit of gaining support and continuing construction of the Grand Ethiopian Renaissance Dam.
The memorandum then explicitly warned that Ethiopian pressure will involve spreading “legal, political, and economic lies that negatively affect our national cause of the Nile waters.”
The water of the River Nile is an integral part of Egypt’s national security, labeling it a “red line,” before asserting “we announce our rejection to the [Ethiopian PM’s] visit.”
Additionally, the memorandum called for meetings between MPs and ministers for agriculture, irrigation, and foreign affairs, as well as national experts, to discuss the ongoing issue of the dam.
It is clear who has been orchestrating and and abusing the land and resource of Oromia so far. It has been done in the name of investment, development corners and mining, all being incepted out of ignoble and greedy motives of the thieves and robbers.
Obbo Lemma Megersa also asserts that after his administration has started against this illegal land grab and illicit trades that drained the land resources of Oromia, “those thieves and robbers launched war against Oromia and and his administration“.
The Famine Early Warning Systems Network says some families in southeastern Ethiopia face a potential ‘catastrophe’ after large-scale livestock die-offs in the past year.
The USAID-funded watchdog writes in its latest November update that some populations of Ethiopia are forecasted to reach levels 4 to 5 on the five-point scale used to measure food security and famine.
“A major food security emergency is expected to continue in southeastern Ethiopia into mid-2018. Worst-affected areas include Dollo, Korahe, and Jarar zones, along with parts of Afder and Liben, which will be in Emergency (IPC Phase 4) through May 2018, while some households will be in Catastrophe (IPC Phase 5),” the watchdog group says.
FEWS NET works with agricultural, market, and weather data to forecast gaps that could lead to widespread hunger or famine.
Recently, southeast Ethiopia’s ongoing Deyr/Hagaya season (which runs from October to December) has performed better than other recent seasons. However, the report questions whether this improvement is enough to keep pastoral and agropastoral families in the region from falling into hunger.
“Substantial time and favorable performance in upcoming seasons is needed for households to reconstitute livestock herds and recover their key livelihood activities, following very high excess livestock deaths and sales due to drought in 2016/17,” reads the report.
Food security is also expected to be ‘stressed’ in parts of the Southern Nations Region from February to June next year, due to poor harvests this year, but humanitarian needs there will not be as bad as the Somali region.
FEWS NET recommends “large-scale, sustained assistance… in order to mitigate food consumption gaps and limited increases in acute malnutrition and the risk of excess mortality.”
The severe food insecurity in southeastern Ethiopia is similar to that experienced in neighboring Somalia, which has been suffering from a bad drought as well as an ongoing civil war.
It is rare to see political parties commit suicide. The TPLF just did that. The regimes that came before the TPLF died trying to save themselves. The Derg Regime declared mixed economic policy on the verge of its collapse. The Regime of Emperor Haile Selassie established new cabinet to deal with the grievances of the people. Both failed to implement their initiatives or their measures were too little too late and couldn’t prevent their ultimate collapse.
The TPLF is not even trying. The abysmal and disastrous failure of the TPLF to come up with no new policy, transformative idea or even a new face at the helm of its leadership positions to meet the challenges of a country at crossroad after three months of marathon meeting proved that the TPLF is the 1960s organization with no vision and purpose to exist in 21st century Ethiopia. In fact, the TPLF before this meeting was way better than the TPLF that come out after this disastrous meeting mortally wounded.
The only purpose the TPLF served in this meeting is unifying all the political forces in Ethiopia against itself. By this meeting, the TPLF ended any glimpse of hope and expectation that one may have that the TPLF might be part of the solution to the problem it created over the last 26 years. It proved that TPLF has no vision and mission that serves the national interests of the Ethiopian people except its failing attempt to hold onto political power through repression, violence and divide and rule.
By this meeting, the TPLF proved that it has no respect for the Ethiopian people. All the people it nominated and appointed to its leadership positions are the same people who created the mess and the disastrous policies and structural problems the Ethiopian people are fighting to change. It is also important to mention the elevation of Mr. Getachew Reda, the man who called the Oromo people devils and vowed to turn the relationship between the Oromo and Amhara people into that of hay and fire. It is highly irresponsible for the TPLF to elect this man to the Executive Committee of the TPLF. It shows the disrespect TPLF has for the Amhara and Oromo people.
Right now the political spaces in Ethiopia are dominated by three political forces. The TPLF by failing to heed to any of the three groups unified each and every one of them against itself. The first and the most important political actor and political force that presently occupied the top tier of the political movement in Ethiopia are the Ethiopian people. The Ethiopian people, led by the Oromo Protests, are mobilized to restore back political power into the hands of the Ethiopian people from groups like TPLF and individual dictatorship based politics of the 20th century. The Ethiopian people want to own and lead their country by exercising full and unhindered political power by eliminating group and individual dictatorship.
The end goal and objectives of the current political movement of the Ethiopian people are to establish the government of the people by the people from the people under the rule of law where justice, equality, and fairness are the rule, not the exception. The TPLF is the primary enemy of this agenda of the Ethiopian people to restore political power back into the hands of the Ethiopian people. TPLF is struggling to continue its agenda of a group and individual dictatorship to control the Ethiopian political, economic and security space by its members and few strong personality against the will of the Ethiopian people.
The outcome of the TPLF meeting will put the TPLF in a direct collision course with the Ethiopian people’s agenda and unify all the Ethiopian people against the TPLF. There is no ifs and buts here. TPLF is the obvious loser of this political war between the TPLF and the Ethiopian people. The recent meeting of the TPLF and its decision to keep the status quo simply delimits the political battle lines between the TPLF and the Ethiopian as black and white with no ambiguity.
The second political forces that presently occupied the Ethiopian political space is the political struggle by member parties of the EPRDF to liberate themselves from the TPLF dictatorship. All member parties of the EPRDF are struggling to liberate themselves from the slave and master like relationship between the TPLF and the other three groups: namely the OPDO, the ANDM and the SEPDM. TPLF has no friends here except opportunists. All three of these parties want some form of liberation from the TPLF repressive, violent and divide and rule policies. All these parties want the EPRDF either to be democratized where TPLF will become the junior partner of all the three but the EPRDF survives. Absent this change, it is very likely that the OPDO, the ANDM, and the SEPDM will form a unified front and vote the TPLF out of office or end up dismantling the EPRDF where each group will go its own way for self-preservation. None of the options will keep the TPLF in dominant positions.
In the last 26 years, with less than 6% population base, the TPLF controlled full political, economic and security power with undisputed and uncontested veto power on everything and anything over these satellite parties, who don’t want to remain satellites anymore, who theoretically represents the rest of the Ethiopian people. None of the EPRDF members want that status quo to continue. The OPDO and the ANDM are already at the forefront of this power struggle, with the SEPDM not that far behind. With the fierce and popular wave of resistance behind them, it is more than likely that the three members of the EPRDF will liberate themselves and their members from TPLF medieval and most brute rule or end up dismantling the EPRDF.
All the TPLF is left to do is to try to buy some members of these political parties with money and false political positions, a method the TPLF used well in the past but now completely unthinkable in the face of the fierce popular opposition and resistance against such parasitic and scavenger members which will cost them their life.
The third political force that the TPLF unified against itself is the Ethiopian political opposition of all shreds. Thanks to the TPLF repression, machination, and sabotage, the Ethiopian political oppositions are poorly organized with no clearly defined political vision for the country. Yet, even here, the TPLF has little allies with whom it could make backdoor deals. Even if the TPLF attempts to deal with some urban-based political opposition groups for face-saving as the failed so-called “opposition groups meeting of over the last one year”, they have no popular support to wield to the save the TPLF. That will lead even the weakest and opportunist Ethiopian oppositions to be unified and resist the TPLF.
The TPLF may attempt to use the following six self-defeating strategies to outmaneuver all of the three political forces it lined up against itself.
1. Using the Ethiopian military, the national security and the law enforcement. Over the last 26 years, the TPLF used and abused these three government institutions against the Ethiopian people, the EPRDF members who resented its rule and the Ethiopian oppositions. It may try to use these three entities again. But, the time has changed. Ethiopian people have said enough is enough. Any further attempt to use the Ethiopian military, the Ethiopian intelligence and law enforcement institutions including courts for further killing, torture, and repression will completely dismantle these institutions. The reason is simple. Every other Ethiopian working in these institutions will pull back and side with the Ethiopian people. The division within the EPRDF will not take any time to manifest in the division within the military, the national intelligence, and the law enforcement institutions. The TPLF dominated chain of command in these institutions have no power to prevent this from happening. The signs are abundant already that Oromo and Amhara military, security and law enforcement officers are resisting TPLF commanders and officials. If the TPLF intends to continue this deadly routes of using these three institutions to hold onto power and repress others, it is more than likely that these institutions will be dismantled in a very short time.
2. Rebuilding TPLF and EPLF alliance to counter Oromo-Amhara Rapprochement. This tactical strategy to counter the Oromo-Amhara rapprochement by building what the TPLF calls the “Union of the Agazians” if the EPLF fails for it, could potentially help the TPLF in one of the following ways. 1) It will help the TPLF by easing the tension with the EPLF at a time when most Ethiopians may not aid the TPLF if a conflict arises between the two groups. 2) The TPLF might try to package this tribal alliance between two Tigrigna speaking groups for dubious purpose as a peace effort and the effort to normalize relations between Eritrea and Ethiopia by implementing the Algiers agreement to win the support of the West. 3) It may also help Eritrea in getting the territories it lost in war, including Bademe, if the EPLF subscribes to the TPLF political power gamble in Ethiopia. 4) Last but not least the strategy may also help the TPLF to mobilize its security and intelligence resources to Oromia and Amhara to attack and cause more harm than it is causing now. Unfortunately, this strategy is self-defeating for at least couple of reasons. One, the TPLF strategy to find alliance with Eritreans to attack other Ethiopians will not find national support in Ethiopia. Second, Eritreans will not be played again by the TPLF after the bitter 1998-2000 war and the strategic blunder and lose it sustained at the end of the country’s civil war in 1991 which lead to the emergence of the TPLF as a dominant force in the region. Third, the chance of TPLF staying in power in Ethiopia is hugely diminished after the Oromo protests and Amhara resistance making any deal the Eritrean side might reach with the TPLF unsustainable and with no future. Fourth, any territorial transfer to Eritrea in the name of implementing the Algiers agreement will cause popular fury and fire that will consolidate the popular movement against the TPLF and ultimately deposing it from power.
3. Consolidating the Somali Janjaweed Militias attack on the Oromo and creating more Janjaweed style Militias everywhere else. This is one of the most disastrous policy the TPLF chose in order to maintain its divide and rule policy to stay in power in Addis Ababa. Here, the TPLF is assuming that the TPLF will always be the ultimate power broker while everybody else is a weapon of war in the hand of the TPLF waiting to be used anytime the TPLF wants to use it. Over the last two to three years, the Somali Janjaweed Militia served the interests of the TPLF very well. The criminal militia that now stands at over 68,000 thousand according to multiple internal sources, displaced over 600,000 Oromo civilians inside Oromia and evicted over 70,000 Oromo civilians from the Somali Region using TPLF adopted ethnic cleansing models copied for Darfur. Still, the Somali Janjaweed Militia continued to attack the Oromo people at the direction and pleasure of the TPLF commanders in order to divert the people’s attention from the TPLF crimes at the center. This policy appears to have run its course now. Poor Oromo and Somali militias will not continue to kill each other to serve the interests of the TPLF over the land and territory each group knows will be restored back in the hand of the Oromo people once the TPLF is removed from power. Instead, it is very likely that both the Oromo and the Somali groups will soon return back to attacking the economic and security interests of the TPLF which will effectively end any meaningful presence of the TPLF either in Oromia, Somali or other Regions of Ethiopia where such strategies will be attempted. This self-defeating strategy of the TPLF to incite violence among various ethnic groups everywhere else will soon fire back by producing nationwide hatred and attack on anyone affiliated with the TPLF including attacks on the economic interests of the TPLF, the Ethiopian military, the federal police and intelligence officers who are being used by malicious TPLF commanders and political leaders. It is also very unlikely that the West will continue to finance and support such criminal enterprise. If the TPLF continue this avenue, it is likely that the Ethiopian military will collapse and the federal government is likely to disintegrate within a very short period of time.
4. Increasing the Urban-Rural Divide: This is one of the strategies of the TPLF is using to contain the ongoing popular movement to take power from the TPFL and restore back into the hands of the Ethiopian people. Except for few cities in Oromia and Amhara regions, most cities in Ethiopia were passive over the last three years of the Oromo protests and the Amhara resistance. The TPLF want the situation to continue that way. It believes it is the dividend and the pay off of the TPLF silo economy dominated by TPLF affiliated local and international benefactors in urban areas by transferring land and natural resources of the Ethiopian people to these TPLF affiliated groups. The Addis Ababa Masterplan and the recently tabled National Urban Planning Proclamation (the Addis Ababa Masterplan in a different name) is meant to play the urban-rural divide to contain the popular movement. This is another self-defeating strategy for a number of reasons. One, noticing the so-called Urban and rural divide as a divide between the TPLF affiliated economic monopolies in the cities and the surrounding Ethiopian poor is very easy. The TPLF silo economy only benefited very few urban dwellers at the expense of the impoverished millions. Every interest group in the urban area including small businesses, civil servants, the youth and the political class will soon turn up the heat on the TPLF. Second, every urban dweller has relatives in the rural Ethiopia and shares the suffering of the rest of the Ethiopian people. Third, as the resistance in the rural areas mounts, the life in the urban areas will collapse and the urban dwellers will join the Ethiopian people to preserve themselves. Fourth, the division within the EPRDF will soon trickle down to the ranks and files of the EPRDF which will soon transfer itself to urban movement. Fifth, the large student population in urban areas will soon build bridges with the urban dwellers to join the popular movement.
5. Faking Individual liberties narratives at the expense of group rights narratives: The TPLF ruled through fake group rights narratives for the last 26 years. It used the Oromo and Southern elites in the name of group rights narratives against the urban-based Amharic speaking elites who mostly were against group rights narratives. After the Oromo and Amhara people started asserting their group rights through the Oromo protests and the Amhara resistance, the TPLF now changed tactic by buying into the urban Amharic speaking elite’s narratives of individual rights and liberties narratives. It might even establish fake individual rights based political party. Theoretically, there is no difference between individual rights and groups rights. These are not mutually exclusive rights. They are mutual complementary rights. One does not exist without the other. But, the TPLF might attempt to venture into this route to buy time and continue its policy of divide and rule if it finds shortsighted urban Amharic speaking elites who will fail for this. Unfortunately, the Ethiopian people are not demanding for the selective implementation of this right or that right. The people are demanding for the transfer of political power into the hands of the people to establish a government of the people by the people for the people where equality, justice and fairness reigns. No group or individual rights will be respected and protected unless the political power is restored back in the hand of the Ethiopian people. Even the dullest of political groups in the country are taking note of this fact and understanding the essence of the Ethiopian peoples’ demand. That leaves no room for the TPLF to manipulate and maneuver.
6. Expanding the EPRDF to dilute the resistance of EPRDF members against the TPLF. The TPLF might attempt to expand the membership in the EPRDF if the resistance from the OPDO, the ANDM, and SEPDM increases. At face value, this might seem a plausible option. One might think TPLF can add the Somali Janjaweed Militia and other groups as EPRDF members to dilute the power balance in its favor within the EPRDF. There are many reasons why this strategy will not work. One, if the TPLF touches the current structure of EPRDF, it is very likely that all the three members of the EPRDF(the OPDO, the ANDM, and the SEPDM) will demand population size based representation within the EPRDF the same way it is in the parliament. If that scenario happens, there is no option out there that will save the TPLF from its minority position. More than 85% of the political power will be in the orbit of other members of the EPRDF. Furthermore, it is very unlikely any ethnic minority group will choose to ally itself with the TPLF against any Amhara and Oromo groups which will hurt them down the line when the TPLF will be removed from power.
Therefore, the TPLF suicidal decision not to reform let alone to transform and adopt new policies, structures and strategies to meet and address the demands of the Ethiopian people will strengthen the popular movement and resistance of the Ethiopian people to take political power and permanently end group and individual dictatorship in Ethiopia.
I wrote this article as a way to initiate a conversation on the issues of decolonizing education pertaining directly to the field of Ethiopian Studies. The main purpose of this opinion is to highlight the importance of making Ethiopian languages and ideas dominant in the field of Ethiopian Studies.
Much of the knowledge on Africa has been produced from outside the continent and the methods that are used to study and represent the continent are rooted in colonial discourse. Similar to the rest of Africa, Ethiopia’s history seems to be significantly studied and written about from outside the country. Ethiopia had successfully fought off colonization and remained the single non-colonized sovereign country in Africa. Meaning, Europe had not been central to Ethiopian political, social or economic life as a result of its historical attachment in the continent. This gave Ethiopia the right and freedom to move on in history on its own right and speed, without the use of a European compass. But this did not happen. While ideals of modernization, human rights, ethnicity, development and nationalism engulfed Ethiopia’s educated class from the 20th century onward, through education Europe’s centrality in Ethiopian socio-political and economic thought would reach its completion. I attempt to present the case of scholarship presented about Ethiopians on a global stage and the problems that arise from the centering of Ethiopian studies around European ideals.
Photo from the Addis Abeba Ethnographic Museum
One of the dilemmas of studying contemporary Africa is the issue of researching the continent with terms and ideologies that were born outside the continent and outside African languages. When the scramble for Africa began, and European powers needed legitimacy to push for colonization, Phrenological works and Social Darwinist ideas became central to this effort for legitimacy. Consequently, in the early 20th century, ethnographic works developed which show the persistence of Eurocentric ideas in the research undertaken at the time. For example, structural functionalist anthropology that existed in pure form up to the 1930s and 1940s include scholars such as Malinowski and Edward Evan Evans-Pritchard[1] who inscribed Africa into a literary colonial culture and legacy. Such works simplified cultures and societies; they operated on the assumption that cultures are bounded-entities that could be studied and limited to a single book. This simplification of cultures, among other issues, explained the simplification of Africans, their languages and their customs, convincing colonialists of the need to ‘civilize’ them. These works portrayed Africa as disease ridden, poverty-stricken, uncivilized, illiterate, and pagan, with Europe as its successful inverse. Though discourses of ‘Africa rising’ and ‘Ethiopian renaissance’ are slowly coming to the fore, the persistent image of Africa as a trouble-child traces its roots from the continuation of the image of pre-colonial Africa.[2]
Post-independence, most African states were called upon to “exercise all aspects of modern sovereignty at once”.[3]From the 1960s up-to the 1980s, new independent African states tried to develop their countries autonomously based on ‘developmentalism’ and state socialism, but were dismantled later by the collapse of the USSR, US imperialism and influence of other prior colonizers in the 70s. From the 80s onward, structural adjustment plans enforced by the IMF and the World Bank forced most countries to open up their economies as well as several other sectors to the global market. There was no question to the premise that Africa must follow Europe. In addition to this, except for secession movements that later engulfed the continent, there were few who questioned the existence of the nation state as bound to borders, adopted from the Berlin-West Africa conference.[4] In several ways, Europe remained central to the political, and socio-economic narrative of post-independence African countries.
Europe as an idea has thus become an essential part of studying the African continent. It is, however, inadequate.[5] The global significance of Europe is clear. But it is also important to acknowledge that non-European sources of knowledge, leadership, political and economic ideals are as significant and important in the African continent. In terms of knowledge production, this inevitable yet inadequate nature of Europe to study Africa has been recently challenged by decolonizing movements emerging from Africa as well as Europe itself. I do not refer to the colonial independence movements from the past, but student led movements such as the Rhodes Must Fall campaign, which originated at the University of Cape Town and spread to European universities such as Oxford, challenging the production, ownership and studying of Africa through the glorification of European ideas, and at times at the risk of ignoring the faults of these European scholars.
I will proceed to present the complexities of studying Ethiopia and how even a country that allegedly wasn’t colonized needs to embark upon similar attempts at decolonization.
Language and Ethiopian Studies
Parallel to the anthropologists of pre-colonial Africa, Ethiopia has had its fair share of European scholars attempting to study it. (An example is Eike Haberland, who misrepresents and essentializes “the Galla” at a time when the Imperial Southern Marches were in full swing.[6]) The difference is that as home-grown systems of Ethiopian education were not centered on Europe or done through European languages; they have had no place in Ethiopia’s scholarly world – i.e., until late 20th century[7]. Further, Ethiopia’s sovereignty also led to its subsequent removal from contributing meaningfully to scholarship on African history, or African studies. Whereas, independence allowed Ethiopians to continue using their own languages to write, discuss, and evaluate their history, it also hindered the spread of their knowledge into other countries. The knowledge produced by most Ethiopian scholars is thus to-date limited to the nation. This means that subsequently, what Ethiopians write does not receive as much credit on the global scale because of the language barrier. Even if the narrative of their history, lives, and society differs vastly from common Eurocentric narratives, they are made voiceless because they do not write in English or French or say, German.
It also goes the other way that Ethiopian scholars, to be read and to find jobs, have to write in English, or French. This spreads into the Institute of Ethiopian Studies, the most important secular institute of Ethiopian epistemology. One would assume, at least for the Ethiopian studies based in Ethiopia, that Ethiopian languages be at the front of the scholarship being produced about Ethiopia. But no, that is far from the reality. The trouble here is that the foundation of the Ethiopian Studies initially took place outside of Ethiopia, to this- Ullendorf accredits Hiob Ludolf as the founder of Ethiopian Studies, and its foundation in Ethiopia is accredited to Richard Pankhurst. While it is important to acknowledge the strides taken in the field of Ethiopian studies from abroad and with the contribution of foreign scholars, the critique of this paper is precisely that Ethiopians seem to have little agency in the institute that studies them and takes them as the center of analysis. While Hiob Ludolf must be noted in his opening of the IES in Europe, it should also be as commonly known that it was an Ethiopian monk who taught him what he knows about Ethiopia, namely Aba Gorgorious.
Globally acclaimed works on Ethiopians are rarely written in Ethiopian languages. Languages carry culture and engraved with in them are the history, priorities, aspirations and fabric of the society they emerge from. Studying a society through the lens of foreign languages has troubling implications. Primarily, one will certainly fail to understand fully how a given society understands itself. Using European ideals and languages changes the basic way of how we understand ourselves; almost always, it forces us to accept that we are trying to be like Europe. It is why it may be necessary to also create room for Ethiopian, or other African ways of describing, labeling, and categorizing ideas.
Ethiopian Studies in this regard has yet to face resistance from Ethiopians. The resistance I mention has several unanswered questions to it: primarily, what would a resistance look like in Ethiopian Studies and where could it get inspiration from? I am primarily discussing a break from the exclusion of Ethiopian languages in journals, publications, research and methodologies. Further, another problem is that Europeans having authority over scholarship produced about Ethiopia means that Ethiopians are constantly looking to the West as the source of Ethiopian knowledge. At what point does it become necessary to question where the agency and ownership of Ethiopians is in the knowledge produced about them?
For example Ethiopia’s Axumite civilization is a key point on which foreign and vernacular narratives of Ethiopian history diverge, but where the European interpretation has dominated the field. Foreign scholars have stated boldly that indigenous Ethiopians were invaded by Arabians;[8] which must explain why Ethiopians were able to design their own written forms of languages, and adopt Christianity among other aspects of their civilization. This narrative is singularly the most Euro-centrist way of studying Ethiopia.[9] A land of black Africans who have achieved equal, if not greater, in their history stands to shake the core belief that white-Europe is the epitome of human civilization. Representing discomfort at all cost, Ethiopians are thus presented as not entirely black, with Arab features, and not appearing ‘African enough’. The silver lining of this is, ‘they must have been foreign to Africa. They could not have achieved this without foreigners helping them’.
Such discourses continue in scholarship and engagement with Ethiopia today. One way scholarship on Ethiopian studies remains problematic is that a large number of non-Ethiopian Ethiopianist scholars do not wholly understand Ethiopian languages. Yet, most have been confident in their ability to translate, or write books based on works written in these same languages. The dilemma is precisely that there is an asymmetry of ignorance, the idea that students can study Africa through European ideals and languages but Europeans do not have to use African ideals and language to study the same continent. This allows for an unchecked interpretation of Ethiopian history, politics and society. Because of the global attention papers written in European languages get, it is now a trend to simply ignore Ethiopian scholarship. Further, not only is the product of Ethiopians disregarded, it trickles down to entirely disregarding the guardians of Ethiopian history, Ethiopians themselves. On numerous occasions, I have sat through discussions about Ethiopia with non Ethiopian scholars invited on the panels of globally influential institutes; with Ethiopianists who have little to no understanding of any of the country’s major languages and who boldly assert, at times, laughable claims about the country. For example, at an Oxford University seminar, a renowned European scholar confidently stated that the Ethiopian holiday Buhe was the equivalent of Halloween.
What is apparent here is that Ethiopian scholars, both traditional and contemporary scholars, and Ethiopians themselves have been pushed to the margins of Ethiopian studies, forcing the scholarly work to revolve around European ideals, writers and scholars which is also vastly incomprehensible to the average Ethiopian. Shouldn’t Ethiopian Studies be attributed to Ethiopian scholars instead of Europeans (some of whom never even set foot in Ethiopia)? By this I mean, Ethiopian Studies Institutes should also strive to be understood as primarily shaped and influenced by Ethiopians and Ethiopian languages, feature more Ethiopians in directorial positions, encourage European scholars to learn Ethiopian languages and cite more Ethiopian scholars, encourage joint research projects with Ethiopians in the leading roles, translate all publications of Ethiopian Studies journals into Amharic and other languages, and provide open source and affordable access to research articles/books for Ethiopians in Ethiopia. What use is the Institute of Ethiopian Studies, if it remains primarily a European dominated field far removed from the lives of the subjects of the institute? This is of course a problem of the social sciences in the Western world in general; and a question I cannot answer in this article. What is the place of vernacular views in the ways Ethiopia is represented globally?
Any place to begin?
Agreeably, there are barriers to the development and dominance of Ethiopian languages and ideas in Ethiopian studies. As a keen observer and Ethiopianist scholar, Michael Kebede posits, where should the decolonization effortbegin? Which institution? Should one language have primacy? How to allocate scarce resources between Ethiopia’s many languages? How to deal with the dominance of Amharic in Ethiopian-produced literature? Who will pay for the effort? Or is it a question of a redirection of existing resources? Is there a resource scarcity problem? Does funding decide the response to your proposal?
If history is to be studied by using ‘Europe’ as the thematic subject, then we should be able to find space for other cultures that do not fit into such categories. There should be space for non-European terminologies and languages to study the continent. And in the case of Ethiopia, it is crucial to be able to write a paper in, say, Amharic and present one’s work on a global scale as that is as important and is even closer to the subjects studied, as compared to French or English or Italian works. It is one thing to have escaped direct colonization, but it is also important to strive to have freedom in our ability to produce knowledge based on the people’s interpretations and ideals of what is important to them. Ideally, one of the many end goals is to have equal say in contemporary scholarly work as provisioned and written by Ethiopians in the various Ethiopian languages. It is simply not adequate to use Europe to study Ethiopia, or other African countries. AS
ED’s Note: Hewan Semon can be reached at hewanmarye15@gmail.com
Disclaimer: The views and opinions expressed in this article are that of the writer’s and do not necessarily
reflect the editorial of Addis Standard.
Endnote
[1] Malinowski and Evans-Pritchard’s works are central in structural functionalist anthropology. Some of their works include, Argonauts of the Wesern Pacific, see Malinowski, Bronislaw, 1978, London : Routledge, Ebook 1978 and The Nuer, see Evans-Pritchard, E. E. (Edward Evan), Oxford University Press, Alexander Street Press, 1940, respectively.
[2] This discussion relies heavily on V. Y. Mudimbe’s The Invention of Africa: Gnosis, Philosophy, and the Order of Knowledge (Bloomington: Indiana University Press, 1988).
[3] Herbst, Jeffrey, States and Power in Africa: Comparative Lessons in Authority and Control, New Jersey: Princeton UP, 2000, p 130.
[4] Herbst, Jeffrey, ‘Responding to State Failure in Africa,’ International Security 21, 3 (1996), p 122. (Pan Africanists such as Nkrumah wanted to get beyond the nation-state, without being secessionists.)
[5] Dipesh Chakrabarty, Provincializing Europe: Postcolonial Thought and Historical Difference Princeton, NJ: Princeton UP, 2000, p 4.
[6] Messay Kebede’s 2003 article is a work to consider reading if one wants to see how European scholars have, at times, through racist narratives tried to define Ethiopian history.
[7] Yirga Gelaw’s recent book Native Colonialism discusses this particular evolution of Eurocentrism in Ethiopian Studies, from the point of view of Ethiopian agency in this. Gelaw, Yirga. Native Colonialism. 2017. Red Sea Press.
[8] Among the few that argue for this point are Ullendorf, The Ethiopians, Budge
Why privatize it? Because they now realize they are likely to loose political power and the new power holders whoever they might be will be tempted to nationalize the EFFORT conglomerate. So privatizing it before hand is a preemptive measure. They assume no new regime will be brave enough to nationalize private company. Note that although privatized the company will continue to fulfill its founding objective…allow Tigrean elites dominate the economy. They new ‘private’ owners will be party leaders, relatives and loyalists who will own it on behalf of the oligarchy.
TPLF leaders are planning to transfer EFFORT to their individual ownership in the name of make it IPO, document reveals. Remember they claim EFFORT was established by money they got from Western donors due to the 1980s drought and meant to rehabilitate war affected people of Tigray. In reality most of the seed money was […]
#OromoProtests continues with protests against fascist TPLF regimes’s mass killings and demanding immediate withdrawal of armed forces.![[Photos] Ethiopia students stage peaceful protest over Oromia deaths](https://static.euronews.com/articles/415201/400x225_415201.jpg?1513552800)
OromianEconomist 
You must be logged in to post a comment.