Remember Haystack, the privacy app designed to help Iranian dissidents speak freely without fear? Even before it was released, a string of breathless coverage in newspapers, magazines, television networks, radio programs, and blogs and blogs and more blogs touted it as a tool for technoliberation, during a news cycle in which reporters were eager to tell a story about the internet enabling a righteous revolution in Tehran.
The project was the brainchild of Austin Heap (shown at left); with friend and fellow anti-censorship advocate Daniel Colascione, he formed a nonprofit called the Censorship Research Center to manage Haystack and related cryptoanonymity projects.
Today comes news that brings no one joy: Haystack has effectively been forced to close down after security researcher Jacob Appelbaum* (Tor Project, Wikileaks) and tech writer Evgeny Morozov identified significant and fundamental security holes in the service—flaws that could endanger the safety of people in Iran who use Haystack. The Haystack team have stopped testing the app inside Iran, and are urging people who have installed copies to refrain from using it for the time being.
Coverage of the takedown is all over the place today: Wired News, Seattle Post-Intelligencer, SF Chronicle, The Financial Times (paywall), The H, Ostatic, Computerworld UK.
Danny O'Brien's Oblomovka has an authoritative (and compassionate) account. Snip:
Lessons? Well, as many have noted, reporters do need to ask more questions about too-good-to-be-true technology stories. Coders and architects need to realize (as most do) that you simply can't build a safe, secure, reliable system without consulting with other people in the field, especially when your real adversary is a powerful and resourceful state-sized actor, and this is your first major project. The Haystack designers lived in deliberate isolation from a large community that repeatedly reached out to try and help them. That too is a very bad idea. Open and closed systems alike need independent security audits.
And Jillian C. York's blog post on the affair chronicles sloppiness and lack of disclosure on the part of reporters who covered the project in its early phase.
Haystack's tagline: "Good luck finding that needle." Sadly, it appears the needle has been found. Haystack's website, by the way, still solicits donations "to help with the cause."
Update: EFF releases warning advising against Haystack. The post couldn't be more blunt: "Stop Using Haystack Software Now."
* A disclosure: Appelbaum's a personal friend, and I was able to verify over the weekend that the Haystack team's claims they'd taken the service offline were untrue, by examining an entry in BoingBoing's server logs.
