How US sanctions made Haystack

There seems to be no end to the Haystack Affair. Who knew that this whole "Internet freedom" business was so ugly? Perhaps, it comes with the location: there must be a reason why Washington beats any other city in the world in terms of how many/how often its residents search for that very term on Google. 

I’m glad that The Economist picked it up, along with many others. I’m still waiting for The Guardian to do something about their akward award to Austin Heap. (That award is deeply symbolic of what happens to good editorial judgement when newspapers are forced to run conferences and make money on things that their marketing departments don’t know how to vet.)

Now that we know so much about technology behind Haystack, I think the public attention should focus to discussing the instituational/structural environment that made Haystack possible. I definitely think that the blame extends far beyond Austin Heap; he’s the product of the current "digital-innovation-at-all-costs" environment inside the State Department. Unfortunately, I don’t think that Haystack is a unique case; had Austin been speaking only in half his voice, Haystack would have been able to survive for probably much longer.

To broach thet discussion about the enabling environment, today I did a piece for Slate, where I  recouped some of the key developments but also tried to reflect on the role that the US government – willingly or unwillingly – played in this mess. Since we had to make a lot of cuts to my original essay – I guess Slate didn’t want yet another 6,000-word Haystack piece by yours truly! – I’ll post the full version of one particular segment from the pre-edited version of my piece here. I think it does add some nuance to my argument – in no way was I trying to imply that we need MORE sanctions imposed on Iran, as some of the comments posted in response to my Slate piece seem to suggest.

I was actually arguing quite the opposite: that the sanctions – along with many other existing hurdles in US foreign policy – can easily distort the original noble intentions of the Internet Freedom Crusade. (And yes, if you think there are too many brands here – Haystack Affair, Internet Freedom Crusade, etc – I’ve decided it’s unfair that the State Department gets to use all of those fancy brands – "21st Century Statecraft", "connection technologies", "Internet Freedom" – and I have to stick with boring and precise terms that actually mean something. So as of today, I’ll be branding everything that moves!). So below is a small excerpt from my original essay – the bit that deals with the meaning of sanctions.

***

The Haystack Affair has helped to highlight that if the American diplomats are really serious about defending Internet freedom, they should begin by solving problems in their own backyard. The broader public debate here should go beyond the subject of government incompetence – of which there seems to be little doubt – and focus on the utility of requiring such licenses.

Why should the US government require a license to export an anti-censorship technology to Iran but not, say, China? What exactly is the fear here? That the progressive elements of the Iranian Revolutionary Guards would all become active Haystack users and start browsing the banned web-sites of Human Rights Watch? But isn’t it a good thing? Why didn’t the US government explicitly add circumvention-technologies to the list of other online services – like Web browsers and instant messaging software – that were finally granted exemptions from seeking such licenses when the sanctions were amended in March 2010?

Most likely, we’ll never know. Anything related to Iranian sanctions is deliberately clouded in such secrecy and ambiguity as to guarantee the US government maximum maneuver space should they seek to change their mind on an issue. Such strategy – “flexibility through ambiguity” – may sometimes be quite useful, but as the Haystack Affair has revealed, it can also backfire quite easily. Haystack’s founders may not have boasted of having the US State Department “fast-track” their application to Newsweek– a claim that a State Department official denied to me – if there were at least a modicum of transparency surrounding the government’s deliberation over Haystack’s license application.

It certainly doesn’t help that OFAC – the entity that is ultimately responsible for issuing such licenses – is exempt from some crucial Freedom of Information Act regulations and is not obliged to release any information about individual cases it reviews. Not surprisingly, there is no mention of Haystack anywhere on OFAC’s web-site. It’s such ambiguity that has allowed Austin Heap to make overstated claims that the media didn’t know how to verify or challenge; the government has also not shown much desire to set the record straight, even though they could have easily challenged Heap’s claims to the media. Why didn’t they? Perhaps, because being seen to do something about Iran can’t possibly hurt them. All in all, it looks like sanctions oversight is one critical area where Obama’s call for more transparency is not likely to get heeded any time soon.

But the licensing process does more than just bestow additional legitimacy on projects like Haystack; it can also give an unfair first-mover advantage to the most aggressive and legally-savvy of them. Haystack’s press-release with regards to their OFAC license put all the right accents in all the right places: “Haystack is the first anti-censorship tool developed specifically for Iran and built to target the methods that Iran uses to filter the Internet. The CRC is the only organization licensed to export such software to Iran.”

CRC, being the first entity to obtain an export license from the government rightly saw it as a strategic asset. After all, if everyone in Washington wanted to fund Internet freedom in Iran and Haystack was the only entity with an export license, it was obvious that they had one killer advantage over other organizations: as far as the US law was concerned, Haystack was the only such tool that could be distributed in Iran legally.

It doesn’t matter that there were other more effective tools or that Haystack was a raw piece of code that may never leave its beta status. Austin Heap had the license – and others didn’t. It was clear which way the funding wind would be blowing – especially after a tacit endorsement of
Haystack by Hillary Clinton. However ambiguously worded that endorsement was, it seemed to work in Haystack’s favor.

Had Haystack not collapsed, it is easy to predict what would have happened in the next few months: the project would have locked in a major chunk of the early Iran-related “Internet Freedom” funds, stealing the spotlight from other tools and establishing very tight connections with the donor community. And had the right-thinking people at the US State Department refused to fund Haystack on its weak technological merits, they would soon have been attacked by the media and the Senators – as they always are, for example, whenever they refuse to fund projects affiliated with the Falun Gong movement. (But even the State Department had to capitulate to such pressure in May 2010, granting $1.5 million to one such Falun Gong effort.)

Herein lies a lesson for aspiring digital revolutionaries looking to tap into the Internet Freedom funding bonanza: hire good lawyers before you hire good coders! One of Haystack’s numerous “innovations” in this space was hiring a Berkeley-educated and Washington-based lawyer as its managing director. Whatever their sins, the Haystack gang presciently foresaw that, given how deeply the American foreign policy is mired in government bureaucracy, the crusade for Internet freedom – especially when it targets countries that have American sanctions imposed on them – would always prize one’s ability to write memos over one’s ability to write code.

This is, of course, perverse – but this is just another example of how America’s own rules harm the cause of Internet freedom and distort incentives to produce good software. It seems unwise to embark on such quixotic initiatives as the promotion of “Internet freedom” without first getting a thorough understanding of how existing policies may compromise the noble intentions.

p.s. The Guardian finally picked up the story.