Austin Heap » Technology

The Group That Exposed Bradley Manning

Austin — Sat, 11 Feb 2012 05:13:13 +0000

Some time ago I was contacted by a group of pseudo-government contractors (not even sure what to call them) that tried to toy with me. They told me they had cell phones that would be destroyed, that they tapped phone lines for the lulz, and that they had some official government sanctioning. Wrong.

But a weird thing happened: one of the groups members, Adrian Lamo, turned in Bradley Manning after the private admitted to Lamo to being the leaker behind Wikileaks’ “Cable Gate”. I thought I’d pay it forward by leaking all the docs I have on them.

Fiesta!

Edit: file links fixed.

The files:

Some background:

We met online, after the election (Part 2)

Austin — Tue, 21 Sep 2010 01:15:54 +0000

Before I say anything more, I would like to clarify some issues that have been raised in recent debates regarding the Censorship Research Center.

The CRC has always been a small, volunteer based operation. Dan Colascione and I started the organization, and we were its primary drivers. We have not received income from the CRC and worked on a pure volunteer basis. Everyone else involved with the CRC operated on a part-time, volunteer basis.
The CRC has never received a donation greater than 15k, and the vast majority of its donations have been much smaller than that. These were used primarily to buy our servers and pay for the bandwidth bills.
Unlike other anti-censorship programs used in Iran, the CRC has never received funding from the United States government. Nor did the CRC, to my knowledge, receive special treatment from United States licensing agencies. We believe the United States and the European Community should continue to support anti-censorship efforts, and that restrictions on the distribution of anti-censorship software to countries like Iran should be loosened or eliminated.
A diagnostic version of Haystack was distributed to a small number of users in Iran. The CRC took steps to inform users they had a test version of the program, a fact which was also displayed on the Haystack website. The CRC is not currently testing Haystack in Iran, and has committed to receive third party vetting of Haystack’s security before proceeding.

Dan Colascione and I started the CRC because we were moved by the Iranian peoples’ courage in the face of the government repression following the Iranian elections. In the Iranian peoples’ struggle we saw a chance to help the silenced voices of the world through technology.

My initial efforts involved providing instructions so people could set up proxies for Iranian people — thousands of people around the world helped out. It was after we saw that these proxies were repeatedly blocked by the Iranian government that we started working on Haystack. Dan developed the program’s core functionalities. I was charged with developing the user interface and the organization. Our goal was to provide the Iranian people with a tool to definitively circumvent the government’s increasingly sophisticated filters.

This goal soon turned into an enormously complex project whose scope exceeded anything we had been involved with before. After a few successful tests, we naively believed we were going to finish and launch Haystack within months. Instead, we soon found that we had to build an organization, obtain a license, engage in fundraising, and obtain the help of developers, accountants, consultants, and lawyers before we could even get off the ground.

The last year, in my mind, has been characterized by a constant drive to do more than we could with the resources we had. We were sometimes overly ambitious; we believed we could change the world, and I spoke with that belief in mind. And there was a constant, draining race to meet expectations — expectations that, in retrospect, I created, sometimes without meaning to; expectations that the press made into national stories, when really the story was a couple of kids, working for nothing, trying to bring the tools of communications to others.

To those we may have disappointed — those who supported us, those who worked with us, and those who have waited too long for us to deliver them from the Iranian firewalls — I apologize.

Meanwhile, over 30% of the world is still affected by censorship and monitoring. Western corporations still sell the tools of censorship to oppressive governments around the world, with no repercussions. Worse, the Iranian people still lack a reliable tool to access information and each other.

What I regret most is that the debate surrounding me has distracted from these issues. The only issues that matter are being ignored and for that I feel horrible.

This has become a burden and a distraction to the organization’s mission. ~~That is why I intend to step down as executive director of the CRC and take on a different role.~~ I’m still very much committed to the CRC’s mission of empowering people to speak freely and safely around the world, that’s not up for discussion.

To those who still live under censorship and monitoring, and all of those who have supported us along the way and who continue to send letters of love and support to this very day, you will remain in my thoughts.

All the best,
Austin

Protected: A Conversation With Evgeny

Austin — Fri, 10 Sep 2010 05:37:19 +0000

Brain Dead Journalism

Austin — Thu, 02 Sep 2010 09:30:12 +0000

It’s always fun when you take on something big, something you care about, and brain-dead “journalists” attack you. For full transparency, here’s what I sent to Evgeny after he had no spine to contact me before he penned his tabloid bullshit. Enjoy.

Hey Evgeny,

Completely fair article, I understand it’s frustrating for people outside our organization to figure out how we work. I also wish you would have reached out and I would gladly have clarified the misunderstandings you highlight in the article.

–

Haystack’s story makes for great Hollywood material: Bay Area technologists who serendipitiously discover that there is a bloody and violent world beyond Silicon Valley – the one where people rebel, fight, and die for real and not just as part of some new Facebook game - decide to dedicate themselves to the fight against authoritarian evil with the help of – you guessed it! – the Internet. They are the ones putting “Twitter” into the “Twitter Revolution”! And you too can abet their fight: they’ve got whole two Donate buttons on their web-site!

I agree with you that the media narrative is very “Hollywood” — go modern day press, right? I also agree a lot of media are quick to yell “TWITTER REVOLUTION” or other nonsense. I’m the first person to shoot this down, and do so at every opportunity.

The “Twitter Revolution” is a bullshit phrase used by Twitter and many others to boost the image of social media. I regret any role I had in furthering this completely empty notion.

–

This is, for example, what the ever-modest Heap told Newsweek: “Tomorrow I meet with [Sens. John] McCain, [Bob] Casey, maybe [Carl] Levin, but I don’t know if I will have enough time”.

(a) lol, (b) I work endless hours, I was tired, I was meeting with a reporter on my third dinner of the night. I know people like to yell “omg you think you’re so important” — I have a good friend who always says “omg i’m @austinheap” to me. I had a flight leaving that evening, it was a pure scheduling issue. Not the lols you’re trying to spin it into, but I applaud your attempt to do so and Newsweeks effort at making it seem like I’m the most in-demand person in DC.

I’m trying to raise awareness of Internet freedom in DC among our policy makers. As you may know, nothing happens in DC, so we can use all the support we can get. So can the Internet as a whole.

31% of those with access to the Internet live under some form of Government-imposed censorship. More people should get involved. One warning I’d give them, though, is: watch out, a whole bunch of people with blogs are going to bitch you out every step of the way no matter what you do.

–

And it’s not just American media: The Guardian pronounced Heap to be “The Innovator of the Year” – personally I would have gone with “The Publicist of the Year” though – just check this photo - but then who am I to judge?

I learned my lesson: turn down every award offered. Their photo guy suggested the mouse cable stuff, I just complied. Again, lesson learned.

Who are you to judge? Are you actually asking or just using that phrase to play the victim card? You tell me, because I’m still wondering that.

–

So, in essence, the outside public – including Iranians – are asked to believe that a) Haystack software exists b) Haystack software works c) Haystack software rocks d) the Iranian government doesn’t yet have a copy of it, nor do they know that Haystack rocks & works.

(a) I’ll gladly meet you in person and prove it. (b) See A. (c) No one said that — can you source it? Haystack is an *alternative* to Tor, Freegate, Ultrasurf, Psiphon, etc. (d) We would never expect Haystack to *not* fall in the hands of the Iranian regime. That would be stupid.

–

On the contrary – I’m in the anecdotal mode – plenty of cryptologists on the mailing lists I am seem to be extremely cautious/skeptical of what Haystack has (or, as is the case, doesn’t have) to offer.

Every smart person approaches every subject they don’t have full understanding about with cautious skepticism. I support that, it’s smart.

I have also reached out to multiple crypto/liberation technology mailing lists to try to answer questions they have about Haystack. If you would like to recommend others to reach out to, I’m all ears.

I’m also sad to know that you’re on the Standford libtech group which I *JUST* reached out to try to clear up questions out of a desire to be more transparent with people I respect. Instead of contacting me when you had my contact info, you just ran on assumptions. I appreciate how some members of libtech were mature enough to say things like:

“I was too hasty in drawing conclusions from the incomplete information I had access to at the time.”

I like how I ended my e-mail to the group soliciting feedback and questions re: Haystack with:

“For those individual(s) on this list who have a history of being confrontational in order to grab attention, I won’t be responding to your emails. Grow up.”

Didn’t even have you in mind at that point!

–

To me, it seems like a no-brainer: if you want to distribute technology that may endanger lives, make sure that the technology is secure.

It *is* a no-brainer. That’s why we’re taking our time to make sure we do things as safe as possible. We don’t *ever* want to put anyone at risk. The last thing I want is blood on our hands.

For what it’s worth, the most popular anti-censorship tool in the world, Freegate, is also closed source and does not invite outside experts to review their code. They’ve done a pretty amazing job in China. I look up to them on a lot of issues.

–

Second – and here I’m only speaking from my own Belarusian experience – it’s naive to believe that the human networks that Haystack supposedly relies on to distribute the software won’t be penetrated and compromised by the Iranian authorities.

No one said that — again, source? We don’t think Haystack’s security is based on a person-to-person trust network, we’re just using that to control growth and our network of testers. There’s no efficient way to test everything we’re doing with the general public. When Haystack moves to mass-market release, this will be different and we will not be relying on a human network. That’s just the stage we’re at in our growth plan — not a long term strategy like you’ve assumed/implied.

Again, I would like to know why you think our security plan is hinged on this or where you got that impression so I can correct it.

–

Yeah right. Maybe he should go work for the DOD – they need such people to deal with all those leaks.

For someone that bitches so much about trite press, you’ve mastered it.

–

the argument that the software needs to be hidden from authorities at all costs strikes me as untenable

As it should. And that’s why no one said that.

Haystack, as all intelligent anti-censorship tools, are built with *full knowledge* that it will one day fall into the hands of the opposition. We do not make that argument, so I’m confused as to why you’re insinuating I or someone involved in our organization did.

–

This may seem like unnecessary moralizing – but it’s hard to react otherwise when lives are at stake.

It’s the Nancy Grace approach! I was waiting to read “but what about the children” in your article.

–

And what kind of world are we living in when we expect technology expertise to be concentrated in US Treasury anyway?

You, sir, are the Fact Fairy. Where did you come up with just Treasury granted our entire license? It was Treasury Dept, State Dept and Commerce Dept. A little reading into sanction laws would have made that clear to anyone who can understand legalese. (Not that I could have 12 months ago, to be fair.)

–

And who gets to pay for all these? Bingo: the Iranians.

This, again, is why we’re taking our time to make sure we’ve crossed our Ts and dotted our Is — we don’t want to put people at risk. At this point, we’re not happy with the total state of the software, which is why we’re not putting *endless* people at risk.

So your point is well taken, but misguided and lacking understanding of how we’re moving the project forward.

–

…around the needs and demands of the US foreign policy.

Now you’ve got me pegged! I deal with all this bull shit because I want to push US foreign policy. My life has been taken over trying to make people like you happy. Trust me, I’d much rather go back to “fighting dragons” (I love how you make every dig you can, it’s really cute and shows tons of integrity) and not have to deal with this every damn day. But it’s something I believe in, and something I intend on seeing through.

–

Once again: I’ve got nothing against Haystack or Austin Heap per se.

So why didn’t you reach out and ask the questions you raised instead of babbling off factually incorrect nonsense? Just had a bad day and decided to do zero research?

–

What irks me is the way in which the limitations of the current discourse on Internet freedom - and the bizarre, completely non-transparent policies that it conceals – end up conferring unneeded legitimacy to Haystack’s flawed – for my taste, anyway – approach to fighting censorship.

Can you tell me or others what organizations you *do* support?

–

You can agree or disagree with how we run our project and our non-profit, that’s fine. What’s not okay is not having the facts and acting like you know what you’re talking about.

I don’t expect you to publish anything but your one side (because you clearly have no interest in doing that) but I thought it was at least worth it to respond directly to you out of professional courtesy.

I’d be glad to answer any questions you have about Haystack or Haystack conspiracies. Oh, did I tell you we have UFOs hidden in our basement? I also have Jesus Christ cryogenically frozen in my freezer; I keep him next to my Ben & Jerry’s. True story.

All bests,

Austin

Trolls, couldn’t exist without them.

Anti-Censorship Software Licensed by US Government for Export to Iran

Austin — Wed, 14 Apr 2010 02:59:29 +0000

Unfiltered and open internet access is a right that all people around the world are intended to have as embodied in Article 19 of the Universal Declaration of Human Rights. – Austin Heap

SAN FRANCISCO, CA (April 14th, 2010): Today, the Censorship Research Center (“CRC”) announced that it has received critical United States Government authorizations required to export anti-filtering technology to Iran.

In response to widespread crackdown by the Iranian government following the June 2009 elections, the CRC developed a program that provides unfiltered, anonymous Internet access. The program, called Haystack, uses a sophisticated mathematical formula to hide the users’ real Internet identity while allowing them to access websites blocked by Iran’s government, such as YouTube, Facebook, Gmail, and Twitter, which have served as important mediums of communication for Iranians. As noted by CRC Executive Director, Austin Heap, “Now we can launch our efforts to help those in Iran access the Internet as if there were no Iranian government filters.”

Exports of U.S. goods and services to Iran are prohibited unless authorized by Treasury’s Office of Foreign Assets Control (OFAC). OFAC’s decision to approve the CRC’s license application comes in light of recent statements by the Obama administration recognizing the importance of Internet access to democratic movements around the world. U.S. Secretary of State, Hillary Rodham Clinton, highlighted this matter in recent remarks about Internet freedom on January 21, 2010, “[D]espite an intense campaign of government intimidation, brave citizen journalists in Iran continue using technology to show the world and their fellow citizens what is happening inside their country,” she said. “In speaking out on behalf of their own human rights, the Iranian people have inspired the world. And their courage is redefining how technology is used to spread truth and expose injustice.”

“Unfiltered and open internet access is a right that all people around the world are intended to have as embodied in Article 19 of the Universal Declaration of Human Rights. The Obama administration has recognized that the right to information should not be denied and is finally taking decisive action to back their stated objectives to see that these rights are realized.” concluded Mr. Heap.

About the Censorship Research Center

The Censorship Research Center (“CRC”), is a San Francisco-based non-profit organization, was founded by Austin Heap and Daniel Colascione in 2009 to provide anti-censorship education, outreach, and technologies. The CRC’s first major project is Haystack, which provides access to information and communications to the Iranian people in the wake of recent restrictions imposed by the government of Iran.

Haystack is the first anti-censorship tool developed specifically for Iran and built to target the methods that Iran uses to filter the Internet. The CRC is the only organization licensed to export such software to Iran.

###

PDF

Guardian Innovator of the Year

Austin — Sat, 27 Mar 2010 03:15:33 +0000

This isn’t just about the future of the Internet, this is the future of humanity, the story we’re all taking a part in creating. This is about making sure that the first open, global communication network in human history continues to be used by people, not against the people, not against the rights every person on this planet deserves.

Austin Heap is executive director of the Censorship Research Centre in San Francisco, a non-profit organisation which provides anti-censorship education, outreach, and technology free of charge to those who need it most. He is an entrepreneur, technologist and activist who works to develop Internet-based technologies that facilitate the rapid transfer of knowledge between people, groups, and organisations.

Heap is the creator of Haystack, a piece of software which was a key technology used by Iranians to disseminate information outside the country in the protests that followed the disputed election result in June 2009. Heap developed Haystack to open up social networking sites such as Twitter and Facebook, giving voices on the streets a platform, and people in the west a window into a closed-down state.

(Here’s the original announcement.)

Exclusive Nexus One Pictures

Austin — Fri, 01 Jan 2010 07:29:52 +0000

Happy new year all; I present you with exclusive hands-on pictures of the upcoming Google Nexus One.

[Show as slideshow]

See you all in 2010! <3

We met online, after the election

Austin — Fri, 06 Nov 2009 04:50:41 +0000

The events of the Iranian election in June had us unrepentant Twitter addicts enthralled. With traditional media controlled by the government, the opposition organized using mobile phones and the Internet. As never before, the whole world could cheer alongside protesters demanding their rights while sharing in the terror and heartbreak of seeing them brutally crushed — all in real time, on Twitter and YouTube.

Outraged at seeing a movement and a generation muzzled, a group of us got together and started developing anti-censorship tools. We believe everyone, everywhere should be able to freely communicate. The system we designed, “Haystack,” provides completely uncensored access. There are no more Facebook blocks, no more government warning pages when trying to read BBC news — just unfiltered Internet. It’s an improvement to the state of the art in anti-censorship technology. It’s a necessary one too: Iran’s filtering is quite advanced, and it’s one of two countries to censor the Internet using domestic hardware and software. (The other is China.) Imagine a postal service that opens each piece of mail and uses machine learning algorithms to detect subversive correspondence. That’s Iranian digital censorship.

This kind of filtering is called “deep packet inspection.” It allows the government to block, read, and even change messages sent over the Internet, including emails and tweets. Iran purchased equipment from Western companies like Nokia and Siemans for this censorship, and is rapidly deploying homegrown equivalents over which it can exert more control.

Still, we were able to identify weaknesses in Iran’s approach and develop countermeasures. On a tecnología-e-tecnología basis, censors will always lose as long as any information at all can get out.

After coding night and day since the election we tested a beta version of Haystack in early July by bouncing traffic through Iran. It worked. When we saw that the government had improved its filtering methods in preparation for the Qods Day celebration in September, we were briefly worried. But we couldn’t help but cheer as Haystack cut through even the improved filtering. We couldn’t have been more excited.

In retrospect, we shouldn’t have been surprised. Traditional anti-censorship systems divert blocked traffic to servers located outside of the country. Haystack goes one step further: it uses innovative techniques to make blocked traffic look benign, rendering a user’s activity virtually undetectable. Haystack also has a cryptographic component which ensures that our users’ communications remain safe even if detected. The only way to block Haystack, we like to say, is to shut down the internet.

Deploying Haystack has hardly been a walk in the park, however. The problems are not merely technical. Under United States law, one can be put in jail for ten years just for sending an iPod to Iran. The legal clearance necessary to distribute Haystack has been a tall hurdle to jump. We’ve shuttled back and forth to Washington, D.C, and from coast to coast. We’ve written dozens of pages worth of legal forms and, because we’re committed to a sustained effort to end censorship, we’ve even founded a non-profit, the Censorship Research Center, through which we hope to tackle the filtering schemes of other countries as well.

There is something strangely ironic about the events that brought us to this point. We learned about Iran through Tweets, YouTube videos, and photos posted on Facebook. These same media which we are told pull people apart, away from the personal contacts that make life meaningful, brought us closer to a people, and a movement that we would have not otherwise known. These same media that were supposed to create a generation of apathy, in fact, gave a generation its voice. The courage displayed by the Iranian people inspired us to help them, and to help others. We refuse to allow their courage and the courage of those like them to be in vain.

(This article originally appeared at PBS FRONTLINE’s Tehran Bureau.)

The Long Road to Free Speech

Austin — Sat, 24 Oct 2009 03:04:37 +0000

Many of you know how Haystack was born — there was, and still is, a dire need to provide those in Iran with a safe way of getting online and securely communicating. Since the elections, the Iranian government has demonstrated time and again that it’s willing to ‘crank up’ its filtering of the Internet with little reason beyond stopping those who wish to communicate on popular social networks.

This kind of ‘thought control’ (sorry, I went there) is not unique to Iran. Just last week, another popular anti-censorship tool called Tor was blocked in China. There are countries all over the world experiencing varying degrees of government-imposed censorship.

In Australia, the Labor Party introduced a policy of mandatory Internet filtering. They did so partially under the guise of protecting children, but when the blacklist was leaked on WikiLeaks, it was quickly shown to block many completely benign sites. This is just another example, but those who enjoy and appreciate being able to communicate freely online need to also be aware of how quickly that freedom can be taken away.

I, and the rest of the Haystack team, agree and that’s why we’ve formed the Censorship Research Center — a San Francisco-based non-profit. The CRC seeks to do three key things: research the ways censorship is being performed, educate people about the impact of censorship by providing outreach programs and finally, when necessary, building the software tools that will enable people to get around Internet censorship.

Getting to just this point has been neither easy nor fast. The amount of resources — legal, organizational, and technical — required to make this happen has been astounding and we’re just getting started. The goal: to protect bloggers and journalists, students and professors, anyone who wants to get involved. To do this, we need to guard all aspects of social media and our links to them.

Most of us never have to stop and think, “What will happen if I blog this? Am I safe?” But what if you had to?

(This article originally appeared at Commitee to Protect Bloggers.)

Haystack Gets A Dell, Dude

Austin — Mon, 03 Aug 2009 03:27:44 +0000

Well actually two Dells, one for backup. The other night we just ordered our first two Dell PowerEdge blades to handle some of the network load from Haystack users. We hope to take delivery on them in the next week or so (everything takes so long!) and we’ll get them up in their data center home as quickly as we can. Without further ado, I give you the first two in-house Haystack work horses:

PowerEdge R610 – Chassis for Up to Six 2.5-Inch Hard Drives, No Operating System
Unit Price: $4,796.00
Quantity: 2
Total Price: $9,592.00

– PowerEdge R610 –
– Chassis for Up to Six 2.5-Inch Hard Drives
– [224-4848]
———————–
– Shipping –
– PowerEdge R610 Shipping
– [330-4122]
———————–
– Memory –
– 16GB Memory (8x2GB), 1066MHz Dual Ranked UDIMMs for 2 Processors, Adv ECC
– [317-0233]
———————–
– Feature Upgrades for Embedded NIC Ports –
– Dual Two-Port Embedded Broadcom® NetXtreme II 5709 Gigabit Ethernet NIC
– [430-1764]
———————–
– Primary Processor –
– Intel® Xeon® X5550, 2.66Ghz, 8M Cache,Turbo, HT, 1333MHz Max Mem
– [317-0202]
———————–
– Additional Processor –
– Intel® Xeon® X5550, 2.66Ghz, 8M Cache,Turbo, HT, 1333MHz Max Mem
– [317-0211]
– [317-1215]
———————–
– 1st Hard Drive –
– HD Multi-Select
– [341-4158]
———————–
– Primary Controller –
– SAS 6/iR Integrated
– [341-9145]
———————–
– BIOS Setting –
– Power Saving BIOS Setting
– [330-3491]
———————–
– Operating System –
– No Operating System
– [420-6320]
———————–
– Embedded Management –
– iDRAC6 Express
– [467-8649]
———————–
– Internal Optical Drive –
– DVD ROM, SATA, Internal
– [313-7541]
———————–
– Bezel –
– No Bezel
– [313-0869]
———————–
– System Documentation –
– Electronic System Documentation, OpenManage DVD Kit with DMC
– [330-3523]
– [330-5280]
———————–
– Hard Drive Configuration –
– No RAID for SAS 6/iR Controllers
– [341-8753]
———————–
– Rails –
– No Rack Rails or Cable Management Arm
– [330-3522]
———————–
– Hardware Support Services –
– 3Yr Basic Hardware Warranty Repair: 5×10 HW-Only, 5×10 NBD Onsite
– [992-9872]
– [993-3570]
– [993-9359]
– [993-9457]
– [993-9458]
– [994-4019]
———————–
– Installation Services –
– No Installation
– [900-9997]
———————–
– Power Supply –
– Energy Smart Power Supply, Non-Redundant, 502W
– [330-3517]
———————–
– Power Cords –
– No Additional Power Cord
– [310-9057]
———————–
– Power Cords –
– NEMA 5-15P to C14 Wall Plug, 125 Volt, 15 AMP, 10 Feet (3m), Power Cord
– [310-8509]
———————–
– Hard Drives –
– 250GB 7.2K RPM SATA 2.5″ Hot Plug Hard Drive
– [341-8725]
———————–

– Save $549 on each PowerEdge R610 servers through Dell Small Business
- $1,098.00 total savings

With these two machines we should easily be able to serve 7,500 Haystack users while we ramp up to full capacity. The whole team is very excited to get these into place as we press on with the launch of Haystack. We’ve been very busy organizing the logistics of everything and I can’t thank everyone enough for helping make this possible — Twitter, the Internet, and the wonderful group of people I work with endless hours doing the hard labor.

Everyday we continue to test Haystack inside of Iran and are refining the program to make it better, faster, and stronger before our wide-scale release. If you can, consider donating to Haystack to help us bring proper uncensored Internet to Iran.

We’ll post pictures of the babies when they get here

A Stick for the Stack?

Austin — Fri, 24 Jul 2009 03:32:45 +0000

I know it’s a cheesy title but a lot of people have asked how they can help Haystack. We’re working on new ways each day that people can chip in just a little to have a big impact. Today I’m thrilled to announce our first public effort: USB thumb drives! Distribution will largely be a person-to-person effort, and we all know USB keys are nice and tiny. I get the tiny 128mb versions all the time at tech conferences, and now I’ve learned they’re actually useful

So if you’ve got some spare USB keys laying around, why not send them for us to use for Haystack? Just stick them in a regular envelope (or the bubbly kind, just no boxes please) and mail to:

Austin Heap
PO Box 423060
San Francisco, CA 94142
USA

I’ll always post new ways you can help out here, but a “master list” will be kept on Haystack’s donation page.

Building the ‘stack

Austin — Wed, 22 Jul 2009 05:43:58 +0000

Sorry I’ve been AFK on the blog front lately. I know it looks quiet, but that certainly doesn’t reflect what’s going on behind the scenes. So, here’s a quick recap of what’s happened, what’s going on, and what’s to come.

Also, I’d like to take a moment to thank everyone who has made this project possible. From the Twitter support, to the incredibly supportive donations, to private organizations volunteering, people donating their time in real life to help this come together — I’m just amazed at the willingness of people to come together to make this project a success <3

Weeks before Haystack was even announced, we were feverishly working out the technical details, trying to layout what the network would look like, and procuring the first servers we would test our anonymous, anti-censorship tool for Iran with.

A few days after it was announced, we realized that the tech side wasn’t the hardest part. As the Iranian government cracked down on citizens and stepped up Internet filtering, the new challenge would be distribution. We needed to get people together — and fast — to figure out how both parts of the Haystack network would roll out. So we reached out for the first time to the Internet & Twitter to make sure this could happen — and support Haystack you did! Less than a week later we had our first successful test of Haystack from inside of Iran.

The dialogue that came out of our meet-up propelled Haystack beyond my wildest expectations. Since then, we’ve been putting the parts of the plan that came out of that dialogue in place.

On the Haystack front we’ve been building out capacity, testing the network, improving on the Haystack protocol, and meeting with specialists to review our strategy and network security principles. On the organizational front, there’s a non-profit being formed! This will serve to provide the necessary support and legal structure around Haystack. In the future we hope to support human rights and free speech with technology throughout the world. While very exciting, this adds lawyers, banks, accountants, and a whole bunch of other things into the mix. And a huge thanks to everyone donating their time, energy, and hard earned money to make this possible.

Then there’s the PayPal fiasco…

On Monday, I got a notice from PayPal saying that my account was under review and they needed some clarification for what it was for. Great, that’s fine! So I faxed over a letter stating what I was working on, and pointing them to relevant media about Haystack and my past work in the Iran election technology circle.

Somehow they decided that meant I wanted to have my account changed to non-profit status and asked for proof. I call them up and, after getting transfered four times, am told that there’s a problem with the account being in compliance of these laws that pertain to non-profit, tax exempt organizations. Wha? We never represented to paypal or any donors that we were already non-profit. I explain what I’m doing and the service rep tells me I have 14 days to provide documentation to prove the 501(c)(3) status of a non-profit that does not yet exist. We’ve been moving so quickly to get everything done, but changing how quickly the government grants non-profit status is one thing that is totally our of our hands.

So much has happened and yet so little time has gone by.

In the upcoming weeks as we continue to test the platform, we’ll also be gearing up for the launch of Haystack 1.0 and introducing our non-profit more formally, so stay tuned. If you’re going to the rallies in San Francisco or Los Angeles (and possible NYC!), swing by the Haystack booth and say hi!

Haystack grows up, gets a home

Austin — Tue, 14 Jul 2009 09:54:06 +0000

Check it out here! Related posts: Haystack: Good Luck Finding That Needle Haystack Gets A Dell, Dude How You Can Help: Iran 2.0 & Haystack Related posts:

Haystack: Good Luck Finding That Needle

Austin — Sun, 05 Jul 2009 03:22:29 +0000

Hey Internet, we need your help!

In the upcoming days, Daniel Colascione and I will release a new program to provide unfiltered internet access to the people of Iran. A software package for Windows, Mac and Unix systems, called Haystack, will specifically target the Iranian government’s web filtering mechanisms.

Similar to Freegate, the program directed against China’s “great firewall,” once installed Haystack will provide completely uncensored access to the internet in Iran while simultaneously protecting the user’s identity. No more Facebook blocks, no more government warning pages when you try to load Twitter, just unfiltered Internet.

The network will be supported by donated high-quality servers outside of Iran. We will be able to provide an individual user with unfettered internet access that costs the donor $0.015 to $0.0375 per month.

Proxyheap, the precursor to Haystack, was launched on June 22 just ten days after the election. That project, though, was only envisioned as a bandaid. It relied on proxies set up by individual users that were (through no fault of the thousands of generous contributors) unreliable and temporary. Moreover, individual users in Iran had to request access to a proxy. Haystack is a more efficient, effective and long-term solution.

We are in the process of stress testing the network of servers and verifying their functionality. The program will initially be made available at http://haystack.austinheap.com but will shortly thereafter be available through other distribution mechanisms to ensure maximal availability on the ground in Iran.

The Khamenei/Ahmadinejad government has been extremely effective at silencing prominent members of the opposition. But the uprising in Iran was not the result of top-down leadership, it was the result of individuals using whatever means they had at their disposal to organize and communicate. We want to continue to support, in whatever way we can, those who started this and will lead it forward: the people.

State of Freegate in Iran

Austin — Fri, 03 Jul 2009 04:57:23 +0000

Currently VPNs are one of the safest methods of evading censorship. HMA has hundreds of exit nodes/countries and many ways of accessing their servers.

There’s finally confirmation: Freegate has cut Iran’s access by 75%. For over a week now we’ve been trying to figure out what exactly happened to Freegate’s ability to provide Iranians with unfilitered Internet access, but now there’s an answer.

It’s public knowledge that Freegate was founded to help the Chinese get around the ‘Great Firewall’. From the Wikipedia page:

Freegate is software that enables internet users from mainland China, Iran, Syria, Tunisia, Turkey and UAE, among others, to view websites blocked by their governments. The program takes advantage of a range of open proxies, which allow users to penetrate firewalls used to block web sites. Developer Dynamic Internet Technology (DIT) estimates Freegate has 200,000 users.

I’m not sure when that “200,000 users” is from, but I can tell you that the number of users in Iran was much higher than that. Since Freegate received its last major funding, it’s pretty much been up to volunteers and (I can only assume) donated/university bandwidth. This can only get a project so far. Once the university servers have been blocked or the capacity has been reached, the entire Freegate project — as far as Iran is concerned — becomes either slow or inaccessible.

After the election in Iran came down, they put their resources behind the people but were quickly hit with the realities of technical limitations. Bandwidth, servers, everything are expensive: especially when one is providing a method for getting around a government like the one in power in Iran.

Update: Private individuals cannot run Freegate “nodes” or servers as the source code nor binary for the server are available. Freegate runs all their “nodes” internally, which is a smart move given their objectives.

State of the Iran Proxies

Austin — Mon, 22 Jun 2009 09:15:29 +0000

Currently VPNs are one of the safest methods of evading censorship. HMA has hundreds of exit nodes/countries and many ways of accessing their servers.

So there’s been good news and bad news from launching proxyheap. (Btw, you can check it your proxy is working here.)

The good news? We have lots of support! The bad news? There’s a HUGE chunk of proxies misconfigured… rendering them useless. There’s also a bunch of proxies on un-reliable connections — we pass these out to people in Iran and when they’re down, it just makes things harder.

That said, special thanks to r3boot (the original author) and esr (who put all the pieces in place) for putting together a reliable Squid configuration file for those in Iran seeking unfiltered Internet access.

To quote from the config file:

# 0. Do this installation only on a non-essential machine, as the host may be # targeted for serious denial-of-service or cracking attempts. For maximum # security, run it inside a virtual machine. # # 1. Install squid on your system. You will need to be root for this. # Under Ubuntu, do "apt-get install squid" # Under RedHat, Fedora, and Centos do "yum install squid" # Under Gentoo, do "emerge squid" # Under OpenBSD, do "pkg_add PKG_PATH=ftp://ftp.openbsd.org/pub/{version}/packages/i386/squid" # Under FreeBSD, do this: # wget http://www.squid-cache.org/Versions/v2/2.7/squid-2.7.STABLE6.tar.gz; # tar zxvf squid-2.7.STABLE6.tar.gz # cd squid-2.7.STABLE6 # ./configure '--sysconfdir=/etc/squid' '--enable-storeio=diskd,ufs,aufs' '--enable-delay-pools' '--enable-pf-transparent' '--enable-ipf-transparent' '--disable-ident-lookups' '--enable-removal-policies' # make # make install # Under NetBSD, do "cd /usr/ports/www/squid; make install clean" # # 2. Red Hat and CentOS only: # * Edit the iptables via system-config-securitylevel. As root, run # /usr/bin/system-config-securitylevel # * Set SELinux: to either Permissive(slightly better) or Disabled. # Note, this is a crude solution. Someone with more SELinux # knowledge might be able to write a pass-through rule. # * Now go into Customize. In Other Ports, set it like this: # portnum:protocol (eg. 42342:tcp, 42343:tcp, 42344:tcp). # Do this for all of your nonstandard ports. Hit OK->OK # # 3. Replace your squid configuration with this file. It is likely # to be in /etc/squid/squid.conf, but could be in /etc/squid.conf # as well. # # 4. Fix the "visible_hostname" line in /etc/squid.conf: it should declare # your machine's hostname (i.e. the part following "userid@" in your # terminal prompt) # # 5. Choose a nonstandard port number to listen on, or better yet # about a dozen of them. Fix the http_port line in /etc/squid.conf. # Add more lines as needed. # # 6. Specify the IP of a machine where you have login privilages on the # "acl remote_test" liner below. You will use this to verify that your # proxy is working, and can remove it afterwards. # # 7. Type "sudo adduser squid" and specify a password # # 8. Restart squid by typing: "/etc/init.d/squid restart" # # 9. Stop the service by typing "/etc/init.d/squid stop" # # 10. Test it in debug mode by typing "squid -z" (which creates the cache files) # # 11. Type "squid -NCd10" to test squid in debug mode and leave it running. # # 12. Open Firefox and type the URL localhost:3128 It will fail to retrieve a # page, but at the bottom it should confirm that the error is generated # by squid. (To be extra-sure, re-do this test using one of the # non-standard ports you declared in step 4.) # # 13. Back at the Terminal type CTRL-C to cancel the debug mode # # 14. Start squid for real with "/etc/init.d/squid start". It will start # automatically from now on. # # 15. If your squid host is sitting behind a hardware router with firewalling # capability, you must set up port forwarding of all your nonstandard # ports to the squid host machine. The procedure for this varies # depending on your router, but is most likely to involves pointing your # browser at 192.168.1.1 and navigating to a "Port Forwarding" page. # # 16. The easiest way to test that your proxy server is working is to # use the proxy tester at austinheap.com: # # If it says "Fatal error: couldn't connect to host", then your # squid instance probably isn't running; check for possible fatal # error in the configuration parse, and if you don't see that make # sure that you have correctly configured your ruter or firewall # to pass through packets. If it says "Your proxy is not accepting # connections from the validation servers.", you're at least # reaching squid, but your allow/denies aren't right or you # configuration file doesn't live where you think it does. # # 17. Register your proxy server with proxyheap at # # You'll have to do this once for each listener port you declared. # You will receive an email notification from the proxyheap # verification servers if all is well. Otherwise, email will tell you # that your server could not be verified and drop the entry from the # proxyyheap database. Once you are successfully registered, # the Iranian revolutionaries can begin using your proxy with # no further action required on your part. # # 18. Death threats have already been made against cooperating # hackers. If you receive such a threat, report it to your local # police immediately. Do not assume that your cooperation is unknown # to the Iranian regime or their agents, and do not assume you will # have warning if they act on their threats. If you are not already # armed and prepared to defend yourself, fix both of these bugs.

I think this is a very good starting point for getting this effort organized and effective.

How to setup a proxy for Iran citizens (for Windows!)

Austin — Mon, 15 Jun 2009 22:13:24 +0000

Currently VPNs are one of the safest methods of evading censorship. HMA has hundreds of exit nodes/countries and many ways of accessing their servers.

If you’re using Windows, it’s pretty straight forward to setup a proxy and help give access to those in Iran who are being censored. If you’re running Redhat/CentOS, please use the linux instructions.

1) Download Squid for Windows
2) Extract that zip archive, and move the “squid” folder to the root of your drive (probably C:\).
3) After moving the squid folder, open “C:\squid\etc\squid.conf” in your favorite text editor (not Word).
4) Configure the DNS name servers on the line that says “dns_nameservers” to point at your ISPs DNS servers.
5) Now the fun part, locking access down the just the Iranian IP blocks.

Inside the text editor search (Control-W) for the line “http_access deny all” and change it to “http_access allow all”. This will make your proxy open and accessible to the world. If you would like to limit your proxy to Iranian IP blocks, you want to change “http_access deny all” to read “http_access allow TRUSTED” add a line (BEFORE the http_access line to setup an access control list [ACL]). This ACL line that defines TRUSTED should read:

acl TRUSTED src 62.60.128.0/17 62.193.0.0/19 62.220.96.0/19 77.36.128.0/17 77.77.64.0/18 77.104.64.0/18 77.237.64.0/19 77.237.160.0/19 77.245.224.0/20 78.38.0.0/15 78.109.192.0/20 78.110.112.0/20 78.111.0.0/20 78.154.32.0/19 78.157.32.0/19 78.158.160.0/19 79.127.0.0/17 79.132.192.0/19 79.170.144.0/21 79.175.128.0/18 80.66.176.0/20 80.69.240.0/20 80.71.112.0/20 80.75.0.0/20 80.191.0.0/16 80.242.0.0/20 80.253.128.0/20 80.253.144.0/20 81.12.0.0/17 81.28.32.0/20 81.28.48.0/20 81.31.160.0/20 81.31.176.0/20 81.90.144.0/20 81.91.128.0/20 81.91.144.0/20 82.99.192.0/18 82.115.0.0/19 83.147.192.0/18 84.47.192.0/18 84.241.0.0/18 85.9.64.0/18 85.15.0.0/18 85.133.128.0/17 85.185.0.0/16 85.198.0.0/18 86.109.32.0/19 87.107.0.0/16 87.247.160.0/19 87.248.128.0/19 89.144.128.0/18 89.165.0.0/17 89.221.80.0/20 89.235.64.0/18 91.98.0.0/15 91.184.64.0/19 91.186.192.0/19 91.206.122.0/23 91.208.165.0/24 91.209.242.0/24 91.212.16.0/24 91.212.19.0/24 91.212.252.0/24 92.42.48.0/21 92.50.0.0/18 92.61.176.0/20 92.62.176.0/20 92.242.192.0/19 93.110.0.0/16 93.190.24.0/21 94.74.128.0/18 94.101.128.0/20 94.101.176.0/20 94.101.240.0/20 94.139.160.0/19 94.182.0.0/15 94.184.0.0/17 94.232.168.0/21 94.241.128.0/18 95.38.0.0/16 95.80.128.0/18 95.81.64.0/18 95.82.0.0/18 95.82.64.0/18 95.130.56.0/21 95.130.240.0/21 188.34.0.0/16 188.93.64.0/21 188.121.96.0/19 188.121.128.0/19 188.136.128.0/17 188.158.0.0/15 193.189.122.0/23 194.225.0.0/16 195.146.32.0/19 212.16.64.0/19 212.33.192.0/19 212.50.224.0/19 212.80.0.0/19 212.95.128.0/19 212.120.192.0/19 213.176.0.0/19 213.176.32.0/19 213.176.64.0/18 213.195.0.0/18 213.207.192.0/18 213.217.32.0/19 213.233.160.0/19 217.11.16.0/20 217.24.144.0/20 217.25.48.0/20 217.64.144.0/20 217.66.192.0/20 217.66.208.0/20 217.146.208.0/20 217.172.96.0/19 217.174.16.0/20 217.218.0.0/15

6) Setup “visible_hostname” (normally just the public IP address).
7) Turn off logging by adding these two lines:

access_log none cache_store_log none

7) Setup the Squid cache by issuing the following command: “c:\squid\sbin\squid -D –z” (No quotes).
8) Setup Squid to run as a service by issuing the following command: “c:\squid\sbin\squid –i”

Please don’t run this on a machine that you’re worried about or is used for production sites; and take basic security precautions, ie: moving ftp off the default port, using a firewall package, etc.

Once your server is up and running please DM @austinheap and let me know! I will no longer posting proxies on the public list. If you set one up, please e-mail me@austinheap.com to contribute to the private one or e-mail me if your an Iranian that needs access!

How to setup a proxy for Iran citizens

Austin — Mon, 15 Jun 2009 19:45:17 +0000

Currently VPNs are one of the safest methods of evading censorship. HMA has hundreds of exit nodes/countries and many ways of accessing their servers.

Update 4: There is now a recommended squid config file available.
Update 3: Here’s a guide for the Windows users out there.
Update 2: I will no longer posting proxies on the public list. If you set one up, please e-mail me@austinheap.com to contribute to the private one or e-mail me if your an Iranian that needs access!
Update: There’s a list of working Iran proxy servers over here.

If you’re using CentOS/Redhat, it’s pretty straight forward to setup a proxy and help give access to those in Iran who are being censored.

yum install squid nano -w /etc/squid/squid.conf

Inside the code editor search (Control-W) for the line “http_access deny all” and change it to “http_access allow all”. This will make your proxy open and accessible to the world. If you would like to limit your proxy to Iranian IP blocks, you want to change “http_access deny all” to read “http_access allow TRUSTED” add a line (BEFORE the http_access line to setup an access control list [ACL]). This ACL line that defines TRUSTED should read:

Turn off logging by adding these two lines:

access_log none cache_store_log none

Save the config file and as root issue the following command to start the Squid proxy server:

service squid start

Please don’t run this on a machine that you’re worried about or is used for production sites; and take basic security precautions, ie: moving SSH off the default port, using iptables, etc.

Once your server is up and running please tweet @austinheap and let me know!

The Bus Knows Nothing

Austin — Thu, 26 Feb 2009 09:48:05 +0000

A few different stories have popped up over the last week discussing location-aware advertising being used on NYC busses. I asked a few friends in the city to take a picture if they saw the bus, but got something even better: an internal NYCT! Not only is the project on hold, but it got so hot that customers reported a burning smell and the bus had to be pulled.

LED Advertising Sign

Bus 1070 entered revenue service with the LED sign activated on September 8, 2008. However, the sign was not fully operational until September 12, 2008, after LiteLogic (the manufacturer) performed some adjustments and updated software. Preliminary data from LiteLogic indicates that the average and peak power consumption for the sign system is well within what the bus electrical system could accommodate.

As of September 26, 2008, bus 1070 had a road call after customers reported a burning smell from the area of the LED sign. Technical Services/Engineering personnel responded to the event and observed heat damage at the lower left-hand corner of the sign. The sign was disabled and the bus returned to MJ Quill Depot for further investigation. Personnel from LiteLogic visited MJ Quill Depot on Monday, 9/29/08 to assist with the investigation. It was determined that a capacitor on one of the circuit cards within the sign had short-circuit and as a result became hot enough to damage part of the circuit card. Damage was completely contained to the sign itself and was in no way related to the installation of the sign on the bus. The production version of the sign has built-in fuses to prevent this type of damage. Testing will not resume until NYCT is certain that this type of failure can not take place again.

No more GPS bus advertising for now!