Haystack Situation Looking Worse And Worse: Why Did The State Dept. Endorse This Mess?

from the this-isn't-looking-good dept

A couple weeks ago, we noted that there were increasingly serious questions being asked about Haystack, the high profile app that was being championed in the press for supposedly helping Iranian dissidents use the internet to communicate safely. While Haystack's founder, Austin Heap, responded to the accusations by calling it "brain dead journalism," it's increasingly looking like the real brain dead journalism was in the original stories. The deeper people looked at Haystack the worse it has looked, and various experts have ripped the program to shreds, noting massive security holes in the software which likely placed users at risk.

"The more I have learned about the system, the worse it has gotten," Appelbaum said. "Even if they turn Haystack off, if people try to use it, it still presents a risk.... It would be possible for an adversary to specifically pinpoint individual users of Haystack."

Giving the increasing levels of criticism, Heap has announced that the program has been shut down, but others have noted that, not only is it still available, but people are using it without Heap realizing it -- which could be quite dangerous if people think it's safe. The more you read, the more this project sounds like pure hype from the beginning and a total mess in reality. Just take the following resignation letter from the program's chief developer who, according to Wired, had recently taken a "hiatus" over questions about the way the program was being developed and pushed:

I would like to stress that I am not resigning in shame over the much-maligned test program. It is as bad as Appelbaum makes it out to be. But I maintain that it was a diagnostic tool never intended for dissemination, never mind hype. I did have a solid, reasonable design, and described it in our brief overture of transparency. _That_ is what Haystack would have been. It would have worked!

What I am resigning over is the inability of my organization to operate effectively, maturely, and responsibly. We have been disgraced. I am resigning over dismissing pointed criticism as nonsense. I am resigning over hype trumping security. I am resigning over being misled, and over others being misled in my name.

The whole thing is a complete mess, and it sounds like a situation where some folks were more interested in getting press attention for a very early prototype, which they then pretended was a complete and legitimate product. If you're making a random blogging tool or some web 2.0 service, that's fine. When you're trying to make something that people will rely on so that their government doesn't lock them up and throw away the key, it's not.

There is, of course, plenty of blame to go around here, for the lack of more detailed scrutiny from the press and others, but the really stunning part, of course, is that the US State Department specifically endorsed this product. As Evgeny Morozov notes in his blog post (first link above), that's the true head scratcher:

Just to make it clear: Haystack is not at fault here; the State Department -- I am not so sure. Austin Heap can make whatever statements he likes; the government, however, is supposed to treat such statements with due skepticism and think through the political implications of their endorsement of any technologies. All this fast-tracking stuff would surely reflect bad on the State Department if after an independent security review it does turn out that Haystack has severe security flaws, which its testers -- or other Iranian uses -- may not have been aware of.

And why did Clinton choose to speak about Haystack and not say Tor or any other tool? Also, not very clear. Were the diplomats charmed by all the buzz around Haystack in the media? Possibly. That said, it would be very good to know whether the State Department did ANY analysis/testing of Haystack's claimed capabilities, thought through how well it could scale in Iran, and whether they may be hurting its users in Iran -- current and future ones -- by lining up behind them. Were these questions asked and answered?

Filed Under: haystack, iran, obscurity, security

Forget Finding A Needle In A Haystack... How About Actually Finding Haystack

from the security-through-obscurity dept

We recently wrote about Newsweek's coverage of Austin Heap and Haystack, a program he supposedly wrote to help Iranian internet users avoid being spied on by the Iranian government. Some of our commenters questioned the overall legitimacy of the story. It has a very too-perfect Hollywood sort of feel to it -- and some pointed out the fact that no one seems to be able to actually look at Haystack. It sounds like a lot more folks are skeptical of the claims around Haystack as well. Glyn Moody points us to a post by Evgeny Morozov that rips apart the total secrecy around Haystack, to suggest the whole setup is pretty hard to believe.

I like Hollywood as much as the next guy -- and yet something just doesn't feel right about Haystack. What really bothers me is that one cannot download and examine their software; as far as the Internet is concerned, Haystack doesn't exist. In fact, Heap says that it is only distributed to trusted contacts inside Iran; putting it online would create a situation where the government could easily get hold of it as well and then reverse-engineer it or ban it or find a way to track its users.

So, in essence, the outside public - including Iranians -- are asked to believe that a) Haystack software exists b) Haystack software works c) Haystack software rocks d) the Iranian government doesn't yet have a copy of it, nor do they know that Haystack rocks & works. (And who could fault them for not reading Newsweek? I certainly can't). For someone with my Eastern European sensibilities, that's a lot of stuff to believe in. Even Santa -- we call him Ded Moroz -- appears more plausible in comparison.

He goes on to note that, at the very least, this security by obscurity actually could be quite dangerous for Iranians actually using this program, since it may be giving them a very false sense of security:

To me, it seems like a no-brainer: if you want to distribute technology that may endanger lives, make sure that the technology is secure. The only good way that I know of to make sure that it's secure is to let outsiders test it.

Indeed. In retrospect, the Newsweek version of this story had too many holes that should have acted as red flags.

Filed Under: haystack, iran, obscurity, security

The History Of Haystack... And Why Online Censorship Will Remain Difficult

from the there-are-always-holes-in-the-wall dept

Over the years, it's been fascinating to watch the battle over internet censorship, monitors and filters, along with the equally rapid attempts to get around all of those things via technology. Many folks are familiar with anonymous proxies, like Tor, which do help provide anonymity, but can still be blocked once the censor is aware of the tor node. If you follow this space, you're probably already aware of Haystack, which is, in some ways, a step up from Tor and has been getting more and more attention lately. Newsweek actually has a pretty good article on the history of how Haystack came about, involving a 20-something programmer who had little interest in political activism or Iran, until he started seeing the various protests and responses after the Iranian election. Something clicked, and helped along by a "disaffected Iranian official" who sent him the details of how Iran's internet filter worked, and led to Haystack, which hides traffic inside what looks like legitimate traffic (and, in the case of Iran, is specifically designed to hide in traffic that is popular in Iran).

What struck me most about the story is just how improbable a story it is if you look at it in a vacuum. We're talking about a 25-year-old guy, with little interest in Iran or activism, suddenly scratching an itch -- and within a week he had an Iranian gov't official leaking him information that was useful in building a system that could get around the Iranian internet censorship filter. That's impressive, no matter how you look at it. It also highlights why it's always going to be difficult to successfully censor the internet on a wider scale. Someone, perhaps from a totally unexpected place, is going to figure out how to get around it.

Filed Under: censorship, free speech, haystack, iran