Researchers Face Jail Risk For Tor Snooping Study 121
An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."
You can't jail them@ (Score:3, Funny)
Re:You can't jail them@ (Score:5, Funny)
I guess if they get jail time, the lesson to learn is "Do as I say, not as I do."
Re: You can't jail them (Score:5, Insightful)
Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.
If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:
* Just about everything done by CAIDA [caida.org].
* The papers at IMC [imconf.net] - the Internet Measurement Conference.
* Data at CRAWDAD [dartmouth.edu] - the Community Resource for Archiving Wireless Data at Dartmouth.
A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.
Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.
Re: (Score:2)
I second that. I have done similar research myself (albeit not in the US) and all the papers only based on small traces, like an academioc departement routers are not really that significant.
Something else TFA doesn't have... (Score:2, Insightful)
Re: (Score:1)
Re: (Score:1, Redundant)
Albeit in a very unprofessional manner.
Re:You can't jail them@ (Score:5, Funny)
Re:You can't jail them@ (Score:5, Insightful)
Speaking of the Bush administration and violating wiretapping laws...
Re: (Score:2)
To get off they'd either have to be part of the Administration, a Banker, or one of his major donors.
Re: (Score:2)
Re: (Score:1)
But seriously the way the administration treats scientific pursuit you'd think we were at war with it.
Re: (Score:2, Insightful)
If you do a legitimate study on the effects of different strains of marijuana, and control the genetics by growing the pot yourself, without all the impossible to get paperwork and permissions, you're going to prison.
Why should these guys be any different? In the case of the reefer nobody's hared, in these guys' cases they invaded innocent people's privacy. Not only were their actions illegal, they were highly unethical.
Re:You can't jail them@ (Score:5, Interesting)
How is their study either unethical, or illegal as you have claimed? Ignoring your hypothetical marijuana study as completely irrelevant you seem to have missed the key points in what they did.
They did not run a "wiretap" as claimed. They monitored the traffic at a tor node that they controlled. People willingly sent them the information that was supposed to be private.
Their study is a scientific investigation into whether the privacy claims of Tor can be sustained. They cannot - the system is open to abuse. This is an entirely ethical study into the claims made by Tor, and furthermore this is exactly how good empirical science should work.
Re: (Score:1, Interesting)
Tor makes no implication that exit node operators cannot read anything out the exit node, the only option for anyone using they system is to encrypt the traffic outside the scope of Tor.
No good deed goes unpunished (Score:1, Insightful)
They should have just secretly used the data for nefarious purposes, instead of publicizing the security hole. When will these people learn?
Re: (Score:3, Interesting)
I may be missing something, but isn't the whole point of tor that something like this isn't possible?
If this actually points out flaws in tor that may have been missed, and the info is made publicly available, won't this help strengthen the system?
Re: (Score:1, Informative)
Re: (Score:1)
Re:You can't jail them@ (Score:5, Funny)
Re: (Score:2)
Game, set, match.
Re: (Score:1)
For them to get immunity, they need a magic letter.
Hmm, I'm sure I've got one somewhere around here, as the FBI were handing out blank pre-signed ones a couple of weeks back.
Re: (Score:1)
Correct link to study (Score:5, Informative)
Re:Correct link to study (Score:4, Informative)
I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to. Amongst other things, the researchers warn that the design of the network can allow different actions by the same user to to be associated.
They also warn about things that have led many to doubt the project from the start: that (in their language) 'misbehaving' nodes can be set up that could take a range of actions detrimental to users.
Lest this be thought to be a hypothetical threat, consider this from their conclusion:
>we developed a method for detecting malicious
>logging exit routers, and provided evidence that
>there are such routers that
>speciïcally log insecure protocol exit traïfc
They also note that while they ran their node, they received numerous accusations of illegal activity, traced to their node's IP address. This has always been a danger for node operators - this test confirms it is a real threat.
Frankly, a reader of this report would be wise to reconsider Tor usage.
Re: (Score:3, Insightful)
I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to.
I don't know where you get that idea. TOR developers are perfectly aware of TOR's limitations. They even warn you on their website [torproject.org].
They say specifically,
3. No anonymity system is perfect these days, and Tor is no exception: you should not rely solely on the current Tor network if you really need strong anonymity.
And in the list of warnings,
5. While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust.
Nothing in this study is new or ground-breaking. While I am not familiar enough with TOR to say whether if it will even be marginally useful, but I won't be surprised if there is nothing in this study that TOR developers didn't know or suspect already.
Yeah, who do those "researchers" think they are... (Score:5, Funny)
not to worry (Score:5, Insightful)
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
Nope (Score:5, Insightful)
Not unless they have millions to spend on lobbyists.
Re:not to worry (Score:4, Insightful)
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
One could only hope. Fads tend to run their course and then quickly fade away. I have a bad feeling this is more of a long term trend.
Re:not to worry (Score:5, Insightful)
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
For that to work there's a preset number of times that you must use "terrorist", "nine" and "eleven" in your reasoning.
Re: (Score:1)
Re:not to worry (Score:4, Funny)
No, you just have to hand over $9.11 to Congress.
They're cheap now.
Re: (Score:1)
Re: (Score:2)
"protect" and "children" together also works.
Re:not to worry (Score:5, Insightful)
Re: (Score:3, Interesting)
Except for one blogger, no scientists have been threatened with prosecution. The article just says that they could be prosecuted, maybe, and that they should have run this by some lawyers and/or some oversight commitee.
I hope they are not reprimanded and not fined because they clearly had no intention of wiretapping anyone and made no attempt to identify individuals or correlate their actions. 150 bytes of exit data barely gets them past the TCP/UDP and IP layers.
Re: (Score:2)
Re: (Score:2)
Consistent with the 'Common Carrier' gambit we used to enforce on our telcos, perhaps the right answer is: yes they can snoop, but if they do, they are accessories to any criminal activity the exit node engages in.
Re: (Score:2, Insightful)
It depends on the information. Can I have your Social Security number, your bank account number and debit card PIN number? You don't even wat your name posted; not even your slashdot user name!
Sharing SOME knowedge is good, sharing other knowledge is bad. Your anonymous cries of slashdot hypocricy ring hollow.
They can't be stupid. (Score:5, Interesting)
On the other hand, the story is hypothetical. No charges have been filed, and there's no real evidence that the government could give a flying flip.
Re:They can't be stupid. (Score:5, Informative)
When engaging in activities that might be legal, but might be a felony...I'll go for safe over sorry any day.
Re: (Score:3, Insightful)
They probably realized there will be no such prosecution, because prosecution would draw attention to how easily Tor activity can be monitored and conclusions drawn from it. That kind of attention is a Bad Thing: any government would instead prefer that citizens believe that they have access to something which is secret and anonymous (but which is actually not).
It's good to disrupt enemy communications. It's better to intercept enemy communications. It's best to eavesdrop on enemy communications when th
Re:They can't be stupid. (Score:5, Insightful)
If the info is passing through their own network interface - by actual design of the Tor system, and not because they have done something devious - how is this analogous to wiretapping?
Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).
I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.
Re:They can't be stupid. (Score:4, Insightful)
Having said that, anyone using TOR who actually trusts the exit nodes needs their head examined. There are exit nodes which are known to be hostile, and some operators have even publicly stated they have monitored traffic and captured login/password pairs. One should never, NEVER access anything via TOR that may correlate to their meatspace life. Either use the web read-only, or set up nym accounts on sites that require registration.
Re: (Score:3, Insightful)
The thing is that you pay your phone company and have a contract with them, and at least in those states you will know that you have the chance of being monitored as it will be part of the contract. You also know that they won't just give out those recordings to just anyone (though the government or police will probably want it at some point).
With TOR you have no contract or promise that no undesirables are listening in. There is no way of stopping someone snooping on exit nodes, so if these guys are punish
Re: (Score:2)
On the one hand, we have an oligopoly of carriers that the public should be able to safely assume is honest and watched over closely by regulators. Due to their power and reach and (presumed) government oversight, we should be able to trust the telcos to do no harm (recent legislation aside). And on the other hand, we have a rag-tag confederation of volunteered servers with no specific charter, ethic, no terms of service, and no oversight -- nobody with an ounce of common sen
Re: (Score:2)
If this witch hunt gets out of hand, we can expect to see prosecutions for "wiretapping" in cases where suspicious wives install keyloggers to snare their husbands.
From my understanding, it is legal for the wife to 'monitor' the usage of the computer because it is a shared property, aka while they are married she claims ownership of it. Now if she installed the keylogger on a computer (laptop for example) that was owned by his company, but he carried around, she would be in violation.
Re: (Score:2, Interesting)
> Regardless of FAQ containing legal advice to the contrary.
Well heck! It was in an FAQ? Goodness! They ignored an FAQ. This must be the first time ever in the history of the net.
But seriously. The Tor people put a little note on their software saying: "Please don't monitor the network traffic of our uber-secret software", presumably because of a fear that publicity about the nature of the websites visited by Tor users would undermine support of the project.
Quite frankly, that is a little like S/MIM
Re: (Score:2)
Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).
I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.
Think about that applied to your ISP's routers. You know your data is going through their routers. Should they be able to legally snoop on your VOIP calls, data transfers, and anything else you send through them?
Re: (Score:2)
Depends if it's in the contract, or if it's legal. I actually don't mind whether they're legally allowed to or not. It doesn't make much sense that they wouldn't be allowed to, seeing as it's their own hardware being used. If it's illegal for them to do so, that's nice, but I don't particularly see why it should be. It should be illegal for them to do anything malicious with the information, but why shouldn't they monitor what is going on in their own network?
On the other hand, I wouldn't particularly want
Re: (Score:1)
Re: (Score:2)
Actually there is a chance that if someone breaks into your machine and you log their activities that they can hit you with the wiretapping act
Heh. That is so stupid that it's actually believable that it could stand up in court these days :) Like criminals suing the owners of the house they're breaking into when they trip up on something.. that may just be an urban legend though. I fail to see how logging your own computers activities could be an issue. Doesn't the fact that they are breaking the law to get into your system take precedent? How is you monitoring activities taking place on your own property illegal? Wouldn't that make all CCTV and a
Re: (Score:2)
Radio waves pass through ME and it is (at least in Sweden) illegal to listen in on the communications e.g, old non-DECT wireless phones.
Re: (Score:2)
I don't get why people are comparing Tor to paid-for services and networks like ISPs and Telcos at all, it's like comparing a professional sports match with a professional referee to a game out in a public place that has no referee. You can't apply the same laws to it when it is just a bunch of people getting together without any contractual obligements or governing authority.
Presumably if they are monitoring you then it will say in your contract. The whole net neutrality thing is an ongoing debate at the m
Re: (Score:2)
That and run for congress.
Would that work seeing as I'm a British citizen? ;) Get Arnie in there, he'll set them straight. He doesn't just know about present tech, he knows about the future too!
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.
If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:
* Just about everything done by CAIDA [caida.org].
* The papers at IMC [imconf.net] - the Internet Me
Re: (Score:2)
Re: (Score:3, Interesting)
Well its not really illegal! All the data is being sent over the researchers computers unencrypted!
Just because a medium is not encrypted doesn't mean it's legal to listen in on it. Your phone line is unencrypted.
Tor even states that the communication isn't secure after it hits the last "exit node" and warns users that they should not use it for security but anonymity!
"Isn't secure" in this context refers to the fact that it is not encrypted in any way. Refer to the previous argument.
It is perfectly legal to capture data which is sent to or from your personal computer/network!!!
When did TOR become your personal network?
Should have tried to get jobs at telco, first. (Score:5, Insightful)
Apparently, US Telcos can snoop all they want and it's perfectly legal, now!
Re: (Score:2)
We have the best legislators money can buy!
OT factoid... (Score:5, Interesting)
Interestingly, I was once banned from /. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.
The /. admins were very nice and restored my access almost immediately but I found the whole process interesting.
Re: (Score:3, Interesting)
Y'know, it's entirely possible you were banned for volume of traffic related to the tor node, and that they would have restored your access anyway, once it became apparant that that volume was due to tor and not due to you having dozens of sock puppets.
Re:OT factoid... (Score:5, Informative)
Nope. Slashdot banned tor openly, as do most online discussion systems that don't want to be flooded by endless bots.
You either ban all tor users or you allow all tor users, since any one user can just reconnect through every tor node to evade ip bans(allowing them to create new accounts if their old one was banned). Most places would rather be able to ban users, so they disallow tor exit nodes.
if it is your equipment... (Score:4, Insightful)
Re: (Score:1, Insightful)
Yeah and in the AT&T wiretap scandal, the callers chose to actively send electrons through the snooping device.
Re:if it is your equipment... (Score:4, Interesting)
The problem is monitoring the communication itself. You can't just pick up the phone and tape record someone without their permission, or pick up a camera and videotape them. By saving the first 150b of each transmission, they were technically doing this.
TFA does a pretty good job of explaining all the varies angles - from participation without permission to individuals under 18 to international issues - but they're coming up against a number of laws, such as the Wiretap Act, which is specifically aimed at this sort of thing.
What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same? If they can do it, surely the Chinese government could be doing the same, using it to catch all those pro-democracy bloggers. The US could (and would) definitely use this, so what's stopping them, assuming they aren't already doing it?
Re: (Score:2)
You can't just pick up the phone and tape record someone without their permission
Actually, you can do just that in a majority of the US. Only California, Connecticut, Delaware, Florida, Massachusetts, Maryland, Michigan, Montana, New Hampshire, Pennsylvania, and Washington require 2 party notification when recording a phone call.
Though in this case, all they have are "many people who use tor are from these places" and "people using tor often do these things", but no way to link who is doing what, as per the design of the network, as they would have to control all 7(?) nodes
Re: (Score:2)
What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same?
Nothing. Those that think otherwise have fundamentally misunderstood TOR. It provides me (the end-user) the ability to get or send information from any server (through exit nodes) without anyone knowing my identity. Any information in the traffic should be considered compromised since it went unencrypted through untrusted nodes, unless otherwise secured. It's like an anonymous postcard with an anonymous return address, but still a postcard anyone could read.
Update to the old saying... (Score:5, Funny)
Don't wiretap. The government hates competition.
Resume (Score:1)
Fire them (Score:2, Insightful)
IRB? (Score:3, Interesting)
As a social science undergrad,
Which means most of your research probably involves human subjects (assuming it involves some new data collection), so of course you have to get approval. I know all about IRB from psych courses for the same reason.
Most comp sci prof rarely run human subjects (or consider that they data they're looking at comes from human subjects) and therefore often don't need to get IRB approval. The only comp sci field that I can think of that regularly would run human subjects is HCI, and even most of those studies cou
No possible jail (Score:2, Interesting)
These researchers are never going to be arrested or charged with anything.
They didnt do anything illegal.
All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.
For 4 days in December 2007, they logged and stored the first 150 bytes of each network packet that crossed their network...
Re: (Score:3, Insightful)
They didnt do anything illegal. All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.
At which point did it become legal to read emails that were being passed through your relay?
Re: (Score:2)
At what point did it become illegal to inspect data coming through your network?
Cause I'd like to use that law against my ISP when they use deep packet inspection to filter my connection or insert ads into webpages I'm viewing.
From TFA.... (Score:1)
Since we are forwarding traffic on behalf of Tor users, our routerâ(TM)s IP address appears to be the source of sometimes malicious traffic. The large amount of exit bandwidth that we provided caused us to receive a large number of complaints ranging from DMCA Â512 notices related to allegations of copyright infringement, reported hacking attempts, IRC bot network controls, and web page defacement. However, an enormous amount of malicious client activity was likely unreported.
Did they really not see that one coming??
Re: (Score:2)
grammar: nor (Score:2)
"The researchers neither sought legal review of the project nor ran it past their Institutional Review Board."
All this proves is... (Score:1, Insightful)
...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.
Oh well, thanks to the government, the **AA people, and idiots like this, such networks are coming... and where once terrorists, organized crime, and other ne'er do wells had to pay some geeks for serious work to make secure
Re: (Score:2)
I fail to see how the government or any of the others you named are responsible for Tor being insecure.
Tor is an example of why layers of security are not cumalative. The weakest link is not strengthened by putting a plastic sleeve around the chain or putting a bigger lock on the end.
Could you please provide a link to the coming open source secure network, cause I've never heard of such a thing and would love to take a look at it.
Re:All this proves is... (Score:5, Insightful)
...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.
Tor does encrypt data passing through the network, and it does obfuscate the source and destination... That's kind of the whole point. But unless the traffic is inherently encrypted (e.g. SSL), the exit node has to spit out unencrypted data, otherwise the final destination would have no idea as to what it was receiving.
Maybe the Feds broke the encryption (Score:1)
and don't want to be found out, so it can be patched. Then they would have to start all over.
They have more than the law to worry about . . . (Score:2, Informative)
Re: (Score:2)
But they didn't "tap" any "wires"... (Score:2)
That's ridiculous! Wiretaping should be strictly defined as actually physically connecting your equipment to a wire you don't own or lease. TCP/IP is strictly point-to-point. If they got your information via Tor, it's because you ran software that specifically sent information to their IP address (or some other IP the subsequently passed it to them). If you used Tor not knowing this, that's your own fault, not theirs. If you assumed the information was undecipherable but they found that it wasn't, that's al
Tor... Snooping? (Score:2)
Joseph Javorski. Respected scientist. Touch a button. Things happen. A scientist becomes a beast. Shockwaves of an A-bomb. A once powerful, humble man. Reduced toâ¦nothing. Joseph Javorski. Respected scientist. Now a fiend. Prowling the wastelands. A prehistoric beast in a nuclear age. Kill. Kill, just to be killing.
My defense is unstoppable (Score:2, Troll)
Bush made me do it.
So does this mean I can't wargang at the UW? (Score:1)
I like to take my wireless laptop and check the nodes in the UW Tower as I climb the stairs.
Are you saying it's not research?
Because I work in research at the UW, so it must be science ...
Right?
Are they really not covered, though? (Score:4, Interesting)
IANAL, but following the link from the article to
18 USC 2511, reading 2(d)
"It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."
Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?
I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication ...
stupidity (Score:3, Insightful)
Anyone who assumes that Tor exit nodes aren't heavily monitored by lots of three letter agencies, private companies, and researchers is a fool.
If Tor's utility depended on legal protections, it would be a lost cause. What Tor actually does for you is obscure your IP address, nothing more and nothing less. That is very useful. But you still need to make sure that your content is clean. That's why Tor is often used with software like Privoxy.
If anybody actually goes after these security researchers, it's not to protect the privacy of Tor users, it's to prevent the researchers for alerting Tor users to protecting their identity better, because once 99.9% of the Tor traffic is encrypted, listening in becomes much less useful.
Irony (Score:2)
Article is misleading (Score:4, Insightful)
The irony cannot even be charted (Score:1)
This is all rediculus. What law are they breaking? (Score:1)
DMCA be damned. If you send it to me, I can read it.
IOW, if I can read it, I can read it.
testing (Score:2, Insightful)
testing