BROOKE GLADSTONE: This is On the Media. I'm Brooke Gladstone.

BOB GARFIELD: And I'm Bob Garfield, with an update. After last summer’s post-election demonstrations in Iran, a programmer named Austin Heap invented Haystack, software he said would help Iranian activists access banned websites, encrypt their conversations and, most importantly, hide such activity within innocuous material that would not arouse the suspicions of sensors. This spring, he announced that a version of Haystack was being tested by users in Iran and would soon roll out in three other countries, besides, and he brandished a waiver from the U.S. government to distribute Haystack in Iran as further evidence that the software was a success.

BROOKE GLADSTONE: Media outlet after media outlet, including us, celebrated Heap, until two weeks ago when technology writer Evgeny Morozov cast aspersions on Haystack’s overly ambitious claims. By last Sunday, a small group of cyber-security experts finally did what hadn't yet been done by a third party. They obtained a copy of the software, tested it and declared it fundamentally flawed. By Monday morning, Haystack had been turned off. Iranian users were warned off, and its lead developer quit and its board of directors disbanded. The postmortem assigning of blame is well under way, and we covered much of that last week with Morozov. This week, we wanted to talk to one of the cyber-security experts who checked the software – Jacob Appelbaum, a hacker and advocate for another encryption and anonymity tool named Tor. He said the first sign of Haystack’s failings was the secrecy surrounding it. And then he saw the software itself.

JACOB APPELBAUM: The tool that I looked at with a team of researchers this last weekend, it made some mistakes that I believe would allow the Iranian government or other people to potentially find all people who ever used this software, which is exactly the opposite of the claim that Haystack, the Haystack network and Austin Heap specifically said. Because it is a tool only marketed for revolution in Iran, it’s extremely dangerous to be caught using that tool. Unfortunately, I know for a fact that people were able to get copies of Haystack, and those people did not have warnings, and they knew only what was in the media.

BROOKE GLADSTONE: One of the object lessons from Haystack was that the press was totally seduced by the story of its effectiveness. Our guest last week, Evgeny Morozov, chalked this up in large part to what he calls “cyber-Utopianism.” Do you agree with that assessment?

JACOB APPELBAUM: Well, I'll tell you, I was extremely disappointed to see the media react the way that they did to Haystack. It seems quite clear to me that absolutely none of them had any idea about what they were talking about, and all of them wanted it to be true. And that’s fair. I also, for a time, was excited. But the sad thing is that the media seems to lack contacts with the experts, but, even worse, it seems to lack an understanding that it needs to make contact with those experts. The media has a responsibility not necessarily to evaluate every piece of software before they endorse it, but definitely to do some investigative journalism about something when there are human lives at risk. They can ask hard questions, such as, do you have an open design that has been peer reviewed? Do you have a diverse set of users? Do you have a decentralized architecture or a centralized one that allows you to monitor everyone and everything that uses your tool? Does it make promises, like magically encrypting the Internet or making everything perfectly secure? Is it easy to update? Do you do security through obscurity? Do you say, oh, we can't give you a copy of this because, well, that would be telling? If that is, in fact, asked by the media, I think that you will see charlatans on purpose, or charlatans by accident, shrink away.

BROOKE GLADSTONE: Now, you’re the chief advocate for Tor. That’s a software that both encrypts and circumvents censorship. What exactly does Tor allow users to do?

JACOB APPELBAUM: Well, I want to make it clear that this is not a Haystack versus Tor thing. And one of the things that we do with Tor that is different, I believe, is that we openly operate. We share our specifications, we share our source code. We're open about all of our funders. And while we do definitely have the ability to circumvent some kinds of censorship, we are primarily an anonymity tool. Any circumvention, anonymity or privacy tool must have a diverse set of users. I prefer to help people that work for social justice, but this is my own personal preference. I'll basically train anybody in anonymity that needs it. I met with some Swedish police when I was last in Stockholm. Other people at the Tor project have done trainings for the police in the United States. The police use it to hunt down child pornographers. It’s useful for being able to send a message, leak a document. So there are many, many things that we do, but we never, ever claim that you couldn't find a Tor user.

BROOKE GLADSTONE: Now, Tor tries to offer, in a very open way, a certain amount of protection when you’re online. If your code is entirely open for all to see, how can it be effective at all?

JACOB APPELBAUM: You, for example, will install Tor on your computer - you use the Internet at home - and the people watching you locally would see you connect to a server. That first server would know who you are potentially in terms of coming from a connection you pay for at home, that has your name on it. You go from there to a second server. The second server only knows about the first server. Now they no longer know who you are. The second server routes your traffic to the third server, and that is where you connect to, for example, Amazon.com. Amazon.com only sees the third server. Now, whatever you tell Amazon at that point is, of course, your decision, but you no longer implicitly tell them anything other than the fact that you’re coming from the Tor network. So the first knows who you are but not where you’re going. The second doesn't know where you are coming from or where you’re going, and the third knows where you’re going but not who you are or where you came from.

BROOKE GLADSTONE: Do you worry about the cover that Tor could give somebody committing atrocious acts online?

JACOB APPELBAUM: I think that it’s extremely important that we give everyone the same ability to speak freely without fear of repercussion, without fear of retribution. And, yes, it is possible that it could be misused. But I believe the problem of bad speech is not solved by censoring speech or by tracking people down and harming them, but rather it is solved with more speech.

BROOKE GLADSTONE: Tor is a good example of a project nurtured by the U.S. government, by the Naval Research Lab, and that is still funded in part by the government, that has gone on to enable things to happen that the government may no longer find in its interest. For example, Tor is what allows WikiLeaks to shield itself from the identity of people leaking its information. Do you recognize competing interests here, or are you in favor of anonymity no matter what?

JACOB APPELBAUM: I think it’s important to note that it doesn't matter where we get our money from. Everything we do is in the open and is disclosed. I won't comment on WikiLeaks, but I will comment on Tor. Yes, you can use Tor to speak freely on the Internet and, yes, someone might use Tor to leak information. And I personally have no problem with that, just the same way that I wouldn't mind if Daniel Ellsberg had used the U.S. Postal Service to hand over the Pentagon Papers. I think that this is a neutral technology in this regard.

BROOKE GLADSTONE: With the right tools, can the Internet deliver open information and anonymity?

JACOB APPELBAUM: As my friend Luciano – he lives in China – as he says, you know, we used to have one big Internet and now we have lots of little broken Internets, and I think that that’s part of the issue. Circumvention is fantastic for escaping your country.

BROOKE GLADSTONE: Being able to circumvent the censors in your country.

JACOB APPELBAUM: Exactly.

BROOKE GLADSTONE: Mm-hmm.

JACOB APPELBAUM: It doesn't actually deal, however, with book censorship, magazine, newspaper censorship. It does not help you to get back into your country to read the information that has been erased. And that’s part of the reason that Tor is not just a circumvention tool but rather an anonymity tool, because we think that it’s important for people to be able to be anonymous and to publish things without those people being silenced. I'd like to think that in the future we will treat privacy as a human right, as it’s quite clear that it’s a necessity for dignity, but I'd also like to think that we treat Internet censorship as a trade barrier, and potentially governments should sanction places that are effectively oppressing their people with digital versions of the Berlin Wall. And while that’s a little bit hyperbolic, there are people that live behind extremely restrictive firewalls, people who are potentially arrested for the things that they do on the Internet, and not even necessarily the things that they say on the Internet, but just the things that they read about.

BROOKE GLADSTONE: Jacob, thank you very much.

JACOB APPELBAUM: Oh, thank you very much for having me on your show. I very much appreciate it.

BROOKE GLADSTONE: Jacob Appelbaum is an advocate and developer of the Tor Project, and an independent computer security hacker.

[MUSIC/MUSIC UP AND UNDER]