.CYBER

Petition the NSA to Subject its Surveillance Program to Public Comment

Wed, 19 Jun 2013 19:18:05 +0000

I have signed a petition calling on the NSA to "suspend its domestic surveillance program pending public comment." This is what's going on:

In a request today to National Security Agency director Keith Alexander and Defense Secretary Chuck Hagel, the group argues that the NSA's recently revealed domestic surveillance program is "unlawful" because the agency neglected to request public comments first. A federal appeals court previously ruled that was necessary in a lawsuit involving airport body scanners.
"In simple terms, a line has been crossed," Marc Rotenberg, executive director of the Electronic Privacy Information Center, told CNET. "The agency's function has been transformed, and we think the public should have an opportunity to say something about that."

It's an ambitious -- and untested -- legal argument. No court appears to have ever ruled that the Administrative Procedure Act, which can require agencies to solicit public comment, has applied to the supersecret intelligence community. The APA explicitly excludes from judicial review, for instance, "military authority exercised in the field in time of war."

EPIC is relying on a July 2011 decision (PDF) it obtained from the U.S. Court of Appeals for the D.C. Circuit dealing with installing controversial full-body scanners at airports. The Transportation Security Agency, the court said, was required to obtain comment on a rule that "substantively affects the public."

This isn't an empty exercise. While it's unlikely that a judge will order the NSA to suspend the program pending public approval, the process will put pressure on Washington to subject the NSA to more oversight, and pressure the NSA into more transparency. We've used these tactics before. Two decades ago, EPIC launched a similar petition against the Clipper Chip, a process that eventually led to the Clinton administration and the FBI abandoning the effort. And EPIC's more recent action against TSA full-body scanners is one of the reasons we have privacy safeguards on the millimeter wave scanners they are still using.

The more people who sign this petition, this, the clearer the message it sends to Washington: a message that people care about the privacy of their telephone records, Internet transactions, and online communications. Secret judges should not be allowed to use secret interpretations of secret laws to authorize the NSA to engage in domestic surveillance. Sooner or later, a court is going to recognize that. Until then, the more noise the better.

Add your voice here. It just might work.

Finding Sociopaths on Facebook

Wed, 19 Jun 2013 16:19:12 +0000

On his blog, Scott Adams suggests that it might be possible to identify sociopaths based on their interactions on social media.

My hypothesis is that science will someday be able to identify sociopaths and terrorists by their patterns of Facebook and Internet use. I'll bet normal people interact with Facebook in ways that sociopaths and terrorists couldn't duplicate.
Anyone can post fake photos and acquire lots of friends who are actually acquaintances. But I'll bet there are so many patterns and tendencies of "normal" use on Facebook that a terrorist wouldn't be able to successfully fake it.

Okay, but so what? Imagine you had such an amazingly accurate test...then what? Do we investigate those who test positive, even though there's no suspicion that they've actually done anything? Do we follow them around? Subject them to additional screening at airports? Throw them in jail because we know the streets will be safer because of it? Do we want to live in a Minority Report world?

The problem isn't just that such a system is wrong, it's that the mathematics of testing makes this sort of thing pretty ineffective in practice. It's called the "base rate fallacy." Suppose you have a test that's 90% accurate in identifying both sociopaths and non-sociopaths. If you assume that 4% of people are sociopaths, then the chance of someone who tests positive actually being a sociopath is 26%. (For every thousand people tested, 90% of the 40 sociopaths will test positive, but so will 10% of the 960 non-sociopaths.) You have postulate a test with an amazing 99% accuracy -- only a 1% false positive rate -- even to have an 80% chance of someone testing positive actually being a sociopath.

This fallacy isn't new. It's the same thinking that caused us to intern Japanese-Americans during World War II, stop people in their cars because they're black, and frisk them at airports because they're Muslim. It's the same thinking behind massive NSA surveillance programs like PRISM. It's one of the things that scares me about police DNA databases.

Many authors have written stories about thoughtcrime. Who has written about genecrime?

BTW, if you want to meet an actual sociopath, I recommend this book (review here) and this blog.

Cost/Benefit Questions NSA Surveillance

Wed, 19 Jun 2013 11:24:04 +0000

John Mueller and Mark Stewart ask the important questions about the NSA surveillance programs: why were they secret, what have they accomplished, and what do they cost?

This essay attempts to figure out if they accomplished anything, and this essay attempts to figure out if they can be effective at all.

Details of NSA Data Requests from US Corporations

Tue, 18 Jun 2013 21:00:47 +0000

Facebook (here), Apple (here), and Yahoo (here) have all released details of US government requests for data. They each say that they've turned over user data for about 10,000 people, although the time frames are different. The exact number isn't important; what's important is that it's much lower than the millions implied by the PRISM document.

Now the big question: do we believe them? If we don't, what would it take before we did believe them?

NSA Secrecy and Personal Privacy

Tue, 18 Jun 2013 16:02:52 +0000

In an excellent essay about privacy and secrecy, law professor Daniel Solove makes an important point. There are two types of NSA secrecy being discussed. It's easy to confuse them, but they're very different.

Of course, if the government is trying to gather data about a particular suspect, keeping the specifics of surveillance efforts secret will decrease the likelihood of that suspect altering his or her behavior.
But secrecy at the level of an individual suspect is different from keeping the very existence of massive surveillance programs secret. The public must know about the general outlines of surveillance activities in order to evaluate whether the government is achieving the appropriate balance between privacy and security. What kind of information is gathered? How is it used? How securely is it kept? What kind of oversight is there? Are these activities even legal? These questions can't be answered, and the government can't be held accountable, if surveillance programs are completely classified.

This distinction is also becoming important as Snowden keeps talking. There are a lot of articles about Edward Snowden cooperating with the Chinese government. I have no idea if this is true -- Snowden denies it -- or if they're part of an American smear campaign designed to change the debate from the NSA surveillance programs to the whistleblower's actions. (It worked against Assange.) In anticipation of the inevitable questions, I want to change a previous assessment statement: I consider Snowden a hero for whistleblowing on the existence and details of the NSA surveillance programs, but not for revealing specific operational secrets to the Chinese government. Charles Pierce wishes Snowden would stop talking. I agree; the more this story is about him the less it is about the NSA. Stop giving interviews and let the documents do the talking.

Back to Daniel Solove, this excellent 2011 essay on the value of privacy is making the rounds again. And it should.

Many commentators had been using the metaphor of George Orwell's 1984 to describe the problems created by the collection and use of personal data. I contended that the Orwell metaphor, which focuses on the harms of surveillance (such as inhibition and social control) might be apt to describe law enforcement's monitoring of citizens. But much of the data gathered in computer databases is not particularly sensitive, such as one's race, birth date, gender, address, or marital status. Many people do not care about concealing the hotels they stay at, the cars they own or rent, or the kind of beverages they drink. People often do not take many steps to keep such information secret. Frequently, though not always, people's activities would not be inhibited if others knew this information.
I suggested a different metaphor to capture the problems: Franz Kafka's The Trial, which depicts a bureaucracy with inscrutable purposes that uses people's information to make important decisions about them, yet denies the people the ability to participate in how their information is used. The problems captured by the Kafka metaphor are of a different sort than the problems caused by surveillance. They often do not result in inhibition or chilling. Instead, they are problems of information processing -- the storage, use, or analysis of data -- rather than information collection. They affect the power relationships between people and the institutions of the modern state. They not only frustrate the individual by creating a sense of helplessness and powerlessness, but they also affect social structure by altering the kind of relationships people have with the institutions that make important decisions about their lives.

The whole essay is worth reading, as is -- I hope -- my essay on the value of privacy from 2006.

I have come to believe that the solution to all of this is regulation. And it's not going to be the regulation of data collection; it's going to be the regulation of data use.

EDITED TO ADD (6/18): A good rebutttal to the "nothing to hide" argument.

Evidence that the NSA Is Storing Voice Content, Not Just Metadata

Tue, 18 Jun 2013 10:57:57 +0000

Interesting speculation that the NSA is storing everyone's phone calls, and not just metadata. Definitely worth reading.

I expressed skepticism about this just a month ago. My assumption had always been that everyone's compressed voice calls is just too much data to move around and store. Now, I don't know.

There's a bit of a conspiracy-theory air to all of this speculation, but underestimating what the NSA will do is a mistake. General Alexander has told members of Congress that they can record the contents of phone calls. And they have the technical capability.

Earlier reports have indicated that the NSA has the ability to record nearly all domestic and international phone calls -- in case an analyst needed to access the recordings in the future. A Wired magazine article last year disclosed that the NSA has established "listening posts" that allow the agency to collect and sift through billions of phone calls through a massive new data center in Utah, "whether they originate within the country or overseas." That includes not just metadata, but also the contents of the communications.
William Binney, a former NSA technical director who helped to modernize the agency's worldwide eavesdropping network, told the Daily Caller this week that the NSA records the phone calls of 500,000 to 1 million people who are on its so-called target list, and perhaps even more. "They look through these phone numbers and they target those and that's what they record," Binney said.

Brewster Kahle, a computer engineer who founded the Internet Archive, has vast experience storing large amounts of data. He created a spreadsheet this week estimating that the cost to store all domestic phone calls a year in cloud storage for data-mining purposes would be about $27 million per year, not counting the cost of extra security for a top-secret program and security clearances for the people involved.

I believe that, to the extent that the NSA is analyzing and storing conversations, they're doing speech-to-text as close to the source as possible and working with that. Even if you have to store the audio for conversations in foreign languages, or for snippets of conversations the conversion software is unsure of, it's a lot fewer bits to move around and deal with.

And, by the way, I hate the term "metadata." What's wrong with "traffic analysis," which is what we've always called that sort of thing?

Project C-43: A Final Piece of Public-Key Cryptography History

Mon, 17 Jun 2013 17:47:38 +0000

This finally explains what John Ellis was talking about in "The Possibility of Non-Secret Encryption" when he dropped a tantalizing hint about wartime work at Bell Labs.

Blowback from the NSA Surveillance

Mon, 17 Jun 2013 11:13:27 +0000

There's one piece of blowback that isn't being discussed -- aside from the fact that Snowden has killed the chances of any liberal arts major getting a DoD job for at least a decade -- and that's how the massive NSA surveillance of the Internet affects the US's role in Internet governance.

Ron Deibert makes this point:

But there are unintended consequences of the NSA scandal that will undermine U.S. foreign policy interests -- in particular, the "Internet Freedom" agenda espoused by the U.S. State Department and its allies.
The revelations that have emerged will undoubtedly trigger a reaction abroad as policymakers and ordinary users realize the huge disadvantages of their dependence on U.S.-controlled networks in social media, cloud computing, and telecommunications, and of the formidable resources that are deployed by U.S. national security agencies to mine and monitor those networks.

Writing about the new Internet nationalism, I talked about the ITU meeting in Dubai last fall, and the attempt of some countries to wrest control of the Internet from the US. That movement just got a huge PR boost. Now, when countries like Russia and Iran say the US is simply too untrustworthy to manage the Internet, no one will be able to argue.

We can't fight for Internet freedom around the world, then turn around and destroy it back home. Even if we don't see the contradiction, the rest of the world does.

Friday Squid Blogging: Sperm Consumption in the Southern Bottletail Squid

Fri, 14 Jun 2013 21:53:53 +0000

It's a novel behavior.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Microsoft to Offer Standing Bug Bounty

Wed, 19 Jun 2013 20:15:27 +0000

Microsoft said today it will pay up to $100,000 to security researchers who find and report novel methods for bypassing the security built into the latest version of the company’s flagship operating system. Researchers who go the extra mile and can also demonstrate a way to block the new attack method they’ve reported can earn an extra $50,000.

The bug bounty program is a remarkable shift for a company that has for the most part eschewed paying researchers for finding security vulnerabilities in its products. But unlike tech giants like Facebook, Google, Mozilla and Twitter — which have for some time now offered bounties ranging from a few hundred to several thousand dollars to researchers who report bugs in their products or Web properties — Microsoft is reserving its reward money for research on products that are still in beta.

The reward program — which officially launches June 26, 2013 — will pay up to $100,000 USD for “truly novel exploitation techniques” against protections built into the latest version of Windows – Windows 8.1 Preview. Additionally, Microsoft will pay up to $50,000 USD for defensive ideas that accompany a qualifying mitigation bypass submission,” the company said in a blog post today.

These two offers are open-ended, but for just 30 days beginning June 26, Microsoft is offering a separate bounty of up to $11,000 for critical flaws in Internet Explorer 11 Preview on the latest version of Windows (Windows 8.1 Preview).

On Monday, I asked Mike Reavey, director of Microsoft’s Security Response Center, whether the company was concerned that restricting the offering to beta products might be perceived as a promotional gimmick for Windows 8, which has registered flagging sales and mixed reviews. Reavy said the research gleaned from the bug bounty program may well turn out to be useful in hardening older versions of Windows and IE, but in any case the company was focused on fixing big security issues before releasing these products for broader use.

“These are unique programs, because you don’t see white-market vulnerability brokers incentivizing research on products before they’re released,” Reavey said, referring to bug bounty programs run by companies like iDefense and HP Tipping Point, which pay researchers for critical bugs in third-party software and then work with vendors (including Microsoft) to help fix the problems.

Vulnerability researchers have long dug through beta versions of Microsoft products, only to sit on their findings until the product is officially released. That’s because vulnerability brokers don’t typically pay for bugs in beta versions of popular software. But by tying its offer of up to $11,000 to a 30-day preview window only, Microsoft removes the incentive for researchers to hold onto their findings, said Jeremiah Grossman, chief technology officer for WhiteHat Security Inc.

“When any IE preview edition comes out, researchers will start pounding on it looking for bugs, but but since bug brokers don’t pay for preview vulnerabilities the researchers have to hold on to their bugs and hope that they’re still there when the product is finally released,” Grossman said. “Microsoft really is targeting that window of time with this offering.”

Charlie Miller, a former analyst at the National Security Agency and a security researcher who has found his share of bugs in big name software -most notably Apple’s products), applauded Microsoft for trying to fix flaws in software before most customers start using it.

“The whole industry has evolved over the past few years, so there’s now less of a focus on finding and fixing bugs and more of a focus on making exploitation of bugs more difficult,” said Miller, now a security engineer at Twitter. “Most people don’t care about software betas, and Microsoft is trying to change that, and I think that’s good. They’re trying to get the bugs worked out before the software is in most peoples’ hands.”

Critical Update Plugs 40 Security Holes in Java

Wed, 19 Jun 2013 00:31:13 +0000

Oracle today released a critical patch update for its Java software that fixes at least 40 security vulnerabilities in this widely deployed program and browser plugin. Updates are available for Java 7 on both Mac and Windows.

The latest patch brings Java 7 to Update 25 (looks like Oracle has finally followed through on its promise to stop shipping updates for Java 6). In its accompanying advisory, Oracle notes that 37 of the 40 vulnerabilities fixed in this update may be remotely exploitable without authentication — that is, they can be exploited over a network without the need for a username and password.

If you really need and use Java for specific Web sites or applications, take a few minutes to update this software. Updates are available from Java.com or via the Java Control Panel. Keep in mind that updating via the control panel will auto-select the installation of the Ask Toolbar, so de-select that if you don’t want the added crapware.

Other, seriously consider removing Java altogether. I’ve long urged end users to junk Java unless they have a specific use for it (this advice does not scale for businesses, which often have legacy and custom applications that rely on Java). This widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants.

If you have an affirmative use or need for Java, unplug it from the browser unless and until you’re at a site that requires it (or at least take advantage of click-to-play). Java 7 lets users disable Java content in web browsers through the Java Control Panel. Alternatively, consider a dual-browser approach, unplugging Java from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Java.

There are a couple of ways to find out if you have Java installed and what version may be running. Windows users can click Start, then Run, then type “cmd” without the quotes. At the command prompt, type “java -version” (again, no quotes). Users also can visit Java.com and click the “Do I have Java?” link on the homepage. Updates also should be available via the Java Control Panel or from Java.com.

Mac OS X 10.6 (Snow Leopard) users who have Java should check Software Update for any available updates. Mac OS X 10.7 (Lion) and 10.8 (Mountain Lion) users can grab the updated version of Java from Java.com.

Windows Security 101: EMET 4.0

Tue, 18 Jun 2013 17:42:38 +0000

Several years ago, Microsoft released the Enhanced Mitigation Experience Toolkit (EMET), a free tool that can help Windows users beef up the security of third-party applications. This week, Microsoft debuted EMET 4.0, which includes some important new security protections and compatibility fixes for this unobtrusive but effective security tool.

The main window of EMET 4.0

First, a quick overview of what EMET does. EMET allows users to force applications to use several key security defenses built into Windows — including Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). Put very simply, DEP is designed to make it harder to exploit security vulnerabilities on Windows, and ASLR makes it more difficult for exploits and malware to find the specific places in a system’s memory that they need to do their dirty work.

EMET can force a non-Microsoft application to perform ASLR on every component it loads, whether the program wants it or not. Please note that before you install EMET, you’ll need to have Microsoft’s .NET Framwork 4 platform installed. And while EMET does work on Windows XP (Service Pack 3 only), XP users cannot take advantage of mandatory ASLR and a few other notable protections included in this tool.

However, EMET includes several important security features that can help fortify third-party applications on XP. Namely, its “Structured Exception Handler Overwrite Protection,” or SEHOP protection, which guards against the most common technique for exploiting stack overflows on Windows. Microsoft says this mitigation has shipped with Windows ever since Windows Vista Service Pack 1.

In addition to a revised user interface, EMET 4.0 includes a handful of new features that were bundled with the 3.5 tech preview version, such as novel methods of blocking an exploit technique called return-oriented programming (ROP). Attackers can leverage ROP to bypass DEP protections by using snippets of code that are already present in the targeted application.

One of the much-hyped new capabilities of EMET 4.0 is its “certificate trust” feature, which is designed to block so-called “man-in-the-middle” attacks that leverage counterfeit SSL certificates in the browser. The past few years saw several attacks that impersonated Webmail providers and other top Internet destinations using fraudulent digital certificates obtained by certificate authorities, including Comodo, DigitNotar and Turktrust. This feature is a nice idea, but it seems somewhat clunky to implement, and only works to protect users who browse the Web with Internet Explorer. For tips on configuring and using this feature of EMET, check out this post.

To proceed with EMET, download the program and install it (if you are upgrading from an older version of EMET, uninstall the older version first before proceeding with the EMET 4.0 install). This new version of EMET gives users an option to allow a pre-set group of applications to be automatically protected by EMET, including Java, Adobe Acrobat, Internet Explorer and any Office apps that may be installed. Alternatively, users can start from scratch and select their own applications to put behind EMET.

To wrap EMET’s protection around a program — say, Mozilla Firefox — launch EMET and click the “Apps” button in the upper portion of the main EMET window. Selecting the “Add Application” button in the next box brings up a program selection prompt; browse to C:\Program Files (x86)\Mozilla Firefox, and then add the “firefox.exe” file. It should be okay to accept all of the defaults that EMET adds for you.

While you’re at it, add the rest of your more commonly used, Internet-facing apps. But go slow with it, and avoid the temptation to make system-wide changes. Changing system defaults across the board – such as changing ASLR and DEP settings using the “configure system” tab – may cause stability and bootup problems.

I’ve been using EMET on a 64-bit Windows 7 system and phasing in some of my most-used applications one-by-one with the “configure apps” button just to make sure the added security doesn’t crash the programs. Microsoft’s support forum has a useful thread on applications that may not play nice with EMET’s default protection settings.

For example, a handful of applications will simply crash or not work with EMET’s “export address table access filtering” (EAF) mitigation turned on. Skype is one well-known example here. I’ve also experienced issues with running EAF on Google Chrome.

This is really where EMET’s unobtrusiveness can be a blessing and a curse. Unlike some security and antivirus tools that periodically pop-up annoying warnings or notifications to let you know they’re still there and doing their job, EMET is likely to do its job unnoticed by most users. I say curse because on one occasion (I can’t recall the name of the application at issue) I spent a few days scratching my head over an app that wouldn’t work properly, only to remember later that I’d set it to use EMET months before.

If you have questions about EMET or run into issues with the program, check out the Microsoft support page for EMET, which lets you to submit questions to the user community if you don’t see your problem addressed in a previous support thread.

The chart above indicates which system- and application-specific protections in EMET 4.0 are available for each supported version of Windows. Visit this link to download EMET 4.0, as well as a detailed user guide on the software.

Double Cashing With Mobile Banking

Mon, 17 Jun 2013 16:39:45 +0000

The case of a Kentucky man arrested this month for using mobile banking to steal thousands of dollars from a local supermarket chain highlights the security loopholes that thieves can exploit in mobile check deposit schemes being deployed by financial institutions across the country.

Source: Mybanktracker.com

Louisville, Ky. based news station WDRB Inc. carried a story last week about a local man who was arrested after allegedly using mobile banking to steal more than $12,000 from multiple Kroger stores.

“Police say 34-year-old Boma Robert Spero-Jack went into several different Kroger stores and purchased at least 32 Western Union money orders. Each money order was issued for an amount between $195 and $500, according to an arrest report. Police say he would then leave the store and deposit the money order into his Bank of America checking or savings account, via a mobile deposit. Spero-Jack would then go back into the Kroger and ‘cash’ the same money order, according to the arrest report. Later, police say he would withdraw the amount of the money order from his bank account.”

The technology that Spero-Jack is accused of exploiting — known as mobile remote deposit capture (mRDC) — allows banking customers to deposit a check by taking a picture of it with a cellphone. The risk for financial institutions that allow mRDC is that the customer retains the paper check, and can potentially deposit it again and again at other institutions.

Robert McGarvey, a reporter who wrote about the Kentucky incident for Credit Union Times, said paranoids in the banking business have long fretted about this ever since MRDC started to roll out a few years ago.

“Frankly, there have been few reported cases — there have been more accidental double deposits than criminal,” McGarvey said. “But now I am hearing about small time gangs doing this.”

McGarvey and others say this is an area that is ripe for exploitation by far more organized operations — the kind of criminal gangs recently busted for extracting tens of millions from ATM cashout schemes, or from account takeovers involving fraudulently-obtained prepaid debit cards. Those schemes involved transferring funds from compromised accounts and did not require the attackers to put up 50 percent of the cost of the fraud to start with, as was the case with the Kentucky crimes.

“The key is to open an account with fake ID, then buy a throwaway phone at WalMart,” McGarvey said. “You are then in business and very, very unlikely to get arrested. Most banks set a low limit – maybe $3,000 per day on MRDC – which also tells the crook he can get $2,999 with no sweat.”

Julie Conroy, a research director with the retail banking practice of Aite Group, a Boston-based research and advisory firm, said banks are not seeing a lot of losses due to this type of fraud…yet.

“But I think ‘yet’ is the operative word there,” Conroy said. “The product is still fairly new, with many banks just rolling out their offering in the last year or so. Most banks are protecting the product through a combination of rules and velocities, and due to this approach, and the fact that the product is relatively new and doesn’t have a ton of volume yet, this has worked fairly well so far. However, the service is popular with customers, and as this report shows, the bad guys are finding it too.”

Conroy said the key challenge for banks is that they can’t detect in real-time when an item has been deposited via the mobile channel, and then deposited at a branch.

“There are some anti-fraud services that can help detect multiple presentments at multiple banks via mRDC, so to the extent that the banks are subscribing to those services, that can help minimize the risk somewhat,” Conroy said.

According to Conroy, the other aspect of mRDC that has many bankers nervous is the consequential damages provision that was part of the enabling regulation. That provision says that if an item is deposited twice, and that second deposit causes harm to the maker of the item, then the bank responsible for the second presentment has to cover any consequential damages that may result.

“So, to give you the worst case scenario, say I write you a check, and you deposit it once via mRDC, and a second time at a bank branch,” Conroy said. “The second deposit causes my account to go into overdraft status, and the very next check that would have cleared was my homeowners insurance check. That check bounces, and the next day my house burns down. Technically, the bank where that second presentment occurred could be on the hook for the cost of my house if my homeowners insurance lapsed due to that bounced check. No banks have seen much in the way of losses due to this provision, but the possibility of unlimited losses is scary — as is the potential that the consequential damages provision itself could be gamed by the bad guys.”

Iranian Elections Bring Lull in Bank Attacks

Fri, 14 Jun 2013 15:42:38 +0000

For nearly nine months, hacker groups thought to be based in Iran have been launching large-scale cyberattacks designed to knock U.S. bank Websites offline. But those assaults have subsided over the past few weeks as Iranian hacker groups have begun turning their attention toward domestic targets, launching sophisticated phishing attacks against fellow citizens leading up to today’s presidential election there.

Phishing email targeting Iranians. Source: Google.

Since September 2012, nearly 50 U.S. financial institutions have been targeted in over 200 distributed denial of service (DDoS) attacks, according to the U.S. Department of Homeland Security. A Middle Eastern hacking collective known as the Izz ad-Din al-Qassam Cyber Fighters has claimed credit for the assaults, and U.S. intelligence officials have repeatedly blamed the attacks on hacker groups backed by the Iranian government.

But roughly three weeks ago, experts began noticing that the attacks had mysteriously stopped.

“We haven’t seen anything for about three weeks now,” said Bill Nelson, president and CEO of the Financial Services Information Sharing and Analysis Center (FS-ISAC), an industry coalition that disseminates data about cyber threats to member financial institutions. “It’s not clear why [the attacks stopped], but there are a lot of things going on in Iran right now, particularly the presidential elections.”

Meanwhile, data collected by Google suggests that the attackers are focusing their skills and firepower internally, perhaps to gather intelligence about groups and individuals supporting specific candidates running for Iran’s presidential seat. In a blog post published this week, Google said that it is tracking a “significant jump” in the overall volume of phishing activity in and around Iran.

“For almost three weeks, we have detected and disrupted multiple email-based phishing campaigns aimed at compromising the accounts owned by tens of thousands of Iranian users,” wrote Eric Grosse, vice president of security engineering for Google. “The timing and targeting of the campaigns suggest that the attacks are politically motivated in connection with the Iranian presidential election on Friday.”

Grosse said the attacks appear to be the work of the same group that used SSL certificates fraudulently obtained from the now-defunct Dutch certificate authority Diginotar in sophisticated Iranian phishing campaigns that spoofed Gmail and other online services in August 2011.

Jeff Bardin, chief intelligence officer at Treadstone 71, a cyber intelligence and training firm, said he expects the phishing attacks to subside following today’s election in Iran.

“They are ahead of the game this time around as opposed to 2009 when they could not control Web 2.0 and cell phone activities,” Bardin said of the Iranian government. “Since then, they have acquired or nationalized telecoms, established filters, cutoff switches for the Internet and infiltrated Facebook, Twitter, YouTube. Iran has established a high degree of surveillance and control.”

For now, it’s unclear whether the same volume of DDoS attacks against U.S. financial institutions will continue after the Iranian election is over. According to Bardin, the attacks have been increasingly ineffective as more U.S. financial institutions moved to commercial providers of DDoS protection, including companies like Akamai, Arbor Networks, Prolexic (which protects this blog) and Radware.

“We’ll see what happens after the elections, but we’re not holding our breath,” FS-ISAC’s Nelson said. “Maybe this is the end, but they’re probably just gearing up for another round.”

MtGox Phishing Campaign Hits Bing, Yahoo!

Thu, 13 Jun 2013 20:19:16 +0000

An active phishing campaign targeting account holders at popular Bitcoin exchange MtGox.com has hijacked the top search results at Bing and Yahoo.com, redirecting unwary clickers to mtpox.com, a look-alike domain and Web site that was registered on June 12, 2013, less than 24 hours ago.

Check out the video I recorded of this phish in action (turn down in the sound if you hated the Iron Man soundtrack):

Update, June 17, 3:07 p.m: Google’s Youtube team has inexplicably removed my video, calling it a violation of YouTube’s policy on the depiction of harmful activities. 8:09 p.m.: YouTube has restored the video.

Hover over the search links returned in Yahoo.com after searching for “Mtgox” and you’ll see what appears to be a paid or perhaps sponsored search ad that lists a result for mtgox.com, although hovering over the link displays a long “yahoo.com” URL. The same is true when you currently search for “mtgox” on Bing.com: hovering over the returned link shows a bing.com address.

In the video above, entering any credentials at the fake “mtpox.com” site caused a site error, but when I tried it again a moment later, I was redirected to the real Mtgox.com.

Interestingly, it appears the phisher in this case simply copied and pasted the code from Mtgox.com; as shown in the video, hovering over either the username or password field on mtpox.com produces the same warning present on mtgox.com — a message advising visitors to check for the green “extended validation” or EV browser certificate in the URL address bar.

This attack, while not particularly unusual, is a good reminder that relying on trusted bookmarks is among the safest ways to navigate to sites that hold your personal and financial information. Using a search engine to find these sites is better than direct navigation (in which a fat-fingered key can lead to a phishing site), but as this phish illustrates, it’s always a good idea to double check the URL in the address bar.

Hat tip to Twitter follower Ryan Mattinson.

Adobe, Microsoft Patch Flash, Windows

Tue, 11 Jun 2013 19:47:04 +0000

Patch Tuesday is again upon us: Adobe today issued updates for Flash Player and AIR, fixing the same critical vulnerability in both products. Microsoft‘s patch bundle of five updates addresses 23 vulnerabilities in Windows, Internet Explorer, and Office, including one bug that is already being actively exploited.

A majority of the vulnerabilities fixed in Microsoft’s June patch batch — 19 of them — are addressed in a cumulative update for Internet Explorer (MS13-047). The other fix that Microsoft called specific attention to is MS13-051, which tackles a flaw in Office that “could allow remote code execution if a user opens a specially crafted Office document..or previews or opens a specially crafted email message in Outlook while using Microsoft Word as the email reader.”

This Office flaw, which is present in the latest versions of Office 2003 and Microsoft Office for Mac 2011, is already being exploited in targeted attacks, Microsoft said. According to the company’s advisory, this vulnerability was reported by Google. These attacks fit the profile of previous zer0-day incidents, which use targeted email lures and previously unknown vulnerabilities to break into high-value targets.

“When Google encounters flaws that exploit users’ computers, even when the flaws are in other companies’ software, we take strong action to mitigate those attacks,” a Google spokesperson said in response to a request for comment. “Based on the exploit and the way it has been utilized by attackers, we strongly believe the attacks to be associated with a nation-state organization.”

Adobe’s Flash and AIR updates also fix a critical bug that was reported by Google’s security team, although Adobe says it is not aware of any exploits or attacks in the wild against the vulnerability address in its update. The latest Flash version is 11.7.700.224 for Windows and 11.7.700.225 for Mac OS X. This link will tell you which version of Flash your browser has installed. IE10 and Chrome should auto-update their versions of Flash. If your version of Chrome is not yet updated to v. 11.7.700.225, you may just need to restart the browser.

The most recent versions of Flash are available from the Adobe download center, but beware potentially unwanted add-ons, like McAfee Security Scan). To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from here. Windows users who browse the Web with anything other than Internet Explorer will need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).

In addition, Adode AIR (required by some applications like Pandora Desktop, for example) was updated to v. 3.7.0.2090 for Windows and Android, and 3.7.0.2100 for Mac OS X. Adobe AIR checks for and prompts you to install any available updates anytime you launch an application that uses AIR; in any case, the download link is here. See the chart below for the updated version numbers for your operating system.

Update, 8:05 p.m. ET: Added comment from Google.

Update, June 12, 2:10 p.m. ET: Microsoft modified its blog post to say the IE patch covers 19 vulnerabilities, instead of 18. The above copy also has been changed to reflect that.

The Value of a Hacked Email Account

Mon, 10 Jun 2013 19:14:18 +0000

One of the most-viewed stories on this site is a blog post+graphic that I put together last year to illustrate the ways that bad guys can monetize hacked computers. But just as folks who don’t bank online or store sensitive data on their PCs often have trouble understanding why someone would want to hack into their systems, many people do not fully realize how much they have invested in their email accounts until those accounts are in the hands of cyber thieves.

This post aims to raise awareness about the street value of a hacked email account, as well as all of the people, personal data, and resources that are put at risk when users neglect to properly safeguard their inboxes.

Sign up with any service online, and it will almost certainly require you to supply an email address. In nearly all cases, the person who is in control of that address can reset the password of any associated services or accounts –merely by requesting a password reset email.

Your email account may be worth far more than you imagine.

How much are these associated accounts worth? There isn’t exactly a central exchange for hacked accounts in the cybercrime underground, but recent price lists posted by several miscreants who traffic in non-financial compromised accounts offer some insights.

One prominent credential seller in the underground peddles iTunes accounts for $8, and Fedex.com, Continental.com and United.com accounts for USD $6. Groupon.com accounts fetch $5, while $4 buys hacked credentials at registrar and hosting provider Godaddy.com, as well as wireless providers Att.com, Sprint.com, Verizonwireless.com, and Tmobile.com. Active accounts at Facebook and Twitter retail for just $2.50 apiece.

As I’ve noted in previous stories, some crime shops go even lower with their prices for hacked accounts, charging between $1 to $3 for active accounts at dell.com, overstock.com, walmart.com, tesco.com, bestbuy.com and target.com, to name just a few.

Even if your email isn’t tied to online merchants, it is probably connected to other accounts you care about. Hacked email accounts are not only used to blast junk messages: They are harvested for the email addresses of your contacts, who can then be inundated with malware spam and phishing attacks. Those same contacts may even receive a message claiming you are stranded, penniless in some foreign country and asking them to wire money somewhere.

If you’ve purchased software, it’s likely that the license key to that software title is stored somewhere in your messages. Do you use online or cloud file-storage services like Dropbox, Google Drive or Microsoft Skydrive to backup or store your pictures, files and music? The key to unlocking access to those files also lies in your inbox.

If your inbox was held for ransom, would you pay to get it back? If your Webmail account gets hacked and was used as the backup account to receive password reset emails for another Webmail account, guess what? Attackers can now seize both accounts.

If you have corresponded with your financial institution via email, chances are decent that your account will eventually be used in an impersonation attempt to siphon funds from your bank account.

Until recently, some of the Web’s largest providers of online services offered little security beyond a username and password. Increasingly, however, the larger providers have moved to enabling multi-factor authentication to help users avoid account compromises. Gmail.com, Hotmail/Live.com, and Yahoo.com all now offer multi-step authentication that users can and should use to further secure their accounts. Dropbox, Facebook and Twitter also offer additional account security options beyond merely encouraging users to pick strong passwords.

Of course, all of this additional security can be defeated if the bad guys gain control over your machine through malicious software. To keep your computer from being compromised, consider adopting some of the recommendations in my Tools for a Safer PC primer.

Vrublevsky Arrested for Witness Intimidation

Wed, 05 Jun 2013 16:05:27 +0000

Pavel Vrublevsky, the owner of Russian payments firm ChronoPay and the subject of an upcoming book by this author, was arrested today in Moscow for witness intimidation in his ongoing trial for allegedly hiring hackers to attack against Assist, a top ChronoPay competitor.

Pavel Vrublevsky’s Facebook profile photo.

Vrublevsky is on trial for allegedly hiring two brothers — Igor and Dmitri Artimovich — to use their Festi spam botnet to attack Assist, a competing payments processor. Prosecutors allege that the resulting outage at Assist prevented Russian airline Aeroflot from selling tickets for several days, costing the company at least USD $1 million.

Vrublevsky was imprisoned for six months in 2011 pending his trial, but was released at the end of that year after admitting to his role in the attack. Later, he recanted his jailhouse admission of guilt. Today, he was re-arrested after admitting to phoning a witness in his ongoing trial and offering “financial assistance.” The witness told prosecutors he felt pressured and threatened by the offer.

Two months ago, I signed a book deal with Sourcebooks Inc. to publish several years worth of research on the business of spam, fake antivirus and rogue Internet pharmacies, shadow economies and that were aided immensely by ChronoPay and — according to my research — by Vrublevsky himself.

Vrublevsky co-founded ChronoPay in 2003 along with Igor Gusev, another Russian businessman who is facing criminal charges in Russia stemming from his alleged leadership role at GlavMed and SpamIt, sister programs that until recently were the world’s largest rogue online pharmacy affiliate networks. Huge volumes of internal documents leaked from ChronoPay in 2010 indicate Vrublevsky ran a competing rogue Internet pharmacy — Rx-Promotion — although Vrublevsky publicly denies this.

My previous reporting also highlights Vrublevsky’s and ChronoPay’s role in nurturing the market for fake antivirus or scareware products. One such story, published just days before Vrublevsky’s initial arrest, showed how ChronoPay executives set up the domains and payment systems for MacDefender, a scareware scam that targeted millions of Mac users.

I found this development noteworthy because I, too, was offered financial assistance by Vrublevsky, an offer that very much seemed to me like a threat. In mid-2010, after thousands of emails, documents and hundreds of hours of recorded phonecalls from ChronoPay were leaked to this author, Vrublevsky began calling me at least once a day from his offices in Moscow. This continued for more than six months. In one conversation from May 2010 , Vrublevsky offered to fly me to Moscow so that I could see firsthand that he had “only a very remote relationship with this case.”

“My proposition to you is to come to Moscow, and if you don’t have money….I realize journalists are not such wealthy people in America, we’re happy to pay for it,” Vrublevsky said in a phone conversation on May 8, 2010.

When I politely declined his invitation, Vrublevsky laughed and said I was wrong to feel like I was being bribed or intimidated.

“It’s quite funny that you think somehow when you fly to meet me in Moscow or ChronoPay offices that you are in any possible danger from me for being murdered,” Vrublevsky said. “Come to Moscow and see for yourself. Take your notebook, come to my office. Sit in front of me and look around. Because you’re getting information, which, to be honest, is not factual.”

As I note in my book (due to be published in late Summer 2014) I believe Vrublevsky’s intention was more to somehow secure my future silence than to set the record straight. I did, however, eventually come to Moscow and interview him at his ChronoPay offices.

According to Russian news outlet Vedomosti, Vrublevsky is likely to spend another six months in prison for this latest stunt. He faces an additional two years in prison if he is ultimately found guilty of orchestrating the attacks on his company’s rival.

FDIC: 2011 FIS Breach Worse Than Reported

Tue, 04 Jun 2013 04:50:24 +0000

A 2011 hacker break-in at banking industry behemoth Fidelity National Information Services (FIS) was far more extensive and serious than the company disclosed in public reports, banking regulators warned FIS customers last month. The disclosure highlights a shocking lack of basic security protections throughout one of the nation’s largest financial services providers.

Jacksonville, Fla. based FIS is one of the largest information processors for the banking industry today, handling a range of services from check and credit card processing to core banking functions for more than 14,000 financial institutions in over 100 countries.

The company came under heavy scrutiny from banking industry regulators in the first quarter of 2011, when hackers who had broken into its networks used that access to orchestrate a carefully-timed, multi-million dollar ATM heist. In that attack, the hackers raised or eliminated the daily withdrawal limits for 22 debit cards they’d obtained from FIS’s prepaid card network. The fraudsters then cloned the cards and distributed them to co-conspirators who used them to pull $13 million in cash from FIS via ATMs in several major cities across Europe, Russia and Ukraine.

FIS first publicly reported broad outlines of the breach in a May 3, 2011 filing with the Securities and Exchange Commission (SEC), stating that it had identified “7,170 prepaid accounts may have been at risk and that three individual cardholders’ non-public information may have been disclosed as a result of the unauthorized activities.” FIS told the SEC it worked with the impacted clients to take appropriate action, including blocking and reissuing cards for the affected accounts. “The Company has taken steps to further enhance security and continues to work with Federal law enforcement officials on this matter,” it declared in its filing.

FIS’s disclosure to investors cast the breach as limited in scope, saying the break-in was restricted to unauthorized activity at a portion of its network belonging to a small prepaid debit card provider that it acquired in 2007. But bank examiners at the Federal Deposit Insurance Corp. (FDIC) who audited FIS’s operations in the months following the 2011 breach and again in October 2012 came to a very different conclusion: According to a report that the FDIC sent May 24, 2013 to hundreds of FIS’s customer banks and obtained by KrebsOnSecurity, the 2011 breach was much larger than previously reported.

“The initial findings have identified many additional servers exposed by the attackers; and many more instances of the malware exploits utilized in the network intrusions of 2011, which were never properly identified or assessed,” the FDIC examiners wrote in a report from October 2012. “As a result, FIS management now recognizes that the security breach events of 2011 were not just a pre-paid card fraud event, as originally maintained, but rather are that of a broader network intrusion.”

Indeed, the FDIC’s examiners found that there was scarcely a portion of the FIS network that the hackers did not touch.

“From review of the previous investigation reports, along with other documentation provided by FIS, examiners and payment card industry experts identified over 2,000 touch points that indicated a broad exposure of internal FIS systems and client related data,” the report notes. “These systems include, but are not limited to, the The New York Currency Exchange ATM network, prime core application systems, and various Internet banking, ACH, and wire transfer systems. These touch points also indicated approximately 100 client financial institutions, which appear to have had sensitive data exposed by the attackers.”

A screen shot of an excerpt from the FDIC report on security lapses at FIS.

In an emailed statement, FIS maintained that “no client of FIS suffered any monetary loss as a result of the incident, and stressed that the report is based upon a review that was completed in October 2012.

“Since that time, FIS has continued to strengthen its information security and risk position, including investments over two years of $100 million or more, as part of our goal to provide best-in-class information security and risk management to each of our 14,000-plus clients. We have openly and regularly communicated these initiatives, our progress and results to our clients and shareholders through meetings, monthly updates, quarterly public disclosures, Board materials, educational webinars, and more.”

WHAT DOES $100 MILLION BUY?

Nevertheless, investors may be less than pleased about how FIS is spending its security dollars. The FDIC found that even though FIS has hired a number of incident response firms and has spent more than $100 million responding to the 2011 breach, the company failed to enact some very basic security mechanisms. For example, the FDIC noted that FIS routinely uses blank or default passwords on numerous production systems and network devices, even though these were some of the same weaknesses that “contributed to the speed and ease with which attackers transgressed and exposed FIS systems during the 2011 network intrusion.”

“Many FIS systems remain configured with default passwords, no passwords, non-complex passwords, and non-expiring passwords,” the FDIC wrote. “Enterprise vulnerability scans in November 2012, noted over 10,000 instances of default passwords in use within the FIS environment.”

The bank auditors also found “a high number of unresolved network and application vulnerabilities remain throughout the enterprise.

“The Executive Summary Scan reports from November 2012 show 18,747 network vulnerabilities and over 291 application vulnerabilities as past due,” the report charges.

What’s more, investigators probing the breach at FIS may have been denied key clues about the source of the intrusion because FIS incident response personnel wiped many of the compromised systems and put them back on the network before the machines could be properly examined.

“Many systems were re-constituted and introduced back into the production environment before data preservation techniques were applied,” the report notes. “Additionally, poor forensic preservation techniques led to numerous servers being re-imaged before analysis was completed and significant logging data was inadvertently destroyed. Several servers, key to the investigation process, were re-introduced into the production environment and subsequently re-compromised due to misconfigured baselines and inadequate security testing outside of corporate policy.”

Analysts say FIS’s problems almost certainly stem from having to cobble together various networks and systems that it inherited from a long series of corporate acquisitions over the past few years. The FDIC report notes FIS had originally set a target completion date of year-end 2012 for this project, but has since revised the projected completion date to June 30, 2013.

“It appears the extension is necessary due to the immense scale of the project, which consists of approximately 30,000 servers and operating systems, another 30,000 network devices, over 40,000 workstations, 50,000 network circuits, and 28 mainframes running 80 LPARs,” the FDIC examiners wrote. “The vast scope of this project is being addressed in a formal process which requires additional time to complete. Nonetheless, this information asset inventory and risk rating process is critical to effective information security and risk management efforts; and they should have been implemented prior to regulatory intervention.”

An excerpt from the FDIC report on FIS.

MATTERS REQUIRING ATTENTION

In its initial audit in 2011, the FDIC found eight MRAs, or “matters requiring attention.” Ron Lindhart, a former bank examiner for the Office of the Comptroller of the Currency (OCC), said MRAs are extremely serious matters that financial services firms ignore at their peril. In its Oct. 2012 follow-up report, the FDIC said while FIS had addressed four of the eight MRAs it identified earlier in the year, the agency had since documented an additional four MRAs.

Lindhart called FIS’s eight MRAs a “high average” score on a report card in which high scores are not a mark of achievement.

“I’d say in a typical examination, you might have two or three, maybe four MRAs, so eight is a significant number,” said Lindhart.

Financial institutions that fail to address MRAs in a timely manner and to the satisfaction of the banking regulators can face fines and can even be shut down. But FIS is a service provider — not a bank — and while the company’s role as a core provider for thousands of banks means that it can be audited by regulators, those regulatory agencies can’t levy fines against the company or shut it down directly.

Rather, Lindhart said, the FDIC’s leverage comes from taking their case to FIS’s customers. Perhaps that is why the FDIC’s May 24, 2013 letter attached the report began with the message, “We are sending you this report for your evaluation and consideration in managing your vendor relationship with FIS.”

Translation? Get FIS’s customer banks to pressure FIS and create the fear that they may lose business by not adequately addressing the security weaknesses. ”It’s very effective in getting corrective action when the serviced banks find out about the situation,” Lindhart said.

Julie Conroy, a research director with the retail banking practice of Aite Group, a Boston-based research and advisory firm, said a major reason FIS is receiving such regulatory scrutiny is that the company is not just a credit card processor: thousands of small financial institutions outsource their entire information technology systems to FIS.

“It’s basically outsourced IT infrastructure for these banks, including all of their customer information — names, SSNs, DBAs, account balances — all of that is sitting at FIS,” Conroy said. “These kinds of security lapses threatens a key part of the trust relationship that these banks have with the core processors, and [the banks] expect state-of-the-art security.”

But Avivah Litan, a fraud analyst for Gartner Inc., said many of FIS’s customer banks are smaller institutions that can’t exactly afford to pick up and move their operations to a competing service provider, such as Fiserv or Jack Henry.

“It’s very hard for these banks to switch processors,” Litan said. “The pricing is typically the same, but it takes a lot of manpower to test new systems, to stage it and roll it out in a way that doesn’t disrupt your service.”

Litan said for these institutions, switching service providers is akin to the hassle most consumers experience in trying to switch their Internet service from a cable to a DSL provider - only 100 times harder and more expensive.

“So many of these processors neglect security and have awful customer service, in large part because the switching costs are so high that they can get away with it,” Litan said. “There needs to be more heat on these processors, and I think this is a pretty savvy and important move by the regulators.”

CONNECTIONS TO OTHER ATM CASHOUTS?

The $13 million ATM cashout against FIS in 2011 bears a remarkable resemblance to several similar heists involving organized crime, malware and ATM cashouts. In May 2013, federal prosecutors in New York unsealed indictments against eight defendants allegedly involved in two separate cyberattacks that used prepaid debit cards to siphon a total of $50 million from ATMs across the globe; the first was a breach around Christmas 2012 that netted thieves $5 million from an Indian prepaid network, while the second siphoned $40 million from a bank in the United Arab Emirates in February 2013.

Meanwhile, the hackers responsible for coordinating the ATM heists, raising the daily withdrawal limits and monitoring the withdrawals were not named in the New York indictments.

In its emailed statement to KrebsOnSecurity, FIS said the criminal actors involved in 2011 attack on its own networks “are currently the subject of an ongoing federal criminal law enforcement investigation, and several individuals have been arrested and charged with various crimes.” FIS declined to say whether those arrested were involved in the two thefts connected to the New York investigation.

The FIS breach and the two separate incidents encompassed by the New York case are eerily similar to an intricate 2008 attack against RBS WorldPay. In that heist, crooks obtained remote access to RBS’s systems, raised the daily withdrawal limit and used 44 counterfeit prepaid cards to suck more than $9 million from at least 2,100 ATM terminals in 280 cities worldwide.

Federal prosecutors alleged that the 2008 RBS theft was orchestrated by at least eight men from Estonia and Russia — the alleged ringleader, Sergei Tsurikov, was extradited to face charges in the United States. His trial is pending and much of his case remains sealed.

Another key figure in that case was Viktor Pleschuk of St. Petersburg, Russia, who monitored the fraudulent ATM withdrawals remotely and in real-time using compromised systems within the payment card network. Pleschuk and Russian accomplice Eugene Anikin were arrested and charged in Russia. Prosecutors asked the court for five- and six-year sentences, but those requests were ignored. In February 2011 (around the time of the FIS breach) Pleschuk and Anikin agreed to plead guilty for their roles in the RBS heist in exchange for suspended sentences — probation, but no jail time.

Targeted Attacks – a Video Series

Mon, 17 Jun 2013 15:01:50 +0000

Trustworthy Computing in partnership with Microsoft IT, Microsoft Consulting and the product groups just released a series of videos on targeted attacked and how to defend.

I would definitely urge you to listen to them and make sure you implement the countermeasures: Targeted Attacks Video Series

Roger

Are we sitting on a time bomb?

Tue, 04 Jun 2013 07:10:43 +0000

I just read another of these studies: Enterprises sitting on security time bomb as office workers compromise company data. Let's briefly look at the findings first:

38% of U.S. office workers admit to storing work documents on personal cloud tools and services
[…] almost a fifth (16 percent) of people use Dropbox to store work documents, while Google Drive and Apple iCloud came in second and third place with 15% and 12% respectively
[…] 91% of workers also stating that they use personal devices to store, share, access or work on company documentation […]
Regarding personal devices, almost two thirds (64 percent) of office workers use external hard drives to store work documents and almost half (46 percent) use USB drives. More than a third (34 percent) of people admit to using USBs to share documentation with others and 43% use external personal hard drives for the same purpose
Half of U.S office workers want to be able to work from anywhere and almost half (49 percent) wanted to access all of their work documents in one place
A fifth of U.S. workers also want to use their personal smartphones, laptops and tablets for work

According to the research, technology adds to people's frustrations in the office as key annoyances are:
Not being able to send large files via email (31 percent)
Wasting time searching for electronic documents (28 percent)
Ensuring that you are using the most up to date version of any given document (21 percent)
Getting documents approved by others (18 percent)
Figuring out who has specific information about a project or task (17 percent)

In order to share and work on documents with people outside of their company:
Almost two thirds (65 percent) of office workers continue to revert to sending email attachments
Nearly a fifth (16 percent) use USB drives
A similar amount (15 percent) send hard copies of documents via courier
Eight percent send CDs or DVDs via mail

Shocking, no? Do we need to go out now and start to change the policies and punish the user? Well, this is what happens most of the time. We change the policies and then feel really good. However, I would guess that your user do all these things for a reason. This reason probably is not to feel cool but to do their job. A few weeks ago, I posted on Will the user define security policies in the future? where I quoted a study saying that at least 40% of the sales people had to circumvent security policies to do their job – to get access to information they needed to win a sale.

I guess it is time to re-think. Almost all the scenarios above can be done in a secure way with today's technology like Rights Management Services, Bitlocker To Go etc. So, it is probably more helping the user to do their job – but in a secure and safe way rather than tightening the policies – no? Do you have a different view on that?

Roger

The Moscow Rules in the Cyberspace

Mon, 03 Jun 2013 07:46:22 +0000

Doing your basics is a natural given, when you defend your assets. Basics like updating your computers, staying on latest versions, dynamic network zones, incident response, identity management, monitoring etc. etc. – last but not least (or probably first J) is to know your assets and have your data classified so that you understand, which part of your business needs which level of protection.

That's the basic stuff, which almost all companies do on different levels of maturity. But what about intelligence? What about leveraging sources outside your company (and combine it with information inside your company) to be able to look at least a tiny little bit in the future? This rarely happens or – better – I have not seen too many organizations really doing that intensively and successfully. Additionally, there is the question how to behave if you are going to setup something like that up. We are all used to work in a defensive mode but not necessarily in intelligence.

Back during the Cold War, the US had some rules how to move behind enemy lines when you are a spy. These rules were called Moscow Rules. If you look at them, they can really and simply be applied to the Cyberspace as well. Read yourself. It is worth thinking about it and then thinking about how we can start to predict attacks: Moscow Rules: The original protocol for operating in the presence of adversaries can be applied to cyber defense

Roger

Enabling the Hybrid Cloud with Microsoft Technology

Thu, 23 May 2013 13:32:57 +0000

When I talk with customers about the Cloud, we always talk about a few key themes:

Identity: I am convinced that you need to be able to federate your identity from your on premise solutions to the cloud. You will want to control the process of decommissioning an identity and want to make sure that of you have to lay somebody off, this person has no access to the data anymore – especially in the Public Cloud as this part of your infrastructure can be accessed from anywhere.
Transparency: If you move to the public Cloud, you will want to have a certain level of transparency about how the software your business runs on is built and operated.
Data Classification: A lot of customers raise concerns about having their data leaving their premises, especially if they leave the country. However, for a lot of data in your environment, most probably you do not really care as the data is not sensitive at all. Then there is data ("the keys to the bomb") you will never ever move to the public Cloud.

Especially the last point typically leads to a hybrid approach as you want to leverage the public Cloud (for the non-sensitive part of your data) and keep the sensitive data in a private Cloud.

Our French team just published a paper, which you will want to leverage, when you are in such a situation: Enabling Hybrid Cloud Today with Microsoft Technologies. To quote the abstract:

With the ambient credo to "do more with less, with a better agility and time to market", IT inevitably becomes a service provider for its enterprise and need to run like a business. The undertaking also requires a step further in the way the IT delivers its services to its customers: internal businesses and beyond. IT has indeed to deliver the services in an industrialized way for greater speed and lower cost. This requires increasing their overall core infrastructure operational maturity in two main areas.

The first one aims at improving the management of their own on-premises IT landscape and traditional services by evolving towards a private cloud, i.e. an optimized and more automated way to provision and operate (a catalog of) services for businesses. The second one consists in enhancing their service offerings by utilizing off-premises public cloud augmentations (for acceptable cases of use) as (lower-cost) add-ons to existing services in the catalog.

The combination and interaction of these two cloud paradigms results in the emergence of the hybrid cloud which meets the demands and the expectations of the business. Hybrid cloud spans the two above implementations. A service request can be instantiated in either implementation, or moved from one to another, or can horizontally grow between the two implementations (cloud bursting for instance).

This paper discusses how Microsoft can help your organization achieve a successful hybrid cloud strategy and present the enabling technologies from on-premises, cross-premises, and off-premises implementation of (parts of) the services. Several typical patterns and common scenarios are illustrated throughout this paper.

So, download and leverage it!

Roger

Is there a future for Product Certifications?

Fri, 17 May 2013 09:09:10 +0000

Often, when I talk to customers, product certification is one of the key themes they want to address. Especially they want to know about our commitment to Common Criteria and whether our products are certified. Typically we certify an operating system on Common Criteria EAL 4+ - the highest level, which seems achievable for multi-purpose operating systems. However, personally I do not think that product certifications are the future for different reasons:

The certification is static. In other words, there is a configuration at a given time, with a given product build, which is certified. The next hotfix or update basically invalidates the certification and you run the product rarely in the configuration certified. We make all the policies and configuration public – if you want to use them, feel free.
It is slow. Even though we have plenty of experience by now, it still takes us more than 12 months to get a product certified.
It is expensive. I will not go into the details here but it costs us a lot of money. This is the cost of doing business, I get that but there has to be a better way to address this.
Typically the protection profile certified against does not completely meet the customer's requirements. This means a lot of additional energy by the customer and us to go the final mile. This leads, unfortunately, to local requirements, local certifications and accreditations. Again, cost of doing business.

Being an engineer, I am deeply convinced that a secure product is the result of a sound and strong process embedding security into the lifecycle from the beginning. I am convinced as well, that product certification gives you a certain level of assurance but not too much. The process would probably give you much, much more to build your risk management on.

At the Security Development Conference this week, we declared conformance with ISO 27034-1, the first part of a standard on secure software development. Here is the official statement:

Microsoft has used a risk based approach to guide software security investments through a program of continuous improvement and processes since the Security Development Lifecycle (SDL) became a company-wide mandatory policy in 2004. In 2012, Microsoft used ISO/IEC 27034-1, an international application security standard as a baseline to evaluate mandatory engineering policies, standards, and procedures along with their supporting people, processes, and tools.

All current mandatory application security related policies, standards, and procedures along with their supporting people, processes, and tools meet or exceed the guidance in ISO/IEC 27034-1 as published in 2011.

Basically, this means that we are convinced that our Security Development Lifecycle fulfills ISO 27034-1. Transparency in this context is absolutely key in my opinion – much more than any product certification or any statement along the lines of "we trust our (fill in a role), he/she is in the business for so long, he/she knows what to do". No joke, I heard this statement more than once.

In the future – and in the Cloud – transparency how software is built and ultimately run, how a company does incident response etc. gains more and more importance. Looking into the purchasing processes of our customers, they are still much too much focused on the product itself, in my humble opinion. I am convinced that this should change and should change rapidly.

If I may give you an advice: If you do not want to rely on a relatively new standard, you might just start by asking your vendors about how they develop software, how they react on incidents and product vulnerabilities, what support you get when you get compromised on their platform and – if you move to the Cloud – how they run your environment. Use your common sense before any standard when you judge their answers and see what the outcome is. I did it more than once and the answers are amazing (not to the good fairly often)

Roger

Will the user define security policies in the future?

Tue, 14 May 2013 07:39:22 +0000

I think, I blogged about this event already earlier: Years ago I was meeting a customer and was talking about the future of IT. I was telling the audience (about 10 people including the Security Officer) that there is a good chance that IT will not define a set of hardware anymore but that the user will buy their own and use it for business. Additionally, different people have different needs and my notebook is setup differently than a lot of others within Microsoft's internal network – just because I have different needs and I use one piece of hardware for private and business. Actually in my case, it is even my own hardware. Back then at this point the CSO left the room complaining that I am completely nuts.

Where are we today? We all talk of Consumerization of IT (CoIT), we talk of "Bring Your Own Device" (BYOD) – but the mindset in a lot of companies did not change at all. They run projects on BYOD and define a set of acceptable hardware models – which is outdated the moment they publish it as it takes them a few months. I think we need to change our approach as the world changed. We need to think "policy and requirements" and not "hardware models and OS builds". We might decide in a security policy that we require a device to be allowed access to sensitive resources to have a TPM chip to protect the keys. We might require disk encryption to be switched on (Bitlocker with TPM in our case). We might require IPSec policies to be deployed to authenticate the device to the server. We might require full patching etc. etc. But why the hardware? We might care regarding support but if I bring my own device, hardware issues are my problem, aren't they? As long as this is clear, we can head that way and still offer supported hardware with a standard build to people who want to get full internal service.

What will happen if we do not follow that path? To me it is fairly simple: Almost half of employees admit to bypassing security controls.

[…] half of sales-focused employees say their job is hindered because they aren't getting access to all the information they need. And with more than half of the respondents working for large organizations (the majority employing more than 5,000 people), the potential ramifications are notable.

A lot of security people I know have a false sense of security. Do you think that internal security knows of these bypasses? No, not at all:

That's breeding apathy, too: 40% admitted that if they were breached no one would notice.

If we do not help our users to do their job in a secure and safe way, we risk our business. Think about it again:

While 40% of companies have lost a sales opportunity because employees weren't able to access the information they needed, an alarming 46% avoided the possibility of losing a sales opportunity by bypassing security controls to access necessary sensitive information to get the job done.

Can you really blame your sales? Kind of but they are measured by making money. What would you do in their shoes?

How much does this have to do with the BYOD? Well a lot to me as it is just the next big wave – actually the one we are riding since smartphones came up. Our users need access to information wherever they are the way they need it. Our job is to protect the company's assets in this context.

The way we at Microsoft do it, is that we apply something we call "Variable User Experience". It bases on different factors:

Identity: How did the user authenticate? With a consumer identity like LiveID, Facebook or with Active Directory. For certain access the Microsoft Account (former LiveID) might be good enough. Did he/she authenticate with UserID/Pwd or with two factors (we use virtual Smartcards in Windows 8 today, so my computer acts as second factor and I do strong authentication).
Device: Who manages it? Is it IT Managed, Employee Managed (but still in AD), or unmanaged? Is it authenticated? Is it in a policy compliant state?
Location: Is the device on the network or outside on Direct Access/VPN? In which country is the device?
Data/Application: What kind of data is being accessed? Which sensitivity level?

Based on these factors, I might have different routes to what I need to do:

Direct Access/VPN: I might be able to access the network and all the data through DA/VPN requiring Strong Authentication
VDI/Citrix: If not, for any reason, the fallback is a Terminal Server session, where I do not have any local data but might still require strong authentication.
Web SSL: Web based apps, requiring simple authentication. Maybe even through Office365, which I personally use very often.
Denied.

I do not say that we should loosen up everything so that every user can access highly sensitive data on the unpatched and unencrypted iPad or Windows XP. There is a "Denied" in there and it has to. There are administrative (HR) processes in there for violation of policies and it has to. But we have to give the user different – SIMPLE – ways to achieve the goals they have to or they will spend a lot of energy to find ways around our security controls.

I know that we as security people can sleep well when we have all the controls in place. We did everything to secure the data and if it fails, the user is to blame and not us. But this does not help the business we are supporting, does it?

If a CEO or CIO reads this and nods now (which happens to me often, when I talk about this subject) – you have a role in there as well: If the "*** hits the fan" and a security incident happens, think twice before you fire the Security Officer. We talk about managing risks. Risks have the tendency to materialize once in a while – and basically you should fire the CSO only if he did not do his homework or if he does not have a proper incident process. Otherwise you create a culture of "CYA" (Cover Your Ass) and not the openness and trust you need to land such a strategy.

I guess a lot of people disagree now J - let me know!

Roger

Some Windows XP Users Can't Afford To Upgrade

Tue, 23 Apr 2013 15:18:29 +0000

I just read a post on slashdot:

During a recent trip to an eye doctor, I noticed that she was still using Windows XP. After I suggested that she might need to upgrade soon, she said she couldn't because she couldn't afford the $10,000 fee involved with the specialty medical software that has been upgraded for Windows 7. Software written for medical professionals is not like mass market software. They have a limited market and can't make back their money in volume because there isn't the volume for an eye doctor's database product like there is for Office or Quicken. With many expecting Microsoft's upcoming end-of-support for XP to cause a security nightmare of unsupported Windows devices in the wild, it seems a good time to ask how many users may fall into the category of wanting an upgrade, but being priced out by expensive but necessary third-party software. More importantly, can anything be done about it?

Let me briefly give you some insight into a discussion I had a few years ago: I was in touch with a regulator for medical devices as I wanted to understand their approach to patch management for embedded software. The reason behind my ask was, that I talked to hospitals in this country and the CIOs all told me that they are not allowed to patch/upgrade because they would violate the accreditation of the device. So, when I talked to the regulator, they told me that they require only a proper risk management process by the vendor of the device (not an effective, just a process) and from there on they do not want to act. They told me that the hospitals need to increase pressure on the vendors to keep software updated and the vendor does not have the incentive.

This is one of the key scenarios, which scare me around Windows XP end of life. Machines which cannot be upgraded for legal reasons or because of economic pressure as described above.

Roger

Microsoft Account: Enable Two-Step Verification

Fri, 19 Apr 2013 09:06:27 +0000

We could even talk about two-factor authentication in my opinion. The idea is, that whenever you logon from an untrusted PC, you will be asked to use a second factor (or step). In my case, which I show below, I use the Authenticator app on my phone, which is similar to an RSA SecureID.

How to set it up? Fairly easy:

Logon to your Microsoft Account (formerly LiveID) on https://account.live.com .

There you have all your account settings. Go to your Security Info:

And choose Set up two-step verification, which will guide you through the wizard:

Once you are done, get back to your Security Info and choose Authenticator App:

In the meantime, download the Authenticator App to your phone as in the next screen you can pair them:

Done! Enjoy the additional layer of security J

Roger

Internet Accessible SCADA Systems

Mon, 25 Mar 2013 07:21:33 +0000

This is a fairly scary view of the world…. Freie Universität Freiburg mapped the Internet accessible SCADA systems. Have a look on your own: https://www.scadacs.org/projects.html

Roger

Cyber Espionage and Targeted Attacks

Fri, 08 Feb 2013 11:32:25 +0000

This morning I read an article on Infoworld: Why you should care about cyber espionage which – to me – is a strange question. First of all, most companies have to protect some sort of intellectual property. It is not new for the Internet, that state-driven espionage not only targets state's secrets but industrial espionage as well. Therefore Cyber Espionage as it is in no way different than any other espionage. Did you care about losing your intellectual property 20 years ago? Better care about it today as well.

Secondly, if I looked at the targeted attacks companies suffered, they are by no means limited to state-owned infrastructure. It hits private sector companies as well as public sector organizations.

Should you are about protecting your intellectual property? For sure!

Should you defend against targeted attacks? What a question. If you are concerned about this, I recently blogged about a paper we published: Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques.

So, there should be no separation – just protect your infrastructure and make sure you care about classical network hygiene (as described in the paper above). This is the best first step to happiness J

Roger

Get more from your data: learn SQL! | New Organizing Institute

Fri, 31 May 2013 20:55:02 +0000

"Do you want to get more control over your data? Anyone who works with data can benefit from learning SQL, whether you’re an online campaigner, a voterfile manager, an analyst, a pollster, or anyone else who works extensively with data."

Tags: sql data datamining tools

What is a Good Program Spec?

Wed, 29 May 2013 18:50:43 +0000

"There are fundamentally three aspects to any program development effort: defining the program's specifications, designing and writing the program itself, and testing it. The software engineering gurus in the industry are primarily concerned with the internal design of the program, but there is now a raft of consultants trying to determine the best way to approach the program externally."

Tags: vicinus v-res program spec

Complete Walk-through For Doing A Clean Windows 7 Install

Thu, 25 Apr 2013 00:02:13 +0000

"This is a complete walk-through for doing a clean Windows 7 install. This information is based on the ASUS G73JH-X1 laptop which includes one "Windows 7 Recovery Media for Windows 7 Products" and one "Driver & Utility Ver 1.0" disc."

Tags: W7 asus

Asus Utility and Bloatware Guide

Thu, 25 Apr 2013 00:01:28 +0000

Tags: W7 harddrive bloatware asus utility

Clonezilla - Live Doc

Thu, 25 Apr 2013 00:00:50 +0000

Tags: W7 cloning harddrive

Hot Image Your PC's Hard Drive with DriveImage XML

Wed, 24 Apr 2013 23:57:38 +0000

"DriveImage XML can save a full, working snapshot of your Windows hard drive while you work on it. (That's hot.) When your PC crashes and burns or just slows down over time, the best insurance you can have is a mirror image of your operating system, complete with drivers, user settings, software applications, and documents in one place. A while back we covered how to partition and image your Windows hard drive using the Linux-based System Recovery Boot CD, a process that involves command line work, disk-burning, rebooting, and video driver wrangling. With DiskImage XML, imaging your PC's hard drive is a matter of a few clicks, no reboots required."

Tags: W7 cloning harddrive

sentence-boundary-detector - detecting sentence boundaries from phrases or documents - Google Project Hosting

Sun, 14 Apr 2013 18:33:37 +0000

"Detecting sentence boundary is one of the most important function in NLP(natural language processing) area. like language morphological analyzer, part-of-speech tagger. We usually use delimiters or punctuations to segment phrase or document. but problem is the accuracy of sentence boundary. So i would like to create two types of sentence boundary detector that are rule based SBD(sentence boundary detector) and machine learning based SBD."

Tags: sentence boundary detection

splitta - statistical sentence boundary detection - Google Project

Sun, 14 Apr 2013 18:29:01 +0000

"Includes proper tokenization and models for very high accuracy sentence boundary detection (English only for now). The models are trained from Wall Street Journal news combined with the Brown Corpus which is intended to be widely representative of written English. Error rates on test news data are near 0.25%."

Tags: sentence boundary detection python

Tiny Tiny RSS

Wed, 27 Mar 2013 19:21:45 +0000

Tiny Tiny RSS supports filters and labels, so you can organize those feeds into categories, filter out the stories you don't want, and organize them so you read the interesting things first. You can also score feeds, so the blogs you like the most float to the top. There are more features.

Tags: RSS

Converting HTML to other formats

Mon, 18 Mar 2013 19:37:37 +0000

html to plain text txt

Tags: converting html

ESA Tutorial

Mon, 11 Mar 2013 17:45:08 +0000

A Short Ethno Tutorial Searching for the shortest series of real actions that I could use as an example of how Ethno works, I settled on something historical. Julius Caesar described his contribution to the expansion of the Roman empire in three words--veni, vidi, vici--which is a series of three actions: I came, I saw, I conquered. (Suetonius, in Lives of the Caesars , reports that "veni, vidi, vici" was inscribed on Caesar's Pontic Triumph.) I will ruin Caesar's parsimony now by analyzing those three actions extensively in order to illustrate the basic features of program Ethno.

Tags: ESA SNA event_structure

Custom cargo nets

Mon, 11 Mar 2013 17:39:20 +0000

No details on pricing, but difficult to imagine a better quality product.

Tags: ELEMENT

LED dome light.

Fri, 08 Mar 2013 19:18:36 +0000

LED dome lights

Tags: ELEMENT

DIY Roof Rack - With Full Plans!

Fri, 08 Mar 2013 02:19:00 +0000

PaulJ - Seattle Aluminum angle rack bases

Tags: ELEMENT

Honda Service Manual

Wed, 06 Mar 2013 22:59:57 +0000

Genuine Factory Honda Element service manual. $72

Tags: ELEMENT

McMaster-Carr

Wed, 06 Mar 2013 18:32:46 +0000

The Amazon.com of hardware and tools

Tags: ELEMENT

Interior release for rear hatch

Wed, 06 Mar 2013 18:03:25 +0000

Simple, OEM "g1parts.com (part# m72660-SCV-A01ZB)"

Tags: ELEMENT

Top 20 malware programs. Conficker is on the 1st place

Mon, 04 May 2009 13:10:41 +0000

According to the report published today by Kaspersky Lab,it has been detected over 45 190 of unique harmful, advertising and potentially dangerous programs during last month. This digit practically does not differ from a metrics for March.

In a rating of twenty most widespread harmful programs worm Conficker known also as Downadup and Kido continues to the the leading position. By some estimations, Conficker could infect up to 20 million computers worldwide. The last days this worm has started to form the infected computers in a botnet for distribution of spam emails and spyware.

The second string of “charts”, as well as one month ago, holds the virus Sality with spyware functionality. This harmful program intercepts the information entered by means of the keyboard, and sends gathered information to malefactors.

It is remarkable that the harmful code CodeBaseExec which first versions have been detected in 2004 has returned to April virus “twenty”. The program gets on the PC of a victim through old “hole” in a browser of Internet Explorer of versions 5.01, 5.5 and 6.0.

The complete rating of harmful programs for April under the version «Kaspersky’s Laboratory» looks like this:

1. Net-Worm.Win32.Kido.ih
2. Virus.Win32.Sality.aa
3. Trojan-Dropper.Win32.Flystud.ko
4. Trojan.Win32.Chifrax.a
5. Trojan.Win32.Autoit.ci
6. Trojan-Downloader.Win32.VB.eql
7. Packed.Win32.Krap.b
8. Worm.Win32.AutoRun.dui
9. Exploit.HTML.CodeBaseExec
10. Packed.Win32.Black.a
11. Virus.Win32.Sality.z
12. Virus.Win32.Virut.ce
13. Trojan.JS.Agent.xy
14. Worm.Win32.Mabezat.b
15. Virus.Win32.Alman.b
16. Packed.Win32.Krap.g
17. Packed.Win32.Klone.bj
18. Worm.Win32.AutoIt.ar
19. Exploit.JS.Agent.agc
20. Email-Worm.Win32.Brontok.q

A critical hole in Adobe products

Wed, 29 Apr 2009 09:36:13 +0000

A critical vulnerability has been found out in Adobe Acrobat and Adobe Reader, the patch for which does not exist now.

As it is informed, the problem is related to processing of JavaScript code. With help of the document generated in special way malefactors theoretically can organise DoS-attack, provoke emergency end of work of the program or execute any operations on the remote computer.

Adobe has confirmed the existence of the problem, having underlined, that it mentions all delivered versions of Reader and Acrobat packages , including 9.1, 8.1.4, 7.1.1 and earlier updatings. The situation is aggravated with that there were examples of the harmful code on the Internet, allowing to involve vulnerability.

Conficker worm is active again

Mon, 27 Apr 2009 11:22:31 +0000

As mark security experts form Symantec, Conficker step-by-step transforms thousands of infected PCs into zombie network for spam and spyware distribution. The worm loads it’s code under the name Waledac which unites the infected machines in the botnet.

Employees of Trend Micro underline that the network of zombie computers, formed by Conficker, probably, is one of the most difficult and thought over the history of botnets. The creation of this network proceeds rather slowly, however experts do not eliminate possibility of application the botnet in the organisation of massed attacks and distribution of millions undesirable emails.

Conficker has been detected in November of last year, however the peak of its activity was on the beginning of January. By various estimations, for today the harmful program could infect up to 20 million computers worldwide. For a trustworthy information about authors of worm Conficker the award at a rate of 250 thousand dollars is offered.

Database of startup files

Fri, 24 Apr 2009 13:06:12 +0000

The new database of startup programs has been published. Each entry in the database is classified according to security risk. (Malware, Suspicious, Infected, Trusted, etc.)

The database currently contains over 90 thousand of autorun items, and is constantly being updated.

Visit CESAM Startup files database

Hackers have stolen the data about superexpensive military project of the Pentagon

Wed, 22 Apr 2009 12:27:30 +0000

Unknown malefactors managed to receive unauthorized access to the information on the most expensive military project of the Pentagon — a hardly noticeable fighter-bomber of fifth generation F-35 Lightning II.

F-35 Lightning II is being developed by companies Lockheed Martin, Northrop Grumman and BAE Systems within the limits of program Joint Strike Fighter. Project cost is estimated in 300 billion dollars.

As network sources inform, malefactors managed to penetrate into a computer network of one of participants of the Joint Strike Fighter program and copied several terabytes of information about electronic components and the plane construction. Theoretically this data can simplify development of protection against American fighter of fifth generation.

Attack, presumably, has been carried out from territory of China. It is marked that cybercriminals did not manage to reach the most important information on a fighter as it is stored on computers which are not connected to the Internet. Nevertheless the damage put to program Joint Strike Fighter, can be calculated by millions dollars.

Let’s notice that computer networks of the governmental departments of the USA regularly are exposed to cyberattacks. Last year the president George Bush even has signed the decree which assumes the essential extension of powers of Agency of national safety of the USA for the purpose of preventing of hacker’s attacks.

First botnet based on Apple computers

Tue, 21 Apr 2009 09:20:21 +0000

Security experts from Symantec company inform of appearance of the first botnet, which structure includes computers under control of Apple Mac OS X operating system.

The analysis has shown that creation of new zombie network, named iBotnet, has started in January. The structure of the botnet includes computers infected with malicious program OSX.iServices. This trojan was distributed as an utility for removal of copy protection of pirated versions of Photoshop CS4 and iWork ‘ 09.

At a rough guess, the iBotnet network can include up to several thousand computers. Some time ago the botnet has been already used by malefactors for the purpose of carrying out of the distributed DoS-attack. Probably in the long term cybercriminals will try to use iBotnet for the organisation of a mass spam distribution. Experts mark that the majority of anti-virus programs for Mac OS X platform already contain detection and removal procedures for the iServices trojan. Users are strongly recommended not to neglect elementary security measures.

New trojan blocks access to Windows

Mon, 20 Apr 2009 07:54:48 +0000

Doctor Web company warns about appearance of the new harmful program locking access to the infected computer.

The trojan was named Winlock.19. The program extends through the Internet under the pretext of counterfeit codecs and suggests to enter the special code ostensibly necessary for registration of a counterfeit copy of the operating system of Windows. To receive this code, it is necessary to send the text message from a mobile phone on a paid number.

It is remarkable that Winlock it is supplied by function of self-destruction and deletes itself in two hours after start. The Doctor Web company does not recommend to users to follow the malefactors and to send SMS anywhere. For those who does not wish to wait two hours to an automatic uninstall, Doctor Web has prepared the special form into which it is possible to enter the text of the prospective short message and to receive an unblocking code.

Conficker worm: new version detected

Thu, 16 Apr 2009 09:13:09 +0000

The “Kaspersky’s Labs” warns about appearance of the new version of the Conficker also known as Kido and Downadup.

Conficker has been detected in November of last year, however the peak of its activity has been on the beginning of January: for a few days the worm has infected about ten millions computers worldwide.

New variant of Conficker has started to extend in the end of last week: the infected computers, co-operating with each other through P2P-connections, have given the command to other infected computers on loading of upgrades and two files — FraudTool. Win32.SpywareProtect2009.s and Email-Worm. Win32.Iksmas.atz. The first of these units represents a counterfeit antivirus which is placed on the servers allocated in territory of Ukraine. At start the program suggests «to delete the found viruses», demanding for it about 50 dollars. The second file — a mail worm possessing a functional of theft of the data and a spam sending.

«Kaspersky’s labs» marks that for 12 hours one bot infected with the new version of Conficker has sent over 42 thousand spam emails. If to assume that the total amount of infected computers is about 5 million it turns out that the Conficker botnet is capable to dispatch approximately 400 billions spam messages daily.

Different sources also inform that in the end of last week the Conficker has penetrated into computer network of University of Utah (USA), having infected about 700 computers at medical school, medical nursing care college and so forth the Primary analysis of a code of new variant Conficker allows to say that it will function till May, 3rd.

Next attack of Conficker is expected on April 1st

Thu, 26 Mar 2009 10:56:58 +0000

On April, 1st worm Conficker, probably, will force not to laugh, and to cry very many Internet users.

Conficker has been detected in November of last year, however the peak of its activity was on the beginning of January: for few days the worm infected about ten millions computers worldwide. The malicious program, capable to extend in the various ways, including through removable disk drives, allows malefactors to inspect the infected computers far off.

Computer security experts warn that on April 1st Conficker will receive a certain upgrade. Experts believe that the malicious program can be used for the purpose of the organisation of DDoS-attacks, and also for realisation of a mass spam sending or the infected letters.

Microsoft with support of some the organisations (including OpenDNS) has already launched campaign for struggle against a worm, providing locking of domain names which can be used by the worm.

The worm of new type unites Linux-routers in a botnet

Wed, 25 Mar 2009 16:30:03 +0000

Experts from DroneBL have detected very unusual botnet, consisting not from personal computers of Internet users, but from DSL-modems and routers.

According to the research, a worm under the name psyb0t is responsible for the creation of the botnet. Network devices on the basis of Mipsel platform — variant of Debian Linux for processors MIPS are the subject of infection. Attack is made by exhaustive search of combinations of a login and the password under the list; after successful breaking psyb0t closes access to a router for other users and incorporates with the botnet.

DroneBL experts mark that they have detected the malicious program during reflexion of the DDoS-attack routed on their servers. The worm, presumably, is unique and extends in the Network from the beginning of the year. At a rough guess, the botnet, organised with the help psyb0t, can consist of more than 100 thousand network devices.

It is informed also that some days ago the botnet has ceased to show activity. However the given information is not confirmed yet.

BAE Wins $68M Army Missile Defense Hardware Contract

Wed, 19 Jun 2013 18:18:30 +0000

BAE Systems has won a $68 million contract to provide the U.S. Army hardware for advanced threat infrared countermeasures systems that work to protect aircraft and troops against missile attacks. The company also finished initial deliveries of common infrared countermeasure systems for testing at its Worrell/Weeks Aircrew Protection Center, BAE said Monday. Last year, the [...]

Autodesk Inks Vocational School Design Software Agreement; Taylan Dedeoglu Comments

Wed, 19 Jun 2013 17:09:24 +0000

Autodesk has agreed to provide its design software products to vocational-technical students in Turkey under a four-year agreement with the country’s national education ministry. More than 5,000 schools and 1.6 million students will have access to Autodesk offerings such as AutoCAD, Revit and 3ds Max, Autodesk said Monday. Taylan Dedeoglu, head of Mediterranean region at [...]

Raytheon Air Traffic Mgmt Systems Go Live in Dallas, Dubai; Joseph Paone Comments

Wed, 19 Jun 2013 15:25:42 +0000

Air traffic management automation systems built by Raytheon have started operating at international airports in Dallas and Dubai, United Arab Emirates. Raytheon’s Standard Terminal Automation Replacement System is an a FAA-approved terminal control automation platform used at Dallas Fort Worth airport, the company said Wednesday. The AutoTrac III automation system is used in Dubai-based airports s [...]

MBDA, PTC Partner on Integrated Systems Development; Jim Heppelmann Comments

Wed, 19 Jun 2013 14:06:11 +0000

MBDA will collaborate with PTC to update an integrated platform that aims to help MBDA commercialize its defense offerings in the international market. The goal of the partnership is to establish a collaborative environment where development and engineering teams can work together to create and design MBDA products, PTC said Tuesday. Jim Heppelmann, PTC president and [...]

QinetiQ Unveils Latest Paramarine Ship Design Software

Wed, 19 Jun 2013 12:03:25 +0000

A QinetiQ subsidiary has released version eight of its Paramarine software product used to design and engineer commercial ships. QinetiQ GRC‘s Paramarine V8 offers a probabilistic modeling tool that works to help naval architects estimate damage stability in passenger and cargo vessels, QinetiQ said Tuesday. Version eight is designed with emergency response features intended grounded [...]

Raytheon Hands Navy First Standard Missile-3 From New Plant; Taylor Lawrence Comments

Tue, 18 Jun 2013 15:18:31 +0000

Raytheon has handed a Standard Missile-3 weapon over to the U.S. Navy with the goal of intercepting short- to intermediate-range ballistic missiles. This marks the first time the company delivered SM-3 from its new Huntsville, Ala., facility, which also produces the Standard Missile-6 interceptor, Raytheon said Tuesday. Taylor Lawrence, president of Raytheon’s missile systems business, [...]

Boeing, Saft Partner on Satellite Program; Thomas Alcide Comments

Tue, 18 Jun 2013 13:32:48 +0000

Boeing has awarded Saft a multi-million-dollar order for lithium-ion batteries to power a new satellite built to expand communication and data transmission services in selected parts of Asia. Works to develop four battery packs with VES 140S space cells started in January this year with delivery scheduled for December, Saft said Monday. Thomas Alcide, Saft’s [...]

MBDA Consortium Wins U.K. Aerospace R&D Contract

Tue, 18 Jun 2013 12:41:27 +0000

An MBDA UK-led consortium has been awarded a research and development project recently launched by the Aerospace Growth Partnership and the UK Center of Aerodynamics to improve the aerospace technology market in the U.K. The group includes BAE Systems, Airbus and Rolls Royce as representatives from the manufacturing industry, as well as aerodynamic modeling and technology providers and [...]

Lockheed, NASA to Launch Sun-Observing Satellite; Gary Kushner Comments

Tue, 18 Jun 2013 12:14:44 +0000

A Lockheed Martin spacecraft built for NASA is set for a June 26 launch on a mission to explore the sun’s energy activity and how it affects space weather. NASA’s interface region imaging spectrograph explorer (IRIS) will go into orbit from Vandenberg Air Force Base, Calif., and observe the sun continuously for two years, Lockheed said Monday. [...]

Raytheon Wins AF Global Hawk Logistics Contract; Bob Busey Comments

Tue, 18 Jun 2013 10:23:05 +0000

Raytheon has won a contract to operate and maintain ground components of a U.S. Air Force‘s unmanned aircraft system for an undisclosed amount. The company will perform contractor logistics support work on RQ-4 Global Hawk drones through September 2014, Raytheon said Saturday. Work under the contract includes on-site mission control, launch and recovery support services [...]

Picking a fight with Clay Shirky

Sat, 15 Jan 2011 15:12:23 +0000

There is an interesting comment that Clay Shirky has just posted to GigaOm:

No one believes social media _causes_ otherwise complacent citizens to become angry enough to take to the streets. It’s a convenient straw man for the skeptics, because, as an obviously ridiculous narrative, it’s easy to refute.

I guess I must be the skeptic touting this straw man argument, because Clay told me the same thing over Twitter. What's most intriguing about this comment is Clay's deliberate use of the term "social media". I've noticed that whenever it comes to debates about the Internet & democratization, this is now his new preferred term (see his Foreign Affairs piece "The Political Power of Social Media").

On Clay's account, "social media" is just a tool that people use to coordinate. So, saying that people want a revolution because of "social media" is akin to saying that people want a revolution because of the telephone. Fair enough and - hold your breath! - I actually agree with Clay on this one.

But this is a very sly recasting of the terms of the debate on Clay's part; the debate about the Internet's impact on democratization has never been about social media only. For example, the impact of social media on social mobilization plays a very minor part in my overall argument; I'm much more interested in understanding the long-term impact of new technologies on authoritarianism and here I also have to consider how it may boost their attempts at surveillance, propaganda, censorship and even the trivialization of public discourse.

A substantial intellectual chunk of this broader debate has been devoted to trying to understand whether giving people the ability to access banned or highly critical information will politicize them in the long term. It's not an argument about mobilization during protests - it's an argument about whether the Internet boosts the odds that such mobilization might eventually happen in the long term.

This is why, I think, we spend so much time debating what to do about circumvention tools that help to bypass censorship. Will giving everyone in China access to a technology like Tor have the desired outcomes of politicizing the masses and enticing the revolution or will the Chinese just use Tor to download porn and get disengaged from politics altogether? Mind you, it's not just about facilitating access to Twitter and Facebook - the tools of social organization- it's also about facilitating access to sites of Human Rights Watch or Radio Free Asia.

Anyone who has seen reports about Tunisia's "WikiLeaks Revolution" would know that those accounts mostly focus on the role that the cable revelations about Tunisia played in enticing the protests (this is an account I don't agree with, if it's not yet obvious). To suggest that a term like a "WikiLeaks Revolution" does not also celebrate - perhaps, implicitly - the factors most commonly associated with the Internet (its resilience against censorship, its spirit of mutual collaboration, etc) would be extremely disingenuous. When people say that events in Tunisia were a "WikILeaks Revolution", they are consciously or subconsciously cheering the fact that there is this former-hacker guy Assange who used the Internet to do the unthinkable. If this is not what is celebrated by the term "WikiLeaks Revolution", then it doesn't have any meaning at all.

WikiLeaks, alas, is not "social media" - so it doesn't meet Clay's rigid definition. But if you broaden the terms of the debate to the Internet proper - and those are the terms that are most interesting to me - you are bound to notice that there are plenty of pundits and analysts celebrating the power of the Internet to politicize future protesters - not only to help them organize. This, by the way, is the same argument that was used by plenty of neocons in the wake of the Soviet collapse: it was assumed that the Western radio informed Soviet citizens about the superior value of Western goods - and the Soviets eventually rebelled. Apologies for self-promotion, but anyone who thinks these are not real intellectual narratives being pimped in Washington DC should take a look at my book, where they are extensively documented (including in the 70-page bibliography!)

Here is just an excerpt from Thomas Friedman's "The Lexus and the Olive Tree", p. 66:

"Put all of this democratization of information together and what it means is that the days when governments could isolate their people from understanding what life was like beyond their borders or even beyond their village are over. Life outside can't be trashed and made to look worse than it is...On the Internet people are ... uploading and downloading ideologies. In a few years, every citizen of the world will be able to comparison shop between his country and his own government and the one next door".

Now debunking Thomas Friedman may seem less gratifying than debunking a social media guru like Clay Shirky - but Friedman is a much better proxy for what people in Washington really think. Anyone who has looked at his columns over the past 5 years would see that he hasn't really changed his view on the power of the Internet.

So, yes, we can have an intelligent debate about the virtues and downsides of social media - but I would not like us to lose sight of the broader intellectual debate about the Internet and democratization, especially in this post-Cablegate era. After all, the debate we are having in Washington is not about the future of "The Social Media Freedom Agenda", it's a debate about the future of the "The Internet Freedom Agenda".

Is Clay himself making a straw man argument here?

UPDATE: Clay has posted an update to his original comment.

What if Tunisia's revolution ended up like Iran's?

Sat, 15 Jan 2011 00:30:36 +0000

(I am not a big fan of counterfactual thinking, but in this particular case it does help to generate new insights.)

So let's assume that the protests in Tunisia had eventually gone the way of the Green Revolution in Iran: the government stayed in power, regrouped, and began a massive crackdown on its opponents.

As we know from the post-protest crackdown in Iran, the Internet has proved a very rich source of incriminating details about activists; the police scrutinized Facebook groups, tweets, and even email groups very closely. Furthermore, the Iran government may have also analyzed Internet traffic and phone communications related to the opposition.

Now, Tunisia is no in Iran. Its long-ruling dictator is now gone and the new government is unlikely to engage in repressions on the same scale. Yet if Ben Ali's regime didn't fall, it appears certain to that the authorities would be brutally going after anyone who has ever posted a damning Facebook post or an angry email. As we have seen in the few weeks leading to Ali's exit, the Tunisian cyber-police have proved to be far more skilled in Internet repression than their counterparts abroad: it's safe to assume they would have dug as much evidence as the Iranians.

This brings me to a somewhat depressing conclusion: if the dictator doesn't fall in the end, the benefits of social mobilization afforded by the Internet are probably outweighed by its costs (i.e. the ease of tracking down dissidents - let alone organizers of the protests).

The question then is whether the social mobilization afforded by the Internet provides a force that is so powerful that no dictator would be able to withstand it. Judging by the events in Iran, the answer seems to be "no"...

It's certainly good news that the revolution in Tunisia has happened - for whatever political and social reasons - just like it's good news that the Internet has played some role in it. But we shouldn't forget that if one of the enabling political and social conditions is missing, the ease of Internet mobilization may also prove to be the opposition's Achilles' heel.

P.S. Yes, I know that crackdowns used to follow failed revolutions before the Internet as well. My point is simply that technology - not just the Internet but also mobile phones - make it easier to trace protesters and dissidents. It would be very hard, for example, to trace the names of everyone who gathered on Minsk's central square to oppose the results of the recent elections in Belarus before mobile phones became ubiquitous...

Tunisia, social media and the politics of attention

Fri, 14 Jan 2011 22:05:27 +0000

Over Twitter, Sami ben Gharbia - who, I hope, will finally get a chance to return to Tunisia after his long exile - pointed out that social media did play an important role in "feeding" information to Al-Jazeera and France 24, conceding that at the same time it didn't have much of an impact on the coverage of the protests in the US.

Sami's remark made me think about my earlier blog post a bit more. My argument isn't really about the efficacy of social media in improving the coverage of the protests in the mainstream media (i.e. their venue, schedule, leaders, etc). Rather, my argument is in the vein of Ethan Zuckerman's reflections on media attention patterns - and ways of shifting them.

But while Ethan's work is focused mostly on getting ordinary Americans to care about foreign affairs, my interest here is on a somewhat different, more pragmatic level: getting Americans to care is likely to push Washington to care as well. This in itself can create powerful incentives for dictators to play by the rules or exit peacefully. (There is probably an element of this to Ethan's thought as well, even though I'm not sure if the citizens-government connection is essential to his analysis).

As I deconstruct the original hype behind the "Twitter Revolutions" in Iran and especially Moldova, their real promise (aside, of course, from liberating the country from oppressive rulers) seemed to lie in using social media as some kind of a Trojan horse to get their countries onto the front pages of American newspapers - and then, hopefully, on the top of Washington's agenda.

There were good grounds for believing this hype. If my memory serves me right, the time gap between me christening the events in Moldova as a "Twitter revolution" and the New York Times running a front page story about it was less than 12 hours. In the case of Tunisia, this time gap has been almost a month...I don't buy the theory that Moldova is more important than Tunisia (not to mention that few Americans ever go on holiday to Moldova...)

Now, I know that Al-Jazeera and France 24 (to their credit) began reporting on Tunisia much earlier than their American counterparts. But then it was probably not a factor of social media's influence but rather of Tunisia's unique position in the Arab and Francophone world. There is little doubt that social media has helped to make their coverage better. Has it also played a role in generating new coverage that wouldn't have happened without it? This would be one good question to investigate.

There are probably many dissertations to be written about the way in which the rise of non-American global broadcasters like Al-Jazeera and France 24 has helped to balance the geopolitical myopia of the American media. However, as much as I'd like to think that it has led to some fundamental shifts in how the American public (and, by extension, the US government) choose their news diet, I cannot possibly see much evidence that this is actually happening.

Thus, that early promise of the Twitter Revolution - that social media could offer a way to hijack the news agenda (and thus influence foreign policy) in the US - rings somewhat hollow to me. I do hope that I'm wrong.

First thoughts on Tunisia and the role of the Internet

Fri, 14 Jan 2011 14:16:17 +0000

News from Tunisia looks good. For better or worse, many of us will be pondering the role that the Internet played or didn't play in the events of the Jasmine Revolution. Below are some preliminary reflections, which, if you know me well, are likely to change by the end of next week!

One thing to keep in mind is that revolutions will continue and Twitter won't go away anytime soon. So, it's reasonable to assume that there WILL be some new-media activity for any social or political turmoil. But correlation, as well all know, doesn't always mean causation.

To reiterate: Yes, there will be YouTube videos, Flickr photos, and Twitter messages -- some written by people on the ground and some by those outside -- accompanying any revolution, successful or not. To deny this would be silly.

What strikes me about events in Tunisia is that social media seems to have failed in what many of us thought would be its greatest contribution (outside of social mobilization) -- that is, in helping to generate and shape the coverage of events in the mainstream media. On the contrary, despite all the buzz on Twitter it took four weeks to get the events in Tunisia on the front pages of major newspapers, at least here in the U.S. (the situation in Europe was somewhat better -- and it was way better in the Middle East -- for all the obvious reasons).

How does it fare historically? Well, much of the enthusiasm related to the "Twitter Revolutions" in Moldova and Iran was based on the expectation that social media would help to push these events on the agenda of traditional media -- and it actually worked. By 2011, however, I think that the novelty had worn off -- and few media outlets were interested in carrying "Social Media Changes Everything!" stories. I'm sure there are many other reasons why Tunisia matters less than Iran for most media -- but then so did Moldova…

This is not to deny that many of us were watching the Tunisian events unfold via Twitter. But let's not kid ourselves: This is still a very small audience of overeducated tech-savvy people interested in foreign policy. I bet that 90% of Twitter users are not like that -- and that percentage will get worse as Twitter becomes more mainstream. So, if we evaluate it in terms of awareness-raising by exploiting and building off the mainstream media, Tunisia's "Twitter Revolution" (as Andrew Sullivan was already quick to dub it), seems to have failed.

I'm curious to see more data about the role that social media have played in the mobilization of protesters. I hope that Sami ben Gharbia and others would enlighten us here. Off the top of my head, it strikes me as improbable that some people in Tunisia had a higher chance of learning about the protests from the Internet than they did from conversations in the streets. Besides, many people got killed, the situation was highly emotional -- and I'm not sure how much anger tweets and blog posts could add to such visceral developments.

I don't deny that the Internet may have played a role in publicizing the protests in Tunisia; it's just that the conditions in which the protests took place do not strike me as those where the leaders of the protest movement had to post updates on where to meet and when. Maybe I am wrong, but it all seemed to be somewhat chaotic and decentralized. Once again, it would be great to see more data on this.

What also strikes me as very odd is that just two weeks ago the Tunisian government was bold and strong enough to break into the email accounts of Tunisian activists -- surely, they could turn off the Internet in the whole country if they really wanted to and saw it as a lethal threat? This speaks either to their misjudgment of the situation or to their dismissal of the Internet as a tool of mobilization -- which, given the profile of those who started the protests (mostly the poor and the unemployed), doesn't strike me as an unreasonable assumption.

The question of social mobilization is a difficult one, and we should continue asking it. We should not, of course, forget the structural conditions -- especially the worsening economic situation in Tunisia -- as one factor that may have made the conditions for such a revolution more likely.

Now, let me ask something really wild: Would this revolution have happened if there were no Facebook and Twitter? I think this is a key question to ask. If the answer is "yes," then the contribution that the Internet has made was minor; there is no way around it. On this logic, we shouldn't expect similar outcomes in other countries just because they also have vibrant communities of cyberactivists.

Finally, I think we shouldn't lose sight of the broader political and social impact of the Internet prior to mobilization (or, as some would put it, the "revolutionary situation"). Part of the argument that I'm making in The Net Delusion is that it's wrong to assess the political power of the Internet solely based on its contribution to social mobilization: We should also consider how it empowers the government via surveillance, how it disempowers citizens via entertainment, how it transforms the nature of dissent by shifting it into a more virtual realm, how it enables governments to produce better and more effective propaganda, and so forth. All of this might decrease the likelihood that the revolutionary situation like the one in Tunisia actually happens -- even if the Internet might be of tremendous help in social mobilization.

The point here is that while the Internet could make the next revolution more effective, it could also make it less likely. (And yes, I know that other factors -- primarily economic and political ones -- are probably way more influential than the Internet in influencing the odds of the revolutionary situation either way).

This, in part, is a lesson that I draw from events in Belarus in December: There was plenty of activity on Twitter and there was potential for mobilization -- but to focus on this at the expense of understanding the more sinister ways in which the Belarusian authorities exploit the Internet and in which their citizens become less politicized because of it would be to miss a much more important role that the Internet has been playing in the country.

Nevertheless, I do hope that the events in Tunisia serve as an inspiration to people in Belarus and elsewhere.

Should we oppose sit-ins just because crazy people can abuse them?

Thu, 16 Dec 2010 10:54:08 +0000

I am still trying to untangle the numerous moral complexities involved in DDoS attacks. Two arguments stand out in particular.

First - and I briefly touched upon this subject in my previous post - some Internet experts fear that participating in DDoS attacks, even if one has morally justifiable reasons for doing so, might make DDoS a more acceptable form of silencing dissent. As such, anyone participating in DDoS – even if they have perfectly good reasons for doing so – should first consider the indirect consequences of popularizing DDoS as a tactic. (I have written about DDoS as a new censorship mechanism on numerous occasions – see, for example, the story of the Georgian blogger Cyxymu.)

Let's leave philosophy aside for a moment and just use some common sense. Would we advise anyone participating in lunch-counter sit-ins during the civil rights era not to do it because it may popularize sit-ins as a tactic that might be abused by all sorts of crazy people and criminals? I don't think so: just because one can organize a sit-in to block an entrance to the offices of ACLU to protest their defense of civil liberties would hardly be a factor in deciding whether to block an entrance to the offices of the Department of Defense to protest a war.

Why is DDoS different? Arguably, physical civil disobedience is often much easier to conduct than its virtual counterpart: having 100 people show up and block entrance to Amazon's offices, on average, is far more effective than having the same 100 people launch DDoS attacks on its web-site. Sure, there are oddballs like Jester, who claims to have taken the entire WikiLeaks with a solo DoS attack; but such people are not exactly missing from the offline domain. Cindy Sheehan has been quite effective acting solo - is it a reason to impose a moratorium on acts of civil disobedience? I don't think so.

I think that those who worry about the adverse effects of popularizing DDoS as a tactic misunderstand what civil disobedience is (moreover, I'm not sure they understand the distinction between its direct and indirect varieties). Civil disobedience involves breaches of law by definition; anyone lamenting the popularization of DDoS as a tactic is only lamenting the fact that those practicing it would violate the rule of law. But what such critics do not seem to understand is that for a breach of law to count as civil disobedience its perpetrators should be willing to accept the consequences, get arrested and serve jail time if this if what the law demands. Submitting oneself to the rule of law after breaching it is the compensatory act that makes such acts morally permissible.

Those who oppose DDoS on the grounds that it will popularize DDos as a tactic are essentially saying: don't breach the rule of law because it would lead others to breach the rule of law. Note that such a position leaves no space to comment on whether the laws that are being breached are unjust to begin with or, in case the laws are, indeed, just, whether violating them may be a morally permissible way to right other wrongs (i.e. engage indirect civil disobedience).

Frankly, I think this is a morally impotent position – and those who advocate it need to spend more time thinking about ways to resolve competing moral claims than about the costs of server administration. Is it really obvious that a bunch of environmental activists in Russia should not launch DDoS attacks on the web-site of a company engaged in illegal deforestation just because it may result in more DDoS attacks on the web-sites of independent newspapers in Burma? It's not that obvious to me – and I'd like to see the experts who condemn DDoS engage in some rigorous (and preferrably public) ethical calculus before making such loud pronouncements.

The second brief point that I'd like to address is this: many liberal democracies are extremely lenient when it comes to allowing their citizens to organize protests and demonstrations. As someone who comes from Belarus, where protests are few and far in between, this is one feature of democratic societies I find extremely attractive.

I've lived in Berlin's Kreuzberg neighborhood - and I have seen a plenty of spontaneous demonstrations, some of them not particularly peaceful and many involving broken windows and the like. I don't see why the German state should be any less lenient when it comes to allowing its citizens to protest in cyberspace than they are in allowing them to riot on Oranienstrasse. Such considerations, as far as I understand, were part of the reasoning of the German court in the Lufthansa case.

What I find amusing about the present situation is that the same people who often lament the fact that the Iranian government denies freedom of assembly to the Green movement almost reveal themselves as crypto-conservatives when they are forced to think about the digital equivalent of protests and demonstrations in democratic societies. So, those opposing authoritarian governments should feel free to protest anytime they want – but those who want to protest Amazon should be careful and ask for permissions and all that?Does anyone else smell hypocrisy here?

While the exact conditions differ from country to country, I am pretty sure that most liberal democracies do permit unconditional protests as long as the protesters do not cause serious public disorder and do not seriously disrupt the life of the community. Even if the protests are organized on private rather than public property, trespassing is not always viewed as a criminal offense (unless, of course, it is aggravated trespassing, with lots of disruption/damages, in which case it is often criminalized). Don't they teach such basic stuff at Harvard Law School?

True, we don't yet have a neat theoretical framework to translate the norms surrounding the criminalization of trespassing (or lack thereof) in the physical world into the digital domain. What I do know is that I don't want a blanket ban on anything that involves groups of people seeking to protest an activity that they find unjust simply because it occurs on the Internet. Even more so in the case of protesting the actions of technology companies, who, unlike conventional factories and plants, bury all their infrastructure underground, where it's unreachable to those who may otherwise choose to protest in the physical space. How do you disrupt Amazon's business in the real world anyway? I know how to do it with, say, a Ford factory; I'm not sure how to do it with a data center.

Anyone arguing against DDoS on the grounds that it may have some undesired secondary consequences is implying that some basic human rights do not apply online. I find this unacceptable. And by the way, I think that the current laws that criminalize DDoS in liberal democracies – some with up to 10 years in prison – are in for some major revision as well. No one blocking access to a physical building or even tinkering with some corporate infrastructure without causing it much damage would receive 10 years in jail. This doesn't mean we need to de-criminalize DDoS altogether but I think that we do need to think about proportionality here.

***

What bothers me even more is that the leading brains working on DDoS – especially the folks at the Berkman center – are once again not particularly vocal in this debate. A few months ago, I pointed out that they were conspicuously silent on the Haystack issue; their excuse then was that they were working on a report about circumvention tools and felt like they shouldn't weigh in on a tool they haven't tested.

Now they are also working on a report about DDoS attacks – and once again, there is nearly complete silence from their end, not counting a comment that Ethan Zuckermand left on Deanna Zandt's blog and a handful of tweets and retweets. Perhaps, if it distracts them from participating in some of the most fundamental debates taking place online today, they should take it easy on all this report-writing.

I am absolutely serious about this, as I happen too believe that too much coyness and pragmatism by the leading minds working on Internet issues is what has allowed the US government to behave as recklessly as they have towards the Internet in the last few weeks. But perhaps we'll read all about this in a report next year.

Update #1: I think many people misunderstand the reason why I'm engaging in this debate about DDoS attacks as acts of civil disobedience. This is not to debate the effectiveness of this tactic nor is it to understand whether it fits (or defies) the charge of "slacktivism". I think that hundreds of people who have participated in such attacks risk getting arrested - and some have been arrested already.

If some of them were acting on the assumption that their actions were fully public and that they were ready to get arrested, I think we should honor their willingness to go to jail for launching attacks on companies that behaved in a very cowardly fashion. (By the way, one of the two teeanagers arrested in the Netherlands for launching these DDoS attacks said as much - he chose not to disclose his online identity precisely to make a public statement about WikiLeaks and suffer the consequences).

More on DDoS as civil disobedience

Tue, 14 Dec 2010 09:55:11 +0000

After I found one of my earlier FP blog posts quoted in an Anonymous press-release, I thought that I need to clarify my position. Here is my piece for Slate where I attempt to do just that. (Warning: some light political philosophy ahead).

The crux of my argument is that there are certain conditions, which, if met, could make DDoS attacks a form of civil disobedience. However, the case of Anonymous doesn't meet all of them, mostly because the Anonymous attackers don't want to take legal responsibility for their actions.

The part of my original blog post quoted in the press-release -- the one that mentioned DDoS as a "legitimate expression of dissent" -- is not at all ambiguous: what I was suggesting is that the actions of Anonymous would not be interpreted as such by the U.S. media/political circles and may thus result in more control over the Internet by the governments and complete de-legitimization of DDoS attacks as civil disobedience. So I was surprised that Anonymous took those words somewhat out of context and used them to imply that I actually viewed their acts as "legitimate"; I did not. This, however, does not mean that I view all DDoS attacks as illegitimate!

So let me just repeat this once again:

1. To understand whether DDoS attacks can be viewed as civil disobedience, we need to examine the context in which they occur.

2. As far as I can judge the context of the Anonymous case, they failed the test (for more on the specifics of the test, see my Slate piece; I rely on John Rawls's views on civil disobedience n his A Theory of Justice).

3. Operation Payback and its successors may, indeed, harm the causes of Internet freedom but this is NOT what makes them illegitimate.

There is a vibrant debate about DDoS as a legitimate expression of dissent in the blogosphere -- see this excellent summary of positions at TechPresident and this blog post by Deanna Zandt. There is an interesting comment by Ethan Zuckerman in response to Deanna's original blog post that I would like to examine a big more closely.

In short, Ethan is arguing that DDoS attacks are increasingly used to silence down independent publishers; they don't have the same resources as MasterCard or PayPal to deal with them; as a result, for them DDoS causes real rather than just temporary damage; Operation Payback has given DDoS as-a-silencing-tactic a lot of PR; and, finally -- and I am really putting words into Ethan's mouth here -- Anonymous and others should consider the consequences of their actions for others.

As much as I would like to agree with Ethan, I am not sure I am buying the (rather implicit) prescriptive part of his argument. First, it seems to conflate the issues of legitimacy and efficacy -- something that I explicitly caution against in my Slate piece. I'm strongly opposed to making efficacy a factor in evaluating the morality of particular DDoS attacks, not least because efficacy is too fickle of a concept and tends to undervalue the deterrence value of civil disobedience.

How do we know that the reason why Facebook and Twitter still have not removed WikiLeaks' account was not because they feared DDoS retaliation from Anonymous? Of course, it's much easier to measure the costs -- greater crackdown on the Internet, more NSA types in 4chan chatrooms, etc -- but it's not so easy to measure the benefits; will PayPal be as forceful in freezing the funds when it comes to the next WikiLeaks? We simply don't know -- but I'd venture to suggest that the attacks have probably had some impact on corporate decision-making.

This is not to suggest that we shouldn't try to assess the efficacy of DDoS but only to suggest that tying it to legitimacy seems misguided. That an entity like Anonymous has a good moral reason to act on something does not mean that they should necessarily act on it. In the end, it all boils down to good judgment -- and this is where wise Internet intellectuals should step in and theorize about potential fall-outs, crackdowns and what not, so that any of us can make the right (for us) call on whether to join the DDoS effort.

The other thing that bothers me about Ethan's comment is that it doesn't really make an effort to reconcile my right to protest injustice by engaging in acts of civil disobedience (forget Anonymous, we are talking abstract DDoS which doesn't fail the test) with some independent web-site's right to publish what they want and when they want online. (Remember: the theory at play here is that as DDoS get popular/mainstream, this would result in more attacks across the board, thus having a very negative impact on independent/poor publishers).

Is it really always the case that I shouldn't engage in DDoS to right some moral wrongs just because this may potentially make it harder for some third-party to conduct their affairs? I can think of conditions when this would be the case -- but critics of DDoS as civil disobedience need to spell out those conditions in great detail before they assume a particular resolution of competing claims. I can, for example, also think of conditions where my right to protest an injustice might trump a third-party's right to publish.

Otherwise, we end up with very simplistic moral and ethical frameworks where all attacks are presumed to be good or bad simply because of the intrinsic qualities of DDoS. This is an outlook that I reject as technology-centrism (in The Net Delusion, I am actually very critical of a similar tendency in "Internet freedom studies," where the assumptions about the Internet's inner logic seem to outweigh the assumptions about the context in which it manifests itself).

Unfortunately, I can't sign up to Ethan's call -- "Just don't give moral and ethical air cover to the bastards who are using DDoS to silence sites for whom a DDoS is a shut down, not a sit in" because "giving moral and ethical cover to bastards" is often the unfortunate result of allowing those who are NOT bastards to act in morally justifiable ways (as opposed to ways recommended by the estimable Berkman Center).

Until we hear some cogent arguments as to why the possibility of digital shutdowns should always prevent us from participating digital sit-ins, I would like to urge more caution on this subject. My own guess these arguments would never work in the abstract and would still need to be evaluated on a case-by-case basis in the particular contexts they are set in. Which, to return to my original post, was my whole point: we shouldn't prejudge DDoS to be "good" or "bad" simply because it's illegal or because it is "DDoS."

p.s. plenty of folks -- check comments to Deanna Zandt's post -- suggest that there are better, more constructive ways to express one's solidarity with WikiLeaks or one's indignation with the companies that dumped it. Sure, there are. However, most of the "constructive" activities mentioned in the comments are fully legal and thus do not meet the definition of "civil disobedience," which presumes a breach of law. So, once again, this is the question of efficacy, not legitimacy.

Predicting the future of WikiLeaks: Follow the media!

Fri, 10 Dec 2010 09:46:18 +0000

The New York Times asked me to do a short piece for their Room for Debate forum on WikiLeaks. Go read the whole piece; below is a paragraph that I'd like to discuss in more detail on this blog:

One possible future for WikiLeaks is to morph into a gigantic media intermediary -- perhaps, even something of a clearing house for investigative reporting -- where even low-level leaks would be matched with the appropriate journalists to pursue and report on them and, perhaps, even with appropriate N.G.O.'s to advocate on their causes. Under this model, WikiLeaks staffers would act as idea salesmen relying on one very impressive digital Rolodex.

The argument I'm making in the Times piece rests on three premises:

a) WikiLeaks, at least in its post-Cablegate reincarnation, has two major assets: an easily recognizable brand and an extensive network of contacts in the media

b) If the Cablegate release ends up having significant global repercussions -- resignations of politicians, alterations in the behavior of governments and corporations -- this is bound to encourage more people to take risks and start leaking

c) The buzz generated by the Cablegate makes it clear that WikiLeaks is only as effective as their media partners: they are the ones screening the cables, identifying narrative threads, redacting the names, and, most importantly, embarrassing the parties involved.

Thus, one of the most important questions about the future of WikiLeaks is how they will choose to structure their relationship with the media. One option that I outline in the quote above assumes that they would continue operating in the Cablegate role set: i.e. WikiLeaks would leverage their brand to solicit leaks and rely on their in-house technology to protect the anonymity of the leakers, with the media doing all the heavy lifting -- i.e. writing news reports based on the leaks.

That said, I myself am not sure if this option is sustainable, especially for leaks that are less explosive than the poignant cables penned by arrogant American diplomats. Suppose I want to leak some documents about corruption in, say, Azerbaijan. Why would I bother leaking them to an organization that knows very little about this country if I can leak them to Azerbaijan's best/only oppositional newspaper or, failing that, simply distribute them to anti-government bloggers? And even if I do leak them to WikiLeaks, wouldn't they just reroute them to the very same sources after going through their database of media contacts? In other words, why bother with an intermediary?

One reason for needing to keep the intermediary in the loop might be WikiLeaks's newly acquired connections with the likes of the Guardian, Le Monde and Der Spiegel. These media -- rather than Azerbaijan's anti-government bloggers -- would be far more effective in attracting global attention to these stories and thus ensuring at least a modicum of embarrassment to the parties involved.

I'd really like to believe that this is a valid assumption. But cynical as I am, I also wonder how much global appetite there exists for stories about corruption in Azerbaijan, Moldova or Mauritania. I suspect that Assange is bound to run into the same global attention problem that Ethan Zuckerman has been trying to tackle for a while now: it's not easy to get people to care about what's happening in far-away and exotic lands -- and certainly not about their complex politics. I don't think that the greater availability of classified information, even when backed up by superb technology for anonymous leaking, would substantially change the amount of attention that global audiences are willing to expend on understanding Azerbaijan or Moldova.

Thus, we should not get carried away: the reason why there is so much hype about the cables right now is because they implicate the United States, a country that everyone loves to hate. I bet cables written by diplomats from, say, Cambodia would be barely noticed by the global media. The United States is unique here because it is clearly the only country that has a stake virtually in every part of the globe, so every cable counts. Now, how many cables from Cambodian diplomats in Macedonia can one really read without falling asleep? Probably none: most people don't care enough about Cambodia, let alone its foreign policy interests in the Balkans.

So, now we are getting to the very heart of the issue. For WikiLeaks to be truly effective, someone knowledgeable -- i.e. not just a geek on a quest for global justice -- needs to look at the cables and tell a captivating story about them. In fact, the story needs to be so captivating that it would even make Cambodian cables from Macedonia look like a treat. This is also the conclusion of my piece in the Times:

One could only hope that the lesson he [Assange] would draw from all this is not that WikiLeaks had not released enough documents but that, in order to be truly effective, any releases of documents needed to be accompanied by dedicated investigative reporting and strategic and careful advocacy.

As I note above, it's possible to do this by pursuing partnerships with the media -- but in this case, it's still not clear what value WikiLeaks actually adds to the process other than providing safe technology for leaking.

Another possibility, which I didn't have space to consider in the Times piece, is that WikiLeaks would develop an in-house fleet of investigative reporters -- they are laid off in droves and searching for jobs anyway -- who would be employed full-time to produce well-informed investigating reporting from far-away lands. Thus, there would be no need to work with intermediaries and WikiLeaks would, all of a sudden, have a reasonable raison d'être (it would also ensure protection from the likes of Joe Lieberman, for it would clearly be a journalistic venture).

What would happen to WikiLeaks pieces once they are written? One option is for WikiLeaks to become something like ProPublica and either try to syndicate their articles to whatever media would take them or strike exclusive deals with select few media partners. This won't be terribly profitable and no U.S. foundation would want to touch WikiLeaks for a very long time (private donors, on the other hand, are a different case; there are plenty of rich oddballs like Peter Thiel who may find the idea of funding WikiLeaks very appealing -- too bad he won't be able to use PayPal to wire his dues though). On the other hand, the WikiLeaks brand right now may be strong enough for them to run on donations for quite some time -- this seems to work with Wikipedia (but the latter do receive a lot of non-donations money as well).

As the above should have made obvious by now, I clearly don't think that the story of WikiLeaks is nearing its end with the full release of all the cables. I know for a fact that Assange has been thinking about the kind of relationship that WikiLeaks needs to have with their media partners for years. I suspect his thinking has evolved quite a bit this year, not least because WikiLeaks has become a media's darling after spending a few years in relative obscurity.

Whatever strategy Assange chooses to pursue, I don't think it's possible to get the future of WikiLeaks right without first addressing the media relationship piece of the puzzle.

Parsing the impact of Anonymous

Thu, 09 Dec 2010 08:30:50 +0000

The current chapter in the WikiLeaks saga has finally forced me to come out of my blogging semi-retirement! While I'm still trying to make sense of everything that has happened in the last ten days, here are some analytical notes on Anonymous and the challenges facing the Obama administration as it mulls an appropriate response to WikiLeaks.

The impact of the recent wave of cyber-attacks launched by Anonymous on a handful of companies that dropped WikiLeaks as their client -- Amazon, EveryDNS, MasterCard, Visa and others -- is hard to gauge. I'm certain these attacks won't make any of these firms to reconsider, strike peace with WikiLeaks, and offer them some vouchers in compensation. But could the attacks serve as a deterrent to other firms that have been considering dropping WikiLeaks?

Perhaps -- but I don't know how many such companies there are. Right now, WikiLeaks is heavily dependent on Twitter and Facebook as their primary channels for external communications; it's these two firms that need to be watched most closely. (I don't expect many people to call on Google to remove WikiLeaks from its search results -- but let's wait and see...) So far, both Twitter and Facebook have been taking rather bold steps: they declined to stop doing business with WikiLeaks and actually removed the accounts of Anonymous (alas with little success, as new accounts were created within minutes). It's clear that should these two companies succumb to pressure and part with WikiLeaks this would result in a major online backlash.

Now, the fact that Anonymous chose to go after Visa and MasterCard has created all sorts of other challenging issues. While the attacks targeted only the public web-sites of these companies -- rather than the underlying infrastructure that allows card transactions to be processed -- such subtleties are likely to get lost in the public debate. As far as policymakers are concerned, these attacks would be viewed as striking at the very of the global economy (even if they obviously aren't in reality). It's still not clear to me whether any credit card data has been leaked or compromised as a result of such attacks, even though Anonymous posted some links to such data on their Twitter feed. This too won't matter, as most people would assume that data has, in fact, been stolen.

I seriously doubt that U.S. authorities would be able to effectively go after Anonymous, in part because there are too many people involved, they are scattered all over the globe, and attributing cyber-attacks to them would be impossible (and would surely require reading a lot of chat transcripts from IRC). The only other possible policy response at their disposal is to make it easier to trace such attacks in the future -- most likely by empowering the likes of NSA/Cyber Command. I would imagine that after the current cyber-attacks on credit card companies -- even if they didn't cause much damage -- this would enjoy bipartisan support in the United States.

As far as long-term developments are concerned, I think that much depends on whether the WikiLeaks saga would continue being a debate about freedom of expression, government transparency or whistle-blowing or whether it would become a nearly-paranoid debate about the risks to national security. Anonymous is playing with fire, for they risk tipping the balance towards the latter interpretation -- and all the policy levers that come with it.

That said, I don't think that their attacks are necessarily illegal or immoral. As long as they don't break into other people's computers, launching DDoS should not be treated as a crime by default; we have to think about the particular circumstances in which such attacks are launched and their targets. I like to think of DDoS as equivalents of sit-ins: both aim at briefly disrupting a service or an institution in order to make a point. As long as we don't criminalize all sit-ins, I don't think we should aim at criminalizing all DDoS.

I can spend hours debating this subject but, in short, while Anonymous' actions may result in greater government oversight of the Internet, they are not necessarily illegal or immoral just because they involve DDoS attacks. The danger here is obviously that if the narrative suddenly becomes dominated by national security concerns, we can forget about DDoS as legitimate means of expression dissent -- that possibility would be closed, as they would be criminalized.

What is the impact of these attacks on WikiLeaks? The organization has been silent about its own relationship to Anonymous -- I didn't see any tweets, let alone press-releases, that either spoke out against or in favor of cyber-attacks. As far as strategy is concerned, I think it's a big mistake for WikiLeaks to stay silent on the issue. In the absence of any statements from their end, most people -- especially those who have never heard of Anonymous before -- would assume that they are part of the same hacker gang. (Sarah Palin seem to have implied as much when she accused WikiLeaks about attacking her site).

That WikiLeaks chose not to address this issue publicly suggests that the organization is either overstretched or has not yet reached a level of maturity that some of us expect from it before expressing our unqualified support for what they do. As long as most people link WikiLeaks to the cyber-attacks on credit card companies, it's a net loss for WikiLeaks. It would also make it easier for certain cyber-hawks in Washington to justify classifying them as a "terrorist" organization -- at least whenever they appear on Fox News. Arguably, this is not a battle they can win with facts anyway -- but they should at least be leaving some public record of their stance on such issues. I'm also not sure about the overstretching argument: I'm sure plenty of smart people would volunteer to do PR for WikiLeaks for free...

All in all, if the public continues to associate WikiLeaks with hacking and cyber-attacks -- rather than, say, providing a safe platform for whistleblowers -- this will greatly erode the goodwill that WikiLeaks has built over the course of the last few months by increasing their cooperation with media organizations and NGOs. That "normalization by third parties" allayed the concerns of many -- but cyber-attacks may once again seed doubt in many people's minds.

Looking beyond Anonymous, I'd like to note that when it comes to crafting an appropriate response to WikiLeaks, the Obama administration is in a very delicate position. On the one hand, the domestic pressure to do something about WikiLeaks is growing -- and it will get even worse, as Anonymous continues its attacks and adds more political targets to their list (and I'm sure they will as there is some vicious circle at play here: the more attacks they launch, the more people condemn WikiLeaks, the more new targets Anonymous has). On the other hand, it's obvious that going after WikiLeaks would put the final nails in the coffin of the State Department's Internet Freedom Agenda, which is the most obvious victim of the last ten days.

I have always had mixed feelings about this Internet Freedom drive. While I think it's misguided and led by highfalutin techno-boosters unaware of the geopolitical background to their own actions, it's also obvious to me that there is some good that may come out of the U.S. government's interest in such matters -- for example, the support they offered to tools like Tor has been most appreciated. (That support, however, predated the formation of the Internet Freedom Agenda as articulated by Clinton in January 2010).

The real question here is whether, as the public attitudes towards tools like Tor -- which provide the very anonymity that benefits leakers -- quickly turn negative, the State Department and agencies like the National Endowment for Democracy would lose the ability to fund anything in this space. It's also not clear to me whether many of the geeks associated with the "Internet freedom" movement would feel comfortable taking money from the U.S. government, given that the latter are actively pursuing people like Assange.

I think this partly explains why the U.S. government has been so slow/low I key in lashing out against WikiLeaks, leaving the rhetorical heavy-lifting to populists like Sarah Palin, Rush Limbaugh and Joe Lieberman. Leaving in their hands also means abandoning control of the conversation; so far, it seems to me that such approach has been quite detrimental.

For example, many foreign politicians are already calling on Washington's duplicity and lack of media freedoms and disrespect of human rights -- all because Glenn Beck and Sarah Palin said something radical. As far as most foreign audiences are concerned, few draw distinctions between the elected officials, those in the opposition, and the punditry -- they are all part of "Washington"; so whatever the radicals says would, of course, eventually be associated with the White House and the State Department. I don't know how long the administration can afford to stay on the sidelines of this debate.

Another possible unfortunate consequence of the current backlash is that more U.S. government funding would go to tools that don't provide full anonymity but that still allow to circumvent censorship in authoritarian states. These are the tools developed by the Falun Gong technologists who already enjoy vast support from various neocon interest groups in Washington.

This would be most unfortunate and would further alienate geeks from policymakers, as Falun Gong tools are less effective and, well, they don't provide much security at all. This would only further reveal the duplicitous nature of Washington's Internet Freedom Agenda: it will seem as if all they want to promote is the ability to break through China's firewall -- but not the ability to say and publish what one wants without attribution. Many people in the State Department are not very keen on the Falun Gong crowd either, so I can't imagine that they would be interested in highlighting such issues (and yes, I know that State Dept is not monolithic but getting into internal squabbling inside Foggy Bottom would add another page or two to this post!).

I hope to post more analysis soon! In the meantime, make sure to check my Twitter feed, where I do post occasional observations and share links about WikiLeaks.

Update #1: There is now a statement on Anonymous/DDoS posted on WikiLeaks' site. They distance themselves from the attack -- which is good -- but don't really say what they feel about it (which is not so good...)

Were Haystack's Iranian testers at risk?

Sat, 18 Sep 2010 21:26:00 +0000

First I was thinking of offering my readers an apology for overloading this blog with Haystack-related observations. Then I changed my mind and decided that I should make no such apologies whatsoever: Haystack is the Internet's equivalent of the Bay of Pigs Invasion. It is the epitome of everything that is wrong with Washington's push to promote Internet Freedom without thinking through the consequences and risks involved; thus, the more we learn about the Haystack Affair while it's still fresh in everyone's memory, the better. (On that note, all readers of my blog should check this excellent new essay by my good friend Sami ben Gharbia, who discusses what the Internet Freedom Crusade means for digital activists in the Middle East – I'm still digesting many of the good points he makes).

Since so many of good discussions about Haystack happen on Stanford's Liberation Technology mailing list and thus may not reach the wide audience, I take it upon myself to periodically report on some of the news/revelations reported there on this blog.

The most interesting Haystack-related development on the list in the last few days was that we heard from Mehdi Yahyanejad, who disclosed that he had been contacted by one of the CRC's former advisory members and asked to test Haystack a few weeks before I started blogging about them. (I spoke to Mehdi several times during my investigation into Haystack and knew him from before.)

Here is the short version of Mehdi's argument as I understand it:

First, Mehdi had known that Haystack didn't have the goods much earlier than the rest of us and had evidence to prove it

Second, Mehdi thinks that the use of circumvention tools – even if the latter are insecure – presents no major risks to users in Iran and that the use of Haystack, despite its design flaws, wouldn't be seen as different from the use Tor or Freegate. (According to Mehdi, the use of circumvention tool is not illegal in Iran and is widely tolerated by the authorities.) Some of these tools are better than others - and Haystack happened to be somewhere on the lower end of the range.

Third, unlike me and Jake Appelbaum, Mehdi chose not to take his concerns public for fear that a scandal may ensue, thus jeopardizing future funding/support of circumvention in general. Here is a telling quote from one of his messages to the group:

...I know that circumvention tool projects, commercial or non-profit, are by in large dependent on the government funding. The government funding is highly policy driven. If Iran's nuclear issue is on the top of the news, this translates to various sorts of "democracy funds" and some of those funds end up in the hand of circumvention community. There is pretty much no other easy way of funding these projects for their service to countries like Iran.

When I was following Evgeny Morozov's blog posts, once he changed the narrative of "Austin Heap misled people" to "Haystack puts people at risk", I exactly knew where he was going with this. The first narrative would have been enough to take down Austin Heap but not necessarily Haystack as an organization. Evgeny wanted to bring down Haystack in a way that he could take the battle to the next step: going after the State Department and other potential government players (his latest article in Slate confirms my suspicion). I believe this can be very damaging and would appeal to Evgeny to consider all the intended or unintended consequences before moving further with this.

Going after the US government can scare away all sort government players from touching circumvention tools projects and would damage the level of funding for all circumvention tools. Of course, people who created Haystack, particularly Austin Heap, and the hype around it are primarily responsible for what has happened but I care less about them or for that matter who gets the blame. I care about what the damage would be to the fundings for circumvention tools projects.

I think Mehdi's is a very important argument that most organizations and actors in the freedom of expression/Internet freedom communities need to grapple with,

The debate that Mehdi has broached does risk pushing us towards engaging in a bit of Iran-inspired Kremlinology – e.g. statements like “I can predict the Iranian government's reaction to Haystack better than you ever can!” are probably inevitable – but I think it's a price worth paying for having such a debate.

So, assuming that Haystack did have major security risks – a fact that no one seems to dispute anymore – were Iranian testers at risk or not? In other words, even if the government could track down Haystack's testers – why should anyone worry, given that they don't have a long history of arresting users of such tools? Were concerns about Haystack overblown?

Here is my best attempt to elucidate four main arguments as to why Haystack's Iranian testers were at risk:

Number 1. Austin Heap made more claims about Haystack's awesome capabilities than all other circumvention tools put together, presenting Haystack as something genuinely new and dangerous. Were one to treat all those statements seriously, it would appear that Haystack is something that the Superman and Batman produced in their garage in their spare time and thus needs be watched very closely. On top of this, Haystack never released its code, making it impossible for the Iranian government – or anyone else – to verify how well Austin's claims matched the reality.

Given the well-known tendency of the Iranian government to see conspiracy theories even in basic laws of physics, I don't think it was so unreasonable for us to assume that they would treat Austin's claims much more seriously than they deserved. Given everything the government did since June 2009 – including crackdowns on bloggers, arrests and intimidation of people working on proxies, and so forth – I don't think we made the wrong call by assuming the government's reaction to Haystack would be harsh. And that Austin marketed Haystack as a tool for high-value dissidents put its testers at risk regardless of whether they were dissidents. I think it only makes things worse.

Number 2. Whatever the original intentions of its founders, Haystack was presented/interpreted as an ideological project rather than just yet another censorship-circumvention tool. Austin did like to highlight the fact that the tool got a US government license and even some fast-tracking from the State Department and in many of his interviews – most notably in the now infamous 20-minute video interview with Aleks Krotoski of the Guardian – he almost seems to imply that it was instrumental during the June 2009 protests. (There is also an implied association with the Neda video there as well – note the bit about citizen journalists using Haystack: “"[Haystack] gave [Iranians] a layer of protection that allowed a random person to be a citizen journalist without the risk of persecution, jail, torture, you know, whatever happens next.").

My research into the government's response to the claims of a “Twitter Revolution” in Iran convinced me that any remote associations with facilitating it could be extremely damaging to one's safety. In Haystack's case Austin was willingly jumping on the Twitter Revolution bandwagon, trying to present Haystack as a tool that made it possible. (That he had a well-publicized gig running proxies for Iran before Haystack – anyone remembers ProxyHeap, that other unique brand from the Heap Marketing Labs? - certainly did not help to dispel the myths).

I am sure that if we conduct a global poll asking people: “Name one anti-censorship technology that was crucial to the Green Movement in 2009” - Haystack would come on top, if only because it got so much free publicity for doing so little. (BBC's The Virtual Revolution documentary, HBO's For Neda documentary, all the media mentions...) I know that this is not what the logs of the Green Movement's web-sites would say – but the Guardian et al never bothered to see those logs – and based on my own experience in the former Soviet Union, paranoid authoritarian governments tend to place much more faith in the professionalism of the Western media than anyone in the West. “If the Guardian said Haystack mattered in Iran, how could it be otherwise? In fact, Haystack probably mattered even more and the government-controlled Guardian is just covering it all up” - this is the kind of government logic I'm very familiar with.

Number 3: Censorship Research Center, the entity behind Haystack, had a board of advisers that can hardly be classified as dear friends of the Iranian regime. Karim Sadjadpour and Abbas Milani are both well-known to the Iranian authorities and it would be silly to believe that their involvement with Haystack didn't help to confirm the government's fears that Haystack was more than just a circumvention tool. In fact, their involvement did make it seem that Haystack was part of some foreign ploy to subvert the regime by means of the Internet. The quote below from a May 2010 article in a state-controlled Iranian newspaper does build its anti-Haystack argument based on the involvement by Milani and Sadjadpour:

It is interesting to note that two Iranian opponents of the Islamic Republic in America are assisting the Censorship Research Centre in programming the software. Abbas Milani and Karim Sajjadpur, advisers of Austin Hype [as published], have offered their knowledge to design this anti-Iranian software to the American government. In addition to the Iranian assistants, the Censorship Research Centre has also established connection with some anti-state elements and the so-called Green Movement inside.

Gary Sick – the third member of the advisory board – is also hardly a neutral figure when it comes to Iran. Not only did he do multiple stints on the US National Security Council and write October Surprise, but he also runs Gulf/2000 Project, an academic mailing list that the Iranian government clearly sees as subversive and revolutionary. In fact, one of the ludicrous accusations made against Kian Tajbakhsh during his 2009 trial was that his membership in Gary Sick's ACADEMIC mailing list – which is run out of that traditional hotbed of revolutionary activity, Columbia University – was enough to prove his connections to the CIA.

Maybe it's just me but putting Gary Sick on Haystack's board and TWEETING ABOUT IT while a bunch of Iranians were supposed to be testing this extremely insecure and incomplete piece of software in Iran seems extremely ill-thought. Nothing against Gary Sick– he's a great scholar – but we should also be fair: tools like Tor have successfully avoided the kind of politicization that Haystack deliberately created around itself.

Are mailing lists illegal in Iran? I doubt it – and yet Kian has been locked up nevertheless. Thus, Mehdi's argument that circumvention tools are legal in Iran fails to convince me; some are clearly more legal than others. And as much as I'd like to believe in the ultimate perfection of Iran's legal system, I somehow can't, especially given the developments of the last 15 months. While circumvention tools may be legal, espionage for the US clearly isn't – and I think that this is the charge that Haystack's testers were (are?) most likely to face. It's extremely sad but everything Austin did/said since June 2009 made Haystack testers appear much more like American spies rather than clueless testers of circumvention software and the composition of CRC's advisory board helped to legitimize Austin's outrageous “we'll take this regime down!” claims.

Haystack is actually a perfect case-study of how one could start with what seems like a purely technological project that has noble objectives and end up with an extremely politicized and mostly socially constructed phenomenon that presents far more danger as an ideology than as a piece of code.

At the risk of dragging this discussion into the darkest theoretical alleys in the philosophy of technology and science and technology studies, let me just say that the main problem with Haystack was not how it was designed but how it was socially constructed and subsequently interprepted, not least by the Iranian government.

Here one needs to look at Haystack's position in the "let's liberate Iran!" and "let's liberate the world through technology!" discourses and how that position may compromise its effectivenss as a censorship-circumvention tool. As such, one needs to go beyond the discussion of how secure or insecure Haystack's protocols are - and we know conclusively that much of Haystack's prototype design was, in fact, insecure - and look at the broader socio-political context in which Haystack was supposed to be used. (Tricia Wang offers some more Haystack-related thoughts along these lines on her blog. I'd be curious to see more philosophers of technology and scholars working in STS take on the Haystack issue but the odds of that happening in the near future, well, are probably nil - not until 2015, I guess.

Number 4: What has been completely ignored in the discussions about Haystack's security until now is that it's their on-the-ground distribution method – at least as it applied to one group of their testers – was as unsafe as its design. I'm curious as to why almost nobody has asked how Haystack was actually distributed to the Iranian testers: it certainly didn't drop from the sky in those 976 USB sticks that Austin Heap collected from the trusting inhabitants of the Interwebs.

So let me shed some light on this here, for in my investigation I found how at least one group of testers got access to it. Here is how it worked. Together with their intermediary based outside of Iran, the Haystack team had set up a Gmail account and created a draft message there, where they stored instructions/executable files for download by others. The log-in details were then distributed to the testers – and eventually reached me last week. Even though I personally did not log into that account as it would probably have been illegal, a person authorized to use the Gmail account confirmed that the password still worked and sent me the screenshots.

There are many reasons why I think it was a bad idea to distribute Haystack that way – but the main one is that Gmail allows anyone with access to the inbox to track the IP addresses from which the account has been accessed in the past. That very Gmail account was accessed by NUMEROUS testers and I'm 100% sure that the Haystack team doesn't even know all of them, in part because they lost control over the distribution.

Even though the feature was turned off when my source accessed it last week, I believe it's impossible to say conclusively if it always stayed that way (based on some internal correspondence between Austin and the testers, I've come to believe that this feature was on at least once.) Obviously, if there were even one compromised individual inside Haystack's testing network, that person would be able to track down the IP addresses of everyone who has ever logged into that inbox – ironically, with Google's help. Even assuming that this did not happen, it seems obvious that there are many better ways to distribute Haystack while protecting the security of other testers. My point here is that if we really want to start comparing Haystack to Tor or any other tools, we need to look beyond architecture and start looking at many other parts of the chain – and those parts so far have not been made transparent by Haystack...

***

Given all this, I don't think that Jake and I made the wrong call in publicizing our concerns about the risks that using Haystack posed to the testers. I'm much more perturbed by the fact that Mehdi had a chance to test Haystack a few weeks before us, had deep reservations about it, and chose not to go public with them – as it seems because of some macro-level concerns about the shifts in the US government's approach to funding circumvention that the Haystack scandal may trigger.

Frankly, this makes me even more concerned about the perverse incentives and disincentives that the US government's push towards promoting Internet Freedom at all costs creates. I understand that Mehdi had a conflicting set of moral concerns – exposing Haystack for the fraud that it was on the one hand and not harming the funding prospects for such tools in general on the other hand. However, given the four arguments above, I think that conflict was not so hard to resolve: he should have gone public about his concerns with Haystack and – maybe – even send a copy to independent reviewers as soon as he began having “serious concerns” about Haystack.

Up until he sent several long messages to the Stanord mailing list, I was under the impression that Mehdi simply didn't grasp the fact that Haystack was insecure – which is what he himself told me on the phone when I interviewed him. In his subsequent correspondence with the list, however, Mehdi clearly states that he DID know that Haystack had major problems with security and even informed Austin and Daniel about them...

To say that I'm confused at this point would be an understatement. Essentially we are asked to believe that Mehdi – who knows the Iranian political context far better than Jake or me (and has a PhD from MIT – okay, I know it's in physics but still) – did not see how Haystack and everything related to it– its advisory board, Heap's claims, crackdown on proxies and everything connected to the mostly imaginary “Twitter Revolution” – might be perceived/interpreted by the Iranian authorities... Am I the only one who finds this hard to believe?

So what are the odds that Haystack testers will be pigeonholed into “enemies of the state/American agents” category rather than “circumvention geeks” category where Mehdi thinks they clearly reside? Everything I've seen/read about Iran in the last 15 months has convinced me that the odds that the former interpretation would become dominant are considerably higher – especially given the media image that Austin managed to build around Haystack. (E.g. Heap's meeting with John McCain mentioned in the Newsweek piece – I'm just curious if McCain sang “Bomb, bomb Iran” at that meeting? Sorry for the snark: but publicizing Heap's meetings with the likes of McCain is just another way to get Haystack testers in trouble...).

I'd very very much like to be wrong on this one and hope that both me and Jake are very poor students of Kremlinology as well as its application to the Iranian context...So far, unfortunately, I haven't seen many arguments that would convince me that we somehow overstated the risks...

P.S. This is a slightly edited version of my post to the Liberation Technology mailing list. And for the record, Mehdi is correct to identify a shift in this blog's narrative - but it happened naturally, as we discovered holes in Haystack's design.

How US sanctions made Haystack

Fri, 17 Sep 2010 05:02:15 +0000

There seems to be no end to the Haystack Affair. Who knew that this whole "Internet freedom" business was so ugly? Perhaps, it comes with the location: there must be a reason why Washington beats any other city in the world in terms of how many/how often its residents search for that very term on Google.

I'm glad that The Economist picked it up, along with many others. I'm still waiting for The Guardian to do something about their akward award to Austin Heap. (That award is deeply symbolic of what happens to good editorial judgement when newspapers are forced to run conferences and make money on things that their marketing departments don't know how to vet.)

Now that we know so much about technology behind Haystack, I think the public attention should focus to discussing the instituational/structural environment that made Haystack possible. I definitely think that the blame extends far beyond Austin Heap; he's the product of the current "digital-innovation-at-all-costs" environment inside the State Department. Unfortunately, I don't think that Haystack is a unique case; had Austin been speaking only in half his voice, Haystack would have been able to survive for probably much longer.

To broach thet discussion about the enabling environment, today I did a piece for Slate, where I recouped some of the key developments but also tried to reflect on the role that the US government - willingly or unwillingly - played in this mess. Since we had to make a lot of cuts to my original essay - I guess Slate didn't want yet another 6,000-word Haystack piece by yours truly! - I'll post the full version of one particular segment from the pre-edited version of my piece here. I think it does add some nuance to my argument - in no way was I trying to imply that we need MORE sanctions imposed on Iran, as some of the comments posted in response to my Slate piece seem to suggest.

I was actually arguing quite the opposite: that the sanctions - along with many other existing hurdles in US foreign policy - can easily distort the original noble intentions of the Internet Freedom Crusade. (And yes, if you think there are too many brands here - Haystack Affair, Internet Freedom Crusade, etc - I've decided it's unfair that the State Department gets to use all of those fancy brands - "21st Century Statecraft", "connection technologies", "Internet Freedom" - and I have to stick with boring and precise terms that actually mean something. So as of today, I'll be branding everything that moves!). So below is a small excerpt from my original essay - the bit that deals with the meaning of sanctions.

***

The Haystack Affair has helped to highlight that if the American diplomats are really serious about defending Internet freedom, they should begin by solving problems in their own backyard. The broader public debate here should go beyond the subject of government incompetence – of which there seems to be little doubt – and focus on the utility of requiring such licenses.

Why should the US government require a license to export an anti-censorship technology to Iran but not, say, China? What exactly is the fear here? That the progressive elements of the Iranian Revolutionary Guards would all become active Haystack users and start browsing the banned web-sites of Human Rights Watch? But isn't it a good thing? Why didn't the US government explicitly add circumvention-technologies to the list of other online services – like Web browsers and instant messaging software – that were finally granted exemptions from seeking such licenses when the sanctions were amended in March 2010?

Most likely, we'll never know. Anything related to Iranian sanctions is deliberately clouded in such secrecy and ambiguity as to guarantee the US government maximum maneuver space should they seek to change their mind on an issue. Such strategy – “flexibility through ambiguity” - may sometimes be quite useful, but as the Haystack Affair has revealed, it can also backfire quite easily. Haystack's founders may not have boasted of having the US State Department “fast-track” their application to Newsweek– a claim that a State Department official denied to me – if there were at least a modicum of transparency surrounding the government's deliberation over Haystack's license application.

It certainly doesn't help that OFAC – the entity that is ultimately responsible for issuing such licenses – is exempt from some crucial Freedom of Information Act regulations and is not obliged to release any information about individual cases it reviews. Not surprisingly, there is no mention of Haystack anywhere on OFAC's web-site. It's such ambiguity that has allowed Austin Heap to make overstated claims that the media didn't know how to verify or challenge; the government has also not shown much desire to set the record straight, even though they could have easily challenged Heap's claims to the media. Why didn't they? Perhaps, because being seen to do something about Iran can't possibly hurt them. All in all, it looks like sanctions oversight is one critical area where Obama's call for more transparency is not likely to get heeded any time soon.

But the licensing process does more than just bestow additional legitimacy on projects like Haystack; it can also give an unfair first-mover advantage to the most aggressive and legally-savvy of them. Haystack's press-release with regards to their OFAC license put all the right accents in all the right places: “Haystack is the first anti-censorship tool developed specifically for Iran and built to target the methods that Iran uses to filter the Internet. The CRC is the only organization licensed to export such software to Iran.”

CRC, being the first entity to obtain an export license from the government rightly saw it as a strategic asset. After all, if everyone in Washington wanted to fund Internet freedom in Iran and Haystack was the only entity with an export license, it was obvious that they had one killer advantage over other organizations: as far as the US law was concerned, Haystack was the only such tool that could be distributed in Iran legally.

It doesn't matter that there were other more effective tools or that Haystack was a raw piece of code that may never leave its beta status. Austin Heap had the license – and others didn't. It was clear which way the funding wind would be blowing – especially after a tacit endorsement of Haystack by Hillary Clinton. However ambiguously worded that endorsement was, it seemed to work in Haystack's favor.

Had Haystack not collapsed, it is easy to predict what would have happened in the next few months: the project would have locked in a major chunk of the early Iran-related “Internet Freedom” funds, stealing the spotlight from other tools and establishing very tight connections with the donor community. And had the right-thinking people at the US State Department refused to fund Haystack on its weak technological merits, they would soon have been attacked by the media and the Senators - as they always are, for example, whenever they refuse to fund projects affiliated with the Falun Gong movement. (But even the State Department had to capitulate to such pressure in May 2010, granting $1.5 million to one such Falun Gong effort.)

Herein lies a lesson for aspiring digital revolutionaries looking to tap into the Internet Freedom funding bonanza: hire good lawyers before you hire good coders! One of Haystack's numerous “innovations” in this space was hiring a Berkeley-educated and Washington-based lawyer as its managing director. Whatever their sins, the Haystack gang presciently foresaw that, given how deeply the American foreign policy is mired in government bureaucracy, the crusade for Internet freedom – especially when it targets countries that have American sanctions imposed on them – would always prize one's ability to write memos over one's ability to write code.

This is, of course, perverse – but this is just another example of how America's own rules harm the cause of Internet freedom and distort incentives to produce good software. It seems unwise to embark on such quixotic initiatives as the promotion of “Internet freedom” without first getting a thorough understanding of how existing policies may compromise the noble intentions.

p.s. The Guardian finally picked up the story.

More on Internet intellectuals and the Haystack affair

Wed, 15 Sep 2010 01:10:57 +0000

So the Haystack Affair (is there a Wikipedia page named after this already?) continues generating food for thought for those of us working at the intersection of free expression, Internet censorship, and media development.

Yesterday I blogged about what the Haystack Affair suggested about the responsibility of "Internet intellectuals." Ethan Zuckerman, who was one of the intellectuals I singled out in that post, eloquently responded to my criticism on his blog.

[[BREAK]]

"I’ve not published on Haystack for a very simple reason: I haven’t been able to conduct a proper evaluation of either the tool or the protocols behind it," wrote Ethan.

But I think that Ethan's rebuttal fundamentally misunderstood the origins and the direction of my original criticisms. Ethan writes:

"Evgeny’s concern in his recent post appears to be that I haven’t publicly critiqued Haystack, a proposed censorship circumvention tool that’s received a great deal of laudatory press coverage."

That's not my concern; I apologize if I didn't state it more cogently in the original post. My concern is that Ethan hasn't joined the public pressure campaign on Haystack to a) open up their code to external examination b) provide more information about how they operate.

Once again, I know that this post will make me sound extremely self-righteous so there is no need to point that out in the comments (I'm looking at you, David Sasaki!).

To understand what exactly I'm driving at, I need to elaborate on the history of the Haystack Affair. Here is my brief understanding of what has happened. (I'm almost sure I am overstating my own role in this -- but I hope Jake Appelbaum and others can chime in the comments and set the record straight.

***

Around early August 2010, many people on Stanford's Liberation Technology mailing list started asking a lot of serious questions about Haystack's model; their unwillingness to have their code examined; and their overall lack of transparency.

Based on my own long-running investigation of Haystack -- which long predates my membership in the Lib Tech mailing list (I discuss Haystack in my book, so I did a lot of research around them in the past) -- I wrote a provocative blog post, which got some media attention and triggered an angry -- some might say nearly hysterical -- reaction from Austin Heap.

This, in turn, led to even more questions about Haystack on the Lib Tech mailing list and elsewhere in the blogosphere. Austin's nervous reaction surprised me, prompting me to continue digging into Haystack. It also pushed me to join forces with Jake Appelbaum, who has had many similar concerns, and voiced support to my criticism of Haystack on the Lib Tech mailing list.

I also started working on a second, much longer blog post for Foreign Policy. I decided to indulge Austin's call for more and better reporting around Haystack and put my heart into the investigation.

In the meantime, the attention that all of this brought to Haystack pushed Austin to release some major information about its inner workings in responses to my questions. For the first time, we actually got a short technical note from Haystack's developer Daniel; it discussed some basics about Haystack's steganography.

I believe such close scrutiny of Haystack -- in my blog posts and by others in the blogosphere and on the mailing list -- has also pushed Austin Heap to demo the software to more people in San Francisco. Some of them noticed flaws in Haystack's design. (Of course, it's also possible that Austin had been planning those meetings for a long time; the fact remains that the fact that Haystack was everyone's favorite subject last week probably resulted in much more scrutiny being paid to how well it matches the claims made by its founders. )

Jake gleaned some information about Haystack from my communication with Heap (much of it was on the record -- and Austin himself promised to publish his answers) and conducted his own investigation. We did share a lot of notes in the process -- it was a collaboration I greatly enjoyed! In addition, some of the details that emerged from the demos that Austin Heap showed to people in San Francisco helped Jake grasp that it was extremely insecure and push Austin to shut it down (which, as we later found out, he didn't).

I kept digging into Haystack, reading everything I could find and spending a lot of time talking to people on Skype and on the phone. Eventually I got hold of several Iranians in London who had helped Austin Heap to recruit some of Haystack's developers in the country. It was them who gave me a copy of Haystack, which I then passed on to Jake for analysis. You all know the rest: Haystack was shut down on Sunday night.

***

Now, my conclusion -- and I'm curious as to what Jake thinks about this - is that we wouldn't have been able to expose Haystack without the public campaign that aimed at forcing Austin to start sharing more information about the project.

Even before seeing a copy of their code, Jake knew enough about how Haystack works to force Haystack to shut down. What he learned on Sunday was devastating -- but we knew ENOUGH by end of day Friday -- BEFORE we got hold of a copy of Haystack's code.

Thus, where I do think Ethan and many other academics/intellectuals failed to act responsibly was in not joining that public pressure campaign on Austin -- on the mailing list or on their blogs and tweets (not to be a complete jerk about it but Ethan's only public noise about Haystack was a retweet of someone else's suggestion that Austin Heap and me go on Jerry Springer).

Anyone who would go through that Lib Tech mailing list would not fail to notice that many of the questions raised about Haystack -- once again without anyone seeing the code -- were valid. I don't think it was a particularly hard campaign to notice -- and I think that Ethan himself acknowledges that he has been watching it from the sidelines.

Could Austin Heap be pressured into opening up his virtual (in all senses) empire earlier had people like Ethan Zuckerman joined our efforts? I don't know -- but I do think that Ethan and others did HAVE a responsibility to join that debate and voice their concerns about Haystack's methods and strategy.

One doesn't have to look inside Haystack's code to notice that the kind of risks its founders were putting their users under required a completely different operating model and probably a different working relationship with the rest of the community.

Evaluation of technology requires more than just close scrutiny of the code and the protocols involved; it also requires some hard thinking about the appropriate norms & the context. Academics -- and especially academics with a public profile who take it upon themselves to explain technology to non-technologists -- are well-aware of what those norms and contexts are. As far as I am concerned, it seemed pretty clear that Haystack violated both. If Ethan and others can make a convincing case that this was NOT clear, I'll be happy to acknowledge that I'm wrong and retract my criticism.

On the other hand, let's just imagine what would have happened if that public campaign had NOT occurred. Chances are that Austin would still be meeting with senators, raising money, and putting even more Iranians at risk. Ethan and others would still be waiting until a copy of Haystack's code would suddently drop from the sky.

To know that people's lives may have been put at risk and fail to act when such an opportunity to came around -- well, I just don't think that this is a valid excuse. I don't want to go all Sartre on Ethan or anyone else at the Berkman Center and outside, but to me it seems quite obvious that the noble desire to publish respectable papers about how circumvention technology works does not absolve one of the necessity to engage in public debate about it, especially when one has so much to contribute to it. One doesn't have to stop being an academic to participate in such debates; I don't think that a couple of critical emails to a mailing list somehow compromise anyone's academic integrity.

(And I do find it quite hilarious that two people without a PhD -- me and Ethan -- are arguing about the responsibility of academics. For the record, I deliberately framed this as the “responsibility of intellectuals” debate for that purpose.)

On the irresponsibility of Internet intellectuals

Mon, 13 Sep 2010 16:30:43 +0000

For those of you who are still following my Haystack chronicles, here is a recent announcement from Haystack's website:

We have halted ongoing testing of Haystack in Iran pending a security review. If you have a copy of the test program, please refrain from using it.

I hope the Haystack founders would be kind enough to expand on this.

The Haystack fiasco has revealed so many things about the state of play in the "Internet freedom" world that it is enough to produce a collection of essays. Beyond the actual technological details -- which I am sure Jake Appelbaum, Danny O'Brien, and plenty of other technologists will discuss in due time -- several other interesting threads have emerged.

[[BREAK]]

First, why have the media failed to properly cover Haystack as they should have? Jillian York and Nancy Scola have already weighed in on this -- and I hope the media critics will be quick to opine as well.

Second, why has the U.S. government been so eager to embrace technologies like Haystack without due diligence? I've already discussed some possible reasons in my earlier blog post and am working on a more extensive essay on the subject, to appear later in the week.

These are both good questions. Let me add a third one. Why were so many "Internet intellectuals" silent during the early stages of the Haystack debate? I don't want to take on a self-righteous pose and highlight my own role in the Haystack proceedings, but I think they do reveal the timidity of the current debate in the field. (Let me warn you: this post will be hard to finish without name calling but I'll try my best).

Last week I blogged about the "20th century roots of the 21st century statecraft," where I may have inadvertently implied some improper relationship between Harvard's Berkman Center and the U.S. State Department. I did not mean to suggest that State's funding compromises Berkman's academic integrity -- I apologize if my blog post created that impression. What I meant to suggest is that the proximity to power of any kind compromises many of Berkman's researchers as public intellectuals -- and this may reflect badly on Berkman as a whole.

The tough and probably inevitable dilemma is between helping the government get it right and helping the public get it right, by being in a strong position to criticize the government.

Obviously, this is not a new argument -- people are still arguing over Chomsky's famous essay of 1967 -- but I think it's an argument that is extremely important today, when the U.S. government is (in my opinion) embarking on a quixotic mission to promote "Internet freedom" without -- as the Haystack fiasco has so clearly revealed -- fully understanding the highly technical nature of the field or the risks associated with it.

This, of course, launches another chapter in the long-running debate of a) how should the government profit from external expertise?; and b) how should public intellectuals -- and especially those with a good understanding of the technologies involved -- build, disclose and scrutinize their own relationships to the government's efforts in this space?

Now, there are several extremely important issues to unpack here. One is the macro-level and has to deal with the critique of "Internet freedom" policy as such. Is it a useful orientation/foundation for the U.S. foreign policy as a whole? Is there something that we know about the Internet that should make us suspicious of the ideology behind the "Internet freedom" doctrine, even if that ideology seems to be empty? Is it likely to rid us of existing problems or only aggravate them? What should the procedures be for designing effective policies based on such a doctrine? Are such procedures or policies even possible given the rhetorical limitations of the doctrine?

Of course, it's been less than a year since Clinton's "Internet freedom" speech but I haven't seen much cogent meta-criticism. There were a few good short pieces written by very smart folks -- it's just that few would consider them to be "public intellectuals with an expertise in matters of technology or the Internet".

The second issue is the micro-level. Imagine that we can go beyond the Internet freedom doctrine for a second and engage with specific issues that inevitably pop up regardless of the doctrine. The Haystack fiasco is probably the best example here. The structural constraints created by the Internet freedom crusade surely created enabling conditions and added Haystack and its founder some legitimacy and media capital. All of this is true and chimes very well with many of the arguments I myself have been making for quite some time.

And still, it seemed pretty obvious from the very beginning that Haystack's founders may have violated some of the basic norms of the anti-censorship community and put people at risk. The burden of proof was clearly on them. What I along with a number of other folks have been doing in the past two weeks has been pushing them to produce the evidence that there are no risks to their testers -- or halt those tests if they can't convince us.

The need for this public campaign became obvious before anyone saw a line of their code. That "Internet intellectuals" -- people who write books, give TED talks, talk to the media, and explain the Internet to the public -- failed to point that out, well, I find that inexplicable. (Once again, I know that it makes me sound extremely self-righteous, but I feel like I'd better make this point anyway.)

I understand that some academics may feel the need to examine Haystack's code before making any definitive conclusions -- but I'd be hard-pressed to imagine why even academics wouldn't point out to some obvious discrepancies between Haystack's claims, their practices, and the kind of risks both of those posed to the Iranians. In fact, academics were in the best position to speak up and opine on all of this; had such criticism come from academics (rather than from mere bloggers like myself), it would have seemed much more credible.

I'm not talking about Clay Shirky or Nicholas Carr here; their engagement with the international-censorship dimension of the Internet has been quite shallow in the case of Shirky ("Belarusians use blogs to pull off ice-cream eating flashmobs! Kenyans use mobile phones to track violence!") and virtually non-existent in the case of Carr. This is also a big problem -- but this is not a problem that bothers me the most in relation to Haystack.

I'm more concerned with those in the know. The folks at Harvard, who have or have had some affiliation with the Berkman Center -- Ethan Zuckerman, John Palfrey, Jonathan Zittrain -- these guys have an established track-record of weighing in on international dimensions of the Internet, they have an unmatchable understanding of the freedom of expression world, and they actually know A LOT about circumvention.

Why none of them chose to join the Haystack debate at a point when it really mattered -- before Haystack was turned off -- is a complete mystery to me. I've toyed with the idea of reaching out to all them and asking them privately -- but I think it would be for everyone's benefit to ask this question in public.

Just to emphasize: I am only writing this post to stimulate a debate. I have been mulling over the notion of "Internet intellectuals" for a while now -- and I'm working on a long essay on the subject -- but the Haystack debacle has helped to crystallized many of the points I want to make and convinced me that something is clearly broken in our field.

I know that drawing the exact boundaries between academics/experts/government grantees/public intellectuals is never going to be easy, but I suggest that we at least start asking all these uncomfortable questions, so that hopefully we can start seeing where those boundaries lie.

And just so that it doesn't look that I am trying to claim the limelight for myself: a lot of people -- Jake Appelbaum, Danny O'Brien, Katrin Verclas, Jillian York and many others -- have been involved in helping to shed more light on Haystack. My problem is mostly with the people who WERE NOT involved.

One week inside the Haystack

Thu, 09 Sep 2010 19:22:24 +0000

Last week I blogged about Haystack. That post, followed by reply from Austin Heap, Haystack's founder, triggered an interesting and at times heated discussion on mailing lists, blogs, and Twitter.

Some of that discussion was more heat than light, and I am sorry if my original post contributed to that. These issues are of huge importance. And in the interest of focusing on what really matters—the promise of systems like Haystack in protecting dissidents—I would like now to express my understanding of Haystack both more cogently and in greater depth. To be clear: I am not a security specialist. But since my blog post went up I've had many conversations with security/cryptology experts as well as with Austin Heap. I am very grateful for the conversations. My conclusions about Haystack remain very skeptical, and I will explain the sources of that skepticism here as well as reflect on what the Haystack situation reveals about the state of play in the "Internet & democracy" space. Let me emphasize once again that this post is not meant as an attack on Haystack or Austin Heap.

Since this will be a very long post, I'll break the rules and start with some conclusions. You may then want to read or skip some of the technical details before heading straight to the last section that contains some unanswered questions/even broader reflections.

[[BREAK]]

I. Haystack-related: Nothing about what Haystack/Austin Heap has disclosed so far could convince me that Haystack is a safe product that can be used in a highly sensitive context like Iran. (Austin Heap did make some important promises about the future.)

II. Haystack-related: Haystack has so far failed to publish a coherent narrative about their operation, how it came into being, and how extensive it really is. Paradoxically, such ambiguity may have helped to generate the buzz in the media, as reporters were free to imagine anything they wanted about Haystack and how it worked. Furthermore, some of the claims that have been made by Austin Heap earlier this year are misleading and ended up presenting Haystack in a far more impressive light than the evidence merits. The fact that Haystack is still in beta is not widely publicized and not reflected in most media reports about them. While this ambiguity probably works in their favor at this point – at least in terms of raising money and generating the public profile – the ethics of this are dubious.

III. US government-related: the murkiness surrounding the review process of allowing technologies like Haystack to be exported to Iran is extremely nontransparent and ambiguous. While the US Treasury and Commerce Departments almost certainly did not opine on the security of Haystack's architecture in the context of Iran, the fact that they granted them the license/waiver can still be construed as such by the general public. That the US State Department chose to reveal its endorsement of Haystack is unfortunate and would most likely hurt both parties.

If you want some geeky technological details, see below. Otherwise, skip straight to the end of the post.

***

Now, after I perused virtually everything ever published about Haystack on the Web and exchanged numerous emails with Austin Heap, it appears that Haystack claims to do three things:

1) It encrypts all data that is being exchanged between Haystack's users and Heap's servers. For the uninitiated: if the encryption is done properly, even if someone intercepts the data that is being exchanged, they would have a very hard time determining what it is.

2) It then relies on some form of steganography to mask this data to look as if it were something else. This supposedly makes it more difficult for the Iranian police – or anyone else who might be looking – to automatically identify that some improper sites are being visited.

How does it work? Well, it appears that Haystack presents some of its user traffic as traffic that looks innocuous; i.e. the police may be led to believe that the users are visiting sites like weather.com while they might be browsing sites that are banned in Iran or may simply raise suspicion (e.g. Twitter or Facebook).

As per my most recent correspondence with Daniel Colascione, Haystack's lead developer, “ the traffic [is made...] to look legitimate enough to a machine that it can’t confidently and automatically tell the difference between it and regular traffic...We never claimed that a *human being* sitting down with traces couldn’t figure out *something* was going on --- though thanks to our encryption, that human being still couldn’t figure out who the user was actually talking to.”

This is all that Haystack has disclosed about their steganogaphy so far. Note that if their encryption IS NOT as strong as they claim and if THERE IS a human being assigned to the task of hunting for dissidents and performing in-depth analysis, they've got a problem.

3) Relying on Functions 1 and 2, Haystack then helps to circumvent censorship, i.e. it allows those who use it in Iran to access web-sites that have been blocked by the government. My understanding also is that after the data has left Iran, it is sent to Austin's central system that can monitor everything – they know what was sent, where it was sent from, where its going on the net, and of course possibly also the content of the requests themselves. While this is standard practice with many similar tools, there are all sorts of things than can go wrong here. All depends on the implementation.

One needs to remember that even if Haystack did not exist, some of such functionality is already available in other tools. Functions 1 and 2, for example, are already provided by a number of commercial off-the-shelf tools. (However, not all of them are easily accessible from Iran, as the government quickly blocks access to them as well. ) Function 3 is interesting; I don't know of many (any?) mass-market tools that could perform that function in the context of Iran.

Essentially, if Haystack works as advertised and has no security flaws that might compromise its users' security, it's, indeed, something of a conceptual breakthrough. I'll be the first one to acknowledge this.

What kind of evidence do we have so far to assert that it does, indeed, work as advertised? Let's deal with each of its three functions separately.

***

On the circumvention front: according to my correspondence with Austin Heap, they have tested their software inside Iran. They have had some problems, most of which – according to Heap – they have managed to resolve. My anonymous source inside Iran who has had first-hand experience with testing Haystack has painted a somewhat less rosy picture; Haystack's rate of circumventing censorship was not particularly impressive. An Iranian source very close to Haystack also wrote to me that “some preliminary tests on the software in Iran have been less than satisfactory.“ Also, Austin claims it has been tested and works in some other Middle Eastern countries; he produced some evidence to that effect.

This seems like good news. But I don't really know what it tells us about Haystack's future potential. For once, Haystack is only used by a limited number of people who are test-driving it in Iran. At this point, there is no reason why any government – including Iran's – would start searching for ways to block software that is not widely used by their population and presents no threat.

The moment Haystack goes into mass-market distribution – and this, according to Heap, is their stated goal – this would no longer be the case; the Iranian government would immediately get very interested. Given the resources they have at their disposal, it's quite likely they'll find a way to block Haystack pretty quickly.

Of course, maybe Haystack will raise enough resources to outsmart the censors, at least in the short-term (this is the famous “cat-and-mouse” game that Patrick Meier alluded to in the Newsweek piece and that Austin Heap often alludes to in interviews as well). Such an approach seems to be working in the case of the Falun Gong-affiliated Global Internet Freedom Consortium who have been designing tools similar to Haystack to distribute in China.

In reality, though, the approach is most probably not working: if it was, GIFC would not be asking for so much money from the US government all the time. What they seem to be doing is rotating IP addresses and buying a lot of bandwidth – a blunt strategy but it seems to work as long as someone wants to keep pouring money into their ventures.

That said, I'd be wary to draw parallels between Censorship Research Center – which, according to my conversation with Austin – has less than $3k left in their bank account while their hosting costs are $1k per month – and the Falun Gong crowd. The latter are way more resourceful, have a religion to back them up as well as a bunch of extremely powerful Washington insiders like Michael Horowitz and Mark Palmer to advocate on their behalf.

So my verdict on point #1: While I'm willing to acknowledge the possibility that Haystack might be working in Iran during its testing phase, I don't think this means much in the long-term. It's no worse or better than any other prototype that has not yet been flagged by the Iranian government. And it's very hard to expect that the Iranian government wouldn't be watching Haystack with their utmost attention given how much buzz Haystack has generated in the media...

Unfortunately, I still don't know what goals – other than fund-raising and development – such proactive media exposure has advanced. One of the few snarky remarks I'll allow in this post is that it's very tempting to believe that Haystack's approach seems to be “market first; test second”. It is an approach that works well in the Bay Area; I am not sure it would work equally well in Iran.

***

Now, onto point #2: encryption. It's not the case that a censorship-circumvention tool absolutely needs strong encryption to do what it is supposed to do: i.e. provide access to sites that are banned. I can think of many cases where encryption does not need to be very strong – e.g. I use the tool to access the banned Gmail and use it in https (i.e. secure) mode. Some kind of basic encryption may be good enough to let me bypass government's filters but it surely won't protect my privacy; that said, knowing that Gmail provides encryption of its own, I may not be particularly worried. The most important thing here is to make sure that the risks I am taking are made visible. E.g. if I know that the software I am using does not claim to be secure, I'll alter my behavior accordingly and be more cautious. If the software DOES claim to be secure, I may not be motivated to do so.

The tools offered by the Global Internet Freedom Consortium – Freegate, Ultrasurf, and others – which Austin Heap likes to tout as his model – claim to be “secure” but it's such a broad definition of security that no one really knows what it means; uses would probably be wise to disregard such claims outright. In other words, while they do make some claims about encryption, they do not back them up; their primary focus is on circumventing censorship. Is it a problem with GIFC's tools? I bet it is.

Now, given that Haystack is a censorship-circumvention tool and the very act of circumventing censorship in Iran is illegal and can put users in danger, one probably wants to hide as much data about users as possible. So “security” - however vaguely we define is – is something that one does want to see in Haystack. This is precisely what Austin Heap and Haystack claim to provide on their site's FAQ. Furthermore, they claim to provide some effective steganography, which is seen as a very difficult challenge by those in the privacy/security community:

Is Haystack secure?

Yes. We go to great lengths to ensure that any traffic between our servers and our users looks like perfectly normal, innocuous, and unencrypted web traffic. It would be exceptionally difficult to detect and block automatically.

However, even if our methods were compromised, our users' communications would be secure. We use state-of-the-art elliptic curve cryptography to ensure that these communications cannot be read. This cryptography is strong enough that the NSA trusts it to secure top-secret data, and we consider our users' privacy to be just as important. Cryptographers refer to this property as perfect forward secrecy.

I am not a cryptographer and I've learned more about encryption this week than in my entire life. That said, based on the numerous conversations/email exchanges I've had with people who work on these issues, my understanding is that Haystack has so far failed to produce much evidence that their encryption works as advertised. The fact that they have implemented a particular open-source cryptographic routine is not a guarantee that they have implemented it properly. That it's state-of-the-art does not mean much; Space Shuttle Columbia also had a lot of state-of-the-art technology in it.

An analogy might help here. Suppose you and I start with the same perfectly safe parts of the automobile engine. Is it possible that we assemble those parts in two different ways, of which one would be less secure than the other? Sure, it is possible. So far Haystack has disclosed that they use one safe part in their engine – without telling us anything about how the engine actually works and how that particular part fits into it. This is not a car that I would like to be driving, even if NSA owns a car fleet with cars that have the same parts in their engines.

Do the Haystack folks need to publicly reveal everything about their engine and make it into an open-source kind of car to assuage security concerns? No, this is not required (even though I've heard many strong arguments that it would help: the Iranian government would probably be able to decompile their software anyway while making it open-source at this point would help them tap into the community of well-meaning outside techies who can help).

If they are short on funds, it's possible to ask someone with an independent third-party with the right credentials in the computer security/cryptology field to take a thorough look at their code, test-drive the software and write a report that can be shared with the rest of the community that would assuage at least SOME fears without disclosing any proprietary information.

Austin Heap wrote to inform me that they are planning to hire a professional testing firm to do just that once they finish tweaking their code. I think this is a good idea – provided they have the money. But it's important to keep in mind that until that happens, there are few reasons to treat Haystack as a secure or reasonable technology, not lease because its overall design has not been independently vetted or peer-reviewed. In our correspondence, Heap did point me to a few people that they have shown Haystack to. I interviewed a few of them.

My impression is that they did not really get a chance to look inside it – nor could I definitely say that what they looked is what Haystack looked like 10 days ago or 20 days ago. (One knowledgeable person who spent some time looking at Haystack's demo said that it was “ software definitely in beta stage, with a lot of room for improvement”.) For all we know, at this point, Haystack may well as be like the Ship of Theseus in Greek mythology: it's changing so much and so fast, that no one is sure if any of the original wood is still there.

***

Now, function #3: steganography. I'll save you the Wikipedia visit: “Steganography is the art and science of writing hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message, a form of security through obscurity. “ (UPDATE: Bram Cohen just alerted me to the fact that it may actually be incorrect to say that steganography is a form of "security through obscurity" - did someone get something wrong on WIkipedia?)

In Haystack's context, it translates into the ability to mask what sites/content you are actually visiting/downloading, presenting it as something innocuously-looking instead and potentially confusing the Iranian censors. Maybe Haystack does a good job at it; maybe, it doesn't. No information has been released to prove it either way. While they have disclosed at least some information about their encryption methodology, very little has been disclosed about the steganography.

Both of the anonymous experts who had a chance to see Haystack's demo that I spoke to implied that Haystack's steganography didn't seem to be flawless and would benefit from an independent review. As such, unless it's vetted properly – by a third-party firm or by someone else – I think it's safe to assume that it is not safe.

My own limited understanding of this issue based on conversations with experts is that while Haystack's particular approach may be working at the moment, it's most likely due to specific bugs in Iran's firewall. Obviously, once Haystack goes into mass-market circulation, it's not clear that those bugs will remain. (The Newsweek piece does contain a very important detail: Austin Heap did manage to get hold of a 96-page document about how Iran's censorship system works that was leaked to him supposedly by someone in the government; this may explain how they pulled off the particular steganographic solution.)

***

So, to sum up the three points, we are dealing with a program that

a) has only been used by a VERY limited number of people inside in Iran (I hear that less than 100 copies have been distributed after Haystack got the US government's greenlight for export sometime between mid-March and mid-April) while its future as a mass-market product depends on how much money/resources they can raise.

b) may not offer the kind of encryption/security that its founder claims it does; Haystack has not provided any significant evidence to convince me of their security, only promises that they WILL address it, including by disclosing parts of their encryption architecture (note: by “evidence” I mean tests results by independent security experts – which Haystack does expect to obtain in the FUTURE). This is a great and important commitment – but for now, we don't know much about Haystack's security. I am not sure I can trust their FAQ alone.

c) may be hiding sensitive user traffic and mixing it with some innocuously looking traffic – but we don't know how secure such “hiding” methods really are, because they have not been independently tested. (Once again, this is something that Haystack seems eager to have tested at some point IN THE FUTURE.)

Does it mean that Haystack will never be secure? No, it doesn't. As far as I'm concerned, they may one day become the most secure piece of software in history. It's just that at this point we have very little evidence to imply anything of the kind. They may have a fine prototype – but it's just that, a prototype.

Given what I've heard from Austin Heap so far – including their plans to make Haystack available on the iPad – I have some questions about their priorities. (Who needs Haystack on the iPad when one cannot even legally purchase iPads in Iran?) Moreover, Austin Heap wrote to me that they are planning to launch in four more countries, which may stretch their ability to make their software secure even further.

In short, Haystack may have a very glorious future. Its past, however, is far less glorious.

***

It may be too much to demand of my readers but do watch this 20-min video interview with Austin Heap. Or watch at least the first 8-10 minutes of that interview, which Austin Heap gave to Alex Krotoski of the Guardian (the interview was shot for the Virtual Revolution documentary; some transcribed parts of that interview also appeared on The Guardian's web-site). The interview was published on March 21, 2010.

Here are three excerpts from that interview, which I think are important to consider when thinking through Haystack's history.

Interviewer: Austin Heap, you developed an application called Haystack, which was pretty important in opening up the Iranian Internet which had been shut down in the immediate aftermath of the Iranian elections last year. Can you explain what Haystack is? How does it work? And how you decided to develop it?

Austin Heap: Sure. Haystack, it's basically a piece of software that a user in Iran would run on their computer and it does two primary things: it encrypts all of the data and it hides all of the data inside what looks like normal traffic, so it looks like you are visiting weather.com or completely innocuous sites...[interview continues...]

Interviewer: ...And Haystack acted at what point in this process [of circumventing censorship?]

Austin Heap: What Haystack does it starts at the very beginning. The primary concern is protecting the user. That's why step 1 is encryption. Step 2 is getting around actual censorship. You can use a proxy to get around the censorship but it's fairly easy to monitor that traffic; you can eavesdrop, imagine what you can do if you can watch someone's internet connection: you can watch them log in into GMail, you can watch them log into Facebook, you can see who they are talking to, you can intercept their messages. And so the encryption was really really important for us: now, it has to start on the user side - like on their computer. So Haystack sits there. First, it encrypts, then it makes its way through the government filters.

Interviewer: And what Haystack did in practice when it did find its way onto people's computers? Was that it allowed them to load things like Twitter and Facebook and the blacklisted sites?

Austin Heap: Right. And I mean it's not just Web traffic. All of a sudden, it allowed people to make Skype calls back to their families securely, it allowed people to do basic things like send Gmail without worrying that someone is doing like man-in-the-middle attack and trying to steal their passwords or monitor their email. It gave them a layer of protection that allowed a random person to be a citizen journalist without the risk of persecution, jail, torture, you know, whatever happens next.

Perhaps, it's just me, but on reading these three questions and answers, I am led to believe the following: Haystack is not a prototype but a real piece of well-functioning software that made it to the computers of random Iranians; it aims to deliver SECURITY [“our primary concern”...] to those who use it while also providing ACCESS to banned sites; it is actually actively used by “people in Iran” who rely on it for all sorts of things that they could not do before – Skype, Gmail, etc – AND it allows them to do so more securely than they would have been able to otherwise.

Nowhere in the interview does Heap mention that the software is in the beta-testing stage or that its use has been limited to only a few dozen – or even fewer – testers. (It may be too difficult/challenging of a point to make, but it would also be nice to have him point out that since Haystack is hosted n the US, the American government can now potentially monitor all of the traffic that is used by people plotting a revolution in Iran.)

Now, after I exchanged a dozen emails with Heap, the picture that emerges is very different from the one painted in the Guardian interview. Haystack has not been widely distributed in Iran; its use has been limited to a few dozen people, all of whom were specifically recruited to test whether it circumvents censorship. In fact, Austin wrote to me that “our initial test group prior to halting exports was much smaller (a handful of people)” (Austin resumed exporting Haystack to Iran – I assume for testing purposes – after getting the license from the US government; this also means that they may have been doing some of those exports illegally).

Am I wrong to assume that the “people” Austin mentions in the interview – those accessing Skype and Gmail – were just a “handful” of specifically-recruited testers of the software? That there was no network of Iranians using Haystack? That there are less than a hundred now – but there were just a “handful” when Austin gave the interview?... I think it's not an unreasonable assumption.

In other words, the grounds for claiming that Haystack allowed “a random person” to become “a citizen journalist” seem rather shaky; according to Austin's own version of events, no random people ever saw this software. And if some random people did use it, it was a major oversight on Austin's part, because, as himself acknowledges now, the software needs a security review. The only reasonable conclusion that I can draw from this is that either Austin greatly overstated the actual use level of Haystack in Iran OR that some naive Iranians were put under unnecessary risks. For Iranians' sake, I'd really like to believe it's the former.

Furthermore, the interview makes it clear that Heap does believe that “security” and “encryption” are so important to Haystack that he places them even above “circumvention”. This is fine and laudable – but we have not seen much evidence that it does deliver security to its users as flawlessly as Austin Heap claims. (Once again, I believe this is something that he is coming to recognize – hence his willingness to show software to some experts and run a third-party test on it). As such, his analogies to tools like Freegate don't stand up to close scrutiny; Freegate surely does not place “security” first – a fact that the GFIC folks do not hide. Theirs is primary a circumvention tool that provides just enough security to break through the firewall.

Very few of the other interviews/public statements from Austin Heap that I have read in the last week (and believe me, there are very few statements I did not go through) have been forthcoming on either a) the fact that Haystack is still a prototype – or a beta if you will b) the fact that its use was limited to testers only.

The impression that one would get on reading most of those pieces is that a) Haystack is distributed to Iran – not widely, but distributed nevertheless – with the objective of being used beyond testing b) its level of encryption/security fully satisfies the Haystack team (see the FAQ above). If anything, Haystack may have overstated their capabilities/use level to the media.

***

Some Conclusions and Unanswered Questions

Now, what have I learned form all this?

a) The Media Failed to Produce Serious and Critical Reporting on Haystack: The mainstream media who have covered Haystack so far have almost completely failed to ask the tough questions they should have been asking: about the number of Haystack's existing users; about how its founders are planning to scale their userbase; how such scaling may affect their ability to provide effective circumvention AND security; how extra publicity they get in the media may hurt their objectives; which independent party can vouch for the security of their software... This list can go on.

The bottom line is that such questions were not asked. Is it because the journalists are so caught up in the cyber-utopian myths around Iran's Twitter Revolution that they refuse to critically examine its proponents? Or is it because the subject matter is too complex for them to scrutinize the claims made by technologists? I don't know. Most likely, both have played a role.

If the journalists were covering Haystack as a prototype – a technology that might be of use in Iran at some later point in the future – they definitely failed to investigate the kind of conditions that its successful deployment as a full-blown project would require. If they were writing about Haystack as an actually existing technology, their failure to pose questions about its security is even more glaring. Either way, there is no escaping the fact that media failed.

In my research, I inadvertently uncovered some other ugly stuff, which I feel I have an obligation to disclose. It was probably not a very good idea for the journalist cousin of Haystack's managing director to pen articles/do radio pieces about Haystack without disclosing the connection. To his credit, Cyrus Farivar promptly disclosed that connection after I asked him about it.

Cyrus also posted some interesting reflections on how hard it is for a technology journalist to actually investigate the kind of claims made by Haystack – this would require background reading in cryptology, sanctions, etc. True – but covering the modern-day financial industry with derivatives and other complex financial industries would require as much knowledge. I don't think that ignorance is a good excuse here.

If the US government is serious about all this “21^st century statecraft” business, they should start funding conferences/trainings/events aimed at educating the journalists about how to write about such stuff. (I've long been making an argument that the only way to go beyond the simplistic discussions of cyberwarfare in the media is to educate the journalists – something that I'm glad the NATO center in Tallinn is keen on doing.)

II. Much Ambiguity Is Created by the Technology Export Review Process: The way the US government reviews what circumvention/encryption technologies are allowed to be exported to Iran is nontransparent and ambiguous. The fact of obtaining a license can be easily misunderstood as meaning something that it is not intended to mean. The more I learn about this bureaucratic process, the more I come to realize that all that the US government really vetted in Haystack's case was not its ability to do what it claims – i.e. circumvent censorship and do so securely – but only its potential to compromise American interests – including those of the national security variety – if it were to be allowed to be exported there.

In other words, the US government would have alerted Heap if Haystack were too good to be true – but it would not have alerted him if Haystack had some major security flaws. I've got evidence (which is highly sensitive but can probably be revealed on demand) that at least on one occasion Austin Heap used the fact that Haystack had been granted a waiver by the US government and that no other companies had been granted a similar waiver as an argument to buttress his claims about Haystack's superb technological potential. I don't know whether this happened because he misunderstood the meaning of the waiver or whether because he deliberately misrepresented the facts.

Did getting the waiver require Haystack to submit tons of documentation? I am sure it did; Heap confirmed this in his emails to me. Was a positive decision to allow such exports somehow reflective of Haystack's ability to do what it claims to do? I doubt it... I'm not a legal expert on trade law but so far this is the only explanation that makes sense; we can't really expect the US government to vouch for Haystack's security architecture – and I am sure this is not a role they see themselves playing either (e.g. they don't opine on the security of tools exported to China or Saudi Arabia). That said, I'm not certain that this is how the media interpreted the fact that a positive decision had been taken. Too much ambiguity here creates an impression that a more thorough vetting may have taken place.

III. Haystack's Endorsement by the US State Department Was Not a Good Idea. Warning, my favorite subject ahead! Parts of the the US State Department do not seem to be aware of the highly political nature of their activities. Hillary Clinton did mention Haystack – if only in passing – in one of her speeches, as I already pointed out. The Newsweek piece about Haystack specifically mentioned that the State Department was also supportive of Haystack. Here is the direct quote from that piece: “[Heap's] innovation caught the attention of the State Department, and it was fast-tracked for speedy approval”. If this is not an direct endorsement of Haystack by the US government, I don't know what is.

I am not pointing any fingers here (joking, of course!), but Austin Heap was also invited to appear at the London summit of the Alliance of Youth Movements, an organization that was launched with the backing of the US State Department and was spearheaded by this blog's ultimate hero Jared Cohen. Jared also chaired a panel that featured Austin at the AYM's London summit and accompanied Heap to the reception held at the residence of the US Ambassador in London (this is a great photo of Heap and Cohen together – also have a screenshot). Heap told me that he believes Cohen had nothing to do with their licenses/waivers – something I very much like to believe but find it very hard to, given Cohen's own history of interventions in Iran-related technology matters. Regardless of Cohen's involvement, even if the US government does love Haystack so much, why on Earth make its love so public? Won't it put Haystack's users at even greater risks?

Suppose that Haystack was not as judicious as they have been so far in distributing their software and, with the government waiver in their hands, would simply put their software for download by anyone in Iran. This could easily have led to disastrous consequences...

Just to make it clear: Haystack is not at fault here; the State Department – I am not so sure. Austin Heap can make whatever statements he likes; the government, however, is supposed to treat such statements with due skepticism and think through the political implications of their endorsement of any technologies. All this fast-tracking stuff would surely reflect bad on the State Department if after an independent security review it does turn out that Haystack has severe security flaws, which its testers – or other Iranian uses – may not have been aware of.

And why did Clinton choose to speak about Haystack and not say Tor or any other tool? Also, not very clear. Were the diplomats charmed by all the buzz around Haystack in the media? Possibly. That said, it would be very good to know whether the State Department did ANY analysis/testing of Haystack's claimed capabilities, thought through how well it could scale in Iran, and whether they may be hurting its users in Iran – current and future ones – by lining up behind them. Were these questions asked and answered?

Final Note: Based on my conversations with Austin Heap, I understand that they are eager to show Haystack to more experts and have an independent security review. All of this is great. The past, however, is the past – and I think there are certain things there that Haystack needs to explain/live up to. On the one hand, I am glad to discover that the number of people using Haystack in Iran is so small and that they may have all volunteered to do it as testers. On the other hand, the way in which Haystack has been presented to the public over the last 12 months has been misleading.

UPDATE #1: I just received information that "Haystack has been turned off as of ~19:00 PST, Sept 10/2010", with Austin Heap agreeing that "Haystack will not be run again until there is a solid published threat model, a solid peer reviewed design, and a real security review of the Haystack implementation."

The 20th century roots of 21st century statecraft

Tue, 07 Sep 2010 11:20:21 +0000

Let's imagine a parallel universe for a second. In that universe, the U.S. State Department decides that energy -- rather than the Internet -- would form one of the core pillars of "21st century statecraft."

To that end, the secretary of state would give a speech about some highly abstract and ambiguous concept like "environmental freedom" that would strike the right chord with the media -- if only because it promises a greener future for all of us!

Since energy-inspired "21st century statecraft" would be difficult to practice without courting the private sector -- the likes of Haliburton, Exxon Mobile, and Chevron -- their executives would be taken on regular tours of exotic places and invited to private dinners with the secretary of state.

People spearheading this kind of energy-inspired "21st century statecraft" would have a very friendly relationship with the corporate world, occasionally leaving government service to work for the giant energy corporations.

[[BREAK]]

To add legitimacy to concepts like "environmental freedom," the U.S. State Department would commission a bunch of supposedly apolitical academic studies at some Ivy League university, recruiting its leading technologists to make it seem that this entire initiative is all about energy efficiency -- and not at all about regime change.

Furthermore, as the business goals of the energy sector and the political needs of the American diplomats became intertwined, it would become extremely challenging to make sense of either on its own terms and identify how they influence each other.

... Call me contrarian if you wish -- but I think this is the kind of a universe where U.S. foreign policy has operated for the last 50 years or so, most recently during the Bush administration. Back in the Bush days, there were even a couple of bills and speeches about "energy independence" -- not as catchy as "Internet freedom," of course, but suffused with the same high-pitch rhetoric.

Save for a few people in Dick Cheney's office, I'm yet to see anyone who thinks that the kind of private-public partnerships all of this yielded had a benign effect on U.S. foreign policy. I mentioned the Energy Task Force in one of my previous blog posts and I'll mention it again: maybe, it wasn't such a great idea after all.

Hence a question that has been bugging me for months now: What exactly is so 21st century about "21st century statecraft"?

Am I being unfair to the State Department in drawing such parallels and asking such questions? Well, here are the facts. Silicon Valley CEOs do join American diplomats to exotic locals like Siberia, Syria and Iraq -- such practices have now been codified as "tech delegations" -- and no one is hiding the fact that Washington expects to profit from Silicon Valley's Internet brands and services. Likewise, the very same CEOs and other technology industry insiders are invited to private dinners with the Secretary of State.

Despite all the transparency rhetoric of the Obama administration, we don't have much detail about the kind of academic studies that the U.S. State Department is funding at the Ivy League and elsewhere -- but I hope the folks at the Berkman Center can fill us in here at least on their share of the pie (see, for example, this post by Ethan Zuckerman, where he acknowledges that the State Department funds some of his Berkman work).

The Berkman Center, of course, was receiving State Department money during the Bush era as well, so nothing new here (full disclosure: I sit on the board of OSI's Information Program, which also funds Berkman). To make the connection even more explicit, David Weinberger, a senior researcher/fellow at the Berkman Center, is now also a Franklin fellow at the State Department.

Most disturbingly, more and more leading practitioners of "21st century statecraft" at the State Department are jumping ship and leaving to work for the very CEOs they have just been escorting around the globe. See Katie Stanton's departure to work for Twitter and Jared Cohen's announced departure to work for Google -- the two career moves that, in my opinion, did not get the level of public attention that they truly deserve. (In all fairness, Stanton came to the government from Google -- but I think this only strengthens the overall argument about the mostly invisible revolving door between Silicon Valley and Washington).

And, of course, there is no shortage of acts and blurbs by American diplomats that take a completely uncritical attitude towards Silicon Valley. Jared Cohen once again is a case in point: from his decision to reach out to Twitter during the Iranian protests to his statements ("Facebook is one of the most organic tools for democracy promotion the world has ever seen" -- quoted in David Kirkpatrick's The Facebook Effect), much of what he does and says fits the pattern that seasoned observers of U.S. foreign policy would easily recognize.

Good or bad -- I'll save final judgment until my book is out -- this is a pattern that predates 21st century. A pertinent question to ask is this: Isn't the U.S. government showing too much admiration for these two high-profile tech companies with questionable ethics without subjecting them to the level of criticism they truly deserve? Never mind the privacy battles: Unlike Google, Microsoft, and Yahoo, both Facebook and Twitter have refused to join the Global Network Initiative -- just how uncool is that?

Maybe -- and I'm just thinking out loud here -- the State Department should not waste their chef's time on cooking meals to Twitter's executives until those do sign up to GNI? Because otherwise it does look like the U.S. government is happy to ignore those companies' human rights record -- as long as they are instrumental to achieving the government's own policy objectives. That's very 21st century, indeed.

And for the muckrakers out there: why don't you go investigate how it is that Jared Cohen and Alec Ross each accumulated hundreds of thousands of followers on Twitter? Is it, in part, because they were on one of Twitter's "Suggested User Lists" before those got scrapped? My sources in the U.S. government tell me so, and I have no reason to doubt such claims, especially given that the ratio of retweets (Cohen, Ross) per number of followers and the ratio of lists (Cohen, Ross) they are on per number of followers look surprisingly low compared with similarly popular users who reached the same number of followers organically. No crime has been committed here -- but if Haliburton had a TV channel and David Addington got his own weekly TV show there while in office, this would have seemed somewhat, well, weird.*

Now, I am not writing this to join the Noam Chomsky branch of critics who see structural problems of U.S. foreign policy everywhere they look. I've got a different argument to make: the problems that plagued the U.S. foreign policy in previous decades would not only be perpetuated, they would actually be aggravated in cyberspace. Why so? Because few people treat the Internet as political and subject it to the level of scrutiny that any policy initiatives connected to, say, energy or nuclear weapons would deserve.

Somehow I feel that Heidegger's quip that "the essence of technology is by no means anything technological" is not particularly popular (or even well-known) in Washington (still, here is a guide to the perplexed; I can only hope that David Weinberger who once was a Heidegger scholar would take the time to spread some Heidegger love around town). This is too bad, because Heidegger was actually right for a change: given all the myths and misunderstandings surrounding modern technology, anyone dealing with it often misses its highly political nature.

I am pretty sure that if energy had been made into the key component of "21st century statecraft" and two of its leading proponents in the State Department left office to go work for Exxon and Halliburton, this would have triggered a minor outcry -- or at least a few moans -- from a) the energy blogosphere, and b) the foreign policy blogosphere.

However, I am yet to see such moans triggered by the departures of Stanton and Cohen. The technology blogosphere seems to have completely ignored the political dimension to all this -- which was easy to do given all of this summer's problems with iPhone's antennas.

Likewise, the foreign policy folks, busy as they are reading the latest Rolling Stone and half-convinced that technology is apolitical anyway, simply have no time or energy to subject the "Internet freedom industry" to the kind of scrutiny it deserves.

Worst of all, I fear that the people who are in a good position to make such criticisms on both fronts -- the folks at the Berkman Center, for example, often excel at both technology and international issues -- are too tied to the State Department to make as much noise as they should be making.

Once again, nothing new here. We have all seen that movie before. What I object to is sticking a "21st century" label on it. So far, this label has proved a major distraction, for it has made the deep-rooted problems of American foreign policy harder to identify and address.

Similarly, one reason to be suspicious of "Internet freedom" as a priority for U.S. foreign policy is that the end result of pursuing it may have an extremely corrosive effect on the rest of foreign policy making; Twitter won't make any of those pesky non-digital issues simply go away.

Nothing in what the U.S. State Department has done so far convinces me that they have much awareness -- let alone a roadmap (and those they usually have in abundance!) -- for dealing with the spillover effects that the promotion of either "Internet freedom" or "21st century statecraft" will have on the rest of foreign policy making.

The technologists, oblivious to the highly pernicious externalities of their own good intentions, can always claim the ignorance privilege: they are simply trying to make the world a better place! They don't know anything about foreign policy! Don't hold them accountable! Fine -- even though this is dubious ethics-wise. (Confused about how your actions will aggravate the problems of U.S. foreign policy? Go read a book.) But diplomats -- these guys are paid to think in terms of externalities... They can't simply afford to embark on some utopian agenda without first thinking how it might affect what it is that they do all day.

The reality is that the Internet is driven by dynamics that are far more explosive and unpredictable than even oil. Plenty of people around the world may hate Exxon for the kind of U.S. foreign policy that its business needs may demand -- but no one exactly accuses Exxon of allowing its oil wells or gas stations to be used as secret meeting venues for the new breed of revolutionaries. No one thinks "anti-government materials" or "censorship circumvention" when they hear "petrol."

This is definitely not the case with Facebook, Twitter, and Google -- which many governments do perceive to be political by the sheer virtue of providing a service that can be used to organize, mobilize, and distribute information. If technology gurus believe their own theories that we are now living in the Information Age, there is absolutely no escaping the fact that information also becomes the most politicized of global commodities.

Building a foreign policy around information may all be fine and even inevitable -- but one should start by fully acknowledging its political dimension. (I won't go into politics of information here -- but you may want to check my earlier blog post about the motivation behind Iran's search engine).

Once you peel away the rhetoric of "21st century statecraft" and "Internet freedom," this becomes all too obvious; the problem is that such rhetoric is extremely hard to peel away -- if only because "freedom of expression" generates far more positive emotions than say, "energy efficiency." And who would be silly enough to argue against "freedom of expression"?

What we are left with, as a result, is a counterproductive debate about censorship (and that debate itself has been taken over by lobbyists touting their own censorship-circumvention tools) rather than a much more important and far-reaching global debate about the future of foreign policy in the digital era.

* Since such accusations are inevitable, let me address them head-on: no, I'm not trying to establish moral equivalence between Haliburton and Twitter. That said, I do think that we are careening towards a world where such equivalence would be easy to establish. Exxon simply wants to make money on oil -- and people happen to die in wars as a result; Facebook simply wants to make money on exploiting user data -- and dissidents simply get outed as a result. See? It wasn't so hard. In part, because the government wasn't watching...

p.s. FP's anti-spam system seems to catch all links posted in the comments. The two links provided by John Palfrey to Berkman's funding and their State Dept's project are here and here.

Hay-what?

Thu, 02 Sep 2010 04:50:42 +0000

If the world of non-profit technology had its own stock exchange, I'd recommend buying lots of stock in Haystack, a censorship-circumvention software put together by California-based Censorship Research Center in order to help Iranians evade their government's control of the Internet.

Haystack's story makes for great Hollywood material: Bay Area technologists who serendipitiously discover that there is a bloody and violent world beyond Silicon Valley -- the one where people rebel, fight, and die for real and not just as part of some new Facebook game -- decide to dedicate themselves to the fight against authoritarian evil with the help of -- you guessed it! -- the Internet. They are the ones putting "Twitter" into the "Twitter Revolution"! And you too can abet their fight: they've got a whole two Donate buttons on their website!

Not surprisingly, Haystack has been all over the media in the last few months -- most recently in Newsweek -- with its founder Austin Heap getting quite a bit of attention from journalists and policymakers alike. This is, for example, what the ever-modest Heap told Newsweek: "Tomorrow I meet with [Sens. John] McCain, [Bob] Casey, maybe [Carl] Levin, but I don’t know if I will have enough time." (Apparently, the senators have become much more tech-savvy since I left town; perhaps, this comes with age.) And it's not just American media: The Guardian pronounced Heap to be "The Innovator of the Year" -- though personally I would have gone with "The Publicist of the Year," just check this photo -- but then who am I to judge? (Moi -- I am only invited to opine on the Snark of the Year Awards.)

I like Hollywood as much as the next guy -- and yet something just doesn't feel right about Haystack. What really bothers me is that one cannot download and examine their software; as far as the Internet is concerned, Haystack doesn't exist. In fact, Heap says that it is only distributed to trusted contacts inside Iran; putting it online would create a situation where the government could easily get hold of it as well and then reverse-engineer it or ban it or find a way to track its users.

[[BREAK]]

So, in essence, the outside public -- including Iranians -- are asked to believe that a) Haystack software exists, b) Haystack software works, c) Haystack software rocks, and d) the Iranian government doesn't yet have a copy of it, nor do they know that Haystack rocks & works. (And who could fault them for not reading Newsweek? I certainly can't). For someone with my Eastern European sensibilities, that's a lot of stuff to believe in. Even Santa -- we call him Ded Moroz -- appears more plausible in comparison.

While I don't dispute Heap's right to do whatever he wants with his software, it still strikes me as a very dangerous approach to empowering ordinary Iranians. First of all, the fact that no one can download and test it means that its flaws and vulnerabilities may remain unexposed for a far longer period of time than otherwise (I'm not trying to pull a Bruce Schneier but it may be useful to check this, for example). I'm not a cryptologist, but I've yet to meet one who thinks that Heap's approach is justified. On the contrary -- I'm in the anecdotal mode -- plenty of cryptologists on the mailing lists I am on seem to be extremely cautious/skeptical of what Haystack has (or, as is the case, doesn't have) to offer.

While I don't doubt Austin Heap's noble intentions, the world is not exactly running short on well-meaning Americans wrecking havoc on everything they touch. I propose that Haystack should first be tested on some friendly people with a nice government -- say Canadians. They seem like a good bunch who won't imprison their dissidents; Iran, on the other hand, seems like the worst possible testing ground for Heap's new method -- even if it works. So I say -- Go Canada! -- or stay home.

To me, it seems like a no-brainer: if you want to distribute technology that may endanger lives, make sure that the technology is secure. The only good way that I know of to make sure that it's secure is to let outsiders test it. All this stuff about cats and mice quoted in the Newsweek piece -- I am yet to see Patrick Meier quoted in the context of authoritarian states without invoking that zoo-inspired analogy -- does not exactly sound very convincing, especially given that I like to define mice as "animals eaten by cats".

Second -- and here I'm only speaking from my own Belarusian experience -- it's naive to believe that the human networks that Haystack supposedly relies on to distribute the software won't be penetrated and compromised by the Iranian authorities. What are they -- a bunch of losers? Well-funded and powerful NGOs -- I'm not pointing any fingers here -- have their Iranian offices penetrated and their staff arrested, and here we have some guy from the Bay Area who is building the most secure -- even infalliable -- network in Iran. Yeah right. Maybe he should go work for the DOD -- they need such people to deal with all those (wicked-) leaks.

So, helping you cut through the cynicism, the argument that the software needs to be hidden from authorities at all costs strikes me as untenable; the only assumption I'm prepared to tolerate in the context of authoritarian states is that no software will remain hidden. Moreover, if the government does manage to get hold of Haystack and it is, indeed, so easy to break into that it needs to be guarded, then lives of Haystack users are at risk as well.

So my question to all those journalists penning admiring articles about Haystack: have you guys actually seen the software? Have you tested how it works? Are you sure that those who use it are not automatically getting a free holiday in Evin prison? Or have you all been sweet-talked into covering a fancy piece of code that -- drumroll here -- "undermines authoritarianism" -- without ever bothering to think of its downsides? This may seem like unnecessary moralizing, but it's hard to react otherwise when lives are at stake.

Now, there is no shortage of dumb and incompetent journalists writing about technology, and most politicians have no clue about encryption or censorship-circumvention technologies; expecting John McCain to show nuance and sophistication in discussing Haystack -- let alone Iran -- well, let's just say it's not going to happen.

But elected politicians and the media are one thing; bureaucrats are another. The latter are being paid to be experts rather than talking heads who think in tweets or sound bites. And so far, the bureaucrats have failed badly. In particular, what bothers me the most is the way in which the current process by which the U.S. government regulates the export of technologies like Haystack to Iran ends up confering indirect legitimacy to the software.

To recoup: American entities cannot export most censorship-circumvention technology to Iran without first obtaining a license from the government. Earlier this year Haystack was granted such a license -- something that was widely publicized by Haystack and something that even Hillary Clinton mentioned in one of her interviews (curiously, a monthly before Haystack announced it). Score one for Internet freedom.

Now, I'd very much like to imagine that Treasury officials who granted Haystack the license also happen to be uber-genius whitehat hackers who subjected the software to all sorts of security tests before making up their minds -- and yet, somehow I can't really believe that. Can you? And what kind of world do we live in if we expect technology expertise to be concentrated in the U.S. Treasury Department? Last time I checked they still didn't know why all those flash trades went berserk a few months ago...

Given how much noise Haystack has made in the media -- see this column by Roger Cohen as an example -- it's quite likely that the granting of any such license is a process marred by political pressure, especially from the hawkish part of the Washington establishment who would really like to use the Internet as a powerful weapon to be used against the Iranian regime.

Nothing new here -- except the fact that having such a license makes Haystack look like a tool that has been properly vetted by the U.S. government. My fear is that it hasn't been properly vetted at all -- not on its security merits anyway -- but I doubt that either journalists, who are all too quick to pen another admiring piece about Haystack, or politicians, who finally found a way -- they think! -- to put Ahmadinejad in the corner, get this big picture. The end result is that Haystack gets a very good platform to work in Iran, regardless of how insecure their technology might be. And who gets to pay for all these? Bingo: the Iranians.

I am even sure there are plenty of conservative -- and maybe even some liberal -- foundations who would be happy to fund Haystack's work right now without ever asking to test-drive the software. Good job, guys: it's like funding an automobile where the independent third-party mechanics are not allowed to inspect the brakes. Even the U.S. Treasury folks, patriotic as they are, won't ever drive this vehicle.

Now, I don't have anything against Austin Heap; for all I care, he may be just another nice guy -- apparently, there are many of them in the Bay Area -- who, in between shooting the dragons in his favorite game, just wants to help Iranians. He's not the first; he's not the last. God bless him. There will always be plenty of entrepreneurs eager to build a business of some kind -- whether it pays in reputation or big bucks is another matter -- around the needs and demands of U.S. foreign policy. I don't think even my powerful blog can ever end this practice, so I'm okay with the fact that Haystack will be around as long as Blackwater is around (or XE or whatever other new name they want to stick upon themselves today).

What I really want to know is this: who in the U.S. government was so smart as to grant Haystack this license? Can we actually see the name of that person somewhere on Treasury's website? Let me break the news: we can't -- there is nothing about Haystack on the site. Another victory for transparency in the Obama administration! But this is something that I do want to know -- for this person (along with a bunch of irresponsible journalists -- luckily those still have bylines) should and would be held responsible if some of Haystack's users are arrested by the Iranian police.

Once again: I've got nothing against Haystack or Austin Heap per se. What irks me is the way in which the limitations of the current discourse on Internet freedom -- and the bizarre, completely non-transparent policies it conceals -- end up conferring unneeded legitimacy to Haystack's flawed (for my taste, anyway) approach to fighting censorship. Some things, perhaps, are better left unfought -- especially if the fight makes everyone but the fighters considerably worse off.

p.s. The Newsweek piece also contains this gem of a quote from Austin Heap, which captures what's wrong with Haystack better than I ever could hope for:

“I hope we are ready to take on the next country... We will systematically take on each repressive country that censors its people. We have a list. Don’t piss off hackers who will have their way with you. A mischievous kid will show you how the Internet works."

How do I say "no, thanks"?

Iran to search for WMDs on its own, thank you

Tue, 31 Aug 2010 04:45:46 +0000

Not long ago I already announced my return to the world of bytes, tweets, and pokes -- only to disappear for another three months. But this time I feel like it's for real: I am back! Spending nearly three months in a Belarusian forest, offline and surrounded by, well, "legacy media" of all sorts, has been a very exhilarating experience. Of course, it was also the worst possible summer to spend in a Belarusian forest -- what's with all those fires? -- but I withstood all the pressure (and no, I didn't meet any partisans).

This summer was full of technology & geopolitical news -- BlackBerry, WikiLeaks, North Korean tweets -- but I wasn't exactly shocked by any of the developments. The recent announcement that Iran is working on their own national search engine did not exactly shock either but it gives your humble blogger a good excuse to reflect on the growing politicization of the Internet in general and of search space in particular.

I've tracked the idea of national search engines for some time -- see my coverage of Russia's plans to do the same here and of Turkey's plans here; this summer we also heard some noises from China on that front.

Now, in the case of Iran, we know very little about this new search enterprise; some fear that it might create some kind of an intranet in Iran -- but that's about it. Let's assume it would be very expensive and very ineffective -- not unreasonable assumptions to make in the context of a sluggish state like Iran, which has a few other things to take care of before exploring the world of Web2.0 in all its glory. (For the record, I can't wait for Tehran to host a delegation from Silicon Valley).

[[BREAK]]

Still, I don't think that the high cost or the poor effectiveness present insurmountable obstacles to the project. The calculator may also seem somewhat inferior to Microsoft Excel -- but if the latter is unavailable, prohibitively expensive, or too risky to use, even the calculator would do just fine.

I find the idea that ordinary Iranians would all flock to proxy-servers and censorship-circumvention tools to access Google and Bing -- in case those do get banned -- extremely ridiculous. First, it's not like there are enough functioning proxies to make that happen. Second, it's not like they are easy and quick to use for the ordinary folk. Third, my bet is that Google hasn't exactly spent much time fine-tuning its Farsi-language services to better serve the Iranian market; a well-funded company would find it much easier to beat Google in Iran than, say, in Portugal. And, well, if the Iranians could really make this service work faster than the rest -- and why wouldn't they given that the Basijis already own the telecommunications company? -- they may gain unfair advantages even over local competitors. The point being that I wouldn't write off such efforts just because they are state-led.

Now, there are a few other aspects to consider here. The recent public debates about the politics of the Internet in China, Iran and Russia have convinced me that Google, having joined the U.S. government in its quixotic quest to promote "Internet freedom", is in an extremely unenviable situation. Whatever Washington does in the digital space these days would almost necessarily reflect on Google -- even if they have no direct involvement in the issue. The more moves the State Department makes in cyberspace, the more difficult it would get for the likes of Facebook, Google, and Twitter to claim that they are simply apolitical operators who are out there promoting the common good of our civilization, making the world transparent, and whatever other outlandish claims they like to make. Their own moves, in turn, would be interpreted in light of the demands of America's own foreign policy. Such are, perhaps, the costs of doing business a la "21st century statecraft".

From this perspective, everything Google has been doing in this space for the last 12 months -- all those boring conferences and presentations in D.C., where Google's executives joined the likes of Freedom House and the National Endowment of Democracy -- did not really help to burnish their credentials as independent and apolitical intermediaries. It's as if Halliburton decided to fund a Dick Cheney chair at some Texas university at a time when everyone in the media was buzzing about the latter's Energy Task Force.

For better or worse, Google chose to join with the U.S. government in politicizing the digital space -- and it's only logical that foreign governments are beginning to see Google's dominance in their search markets as a political -- rather than pure business -- matter. As such, I expect many more plans similar to Iran's to pop up elsewhere. When Washington is leading a crusade for "Internet freedom" and Google is cast as one of its leading warriors, what sane government would be happy with a situation where everything its citizens search for can be data-mined by Google? Especially when the latter is so happy to tout its collaboration with the National Security Agency. Seriously, Google's publicity people sometimes just blow me away: if there was one relationship with the U.S. government they should have kept secret, it was that one. (Somehow, I find it hard to believe that it was NSA who leaked it to the media).

So, here is what we've got. In 2009 it became obvious -- for American diplomats anyway -- that Washington was in a unique position to exploit the fact that so many Silicon Valley companies were uncontested leaders in so many markets and that so much civic and political activism was emerging in those digital spaces. In 2010 American diplomats squandered such opportunities by unnecessarily politicizing this space, alerting their very opponents of the political uses to which the Internet can be put (e.g. making contact with Twitter during the protests in Iran -- which I take to be the worst possible intervention into digital matters by the U.S. government ever). In 2011, we'll be seeing all sorts of pushback against the very Silicon Valley companies that were previously thought to be largely unpolitical market leaders. Everyone was fine with Google being the most popular search engine in their country until Washington began acting as if Google's market leadership may also be politically expedient (which, of course, it's not -- but claiming otherwise makes for great newspaper copy).

Hence all the recent fuss over "information sovereignty"; whatever the actual circumstances, cyberspace is perceived to be strategically important as long as Washington treats it as such. Of course, as far as Washington is concerned, this entire "21st century statecraft" business may be just a rhetorical trick -- but the problem is that from the perspective of foreign governments, especially if they are hostile to America, such tricks would almost always demand strict countermeasures. And those countermeasures would inevitably backfire on those who have signed up to use such services. None of this looks very pleasant, does it?

Does Silicon Valley's new favorite Russian moonlight as Kremlin's censorship czar?

Tue, 25 May 2010 11:51:34 +0000

So while the naive folks in Silicon Valley are singing praise to Digital Sky Technologies (DST), Russia's new investing behemoth with ambitions of world domination, I bet they have no clue that Kremlin has recently tasked Yuri Milner, DST's CEO and founding partner, with finding a way to police RuNet and cleanse it of all illegal content.

It's not yet clear what shape this would take but official sources inside DST say that Milner would work on consolidating the views of Russian Internet Service Provicers into a common position on how to deal with illegal content (see here for a detailed report in Russian).

The most interesting bit in all of this is that Milner - who is also an investor in two of Russia's most popular social networks, which are, ironically, leading distributors of "illegal content" in Russia, however you define it - has apparently volunteered for the position. Maybe, we should just adopt the Russian approach to content regulation on a global scale and also have Facebook's founder come up with his own laws for how to regulate his company (and wait, Milner is an investor in Facebook, too - maybe he can help there).

But jokes aside, I actually believe that Milner will be extremely effective in his job - much more effective than the lazy Russian bureaucrats. He may simply need a good excuse to purge his sites of weird, political, and harmful content - and what can be better than given carte blanche by the regime?

That the Kremlin has a history of recruiting smart Internet talent for their own political agenda is not exactly a secret. What bothers me is that no one in Silicon Valley has the guts to start asking questions about Milner's role in what would inevitably become a great purging of the Russian Internet. Milner, of course, knows his way around the Internet universe: just this week, he charmed the tech gurus - and even Charlie Rose - with his grand pronouncements that "Facebook Is Going To Be The Social Graph That Unifies All Civilization" (that is, right before it destroys it through some nasty privacy flaw).

But Milner's high-minded talk is a poor excuse for not challenging the man about his cosy relationships with Kremlin; that a man who - even if somewhat indirectly - controls two of Russia's most popular social networks and has a stake in Facebook, is trusted enough by the Kremlin to help in their censorship efforts (Milner also sits on one of the presidential commissions) should be a cause for concern, not celebration.

But overall I'm kind of glad that Milner is giving Silicon Valley a rope to hang themselves. Privacy-wise, the only thing worse than Facebook is a Facebook owned by a Russian investor with strong ties to the Kremlin.

How to become an Internet freedom warrior*

Thu, 13 May 2010 03:19:09 +0000

Get seriously worried about the Internets. Surround yourself with social media gurus who don't know anything about foreign policy but have a gazillion Twitter followers. Try convincing the world that U.S. technology companies are your new ambassadors, out on a noble mission to spread freedom and democracy around the globe (things not to mention: oil, Iraq, Dick Cheney). Send their CEOs to Siberia, have them play beerpong with the locals. Don't dare mentioning how these very companies abuse freedom and privacy at home, on their own sites. Develop some ambitiously empty buzzword that could make your ridiculous theories sound somewhat convincing (try "21st century statecraft").

Disregard all but the most naïve and dubious assumptions in framing your "Internets problem." Grope for the nearest historical analogy -- the more inappropriate, the better -- and then misread it in a way that would confirm your original thesis. Assume the world hasn't changed since 1989. Remember that "Berlin wall" and "firewall" rhyme; use it to your advantage. Stock up on misleading metaphors that build on "cyber-" and "digital." Commision a few ambitious studies and major conferences to find more non-existing links. Run a grant competition.

Rediscover the toxic ideas behind the Congress for Cultural Freedom and repackage them under the fancier label of Alliance of Youth Movements. Find a bunch of desperate and cash-strapped bloggers from a harsh authoritarian country of your liking -- you'll score bonus points if these hand-picked bloggers-cum-dissidents are completely unknown to anyone who lives there -- and use them as token symbols of your heroic fight to defend the Internets.

Arrange for POTUS to be interviewed by them. If they visit the United States, make sure they meet with a bunch of fringe neocons, keen on promoting regime change in the home countries of your token cyber-dissidents. Think of ways in which to secure a political asylum for them – for they'll probably need one after meeting all these luminaries. Remember to invoke Sakharov when introducing them to the press: as in "Sakharov 2.0." The more "2.0 juice" you spread, the better: hence “samizdat 2.0”, "glasnost 2.0," and "Solidarnosc 2.0" (basically, any Slavic-sounding words with a 2.0 ending would strengthen your case – use them excessively - but watch the pronounciation!)

Meet a group of weird Chinese engineers who are equally confused about the "Internets problem" but are convinced that they can solve it through more engineering. Don't question the viability of such approaches: engineers know better. Ensure their solution solves the wrong problems, lacks transparency, and will convince everyone in Tehran and Beijing that they need to double their incarceration rates for bloggers. Verify that the engineers are as excited about 1989 as you are, albeit for different reasons. Make sure they have some bizarre political or religious affiliation that would make your partnership look extremely odd and geopolitically suicidal. Toy with the idea of giving them funding but decide otherwise, pissing off everyone and their uncle in DC.

Go visit the usual think-tanks in search of aging conservatives who feel nostalgic for the last years of the Reagan administration. Begin by telling them how much you appreciate their (otherwise non-existent) role in ending the Soviet Union by smuggling a bunch of Xerox machines. Practice your rudimentary Polish and Hungarian. Hold their hands and salute Reagan's bust on their table. Proceed to enlighten them about blogs, tweets, and social networks. Watch their faces light up when they grasp the full implications of what you are saying. Surprise them by announcing that Cold War is now officialy back in town.

Remind them to go back to their private libraries and dig up that passionate but unpublishable op-ed they wrote in 1987, the one about tearing down the walls and all that. Have them add "cyber-" to every "wall" in that op-ed and advise them to resumbit it to The Wall Street Journal's editorial page. Act surprised on discovering that the last two paragraphs of their op-ed accuse you of not doing enough to support the revolutionary tweets coming out of Tehran.

Lose control of the nascent but increasingly dangerous debate about your favorite Internets. Convince everyone that you used the Internet to organize the post-election protests in Iran; if it fails, get in touch with Twitter executives and leak your communication with them to the New York Times. Continue telling everyone it was Twitter that caused the protests.

Make no effort to educate the public -- and especially editorial boards and policy-makers -- about the utter idiocy, inappropriateness and outright danger of operating on extremely simplistic assumptions about Internet Freedom. Instead, aggressively embrace those assumptions yourself and turn up the volume on your favorite Cold War songs. Dream up some fancy terms like "information curtain." Let everyone figure out what all that stuff actually means.

Distract everyone by dropping periodic references to the success of technology in rebuilding Haiti and monitoring (sham) elections in Sudan. Benefit from the ensuing confusion -- it buys time. Continue meeting with the weird engineers. Don't debunk any overblown and essentially unverifiable claims about the success of their technology in fostering a "Twitter Revolution” in Iran. Then tell everyone how much you care about Internet Freedom. Wait until your refusal to support the engineers looks extremely hypocritical and doesn't match your own overblown rhetoric. Write a check for $ 1.5 million. Start over.

* Inspired by Lorrie Moore's short story "How To Become a Writer" and the recent announcement that the State Department is about to give $1.5 million to Global Internet Freedom Consortium

I'm back but the Internet still sucks

Thu, 29 Apr 2010 15:31:05 +0000

Nothing can be more enjoyable than a vacation from blogging: my experience was just great! But now that the book is nearly done, I am beginning to slowly rediscover the Interwebs. I am not sure how much I’ll last, as the prospect of spending the summer completely away from all the digital noise –offline and in the woods– is too hard to resist (fear not: I’ll be writing and distributing my blog posts through pigeon mail!). Or, since I already have a position on everything, I can just pre-write them in advance.

Anyhow, good news is that nothing important has happened in my absence. The Internet is still (mostly) evil. Google is still viewed as a sum total of all human goodness on Earth (The New Republic even compared it to Sakharov the other day but here I am comparing them to Hitler for hiding that article under a paywall); “Internet freedom’ is still a buzzword that few people understand – and those who do are not the kind of guys you’d like to send to promote peace in the Middle East; and yes, we are at cyberwar (I’m writing this from a bunker). Below are my mega-vitriolic thoughts on some major developments in all three departments:

Google’s new “censorship transparency” initiative: meh. Given that Google owns different platforms in different countries, making lists of countries with the largest number of requests makes as much sense as saying how many gigabytes of search data (WTF you may ask - me too) are blocked by the Chinese. I have absolutely no clue what it actually means that Brazil leads the world in Google’s tables of “evilness”. After all, Google owns Orkut, a social network, and Orkut is extremely popular in Brazil. Social networks face completely different content regulation challenges than search engines. Comparing Brazil to Ireland is not going to make much sense, why even bother? Just because it makes for a nice map mash-up? Or because it further dilutes the public debate and presents Google as the Sakharov 2.0, waging a global struggle for everyone’s rights?

Last time I checked, though, Sakharov was not selling AdWords during his quest for democracy. After all, tables that lack meaning still make for good PR. Don’t get me wrong: I’m all for transparency but – here I speak the unspeakable, so you may want to stop reading right here - I also see nothing wrong with certain governments demanding Google to remove certain pieces of content . For you know what? In many cases, such demands are driven by rule of law rather than some vile censorship agenda: lumping all of them in one pile is as irresponsible as it gets, which, curiously, Google almost points out in its own FAQ. Now, if only the same people who write Google's FAQs also wrote their press-releases.

“Internet freedom” debate: it’s going south. In just three months, the well-meaning folks over at the State Department have lost all control over their own ill-thought buzzword. Conceptually, it’s no longer just a fancy way to describe defense of “freedom of expression” on the Internet; for all intents and purposes, it’s now seen just as another, cooler, gadget-friendly way to promote “regime change”. That’s how most hawkish conservatives see it – the recent George Bush conference on cyber-dissidents is just another proof – and that’s how the rest of the world would see it, too. I am still puzzled that people at the State Department were so naïve as to think that “Internet freedom” would not be appropriated by the neocons as a useful banner to disguise their regime change agenda.

Even worse, all of this seems to clash with the rest of the Obama agenda on democracy promotion, which is as cool, remote and rational as you can imagine. Well, it was all Hillary’s fault: invoking the “information curtain” metaphor in her seminal speech on “Internet freedom” was a sure way to frame this discussion as some kind of a Cold War 2.0. And boy don't we know what happens in a cold war: everyone wants to start smuggling faxes and Xerox machines, training dissidents in civic disobedience, and using silly metaphors that don't add up but make us all feel extremely smug and important. Predictably, defending the open and single Internet – the original objective behind Hillary’s speech - is not a priority anymore - at least as far as the public is concerned; why bother, if we can just liberate them all with tweets (but if only we avoid our own PowerPoints!). “Internet freedom” must have been the worst possible Internet-related buzzword to throw at the hungry conservatives.

~~CYBERBORE~~ CYBERWAR: yes, in case you haven’t noticed, we are losing the CYBERWAR (all caps, no less) – and, unfortunately, we are losing it to a bunch of cybersecurity contractors (especially those that were smart enough to put former government execs on their payrolls). If, unlike me, you have been anywhere near the Internet in the past few months, you must have heard the news: Mike McConnell – who thinks we are at cyberwar which we are already losing – wants to re-engineer the Internets (all those tubes will need to be relocated, after all), while Leon Panetta apparently didn’t get the memo announcing that “electronic Pearl Harbor” was no longer a very fashionable metaphor. I’ve got a proposal, too: if we are already at cyberwar – and this must be a war with the highest number of cat videos watched during combat – I propose to declare all Twitter activity – and especially if involved iPads – to be unpatriotic. Or here’s an even brighter idea: Let’s just nuke the entire Bay Area! That way, the evil Chinese hackers will have nothing to attack: bingo, we won the war.

Given all the fuss, the only person with sensible views on the issue has been Obama’s newly appointed cyber-czar Howard Schmidt, who, as unpatriotic as he is, thinks that the cyberwar does not exist. It’s only because of Schmidt’s sobriety that I retain a glimmer of hope that cybercontractors won’t win the cyberwar. The most overlooked aspect of this “struggled” is that we can’t fight the cyberwar and be promoting Internet freedom at the same time. Re-engineering the Internet, by default, presumes "re-engineering it away" from being “open and single” – and that’s what Clinton kind of wanted to preserve before their magic Internet juice was claimed by conservatives to be used in their own Twitter Agenda. Good luck. My money is on DoD and the contractors: they always win and they’ll win this time. Get used to it: all your Internet freedoms will belong to Booz Allen Hamilton.

Kyrgyzstan's "Analog Revolution"

Thu, 08 Apr 2010 14:30:31 +0000

I'm still on self-imposed vacation from blogging in order to finish my book manuscript, so my comments on Kyrgyzstan will have to be very brief. Food for thought:

First, for obvious geopolitical reasons, pundits are paying much less attention to protests in Kyrgyzstan than they did to protests in Iran and Burma (or even Thailand). If there were no U.S. military bases in Kyrgyzstan, I doubt that this story would ever have made the front page of the New York Times. But social media couldn care less about geopolitics and military bases. Predictably, we see no significant buzz on Twitter; unlike Justin Bieber, the Kyrgyz revolution is not "trending" as a popular topic there.

Unsurprisingly, we don't see much eulogizing about the Internet's "revolutionary power" in the Western media either. But this does not mean we have suddenly become more reflective or less cyber-utopian; it only means that "Kyrgyzstan" is much harder to pronounce than Iran and most people couldn't care less about it; there is no critical tweetering mass that could fuel the kind of collective fantasy that was fueled by "#iranelection" on Twitter. Consequently, there is no pressure on the Western media to dream up non-existent (Twitter-powered!) angles to news stories: getting their viewers/listeners/readers up to speed on what/where Kyrgyzstan is would eat up the whole story anyway. In short: why is there no Twitter revolution in Kyrgyzstan? Becuase there is no one to hype it up.

Second, those who are in the know about Central Asia and could push this story much harder to the fore of public attention are also predictably cautious: Kyrgyzstan's earlier revolution -- the Tulip one -- was not exactly a paragon of democratization. So whatever role social media is playing in today's revolution is poised to be accompanied by much more cautious and much less celebratory rhetoric, for no one could really be sure that the vector of change we are observing in Kyrgyzstan is "towards democracy" (that said, I do think that it's hard to outperform Bakiev's regime when it comes to incompetence and lack of respect for human rights).

Iran, too, wasn't really such an obvious case -- after all, Moussavi, a former Iranian prime minister with quite a few dark spots on his resume, made for a very poor "martyr for democracy" -- but at least Ahmadinejad's evil was fully transparent and was thus very easy to hate (go ask anyone in any small American town what they think about Ahmadinejad and Iran; then try the same trick by asking them about Bakiev/Kyrgyzstan).

Third, based on what I've seen on Twitter -- and I must say I haven't been looking very hard and it's not a scientific sample -- there are quite a few people in the country who are tweeting about what's going on, in Russian/Kyrgyz/English but no one is using Twitter to organize anything (given that the entire revolution was kind of disorganized and spontaneous, it's hard to make an argument that someone organized anything over Twitter).

Besides, all the tweeting/facebooking/blogging that came out of Kyrgyzstan was possible because the previous government was caught by surprise and did not have enough time to cut off all communications. The whole revolution, apparently, appears to be little else but an afterthought: even the opposition was not expecting it to succeed. Obviously, what matters in most revolutionary circumstances is how fast one can disconnect all communications, and, well, the Kyrgyz government has obviously not given much thought to the issue.

Expect that "turn-it-all-off-with-one-click" systems would get really popular with authoritarian rulers (hey, this could be the new "red button"!). At the same time, we'll probably continue seeing the Kyrgyz opposition -- which now technically is no longer in opposition -- rely on Twitter to push their messages to Central Asia watchers/media folks in the West. That's, of course, perfectly rational and I would even say smart. But it's not the kind of spontaneous grassroots-based organizing the pundits were extolling during the events in Iran.

Finally, some pundits have observed that the availability of footage/tweets from Kyrgyzstan would certainly make other dictators rethink their own vulnerability and heed the right lessons. I agree. This is a variation on the "demonstration effect" argument, which, because of the pervasive liberal bias, we usually believe to work only in one direction (example: "Oh, now that the Uzbek activists have seen what's possible in Kyrgyzstan, they too would rise up"; this, of course, can be countered with a completely opposite point: "Oh, now that the Uzbek/Turkmen/Kazakh dictators have seen what's possible in Kyrgyzstan, they too would take preemptive measures"). By this logic, the folks who really learned the most from the Orange Revolution in 2004 were not the anti-government activists in Minsk, but Kremlin operatives in Moscow.

Bottom line: new media played no visible role in organizing the protesters and some role in broadcasting what was happening to the rest of the world (it's not clear though whether this broadcasting had any real impact on the police's ability to control the unruly protesters). That's a preliminary judgement: I have no clue how well the Kyrgyz opposition was organized in reality; based on media reports, it seems like they were not.

Obviously, I've also omitted any discussion about the regional dimensions to this revolution, for the example, the split between Kyrgyzstan's North and South and how both regions were communicating with the capital, and how what happened in each reinforced/undermined developments elsewhere. I'm well aware of that. But this would get us into a much-longer historical conversation about the role of communications (I'd venture that even faxes/telegraphs would do this kind of job -- no need for Internet media or anything of the kind).

For all the hype about "digital revolutions", "analog revolutions" are still the norm, not the exception.

Is Russia Google's next weak spot?

Fri, 26 Mar 2010 08:45:05 +0000

Big news from Russia today: RBK Daily, a respected Russian news agency, reports (in Russian) that the Russian government might soon be launching a "national search engine". According to RBK's anonymous sources inside Kremlin, it would aim at satisfying "state-oriented" needs such as "facilitating access to safe information" and "filtering web-sites that feature banned content." It's going to be an ambitious project: the government is prepared to invest $100 million in this new venture, does not want to allow any foreign funding, and intends to build it in cooperation with the private sector.

RBK mentions several interesting players that have either been already consulted or would be asked to join soon : Rostelecom (Russia's state-owned telecommunications giant), ABBYY (one of the leading software firms specializing in document recognition and translation - the company was actually founded in Russia in 1989!), and "Ashmanov and Partners" (an Internet consulting firm led by Igor Ashmanov, a pioneer of the Russian Internet and a former senior executive at Rambler, one of Russia's first search engines).

The idea to "nationalize Internet search" comes from Vladislav Surkov, the deputy head of the presidential administration and the mastermind of a recent plan to modernize the country by building Russia's own Silicon Valley (that project is also advancing very rapidly: Viktor Vekselberg, one of Russia's richest people and Kremlin-friendly oligarch, has been appointed to lead the initiative, while ~~Esther Dyson -- a famed American technology investor - has been named as one of the main candidates to join him as a co-chair~~ UPDATE: Esther Dyson says that these speculations are not true). The government has warmed up to Surkov's Internet plans -- perhaps, after hearing the recent news from China -- and Victor Shegolev, Russia's Minister of Communications has been appointed to curate it.

To understand why Kremlin might be embarking on such a supposedly doomed project, one has to look at the structure of the Russian market for Internet search. As in China, it's a domestic company that controls it: according to just released estimates from LiveInternet, Yandex holds 62.8 percent of the market, with Google holding just 21.9 percent of the Russian market (two other search engines -- Mail.ru and Rambler -- have 8.4 percent and 3 percent respectively). But these figures conceal the fact that Google's share has been growing very rapidly: until 2006 Google has held only a tiny share of the Russian market (around 6 percent ) but it has significantly expanded since then (in 2009 Google's PR chief in Moscow even said that "Russia is a pivotal country for Google").

Now, Kremlin clearly views Yandex as one of the most innovative Russian companies and keeps a very close eye on its operations. In 2009 Sberbank, a state-owned bank, even bought Yandex's "golden share", which gave the state veto power on the sale of more than 25 percent of Yandex's shares (in a recent interview with Kommersant, one of Russia's leading newspapers, Yandex's president explained such a close relationship with the Kremlin by the need to have "transparent rules" for attracting investment, arguing that Yandex "has become part of a national infrastructure" and such close ties with the state are inevitable). When in late 2009, Yandex shut down its list of most popular blog posts in the Russian blogosphere -- which had often been used by activists to push their causes to the national attention -- some read it as a sign of the state's growing control of its activities.

I believe that Kremlin has no interest in destroying Yandex -- it's one of the few Russian companies that are actually very innovative and well-known abroad and Kremlin has plenty of other means to influence where Yandex is going- so the real target of this "nationalization of search" must be Google. The big question is: How good of a Google competitor can the Kremlin really build, given that they have almost unlimited resources (both financial, technological and legal ones)?

We should not underestimate Kremlin's capacity to adapt to the digital realities: they have cultivated a sprawling community of Internet gurus who work or consult for the government (Konstantyn Rykov and Askar Tuganbayev are good examples) and they do have a lot of private sector expertise to draw on.

Earlier today Igor Ashmanov, one of the people that the Kremlin consulted about the "national search engine", gave an interview to the Echo of Moscow, a liberal Russian radio station, where he shared his views about the growing political role of Google and search engines in general and what a national search engine might accomplish in Russia. Ashmanov is one of the most influential people on the Russian Internet and the first and only person familiar with Kremlin's plans to go on the record so far. Even though he does not work for the government, I think his opinions are not that far from what Russian bureaucrats would make of Google's problems in China and its murky future in Russia. Below is my translation of some of his most illuminating quotes (italics mine):

On Google as an instrument of the US government and on its role in China: Google is just another way [for the US government] to tease China for not being a democracy and to get it to barge on certain economic issues. So if the Chinese don't want to weaken renmibi's exchange rate, we [the US government] would say that, from the perspective of a true religion of democracy -- of which the US is the capital - you are heretics and we'll be teasing you for human rights violations and the like until you weaken the rate...

Eric Schmidt, Google's CEO, frequently meets with Hillary Clinton, goes to special breakfasts [ at the state department]; the US authorities often say that Google is advancing the causes of democracy in China. How should the Chinese government view this? As an intervention in their affairs. That's exactly what they are doing...Google was founded in a university, it works with intelligence services - the US government would be silly not use it for America's own good.

On the idea of a national search engine: In principle, it's possible to create such a search engine, if you create a strong team, make them co-owners of the project and give them superb technology. It can be Rambler, it can be Aport (an obsolete Russian search engine); those can be revived. Second, the state should make sure there is a [business] environment where such sites can flourish.

A national search engine [may be subsidized so that it] does not need sell any ads in its first few years, which is quite attractive. It has to focus on getting a market share, not making money. Third, it can be installed in all state institutions, on all computers that are assembled in Russia, in all schools, prisons, military institutions, hospitals and so on. This can guarantee it a certain level of traffic; 10-15% is what they can get.

Then one can talk about the owners of Internet resources that are close or loyal to the government -- and we know that there are oligarchs that are socially responsible and close to the state -- and to install this search engine on their own resources. So finally this may lead to a national search engine. This won't help to topple Yandex, but it would help overtake Google, Rambler, and everyone else.

On what would happen if Google wins in Russia: [From a state perspective, if Google wins in Russia], it would be really bad. It would be bad -- and it doesn't matter that some would think that Russia is not a democracy and it does not like it. Even the democratic Europe doesn't like Google's domination...

No one likes it because, first, a search engine is a means of influencing public opinion, and second, it's a source of unique information about what people think and what kind of information they want. Whoever dominates the search market in the country knows what people are searching for; they know the stream of search queries. This is completely unique information, which one can't get anywhere else.

To be fair to Ashmanov, he also expressed some skepticism as to whether the government would be able to pull it off unless they really commit a lot of resources to this project (which, in his view, they aren't doing at the moment.) Nevertheless, his strategy of how such a national search engine might compete with Google seems very realistic to me: if the government does move to leverage the power of the Kremlin-friendly oligarchs -- who own most of the online property on the Russian Internet -- as well as to require all state institutions to make this new search engine their default start page and install it on all new computers sold in Russia -- they may, indeed, gain a significant share of the Russia market. If this is combined with some soft or hard pressure on Google -- think tax raids on their offices or some lengthy litigation of the kind that is now happening in Italy -- it's not unfeasible that a national search engine might steal a significant market share from Google.

This plan for a national search engine is not an isolated development. Earlier this year the government has been debating - without reaching any conclusion -- the plan to give a unique government-run email account to every Russian (supposedly in order to facilitate their access to e-governments services: a unique email account would help to authenticate that the right people are getting the right services).

It also needs to be seen within a global movement launched by many other governments to achieve "information sovereignty" (i.e. distance themselves from Google, which is perceived to be too close to the US government). In fact, I am struck by how much similarity there is between what's happening in Russia, Turkey, and even Iran. In December, I wrote about the Anaposta project launched by the Turkish government in order to do just what the Kremlin wants: build a national search engine and a national email system for every Turkish citizen. In early February, the Iranians announced their own plan for national email (mostly in order to bypass Gmail - which could be interpreted as them just wanting to score propaganda points following the news announcement that Google was talking to NSA).

The idea of national search engines is not new. Europeans have been toying with similar plans for a few years now but to no avail -- there was simply not enough political will in Europe to make that happen (who now talks about Quaero, a much-discussed European alternative to Google that never really took off the ground?). Russia, on the other hand, is a different case: the Kremlin wants to build this new engine for reasons that have nothing to do with national pride or the need to preserve national heritage. All Kremlin wants to do is to establish firmer control over the information flows in the country and given that they have quite a few unfair advantages -- both market-based and legal -- they may as well succeed.

Most interestingly, I am wondering if American diplomats and technology gurus are shooting themselves in the foot by lending their expertise to the likes of Surkov. Wouldn't that be ironic if the result of all those luxurious US State Department~~-funded~~ (UPDATE: according to Esther Dyson, the trip was not paid for by the government) junkets to Siberia would be more tax raids on Google's offices in Moscow?

p.s. As it turns out, Estonia already has a national email system, which proves that this is not impossible. For more details, please see this. The only difference: Estonians have access to any other email services, while Iranians may soon have no choice.

China's tech companies go global while no one is watching

Mon, 22 Mar 2010 07:03:55 +0000

While the whole world is watching what Google is going to do in China, Chinese Internet companies are quietly expanding their global operations. The latest company to do so is AliBaba.com, the country's biggest business-to-business website, which is rapidly increasing its presence in Brazil.

Recently it has partnered with Ludatrade, a Hong Kong company, and expects a growth rate of 30 to 50 percent (disclosure: Yahoo owns 40 percent of Alibaba and my current Georgetown fellowship is endowed by them). Apparently, Alibaba already has 156,000 users in the country.

Earlier this year, we saw another interesting development: In January 2010, Shanda Games, China's largest operator of online games, paid $60 million in cash and $20 million in equity for MochiMedia, a San Francisco-based Flash game advertising network and payments platform.

A question posed on TechCrunch, a technology blog, in relation to that acquisition and the future of relationship between China and Silicon Valley in light of Google's debacle was a good one:

Chinese Web companies are building huge cash hoards and valuable stock currencies and it’s still a comparatively young Web market. Increasingly, these companies could be likely buyers of US startups—not the other way around. Will the Valley’s rhetoric stick then?

By "Valley's rhetoric," they probably meant putting freedom and human rights ahead of business interests.

But that's not at all: check this 2009 map (pdf) that visualizes China's tech expansion (the map comes from Mobinode, a group blog about Asian tech industry). It clearly shows China's investments into India, Malaysia, Vietnam, Russia, Korea, Thailand, Philippines, Brazil, Japan to name just a few (many of them are in the gaming industry). According to this recent article in (the government-owned) China Daily, even Chinese online encyclopedias are now expanding abroad, mostly to target Chinese living abroad (primarily in the U.S.).

Well, let me add a conjecture of my own: if Chinese companies are not allowed to buy oil and transportation firms here in the U.S., they will soon start buying Internet firms. Now, that's a neat way to undermine "Internet freedom" from within. It's only a matter of time before the U.S. Congress starts ringing alarm bells about the Chinese Internet takeover.

To read more about how China's Internet and software companies are trying to expand globally, take a look at this article from Seeking Alpha, this post from MobiNode and SiliconHutong blog. This Jan 2010 piece from Reuters offers some more excellent analysis on the problems faced by Chinese companies seeking global expansion.

More tech-related sanctions to lift in Iran

Mon, 15 Mar 2010 12:46:00 +0000

A week has passed since the U.S. Treasury announced it was going to lift a ban on the export of online services like instant messaging, chat, and photo sharing to Iran, Cuba, and Sudan. This was an ineffective ban to begin with: Anyone who wanted to use tools like Google Chrome could already do so by using proxies to download it. I am curious what happens to commercial software; I am pretty sure that Iranians won't be able to download American software for which they have to pay, as American businesses can't do business with Iran unless they go through a complicated process of obtaining a waiver.

Nevertheless, lifting the ban on this fine assortment of free software is a small step in the right direction. But U.S. officials shouldn't stop there, for they still haven't addressed a much more important problem, namely the fact that Iranians still do not have access to the same tools for supporting their websites as bloggers and Web entrepreneurs elsewhere. They can't, for example, use Google AdWords to generate cash from showing ads on their sites: Google doesn't list Iran as an option in any of the menus available on Google AdWords. This is hardly surprising given blanket restrictions that American companies face when doing business with Iran -- but Google could at least be publicly voicing those concerns rather than simply embracing the Treasury's decision with open arms. I have yet to see a Google rep publicly complain about the inability to sell Google ads in Iran.

As I've already blogged about here, keeping Iranians out of Google ads creates an extremely unhealthy environment where Iranian Internet projects -- even the most popular ones -- can't finance themselves and have to rely on handouts from foundations and Western governments. This, of course, further taints their reputation in the eyes of the regime, as any foreign funding is perceived as a precursor of a revolution. Granted cashing a U.S. check from Google in Iran may not be an easy walk either, but I am sure that it would create fewer risks than cashing a check from any of the 60 organizations identified by the Iranian government as enemies of the state. Without introducing such granularity into its own sanctions regime, the U.S. government pushes its most loyal supporters in Iran toward taking risks that are completely unnecessary.

Muslim Brotherhood's mysterious Wikis

Wed, 24 Feb 2010 13:51:11 +0000

In case you needed another proof that one doesn't have to be a pro-Western, pro-secular, and pro-democracy liberal to take advantage of opportunities offered by new media, here it comes. A recent article in Al-Masry Al-Youm discusses efforts by Egypt's Muslim Brotherhood to document their own history on the Web. And what are the tools they've chosen to do it? Wikis!

The wiki, which is still in its early stages with a little over 1700 accessible articles, provides the Ikhwan perspective of their own history and events in which they were involved or believe to be closely tied to their Islamic or political cause--a mini Ikhwan library for those who don't have access to the Brotherhood's literature or to writings by their thinkers that are available in some Islamic bookstores.

Under the section "Ideology of the group" a wide range of subjects can be found, with politics and religion interweaving--as is the case with the Brotherhood's dogma itself. Essays published on the wiki involve abstract concepts like freedom and matters of spirituality. One essay is titled "Love in God"--a concept directly connected to the idea that Muslims should love and ally with other pious Muslims and avoid "sinners," or those who have strayed from the right path.

...The wiki also links to Brotherhood forums and websites and is hosted by a server based in the United States, which makes it near impossible for Egypt's internet watchdogs at the Interior Ministry to crackdown on the site as they did several years earlier with the first website, which was hosted from Egypt.

This is a very intriguing development. I'll wait for Marc Lynch to weigh in with a deeper look at how it might affect the internal politicsl of the movement. My own (rather uninformed) speculation is that Wikis can reveal some interesting tensions within the Brotherhood. Anyone who has followed Wikipedia community's own attempts to reach consensus on controversial editorial issues would know that the amount of potential tension that can be revealed and chanelled through Wiki is almost unlimited. Given the existing ideological splits between the movement's old guard and its younger Internet-savvy elements, it would be interesting to watch their Wiki space, particularly its sections on the role of women in the political process and their interpretation of the most pivotal events in their own history.

I am somewhat skeptical that the olg guard would be involved in contesting the truth in the Wiki wars with the younger generation, mostly because they are not online and surely see the Internet as evil. So we've got several possibilities here: 1) the Wiki might force the elders to finally get comfortable with new technology and adopt it to ensure that their own conservative positions are not discarded 2) the Wiki is just a facade - a marketing trick to bolster Brotherhood's media-savvy credentials in the country and abroad - and all articles/dates have already been carefully selected and pre-approved (there would be no "editing wars"). Somehow, option 2 seems more likely to me.

Wrong kind of buzz around Google Buzz

Thu, 11 Feb 2010 06:20:56 +0000

The launch of Google Buzz has set various parts of the technology blogosphere afire -- and for all the right reasons: it does introduce a number of interesting social features that could make our email experience more social (whether it has to be more social is a different question).

However, what tech pundits have mostly overlooked is a peculiar privacy choice made by Google's designers: unless you tinker with Buzz's settings, a partial list of your most-emailed Gmail contacts might be automatically made public (see this post over at Silicon Alley Insider; it appears that contacts those who already had a Google Profile account before Buzz are at risk; also see this excellent and very angry post at CNet for additional background. UPDATE: Google has promised to fix some of these problems).

Yes, that's right: without you ever touching Google Buzz's privacy settings, the entire world may know who you correspond with (yes, including that secret lover of yours and that secret leaker at the White House).

This could be an extremely uncomfortable and tragic privacy disaster for Google, potentially of the same magnitude that Beacon was toFacebook. I certainly don't have many concerns about those who are cheating on their spouses or are leaking sensitive information to journalists-- they will survive (even though the future of whistle-blowing does not look very bright in our increasingly overexposed information environment).

Nevertheless, I am extremely concerned about hundreds of activists in authoritarian countries who would never want to reveal a list of their interlocutors to the outside world. Why so much secrecy? Simply because many of their contacts are other activists and often even various "democracy promoters" from Western governments and foundations. Many of those contacts would now inadvertently be made public.

If I were working for the Iranian or the Chinese government, I would immediately dispatch my Internet geek squads to check on Google Buzz accounts for political activists and see if they have any connections that were previously unknown to the government. They can then spend months on end drawing complex social circles on the shiny blackboards inside secret police headquarters.

But potential risk from disclosing such data extends far beyond just supplying authoritarian governments with better and more actionable intelligence. For example, most governments probably already suspect that some of their ardent opponents are connected to Western organizations but may lack the evidence to act on those suspicions. Now, thanks to Google's desire to make an extra buck off our data, they would finally have the ultimate proof they needed (if you think that this is unrealistic, consider this: the Iranian authorities have once used membership in an academic mailing list run out of Columbia as evidence of spying for the West).

It's business decisions like this that make me very suspicious of Google's highfalutin rhetoric about their commitment to defending the freedom of expression. From a business perspective, such decisions do make some sense -- how else, after all, can Google Buzz compete with Twitter and Facebook, who are already light years ahead of Google in terms of building up their user base -- but the ethics of such business decisions is extremely shoddy, to say the least. If Google executives are really committed to defending the freedom of expression, then they must be inhabiting a dreamworld, where freedom of expression somehow always survives despite horrendous attacks on privacy.

The relationship between privacy and free speech has been a subject of contentious debate between legal scholars -- with people like Eugene Volokh arguing that excessive protection of privacy, no matter how appealing, could also harm free speech -- but what I often found puzzling about such arguments is that they don't seem to account for the fact that, without privacy, it's also very hard to exercise one's right to free expression. Isn't freedom of expression of a rather limited value when one is conversing under constant electronic surveillance? For anyone interested in how we should think about privacy in the digital age -- and why it still matters -- I highly recommend Helen Nissenbaum's new book Privacy in Context: Technology, Policy and the Integrity of Social Life.

I am yet to hear a Google executive mention privacy as one of the values that are constitutive of the freedom of expression. Whenever theytalk about the latter, they always make it very clear that privacy inhabits a completely different universe. I think they operate on a very flawed logic, which makes all their other efforts on this front look very insincere. Moreover, I think it is likely to cause Google much more damage in the long run: what's the point of protecting the email accounts of Chinese human rights activists if you tell the rest of the world who those people are talking to?

Seen from this perspective, a recent decision by the Iranian government to ban Gmail and create their own national email system -- something that must have been inspired by Turkey's Anaposta project-- does not sound that bad. After all, it's probably better to have activists stop using Gmail than to watch them expose their connections to government's agents. I can only hope there will be enough anger in the technology community to force Google reconsider their decision to disclose information that is extremely sensitive and should never be disclosed without prior consent from its users; in the future, all similar sensitive data decisions like should be "opt-in" not "opt-out" by default.

Otherwise, all their promises about their stance on freedom of expression is just empty talk. Their recent partnership with NSA does not make Google look any more trustworthy; Chris Soghoian, an expert on information security, made a hilarious point on Twitter: "How do I sign up for the Iranian government's new emailservice? At least they are not in bed with NSA."

Cyber crime expert warns against new trick used by hackers to trap naïve Facebook users

Wed, 19 Jun 2013 20:40:06 +0000

Dubai: Clicking a ‘like’ or ‘Follow us on Facebook’ button could lead hackers to steal your user name and password, experts warn. A new trick has come to light in which cyber criminals use Facebook and other social networking sites to trick users into giving away log-in credentials, potentially exposing millions to identity theft. XPRESS [...]