Wired has an interesting comment as Activists Launch Hack Attacks on Tehran Regime

Iran has one of the world’s most vibrant social media communities. That’s helping those of us outside Iran follow along as this revolution is being YouTubed, blogged, and Tweeted. But Iran’s network infrastructure there is relatively centralized. Which makes Internet access there inherently unstable. Programmer Robert Synott worries that if outside protesters pour too much DDOS traffic into Iran, carriers there “will simply pull the plug to protect the rest of their network.”

It is highly centralized, yet one of the most vibrant communities on the inside. This says to me that it is not necessarily outside communities making the majority of protests. The source of malicious traffic from compromised systems, or even just larger numbers of inexpensive systems is external, but the control is internal. In other words, perhaps it is insiders sending protests from systems they manage on the outside. This could be significantly different from the days of Mosaddeq when many on the outside (e.g. the CIA) were accused of trying to control protests on the inside.