Slashdot Mirror
Japanese P2P Users Arrested, Creator Targeted
nutznboltz writes "According to a story on CNET Asia, two Japanese users of the Winny P2P application have been arrested for copyright violations, and the developer of the P2P software has also had his home searched by police. Winny was 'supposedly anonymous', and purported to be based on Freenet, although Freenet creator Ian Clarke is claiming that Winny is not really like Freenet, and that he's 'not concerned that the Japanese police have somehow found a way to compromise Freenet's security'."
Since Winny is pretty much unknown outside Japan, here is some background information for slashdot readers: Winny is a P2P file sharing program created by a Japanese programmer, who still remains anonymous to this day. It came out two years ago as an attempt to share copyright-protected materials "safely" when somebody was arrested for using another P2P program (WinMX). Since the application was extremely well designed and almost anything is available on its network, from movies to software, it has become immensely popular in Japan, so much so that there are a dozen book available on how to use it and network traffic in the country was down 20% after the news of the arrest broke. As for the reasons why the police was able to identify those two people who were arrested, they used an extra bulletin board feature, which does not guarantee anonymity unlike its file transfer feature, to distribute a list of warez videos. Therefore, I don't think this news has anything to do with the validity of Freenet's technology, or with that of Winny's for that matter.
This is a complicated issue without a clear answer.
If you want to be theoretical, then yes, Freenet does not provide anywhere near "absolute" anonymity. In fact, it doesn't even provide the level of anonymity that is used when judging such things as anonymous remailers or mixnets.
Basically, Freenet purports to be "anonymous" because you files do not recide on the computer of the person who uploaded them, and because all downloads and uploads are chained and tunneled through each host involved in the transfer. That means that the host you download a Freenet document from just knows it got it from some other node, which got it from some other node, which got it through some other node, all the way back to the person who uploaded it. It certainly makes tracking the people upload and download things more difficult then on networks like Kazaa (where it is, as we have seen, trivial) but in theory, and with enough resources, it is of course not impossible.
It should be noted what Freenet does NOT provide however. Freenet does do what the serious mixnets reffer to as "Onion routing", which basically means that the message is wrapped in an onion of cryptographic layers, which are pealed off at every step. The idea behind this is only the very last node can see contents of the message, and only the first knows it came from you (and none of the other nodes know anything except where the message came from and where it went).
If you request something from Freenet, your node will call up another node and ask it for that file - if that node is controlled by the Feds then you are busted. It is argued that there is plausible deniability, because it is possible that your node was not downloading the file because you asked for it, but simply forwarding it for somebody else. Given the state of the judicial process at the moment, I'm not terribly optimistic about this defense.
Freenet also doesn't protect (at least not very well) against traffic and timing analysis, allowing one to track down the author of something using the timing and amount of encrypted traffic that nodes exchange. I don't know of any case of traffic analysis having been used (except maybe on the NSA hyper-spook level), but it isn't impossible.
Another thing that Freenet does not "anonymise", and this is the most important IMO, is that you are running a node in the first place. Your Freenet node has to be public, so the feds could definitely "fish" the network for node addresses and start busting those who run them. Again there is an argument of deniability: you don't actually know what is in your nodes cache because it is encrypted, but again I don't have a lot of faith in this defense when the prosecutor will argue that you knowning acted in bad faith.
Regarding Winny, however, I think I agree with Ian. It seems doubtful that Winny works in the same manner as freenet, for the simple reason that Winny works, and well, freenet, umm, doesn't. Any time you try to put anonymity into something, useability IS going to take a hit, because trying to spread and bounce traffic necessarily hits performance. I have a very hard time believing that Japans most popular P2P network could be based on tunneling everything - purely for performance reasons.
(I have to run, so forgive typos and pitiful spelling errors.)
The way annoymity works is that files are stored in a "cache" in a scrambled format with filename concealed, even to the local user.
:)
Winny knows how to descramble the name and data, and it can search on the P2P network a specific file using its filename or MD5 checksum.
When a file is found, it is either downloaded directly or through another random user (think proxy).
Files goes into the cache either by local upload, by downloading a file (which Winny will descramble for you, leaving a copy in the cache), or by files passing through your node. It is then available for further download by other people.
This provides a kind of load-sharing where more popular a file is, it will be found in more people's cache and more easily available. Downloading from multiple sources is also possible.
You can find out who your immediate neighbour is, but he can claim he doesn't know what the content of his cache contains an infringing file, but of course this requires him to remove the original on his disk
To give an incentive to people to cache files, # of simultanenous downloads is limited to # of uploads+1 with a lower limit of 2.
It is a very convinent system because winny has a function that let you specifies search parameters and you can just leave it alone and it'll download everything that meets the parameters, meanwhile donating bandwidth and cache space to other people on the P2P network.
This model can be possible only because Winny is closed source. Cracks have both appeared for both the download limit and cache descrambling. It is easy to see widespread use of the cracks will compromise the model (less files to be found on the network).
Fortunately normally people don't care (it is just spare upload bandwidth and disk space, which broadband P2P users usually have surplus of).
Ever heard of onion routing? look it up.
Bascially, there is no source and destination, just a bunch of message passing between random nodes, the 'destination' just keeps and eye out for something that belongs to them. Put very basically. Theres a bunch of asymmetric crypto involved also. Look it up for more details.
I.O.U One Sig.
Actually, just the size of the piece of content you are retreiving is very likely to tield enough information to identify exactly who retreived it, I'm afraid.
Pieces of data in Freenet are padded to the nearest exponent of two, so this particular attack would be pretty difficult.