Slashdot Mirror
Researchers Face Jail Risk For Tor Snooping Study
An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."
They did it in the name of SCIENCE!
The link to the study is borked. Correct link: http://www.cs.washington.edu/homes/yoshi/papers/Tor/PETS2008_37.pdf
...music publishers?
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
Sharing knowledge here == bad
Sharing knowledge other places == good
Maybe the correct answer is pay attention to what you agree to.
How could these researchers not know that they were engaging in illegal wiretapping?
On the other hand, the story is hypothetical. No charges have been filed, and there's no real evidence that the government could give a flying flip.
So telcom executives are OK, but let's lock up the academics. All your civil libertarians are belonging to us!
Apparently, US Telcos can snoop all they want and it's perfectly legal, now!
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Interestingly, I was once banned from /. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.
The /. admins were very nice and restored my access almost immediately but I found the whole process interesting.
Not unless they have millions to spend on lobbyists.
What is the difference between what they did and say leaving your wifi access point open to snoop on anybody that might connect to that? Either way, the other people chose to actively connect to YOUR equipment. If it is your equipment, you should have every right to monitor it in any way you see fit.
Don't wiretap. The government hates competition.
Hey, with the way our country has been heading, this would be great resume material - even if convicted. Its not like they lost a database of SSNs...
I will bend like a reed in the wind.
As a social science undergrad, I had it drilled into my brain the importance of IRB's. Not following the review process can threaten your schools federal funding. Any grad student or professor should know better, regardless of their discipline.
These researchers are never going to be arrested or charged with anything.
They didnt do anything illegal.
All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.
For 4 days in December 2007, they logged and stored the first 150 bytes of each network packet that crossed their network...
...or the CP branch of the FBI?
Since we are forwarding traffic on behalf of Tor users, our routerâ(TM)s IP address appears to be the source of sometimes malicious traffic. The large amount of exit bandwidth that we provided caused us to receive a large number of complaints ranging from DMCA Â512 notices related to allegations of copyright infringement, reported hacking attempts, IRC bot network controls, and web page defacement. However, an enormous amount of malicious client activity was likely unreported.
Did they really not see that one coming??
www.purevolume.com/martyd
Would get them right off the hook...
"The researchers neither sought legal review of the project nor ran it past their Institutional Review Board."
If the government and telecoms don't have to obey the law, neither do I.
...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.
Oh well, thanks to the government, the **AA people, and idiots like this, such networks are coming... and where once terrorists, organized crime, and other ne'er do wells had to pay some geeks for serious work to make secure communications a done deal, they will be able to download an open source package off the net with point and click simplicity that does everything they need and more. Just because the aforementioned dipsticks pushing the trend refused to listen to Princess Leia in Star Wars when she told off Grand Moff Tarkin.
You remember, tighter grip, more systems through your fingers. As in, oppression is counterproductive and carries the seeds of your downfall, and everyone else's...
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
and don't want to be found out, so it can be patched. Then they would have to start all over.
What?
Failing to submit this study to the Institutional Review Board is a *huge* professional no-no! One of the major functions of the IRB is to ensure that research doesn't violate subjects rights -- particularly confidentiality and privacy rights (which could, I suppose, be why they didn't submit it). Even if the government decides to the let them slide (unlikely with a case of wiretapping), this has ramifications for the Universities. It can lead to the US Dept. of Education shutting down *all* of their research activities. They will be extremely unpopular where they are, and they'll have the devil's own time getting hired anywhere else.
As a social science undergrad,
Which means most of your research probably involves human subjects (assuming it involves some new data collection), so of course you have to get approval. I know all about IRB from psych courses for the same reason.
Most comp sci prof rarely run human subjects (or consider that they data they're looking at comes from human subjects) and therefore often don't need to get IRB approval. The only comp sci field that I can think of that regularly would run human subjects is HCI, and even most of those studies could get an IRB waiver pretty easily (assuming they even need oversight.) I think these guys were security's people, so they mostly deal in algorithms. I doubt they thought much beyond the various data collection. Granted, they all should have known better, but I've yet to here a comp sci prof mention IRB (even in courses where it's relevant, like ethics.)
open source modern art: laser taggi
That's ridiculous! Wiretaping should be strictly defined as actually physically connecting your equipment to a wire you don't own or lease. TCP/IP is strictly point-to-point. If they got your information via Tor, it's because you ran software that specifically sent information to their IP address (or some other IP the subsequently passed it to them). If you used Tor not knowing this, that's your own fault, not theirs. If you assumed the information was undecipherable but they found that it wasn't, that's also your fault, not theirs.
Some of you will argue "but what about cable modem?". I think it's the same issue. If you subscribe to cable modem instead of DSL and a neighbor on your hub reads your data (I've read this is possible, but I have DLS, so I haven't tried it), well, buyer beware. If you use an access point without encryption, that's also your own fault.
There was a time when we referred to the Internet as the "public network" and assumed that all traffic traveling over it was fair game and potentially accessible by anyone. Those who needed more security were responsible for encrypting their own traffic and had to either trust their encryption algorithms or find another way to communicate. It's this mentality that will keep the Internet secure. Assuming there's some sort of expectation of privacy and forking over large sums of cash to lawyers to fight about it later spells doom for privacy.
Joseph Javorski. Respected scientist. Touch a button. Things happen. A scientist becomes a beast. Shockwaves of an A-bomb. A once powerful, humble man. Reduced toâ¦nothing. Joseph Javorski. Respected scientist. Now a fiend. Prowling the wastelands. A prehistoric beast in a nuclear age. Kill. Kill, just to be killing.
Bow-ties are cool.
...or Comcast for that matter...
Comment removed based on user account deletion
Bush made me do it.
I like to take my wireless laptop and check the nodes in the UW Tower as I climb the stairs.
Are you saying it's not research?
Because I work in research at the UW, so it must be science ...
Right?
-- Tigger warning: This post may contain tiggers! --
IANAL, but following the link from the article to
18 USC 2511, reading 2(d)
"It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."
Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?
I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication ...
Code or be coded.
They should have just secretly used the data for nefarious purposes, instead of publicizing the security hole. When will these people learn?
there is no god but truth, and reality is its prophet
Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.
If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:
* Just about everything done by CAIDA.
* The papers at IMC - the Internet Measurement Conference.
* Data at CRAWDAD - the Community Resource for Archiving Wireless Data at Dartmouth.
A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.
Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.
Anyone who assumes that Tor exit nodes aren't heavily monitored by lots of three letter agencies, private companies, and researchers is a fool.
If Tor's utility depended on legal protections, it would be a lost cause. What Tor actually does for you is obscure your IP address, nothing more and nothing less. That is very useful. But you still need to make sure that your content is clean. That's why Tor is often used with software like Privoxy.
If anybody actually goes after these security researchers, it's not to protect the privacy of Tor users, it's to prevent the researchers for alerting Tor users to protecting their identity better, because once 99.9% of the Tor traffic is encrypted, listening in becomes much less useful.
I second that. I have done similar research myself (albeit not in the US) and all the papers only based on small traces, like an academioc departement routers are not really that significant.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Thy name is government. Thanks for the laughs, America. Keep the hypocrisy factory running. You already have God's President, you might as well formalize the division of your legal system into one manipulable side for corporations, and an uncaring inflexible side for the citizenry.
Fiat Homos et Pereat Theos
Note also it doesn't have any backup to its (misleading) headline. Usually "could face legal..." means some law enforcement agency has noticed the issue. The only one stirring up the pot here (and working pretty hard at it) seems to be the article's author.
can't agree with you more
The headline of the article certainly implies, even if it doesn't actually state, that these researches are actually facing charges. According to the article referenced, there is no mention whatsoever of any criminal investigation, or any evidence that these researchers have even been contacted by authorities. As far as I can tell, the entire article is based on speculation by the EFF and others. It is hard to imagine that wiretapping laws would apply here since (a) the researchers running the exit node are offering a free service and are not in the networking "business", (b) people running Tor voluntarily send their data out to Tor nodes, (c) as an exit node operator, these researchers probably cannot identify the actual people engaging in this communication (at least that should be the case if Tor is running properly), and (d) the study they released only shows aggregate data, and doesn't reveal the private communications of individual users. Doesn't there have to be a specific victim in order for wiretapping charges to apply? (IANAL, I'd love to hear from lawyers on this point.) How is this different from any other network usage study?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
So the Bush government might launch prosecutions for illicit surveillance? What a strange time for them to start taking an interest in this issue.
I still go by the old Electronic Communications Privacy act of 1986.. which basically states that as an administrator, I can monitor the activity of my network for the purposes of administration. This includes private communication.
DMCA be damned. If you send it to me, I can read it.
IOW, if I can read it, I can read it.
How many more years will slashdot have an off-by-one error on your Score in your profile?
there's a lot of monitoring going on, especially with some of the exit nodes running ancient versions of likely modified tor. There's iframe (hope you have yours turned off) and other malicious attacks every day by bad nodes. I'd bet most tor exit nodes are government run, and some governments have even more ability to log you when they do it from an overseas location. Lots of French and German nodes popping up, be sure to block all of the 149.* bettyboop family tor exit nodes, gpftor (though they'll claim they are just fine) nodes, and a few others. Be careful, they ARE watching.
testing