Forgot your password?
typodupeerror
Privacy Education The Internet

Researchers Face Jail Risk For Tor Snooping Study 121

Posted by CmdrTaco
from the learning-is-dangerous-business dept.
An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."
This discussion has been archived. No new comments can be posted.

Researchers Face Jail Risk For Tor Snooping Study

Comments Filter:
  • by wvdmc (1227780) on Thursday July 24, 2008 @10:53AM (#24318681)
    They did it in the name of SCIENCE!
    • by tritonman (998572) on Thursday July 24, 2008 @10:56AM (#24318747)

      I guess if they get jail time, the lesson to learn is "Do as I say, not as I do."

      • by Squeamish Ossifrage (3451) on Thursday July 24, 2008 @02:03PM (#24322233) Homepage Journal

        Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.

        If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:

            * Just about everything done by CAIDA [caida.org].
            * The papers at IMC [imconf.net] - the Internet Measurement Conference.
            * Data at CRAWDAD [dartmouth.edu] - the Community Resource for Archiving Wireless Data at Dartmouth.

        A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.

        Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.

        • by gweihir (88907)

          I second that. I have done similar research myself (albeit not in the US) and all the papers only based on small traces, like an academioc departement routers are not really that significant.

        • Note also it doesn't have any backup to its (misleading) headline. Usually "could face legal..." means some law enforcement agency has noticed the issue. The only one stirring up the pot here (and working pretty hard at it) seems to be the article's author.
        • can't agree with you more
    • Re: (Score:1, Redundant)

      Albeit in a very unprofessional manner.

    • by elrous0 (869638) * on Thursday July 24, 2008 @11:32AM (#24319319)
      Of course we should jail them. According to the Bush administration, science is a major threat to our country!
    • Re: (Score:2, Insightful)

      by sm62704 (957197)

      If you do a legitimate study on the effects of different strains of marijuana, and control the genetics by growing the pot yourself, without all the impossible to get paperwork and permissions, you're going to prison.

      Why should these guys be any different? In the case of the reefer nobody's hared, in these guys' cases they invaded innocent people's privacy. Not only were their actions illegal, they were highly unethical.

      • by smallfries (601545) on Thursday July 24, 2008 @01:36PM (#24321693) Homepage

        How is their study either unethical, or illegal as you have claimed? Ignoring your hypothetical marijuana study as completely irrelevant you seem to have missed the key points in what they did.

        They did not run a "wiretap" as claimed. They monitored the traffic at a tor node that they controlled. People willingly sent them the information that was supposed to be private.

        Their study is a scientific investigation into whether the privacy claims of Tor can be sustained. They cannot - the system is open to abuse. This is an entirely ethical study into the claims made by Tor, and furthermore this is exactly how good empirical science should work.

        • Re: (Score:1, Interesting)

          by Anonymous Coward

          Tor makes no implication that exit node operators cannot read anything out the exit node, the only option for anyone using they system is to encrypt the traffic outside the scope of Tor.

      • They should have just secretly used the data for nefarious purposes, instead of publicizing the security hole. When will these people learn?

    • Re: (Score:3, Interesting)

      by scipiodog (1265802)

      I may be missing something, but isn't the whole point of tor that something like this isn't possible?

      If this actually points out flaws in tor that may have been missed, and the info is made publicly available, won't this help strengthen the system?

      • Re: (Score:1, Informative)

        by skinfaxi (212627)
        TFA explains that Tor itself doesn't do encryption. If you are using protocols that send name/pwd in clear text (like, FTP, POP, etc.), then Tor cheerfully passes those along. The most interesting thing they did IMO is seed the Tor traffic with honeypot clear text username/pwd combos and then watch for attempts to log in using those credentials, which happened almost immediately. There are hackers out there that are scooping up logins, taking advantage of the fact that people don't know (or don't care) how
      • TOR is not supposed to obfuscate your traffic - it doesn`t provide encryption. The sole purpose of TOR is to make it indistinguishable where did the packets come from. Anyway, if you`re using encryption, it doesn`t matter how many subverted exit nodes there are.
    • by TheRaven64 (641858) on Thursday July 24, 2008 @01:02PM (#24320923) Journal
      No problem, they just need to argue that, as operators of a Tor exit node, they are a telecoms company, then they get free retroactive immunity.
      • by praedor (218403)

        Game, set, match.

      • For them to get immunity, they need a magic letter.

        Hmm, I'm sure I've got one somewhere around here, as the FBI were handing out blank pre-signed ones a couple of weeks back.

    • by n1ckml007 (683046)
      Look at me; still talking when there's science to do! When I look out there, it makes me GLaD I'm not you. I've experiments to run. There is research to be done, on the people who are still alive. And believe me I am still alive. I'm doing science and I'm still alive. I feel fantastic and I'm still alive. While you're dying I'll be still alive. And when you're dead I will be still alive. Still alive. Still alive.
  • by miraboo (1164359) on Thursday July 24, 2008 @10:53AM (#24318695)
    The link to the study is borked. Correct link: http://www.cs.washington.edu/homes/yoshi/papers/Tor/PETS2008_37.pdf [washington.edu]
    • by Anonymous Coward on Thursday July 24, 2008 @12:35PM (#24320425)

      I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to. Amongst other things, the researchers warn that the design of the network can allow different actions by the same user to to be associated.

      They also warn about things that have led many to doubt the project from the start: that (in their language) 'misbehaving' nodes can be set up that could take a range of actions detrimental to users.

      Lest this be thought to be a hypothetical threat, consider this from their conclusion:

      >we developed a method for detecting malicious
      >logging exit routers, and provided evidence that
      >there are such routers that
      >speciïcally log insecure protocol exit traïfc

      They also note that while they ran their node, they received numerous accusations of illegal activity, traced to their node's IP address. This has always been a danger for node operators - this test confirms it is a real threat.

      Frankly, a reader of this report would be wise to reconsider Tor usage.

      • Re: (Score:3, Insightful)

        by novakyu (636495)

        I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to.

        I don't know where you get that idea. TOR developers are perfectly aware of TOR's limitations. They even warn you on their website [torproject.org].

        They say specifically,

        3. No anonymity system is perfect these days, and Tor is no exception: you should not rely solely on the current Tor network if you really need strong anonymity.

        And in the list of warnings,

        5. While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust.

        Nothing in this study is new or ground-breaking. While I am not familiar enough with TOR to say whether if it will even be marginally useful, but I won't be surprised if there is nothing in this study that TOR developers didn't know or suspect already.

  • by jeffb (2.718) (1189693) on Thursday July 24, 2008 @10:54AM (#24318699)
    ...music publishers?
  • not to worry (Score:5, Insightful)

    by pak9rabid (1011935) on Thursday July 24, 2008 @10:54AM (#24318703)

    ...the researchers could also face up to 5 years in jail for violating the Wiretap Act.

    I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.

    • Nope (Score:5, Insightful)

      by dreamchaser (49529) on Thursday July 24, 2008 @10:58AM (#24318775) Homepage Journal

      Not unless they have millions to spend on lobbyists.

    • Re:not to worry (Score:4, Insightful)

      by MBGMorden (803437) on Thursday July 24, 2008 @10:58AM (#24318785)

      I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.

      One could only hope. Fads tend to run their course and then quickly fade away. I have a bad feeling this is more of a long term trend.

    • Re:not to worry (Score:5, Insightful)

      by oahazmatt (868057) on Thursday July 24, 2008 @11:05AM (#24318905) Journal

      ...the researchers could also face up to 5 years in jail for violating the Wiretap Act.

      I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.

      For that to work there's a preset number of times that you must use "terrorist", "nine" and "eleven" in your reasoning.

    • Re:not to worry (Score:5, Insightful)

      by AmonEzhno (1276076) on Thursday July 24, 2008 @11:09AM (#24318959)
      It does seem excruciatingly telling how scientists are threatened with prosecution whereas Illegal Domestic spies are treated with what almost seems like respect by the Federal Government. Kind of a reflection on the state of science vs military these days. Though in all honestly they should not have been doing this in the first place, but it's not easy to know 100% where the line is in research sometimes. So it would seem to me the best idea would be to reprimand them think some kind of appropriate fine, and set a precedent. That way it would be clear for later issues. I don't want to be monitored without my permission, I Don't know about you guys, even if it is for science.
      • Re: (Score:3, Interesting)

        by huckamania (533052)

        Except for one blogger, no scientists have been threatened with prosecution. The article just says that they could be prosecuted, maybe, and that they should have run this by some lawyers and/or some oversight commitee.

        I hope they are not reprimanded and not fined because they clearly had no intention of wiretapping anyone and made no attempt to identify individuals or correlate their actions. 150 bytes of exit data barely gets them past the TCP/UDP and IP layers.

    • I don't think they'll get it, there are no mentions of "Think of the children", "Child Pornography", "Terrorism" or "For The Great And Glorious Freedom(TM) Of The USA!" within the study...
    • by spazdor (902907)

      Consistent with the 'Common Carrier' gambit we used to enforce on our telcos, perhaps the right answer is: yes they can snoop, but if they do, they are accessories to any criminal activity the exit node engages in.

  • by Hyppy (74366) on Thursday July 24, 2008 @10:55AM (#24318715)
    How could these researchers not know that they were engaging in illegal wiretapping?

    On the other hand, the story is hypothetical. No charges have been filed, and there's no real evidence that the government could give a flying flip.
    • by faloi (738831) on Thursday July 24, 2008 @11:01AM (#24318845)
      It sounds like, from the very cut down version of the story that's available at the link, they didn't want to go to the effort to find out. They probably figured (correctly) it'd be a huge hassle to go through all the hurdles to get the approvals they might need. Rather than dig into it, they talked amongst themselves and decided it wasn't a big deal. Regardless of FAQ containing legal advice to the contrary. They sought minimal outside advice, and may or may not have provided enough information for the third party to make a determination, but didn't pursue it.

      When engaging in activities that might be legal, but might be a felony...I'll go for safe over sorry any day.
      • Re: (Score:3, Insightful)

        by inviolet (797804)

        They probably realized there will be no such prosecution, because prosecution would draw attention to how easily Tor activity can be monitored and conclusions drawn from it. That kind of attention is a Bad Thing: any government would instead prefer that citizens believe that they have access to something which is secret and anonymous (but which is actually not).

        It's good to disrupt enemy communications. It's better to intercept enemy communications. It's best to eavesdrop on enemy communications when th

    • by somersault (912633) on Thursday July 24, 2008 @11:13AM (#24319021) Homepage Journal

      If the info is passing through their own network interface - by actual design of the Tor system, and not because they have done something devious - how is this analogous to wiretapping?

      Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).

      I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.

      • by Deagol (323173) on Thursday July 24, 2008 @11:31AM (#24319305) Homepage
        I, too, think this is a lame precedent. However, ownership of one end of the means of communication is no defense, as in some states where both parties must consent to recording phone calls. I'm not saying it's right, just that this is how it is in other cases.

        Having said that, anyone using TOR who actually trusts the exit nodes needs their head examined. There are exit nodes which are known to be hostile, and some operators have even publicly stated they have monitored traffic and captured login/password pairs. One should never, NEVER access anything via TOR that may correlate to their meatspace life. Either use the web read-only, or set up nym accounts on sites that require registration.

        • Re: (Score:3, Insightful)

          by somersault (912633)

          The thing is that you pay your phone company and have a contract with them, and at least in those states you will know that you have the chance of being monitored as it will be part of the contract. You also know that they won't just give out those recordings to just anyone (though the government or police will probably want it at some point).

          With TOR you have no contract or promise that no undesirables are listening in. There is no way of stopping someone snooping on exit nodes, so if these guys are punish

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        > Regardless of FAQ containing legal advice to the contrary.

        Well heck! It was in an FAQ? Goodness! They ignored an FAQ. This must be the first time ever in the history of the net.

        But seriously. The Tor people put a little note on their software saying: "Please don't monitor the network traffic of our uber-secret software", presumably because of a fear that publicity about the nature of the websites visited by Tor users would undermine support of the project.

        Quite frankly, that is a little like S/MIM

      • by Arccot (1115809)

        Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).

        I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.

        Think about that applied to your ISP's routers. You know your data is going through their routers. Should they be able to legally snoop on your VOIP calls, data transfers, and anything else you send through them?

        • Depends if it's in the contract, or if it's legal. I actually don't mind whether they're legally allowed to or not. It doesn't make much sense that they wouldn't be allowed to, seeing as it's their own hardware being used. If it's illegal for them to do so, that's nice, but I don't particularly see why it should be. It should be illegal for them to do anything malicious with the information, but why shouldn't they monitor what is going on in their own network?

          On the other hand, I wouldn't particularly want

      • by jgtg32a (1173373)
        Actually there is a chance that if someone breaks into your machine and you log their activities that they can hit you with the wiretapping act. Which is why the MOTD is usually something along the lines of authorized access only blah blah, which will help your case. http://www.honeynet.org/book/Chp8.pdf [honeynet.org] (page 4)
        • Actually there is a chance that if someone breaks into your machine and you log their activities that they can hit you with the wiretapping act

          Heh. That is so stupid that it's actually believable that it could stand up in court these days :) Like criminals suing the owners of the house they're breaking into when they trip up on something.. that may just be an urban legend though. I fail to see how logging your own computers activities could be an issue. Doesn't the fact that they are breaking the law to get into your system take precedent? How is you monitoring activities taking place on your own property illegal? Wouldn't that make all CCTV and a

      • by dr_d_19 (206418)

        Radio waves pass through ME and it is (at least in Sweden) illegal to listen in on the communications e.g, old non-DECT wireless phones.

    • If you are reading this, then you are illegally wiretapping my Slashdot messages by intercepting them with your eyes. Hope you like jail time.
    • Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.

      If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:

      * Just about everything done by CAIDA [caida.org].
      * The papers at IMC [imconf.net] - the Internet Me

    • Hardly.  They allowed others to use _their_ computer resources.  Next time use SSL over Tor.
  • by denis-The-menace (471988) on Thursday July 24, 2008 @10:55AM (#24318731)

    Apparently, US Telcos can snoop all they want and it's perfectly legal, now!

  • OT factoid... (Score:5, Interesting)

    by Anonymous Coward on Thursday July 24, 2008 @10:56AM (#24318763)

    Interestingly, I was once banned from /. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.

    The /. admins were very nice and restored my access almost immediately but I found the whole process interesting.

    • Re: (Score:3, Interesting)

      by zippthorne (748122)

      Y'know, it's entirely possible you were banned for volume of traffic related to the tor node, and that they would have restored your access anyway, once it became apparant that that volume was due to tor and not due to you having dozens of sock puppets.

      • Re:OT factoid... (Score:5, Informative)

        by Anonymous Coward on Thursday July 24, 2008 @11:41AM (#24319473)

        Nope. Slashdot banned tor openly, as do most online discussion systems that don't want to be flooded by endless bots.

        You either ban all tor users or you allow all tor users, since any one user can just reconnect through every tor node to evade ip bans(allowing them to create new accounts if their old one was banned). Most places would rather be able to ban users, so they disallow tor exit nodes.

  • by damonlab (931917) on Thursday July 24, 2008 @10:59AM (#24318801)
    What is the difference between what they did and say leaving your wifi access point open to snoop on anybody that might connect to that? Either way, the other people chose to actively connect to YOUR equipment. If it is your equipment, you should have every right to monitor it in any way you see fit.
    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Yeah and in the AT&T wiretap scandal, the callers chose to actively send electrons through the snooping device.

    • by Amorymeltzer (1213818) on Thursday July 24, 2008 @11:23AM (#24319175)

      The problem is monitoring the communication itself. You can't just pick up the phone and tape record someone without their permission, or pick up a camera and videotape them. By saving the first 150b of each transmission, they were technically doing this.

      TFA does a pretty good job of explaining all the varies angles - from participation without permission to individuals under 18 to international issues - but they're coming up against a number of laws, such as the Wiretap Act, which is specifically aimed at this sort of thing.

      What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same? If they can do it, surely the Chinese government could be doing the same, using it to catch all those pro-democracy bloggers. The US could (and would) definitely use this, so what's stopping them, assuming they aren't already doing it?

      • by compro01 (777531)

        You can't just pick up the phone and tape record someone without their permission

        Actually, you can do just that in a majority of the US. Only California, Connecticut, Delaware, Florida, Massachusetts, Maryland, Michigan, Montana, New Hampshire, Pennsylvania, and Washington require 2 party notification when recording a phone call.

        Though in this case, all they have are "many people who use tor are from these places" and "people using tor often do these things", but no way to link who is doing what, as per the design of the network, as they would have to control all 7(?) nodes

      • by Kjella (173770)

        What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same?

        Nothing. Those that think otherwise have fundamentally misunderstood TOR. It provides me (the end-user) the ability to get or send information from any server (through exit nodes) without anyone knowing my identity. Any information in the traffic should be considered compromised since it went unencrypted through untrusted nodes, unless otherwise secured. It's like an anonymous postcard with an anonymous return address, but still a postcard anyone could read.

  • by Snap E Tom (128447) on Thursday July 24, 2008 @11:01AM (#24318837)

    Don't wiretap. The government hates competition.

  • Hey, with the way our country has been heading, this would be great resume material - even if convicted. Its not like they lost a database of SSNs...
  • Fire them (Score:2, Insightful)

    by thesaurus (1220706)
    As a social science undergrad, I had it drilled into my brain the importance of IRB's. Not following the review process can threaten your schools federal funding. Any grad student or professor should know better, regardless of their discipline.
    • IRB? (Score:3, Interesting)

      by story645 (1278106) *

      As a social science undergrad,

      Which means most of your research probably involves human subjects (assuming it involves some new data collection), so of course you have to get approval. I know all about IRB from psych courses for the same reason.

      Most comp sci prof rarely run human subjects (or consider that they data they're looking at comes from human subjects) and therefore often don't need to get IRB approval. The only comp sci field that I can think of that regularly would run human subjects is HCI, and even most of those studies cou

  • No possible jail (Score:2, Interesting)

    by tshetter (854143)

    These researchers are never going to be arrested or charged with anything.

    They didnt do anything illegal.

    All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.

    For 4 days in December 2007, they logged and stored the first 150 bytes of each network packet that crossed their network...
    • Re: (Score:3, Insightful)

      by wild_quinine (998562)

      They didnt do anything illegal. All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.

      At which point did it become legal to read emails that were being passed through your relay?

      • by Zerth (26112)

        At what point did it become illegal to inspect data coming through your network?

        Cause I'd like to use that law against my ISP when they use deep packet inspection to filter my connection or insert ads into webpages I'm viewing.

  • I thought this section was particularly funny:

    Since we are forwarding traffic on behalf of Tor users, our routerâ(TM)s IP address appears to be the source of sometimes malicious traffic. The large amount of exit bandwidth that we provided caused us to receive a large number of complaints ranging from DMCA Â512 notices related to allegations of copyright infringement, reported hacking attempts, IRC bot network controls, and web page defacement. However, an enormous amount of malicious client activity was likely unreported.

    Did they really not see that one coming??

    • by Machtyn (759119)
      Stating the obvious is a very good way to pad those reports. Especially when the professor is looking for pages of documentation. Plus, this was a finding that may have supported or contradicted a theory. In any case, it's worthy of being included in a report.
  • "The researchers neither sought legal review of the project nor ran it past their Institutional Review Board."

  • ...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.

    Oh well, thanks to the government, the **AA people, and idiots like this, such networks are coming... and where once terrorists, organized crime, and other ne'er do wells had to pay some geeks for serious work to make secure

    • I fail to see how the government or any of the others you named are responsible for Tor being insecure.

      Tor is an example of why layers of security are not cumalative. The weakest link is not strengthened by putting a plastic sleeve around the chain or putting a bigger lock on the end.

      Could you please provide a link to the coming open source secure network, cause I've never heard of such a thing and would love to take a look at it.

    • by exley (221867) on Thursday July 24, 2008 @12:04PM (#24319915) Homepage

      ...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.

      Tor does encrypt data passing through the network, and it does obfuscate the source and destination... That's kind of the whole point. But unless the traffic is inherently encrypted (e.g. SSL), the exit node has to spit out unencrypted data, otherwise the final destination would have no idea as to what it was receiving.

  • and don't want to be found out, so it can be patched. Then they would have to start all over.

  • Failing to submit this study to the Institutional Review Board is a *huge* professional no-no! One of the major functions of the IRB is to ensure that research doesn't violate subjects rights -- particularly confidentiality and privacy rights (which could, I suppose, be why they didn't submit it). Even if the government decides to the let them slide (unlikely with a case of wiretapping), this has ramifications for the Universities. It can lead to the US Dept. of Education shutting down *all* of their res
    • by MikeURL (890801)
      I think IRB is only required when there is a chance that the subjects could be individually identified or harmed. In this case the nature of the TOR network makes that virtually impossible. I don't see the IRB issue. Wiki has the relevant exemption:

      2. Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless:

      1. information obtained is recorded in such a manner that human subjects can

  • That's ridiculous! Wiretaping should be strictly defined as actually physically connecting your equipment to a wire you don't own or lease. TCP/IP is strictly point-to-point. If they got your information via Tor, it's because you ran software that specifically sent information to their IP address (or some other IP the subsequently passed it to them). If you used Tor not knowing this, that's your own fault, not theirs. If you assumed the information was undecipherable but they found that it wasn't, that's al

  • Joseph Javorski. Respected scientist. Touch a button. Things happen. A scientist becomes a beast. Shockwaves of an A-bomb. A once powerful, humble man. Reduced toâ¦nothing. Joseph Javorski. Respected scientist. Now a fiend. Prowling the wastelands. A prehistoric beast in a nuclear age. Kill. Kill, just to be killing.

  • Bush made me do it.

  • I like to take my wireless laptop and check the nodes in the UW Tower as I climb the stairs.

    Are you saying it's not research?

    Because I work in research at the UW, so it must be science ...

    Right?

  • by void* (20133) on Thursday July 24, 2008 @01:27PM (#24321475)

    IANAL, but following the link from the article to
    18 USC 2511, reading 2(d)

    "It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."

    Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?

    I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication ...

  • stupidity (Score:3, Insightful)

    by speedtux (1307149) on Thursday July 24, 2008 @02:33PM (#24322859)

    Anyone who assumes that Tor exit nodes aren't heavily monitored by lots of three letter agencies, private companies, and researchers is a fool.

    If Tor's utility depended on legal protections, it would be a lost cause. What Tor actually does for you is obscure your IP address, nothing more and nothing less. That is very useful. But you still need to make sure that your content is clean. That's why Tor is often used with software like Privoxy.

    If anybody actually goes after these security researchers, it's not to protect the privacy of Tor users, it's to prevent the researchers for alerting Tor users to protecting their identity better, because once 99.9% of the Tor traffic is encrypted, listening in becomes much less useful.

  • Thy name is government. Thanks for the laughs, America. Keep the hypocrisy factory running. You already have God's President, you might as well formalize the division of your legal system into one manipulable side for corporations, and an uncaring inflexible side for the citizenry.
  • by BitterOak (537666) on Thursday July 24, 2008 @03:59PM (#24324493)
    The headline of the article certainly implies, even if it doesn't actually state, that these researches are actually facing charges. According to the article referenced, there is no mention whatsoever of any criminal investigation, or any evidence that these researchers have even been contacted by authorities. As far as I can tell, the entire article is based on speculation by the EFF and others. It is hard to imagine that wiretapping laws would apply here since (a) the researchers running the exit node are offering a free service and are not in the networking "business", (b) people running Tor voluntarily send their data out to Tor nodes, (c) as an exit node operator, these researchers probably cannot identify the actual people engaging in this communication (at least that should be the case if Tor is running properly), and (d) the study they released only shows aggregate data, and doesn't reveal the private communications of individual users. Doesn't there have to be a specific victim in order for wiretapping charges to apply? (IANAL, I'd love to hear from lawyers on this point.) How is this different from any other network usage study?
  • So the Bush government might launch prosecutions for illicit surveillance? What a strange time for them to start taking an interest in this issue.
  • I still go by the old Electronic Communications Privacy act of 1986.. which basically states that as an administrator, I can monitor the activity of my network for the purposes of administration. This includes private communication.

    DMCA be damned. If you send it to me, I can read it.

    IOW, if I can read it, I can read it.
  • testing (Score:2, Insightful)

    by lbane (1329209)

    testing

"Gotcha, you snot-necked weenies!" -- Post Bros. Comics

Working...