Tor Project Claims FBI Paid University Researchers $1m To Unmask Tor Users 108
An anonymous reader writes: Have Carnegie Mellon University researchers been paid by the FBI to unmask a subset of Tor users so that the agents could discover who operated Silk Road 2.0 and other criminal suspects on the dark web? Tor Project Director Roger Dingledine believes so, and says that they were told by sources in the information security community that the FBI paid at least $1 million for the service.
From the article:
"There is no indication yet that they had a warrant or any institutional oversight by Carnegie Mellon's Institutional Review Board. We think it's unlikely they could have gotten a valid warrant for CMU's attack as conducted, since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once," noted Dingledine.
"Such action is a violation of our trust and basic guidelines for ethical research. We strongly support independent research on our software and network, but this attack crosses the crucial line between research and endangering innocent users," he pointed out.
Re: I paid the FBI (Score:3, Funny)
Should have used Sudo.
Re: (Score:1)
kgiii@kgiii-desktop-8:~$ sudo make girl
[sudo] password for kgiii:
make: *** No rule to make target 'girl'. Stop.
Re: (Score:2)
Re: (Score:1)
Frankly, is there anyone who could be considered an innocent user of silk road 2.0?
Re: (Score:1)
Re: (Score:2)
Oh? Please enlighten me on the legal uses for Silk Road 2.0. It is after all an illegal marketplace, so how could there be a possible legal use for an illegal marketplace?
Re: (Score:2)
If they are breaking the law, they are guilty of a crime. Therefore, the FBI's job to investigate crime should fall on those breaking the law in Silk Road just as much as on the street corner.
Re: (Score:1)
Yes! The FBI now knows that judges are using TOR to watch PR0N on gubbermint puters!
Re:News At Eleven (Score:5, Insightful)
News at 11:30.
Re:News At Eleven (Score:5, Insightful)
'Consultants' perform wide-scale, warrantless, attack against large number of individuals not even suspected of wrongdoing on behalf of FBI under the guise of 'research'(probably not IRB approved); FBI thanks them for their assistance and introduces the fruits of an operation that would have been dubiously legal in scope even with a warrant; much less without one.
I'm the first to complaint about warrantless search of Americans, but I don't think this qualifies. If you're going to install software on computers you don't own in order to capture information, you need a warrant. If you're going to ask a private company to hand over data on their users, you need a warrant. If you're going to capture information that passes through your own hardware, even if it's encrypted, that's fair game. If you find a way to break the anonymizing network by creating your own fake relays to do it, as far as my judgement goes, the data was yours to play with, because it passed through your relays, and the research was legitimate, because you did find a flaw on the network.
The only thing I see wrong with this entire operation is that we have laws against what people can or can't take. It's their life, their bodies, their decision, and the FBI is wasting resources going after people who pose no danger to society (at least as far as Silk Road 2.0. The first Silk Road had the guy in charge trying to hire a hit man. Definitely not just a drugs thing. The investigation was legit, the research was legit, and it gives the Tor Project something to think about as far as improving their network.
Re: (Score:2)
A bunch of defendants... (Score:3, Insightful)
Sure but this isn't just about making the FBI play nice and stop cheating. This is about a bunch of defendants at risk of being convicted on evidence that should not be admissible without a warrant or that was only subsequently obtainable because of the information illegally obtained without a warrant and therefore also should not be admissible.
No, it's not about the defendants. The defendants did something illegal. That's about drug policy.
This is about everyone *other* than the defendants, who might be the victim of an illegal search by the state tomorrow.
Courts don't exclude evidence obtained from an illegal search in order to protect defendants. They do it to protect everyone else. They don't have the physical power to make police act legally on the street (cops have to consent to do that), but they do have the power to let defendants go w
Re: (Score:2)
The reality is that everyone breaks the law every day. You probably broke half a dozen laws you don't even know exist today. It is actually more important that law enforcement fail to enforce the law 99.999% of the time due to limitations placed
Re: (Score:2)
Like seizing Tormail and using it to install malware in Tor users browsers? I agree, the FBI should be putting some of their own in federal prison for these crimes the same as anyone else would be. If anything police should be punished more severely for breaking the law than anyone else. Anyone they hire should have the same limitations imposed and any information gathered from third parties
Re: (Score:2)
Like seizing Tormail and using it to install malware in Tor users browsers? I agree, the FBI should be putting some of their own in federal prison for these crimes the same as anyone else would be. If anything police should be punished more severely for breaking the law than anyone else.
I'm not familiar with that case, but if they did so without a warrant, then yes, absolutely. I agree entirely with your sentiment, I do think law enforcement should be held even more strictly to the laws than everyone else.
Re: (Score:2)
What are your thoughts on warrantless use of stingray?
Re: (Score:2)
What are your thoughts on warrantless use of stingray?
That's a very good analogy, and I had to go read about how it works in order to answer your question.
I think I'm ok with the use of stingray to intercept communications as it happens today, but think it should be treated as a security flaw and the method shouldn't work in the future. It works by forcing nearby cell phones to connect to it, but in order for the call to be completed it must also connect to a legitimate cell phone tower in a man-in-the-middle attack.
Ideally, the cell phone companies should fi
Re: (Score:2)
I wonder how the cops would feel about it if I merely took advantage of a protocol weakness to listen in on their radios... Or how the DOJ would feel if I merely took advantage of a protocol weakness to listen in on their phone calls. If their reaction would be anything but "carry on, fair's fair", then they need a warrant.
More generally, there are a great many exploitable security flaws in our society that police require a warrant to exploit. For example, there are very few locks that are really even pick
Re: (Score:3)
So using Stingrays to capture data and voice content is fair game?
Re: (Score:2)
So how is paying someone else to do something different from doing it yourself anyway?
They are acting... on your request. You are using them, as a tool, to perform the action, and using department funds to compensate them. Acting via a proxy is still acting.
In fact, its involving them in a criminal conspiracy, as conspiracy to commit a criminal act is, itself, a crime. Everyone involved should be facing felony charges.
Re: (Score:2)
Re: (Score:2)
Funny how if I hire someone to do something, they are legally treated as my proxy and so I can only hire them to do something I can legally do and if they cross the line, accountability can come back to me.
Re: (Score:2)
Felony charges from breaking what law, exactly?
What did anyone at the FBI or the university do that was illegal? Tracked a bunch of packets going through their own Tor relays and figured out where it was going and where it came from?
Just like finding a random packet on the internet and looking at the IP header data? It's the same concept.
Re: (Score:2)
Re: (Score:2)
Pardon me, but is there a law in the US that the government can't break people's encryption (for any reason)? I'd say the more pertinent question was if the data being decrypted was acquired legally (AKA from nodes owned by a willing third party) or if that traffic was intercepted.
More importantly, is there any assumption of anonymity using a tool running through specifically anonymous peers over public/private pipes ever considered private? If I ran exit nodes to tor and I offered the service of reposting
Re: (Score:2)
If the data was lawfully seized, then there is nothing to prevent attempting decryption. Further, encryption does *not* create an expectation of privacy under US law.
http://papers.ssrn.com/sol3/pa... [ssrn.com]
Re: (Score:3)
The restrictions on law enforcement should carry over to anyone working with them and the admissibility of anything found that way in court should be the same as if the FBI had carried out those actions themselves..
Re: (Score:2)
As I understand it, what you want is true. If I break into your house and discover evidence that you've been transporting underage ferrets across state lines for immoral purposes, that's admissible evidence. If anyone in the police hints to me that I should break into your house, the evidence is inadmissible. The only way for the police to cause a legal search is to get a warrant.
That's how it's supposed to work, anyway. We need more judges who crack down on "parallel construction".
Re: (Score:2)
It shouldn't be. In a world where I can work at Company X and discovering they are putting carcinogens to the water supply a midwestern town and the documents I smuggle out are inadmissable on the grounds they are "stolen company documents" the police shouldn't be able to use evidence that wasn't obtained in a way they couldn't have obtained i
Hmmm... (Score:5, Informative)
Operation Onymous (which is what this is all about) wasn't all that and a bag of chips. Most of the sites they took down weren't the actual intended targets...they were replicas, meant to scam people who were trying to go to the authentic sites they were mimicking. Silk Road 2.0 was pretty much the only significant site that got brought down.
The challenge with dark web sites is that there's no central authority to anything. So, as easy as it is to set up a fake site on the normal web to capture logins or other information, it's even easier on the dark web. There's no warning that a certificate doesn't match a domain, no "verified domains" concept to make your browser turn green up in the address bar and make you all happy. If you don't know for a fact that the .onion address you're going to is valid, it could well be that you're at a copycat that's going to harvest your login, take your bitcoins and give you nothing in return, or whatever else.
It's kind of amusing to think that some academics might have been paid so much and yet accomplish so little, for want of basic understanding of that fact. Carnegie Mellon's people are no slouch (as the academic crowd goes, at least), but that makes this all the more poignant.
Re:Hmmm... (Score:4, Informative)
There's no warning that a certificate doesn't match a domain, no "verified domains" concept to make your browser turn green up in the address bar and make you all happy.
As of 25 Oct. 2015 [torproject.org], this is no longer true.
"Our internet standard reflects on considerations for handling .onion names on the internet as well as officially reserving .onion as a Special-Use-Domain-Name with the Internet Assigned Numbers Authority (IANA). With this registration, it is should also be possible to buy Extended Validation (EV) SSL/TLS certificates for .onion services thanks to a recent decision by the Certification Authority Browser Forum."
Your statement however was correct when Operation Onymous [wikipedia.org] was active last year.
Re: (Score:3)
Either it's secure or it isn't (Score:4, Insightful)
Does it really matter who does the "uncovering"? Security through not-being-paid-by-the-FBI is not security.
Re: Either it's secure or it isn't (Score:2)
That part doesn't matter, but if it's true, the perps should never work in academia again. They can probably get cushy jobs in NoVA though. CMU's reputation is also on the line. If they do a thorough investigation and out any wrongdoers, only their review process ought be found needing of improvement.
Re: (Score:2)
Err... If you ran an exit node, on your own hardware and using your own bandwidth, and then decrypted the content or monitored the traffic then you'd not only be legally in the clear but you'd be getting accolades from academia or, at least, the FBI. It's not like they went out and hacked anything that didn't belong to them or that they didn't have rights to act on. They were well within their legal rights according to what has been disclosed. Immoral? That's subject to debate (and I'd agree). Illegal? Unli
So what? (Score:5, Insightful)
So, the FBI paid someone to unmask TOR users, just like anyone could have paid anyone else to unmask TOR users. So what?
There are two issues here and neither of them are really with the FBI.
1. It is possible to unmask TOR users. This means that TOR is not fit for purpose. No further use or discussion of TOR is necessary. It is not capable of delivering what it promises on the tin.
2. CMU "researchers" are willing to be bad actors for a price. If you want to take issue with them, you would be justified.
The FBI paying someone to do what the FBI does, is not the fucking point. Don't allow yourself to be misdirected away form the fact that TOR is not fit for purpose.
Re: (Score:1)
Someone noticed government had first dibs on your income and could tax it. And therefore you should think of it as government's money, and that it lets you keep some.
This was not a cynical libertarian view, but rather a socialist's rah rah rah! attitude.
This survives today in the meme that government reducing taxes for a particular industry is "subsidizing" them, taking away The People's money and "giving" it to a company.
While the wisdom of any particular tax break is up for debate, and political, and, le
Re: (Score:1)
Nelson, refusing on Tuesdays to take Bart's lunch, does not mean on Tuesdays Bart eats Nelson's lunch by grace of a gift from Nelson.
Re: (Score:2, Informative)
The FBI paying someone to do what the FBI does, is not the fucking point.
Actually, it is the point since the legality of law enforcement agencies like the FBI and the DEA breaking into systems using malware and hacking tools provided by contract firms like the Hacking Team and Carnegie Mellon, has never actually been discussed in public or by Congress. I'm not even sure the DOJ has issued any position briefs on it, or if their legality has been tested in court yet. It also should be noted btw that the FBI
Re: (Score:1)
A tool that breaks into things is not unconstitutional. Using it without a warrant is.
While the contents of unencrypted networks might properly be considered something The People cannot reasonably expect privacy in, encrypted networks The People definitely expect to be secure in, especially without a warrant. This would include not just the latest stuff, but older stuff like basic HTTPS and password transfers.
Re:So what? (Score:4, Funny)
So, the FBI paid someone to unmask TOR users
Only until they discovered that those users were actually DEA agents...
Re: So what? (Score:1)
only with massive effort at the network level. what tor fails to do is to generate decoy traffic. that enables simple traffic bandwidth modulation attacks.
Re: (Score:2)
TOR is fine, the discovery of real IP addresses relies on side channel attacks. Often it is things like using exploits to make the server provide its real IP address, in much the same way as individual users can be identified by using exploits to make their browser give up its real IP address.
Another option is to fingerprint the server/browser somehow, and then look for the same fingerprint in other places. Quite often the server will be hosting non-TOR content as well, so you might narrow it down by lookin
Re: (Score:2)
While those researchers are still at CMU, that should be "we won't be sharing any details of zero day vulnerabilities or other interesting research with anyone at CMU"
Re: (Score:2)
5 seconds of googling:
Carnegie Mellon's primary IP address range (128.2.#.#).
https://www.cmu.edu/iso/govern... [cmu.edu]
--
BMO
Re: (Score:2)
Maybe the US Navy designed TOR to be vulnerable in the first place
Re: (Score:2)
Maybe the US Navy designed TOR to be vulnerable in the first place
Yes, it could have all just been an elaborate ruse... but given the fact that any software of non-trivial complexity has vulnerabilities in it somewhere, it's more likely that the designers of TOR didn't foresee every possible attack vector. This would make them neither more nor less nefarious than any other designers of (allegedly) secure software.
Re: (Score:1)
> The FBI paying someone to do what the FBI does, is not the fucking point.
The FBI is not supposed to conduct drag-net surveillance. Use of Tor is not probable cause.
Re: (Score:2)
So you're saying they're not allowed to run Tor relays?
They probably run thousands of them. So would the NSA, and probably many other governments as well.
LOL ... good luck ... (Score:4, Informative)
I can't speak for the researchers, but essentially agencies like the FBI are long past trust and ethics.
They don't give a crap what the law says, they just do what they want. From illegal and overly broad surveillance to formalized perjury in the form of "Parallel Construction" -- modern police forces have decided they don't give a fuck what we think is legal, and think whatever they do is legal because they say so.
They don't give a damn about pesky little things like warrants.
Re: (Score:2)
They've let the ends justify the means. They've convinced themselves that this is right, that it's justifiable, and that it's absolutely necessary, otherwise the Terrorists/Drug Kingpins/Pedophiles/etc win. It's not just about warrants and espionage either. It's about things like due process, torture, and any number of re
Re: (Score:3)
The problem is that this completely invalidates the concept of "checks and balances". Law enforcement must never have unchecked powers, because that is the only way to avoid a police state.
In fact, they do now have and use some unchecked powers. The only way to fix this would be to dismantle these organizations, put everybody that lied under oat, ordered others to do so or participated in circumventing constitutional provisions in jail and re-build from scratch. That is obviously not going to happen, hence
Innocent? (Score:3, Interesting)
"this attack crosses the crucial line between research and endangering innocent users." Since many of the 'endangered users' were then charged with various crimes, are they innocent?
If a student doctor treats a patient with a gunshot wound, they are still obligated to report the wound to the police. Is the student not learning, and if so, is that materially any different than what the Tor researchers were doing? The gunshot victim may be innocent, or may have been taking part in a crime, but that doesn't change the doctor's obligation.
Or if a Law Enforcement student is participating in a community event and witnesses a crime, we don't raise a red flag if they apprehend the suspect.
The circumstances all seem pretty similar to me.
Re: (Score:2)
It's more like cop paying Spy School student to get the names of people who buy drugs from street dealers, after they give the student the location of all the dealers.
Re: (Score:1)
> Since many of the 'endangered users' were then charged with various crimes, are they innocent?
Yes. Being charged with a crime is not the same as being convicted by a jury of your peers for the crime.
Re: (Score:1)
Since many of the 'endangered users' were then charged with various crimes, are they innocent?
Were all "endangered users" charged with any crime? Were most "endangered users" charged with any crime? No? Then, I'm not sure how much of a point you really have...
If I illegally enter 10000 random houses, for sure I'll find evidence of at least a handful of crimes. Would that justify the invasion of privacy of 10000 households? According to the spirit of the law, no (which is why there is such a thing as a "warrant" in the first place).
Re: (Score:3)
Based on what? The say-so of someone paid $50 million to finger people as experimental "research"?
If the FBI paid a psychic $50 million to finger drug users, would you still open your argument with that line?
Re: (Score:2)
The parent's post was poorly worded / judged since charges don't mean convictions, but realistically a few things may happen:
1. Police won't find any extra evidence to charge the individuals with and the court dismisses the case due to lack of evidence
2. The case goes forward with just the TOR logs, and the court will have a public record of exactly how that data was acquired / processed
3. The case goes forward with other corroborating eviden
Re: (Score:2)
The FBI is considered a bad actor by many, one which subverts the law whenever it suits it. Parallel construction, for example, or the use of fake cell towers. So helping them is morally dubious. To take up your example, a doctor might feel morally obliged not to tell the police if she believed that the police were likely to misuse the information, e.g. by taking the opportunity to frame a black man for a crime (as often happened in South Africa, once upon a time).
Okay, let's say that in this case the CMU r
Re: (Score:1)
"this attack crosses the crucial line between research and endangering innocent users." Since many of the 'endangered users' were then charged with various crimes, are they innocent?
If a student doctor treats a patient with a gunshot wound, they are still obligated to report the wound to the police. Is the student not learning, and if so, is that materially any different than what the Tor researchers were doing? The gunshot victim may be innocent, or may have been taking part in a crime, but that doesn't change the doctor's obligation.
Or if a Law Enforcement student is participating in a community event and witnesses a crime, we don't raise a red flag if they apprehend the suspect.
The circumstances all seem pretty similar to me.
These are really in the larger context of disallowing government the tools of tyrrany. Government is forbidden from warrantless searching to prevent them from rooting around looking for things to charge political challengers with. Yes, even legitimate criminal charges. Putin, Chavez, there are contemporary examples where this is occuring. And political science has for centuries been aware that the more defined crimes, the easier it is for government to have a hook on which to hang pulling you over, thus
At least 2 reasons why this is not a good stance (Score:4, Interesting)
for the FBI and the university to take:
If they are allowed to decrypt messages which are passing through "their" property, then:
a) Pay TV hackers must be allowed to decrypt the Pay TV signals ending at the cable box or coming from a satellite
b) Any ISP or whoever owns a router which transmits encrypted traffic is allowed to decrypt and read it.
Either the FBI and the university have to be punished like cable signal hackers and other bad guys, or the law covering those offenses is not worth the paper.
Re: (Score:3, Insightful)
A university is not a government agency with special powers against other citizens.
Law enforcement ist allowed to do these things only with the approval of the judiciary too. Which they apparently didn't get. 4th amendment, computer security laws and all thoes pesky things.
Re: (Score:1)
There is a law enforcement exception written into almost every criminal statute, from running red lights to the DMCA.
Re: (Score:2)
Only if the encryption is designed to limit access to copyrighted material.
Perhaps you should actually read the DMCA before you bleat on about it.
Pedantic nitpick (Score:1)
Re: (Score:2)