Tor Project warns: Academics accused of helping FBI de-anonymize Internet users
Tor Project warns: Academics accused of helping FBI
de-anonymize Internet users
By Andrew Blake - The Washington Times - Thursday,
November 12, 2015
Researchers from Carnegie Mellon are being accused of
helping the FBI exploit a vulnerability that allowed investigators to gather
information on users of Tor, an online tool that allows individuals around the
globe to browse the Internet anonymously.
Tor Project, the not-for-profit group behind the
technology, said on Wednesday that academics from Carnegie Mellon University
made “at least $1 million” by helping the FBI de-anonymize Tor users earlier
this year during the course of a criminal investigation.
“Such action is a violation of our trust and basic
guidelines for ethical research. We strongly support independent research on
our software and network, but this attack crosses the crucial line between
research and endangering innocent users,” Tor said in a statement.
Tor allows users to stay relatively anonymous online by
routing Internet traffic through various nodes around the world, in turn making
it difficult for eavesdroppers to see where users are located or the websites
they visit. It’s popular among whistleblowers, journalists, human rights
workers and law enforcement officials who use the tool to mask their online
activity, as well as individuals in repressive regimes where access to online
content is restricted by the government.
Drug dealers and child pornographers also rely on the
anonymity the technology provides, however, in order to operate on websites
hosted on the Tor network — so-called “hidden services” where contraband can be
bought, sold and bartered for without one’s real identity having to be
revealed.
The latest discussion to concern law enforcement’s
efforts to crack Tor erupted early on Wednesday when Vice’s Motherboard
reported that court documents recently filed in the Western District of
Washington revealed that investigators had identified an alleged drug dealer
accused of selling narcotics through a hidden service, Silk Road 2.0, by way of
a “university-based research institute that operated its own computers on the
anonymous network” used by the online drug den.
Carnegie Mellon has yet to confirm it’s the
“university-based research institute” named in court filings, but the attack as
described shares overwhelming similarities with a presentation its researchers
had planned to deliver at a hacking conference in August that ended up being
nixed from the schedule at the last minute.
CERT/Carnegie Mellon researcher Alexander Volynkin had
been scheduled to give a talk titled “You Don’t Have to be the NSA to Break
Tor: Deanonymizing Users on a Budget” at Black Hat USA in Las Vegas. The
presentation had planned to show that “a persistent adversary … can
de-anonymize hundreds of thousands of Tor clients and thousands of hidden
services within a couple of months [for] just under $3,000,” according to the
synopsis.
“Apparently these researchers were paid by the FBI to
attack hidden services users in a broad sweep, and then sift through their data
to find people whom they could accuse of crimes,” Tor said in response to
Motherboard’s report.
“I’d like to see the substantiation for their claim,” Ed
Desautels, a public relations staffer at the school’s Software Engineering
Institute, told WIRED this week in response to the allegations, adding that he
was not personally aware of any payment being made to CWU in exchange for their
research, contrary to Tor’s claims of a $1 million reward.
Nevertheless, Tor has outright accused the school of
aiding the authorities and said in a statement this week that the attack
establishes a “troubling precedent.”
“Civil liberties are under attack if law enforcement
believes it can circumvent the rules of evidence by outsourcing police work to
universities. If academia uses ‘research’ as a stalking horse for privacy
invasion, the entire enterprise of security research will fall into disrepute.
Legitimate privacy researchers study many online systems, including social
networks — if this kind of FBI attack by university proxy is accepted, no one
will have meaningful 4th Amendment protections online and everyone is at risk,”
it read in part.
The group added that it seems unlikely law enforcement
obtained a warrant to execute the de-anonymizing process discovered by
researchers “since it was not narrowly tailored to target criminals or criminal
activity, but instead appears to have indiscriminately targeted many users at
once.”
“We teach law enforcement agents that they can use Tor to
do their investigations ethically, and we support such use of Tor — but the
mere veneer of a law enforcement investigation cannot justify wholesale
invasion of people’s privacy, and certainly cannot give it the color of
‘legitimate research,’ ” Tor said.
“Whatever academic security research should be in the
21st century, it certainly does not include ‘experiments’ for pay that
indiscriminately endanger strangers without their knowledge or consent.”
Comments
Post a Comment