Slashdot Mirror
Researchers Face Jail Risk For Tor Snooping Study
An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."
They did it in the name of SCIENCE!
The link to the study is borked. Correct link: http://www.cs.washington.edu/homes/yoshi/papers/Tor/PETS2008_37.pdf
...music publishers?
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
How could these researchers not know that they were engaging in illegal wiretapping?
On the other hand, the story is hypothetical. No charges have been filed, and there's no real evidence that the government could give a flying flip.
Apparently, US Telcos can snoop all they want and it's perfectly legal, now!
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Interestingly, I was once banned from /. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.
The /. admins were very nice and restored my access almost immediately but I found the whole process interesting.
Not unless they have millions to spend on lobbyists.
What is the difference between what they did and say leaving your wifi access point open to snoop on anybody that might connect to that? Either way, the other people chose to actively connect to YOUR equipment. If it is your equipment, you should have every right to monitor it in any way you see fit.
Don't wiretap. The government hates competition.
As a social science undergrad, I had it drilled into my brain the importance of IRB's. Not following the review process can threaten your schools federal funding. Any grad student or professor should know better, regardless of their discipline.
These researchers are never going to be arrested or charged with anything.
They didnt do anything illegal.
All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.
For 4 days in December 2007, they logged and stored the first 150 bytes of each network packet that crossed their network...
...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.
Tor does encrypt data passing through the network, and it does obfuscate the source and destination... That's kind of the whole point. But unless the traffic is inherently encrypted (e.g. SSL), the exit node has to spit out unencrypted data, otherwise the final destination would have no idea as to what it was receiving.
Failing to submit this study to the Institutional Review Board is a *huge* professional no-no! One of the major functions of the IRB is to ensure that research doesn't violate subjects rights -- particularly confidentiality and privacy rights (which could, I suppose, be why they didn't submit it). Even if the government decides to the let them slide (unlikely with a case of wiretapping), this has ramifications for the Universities. It can lead to the US Dept. of Education shutting down *all* of their research activities. They will be extremely unpopular where they are, and they'll have the devil's own time getting hired anywhere else.
As a social science undergrad,
Which means most of your research probably involves human subjects (assuming it involves some new data collection), so of course you have to get approval. I know all about IRB from psych courses for the same reason.
Most comp sci prof rarely run human subjects (or consider that they data they're looking at comes from human subjects) and therefore often don't need to get IRB approval. The only comp sci field that I can think of that regularly would run human subjects is HCI, and even most of those studies could get an IRB waiver pretty easily (assuming they even need oversight.) I think these guys were security's people, so they mostly deal in algorithms. I doubt they thought much beyond the various data collection. Granted, they all should have known better, but I've yet to here a comp sci prof mention IRB (even in courses where it's relevant, like ethics.)
open source modern art: laser taggi
IANAL, but following the link from the article to
18 USC 2511, reading 2(d)
"It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."
Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?
I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication ...
Code or be coded.
Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.
If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:
* Just about everything done by CAIDA.
* The papers at IMC - the Internet Measurement Conference.
* Data at CRAWDAD - the Community Resource for Archiving Wireless Data at Dartmouth.
A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.
Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.
Anyone who assumes that Tor exit nodes aren't heavily monitored by lots of three letter agencies, private companies, and researchers is a fool.
If Tor's utility depended on legal protections, it would be a lost cause. What Tor actually does for you is obscure your IP address, nothing more and nothing less. That is very useful. But you still need to make sure that your content is clean. That's why Tor is often used with software like Privoxy.
If anybody actually goes after these security researchers, it's not to protect the privacy of Tor users, it's to prevent the researchers for alerting Tor users to protecting their identity better, because once 99.9% of the Tor traffic is encrypted, listening in becomes much less useful.
Note also it doesn't have any backup to its (misleading) headline. Usually "could face legal..." means some law enforcement agency has noticed the issue. The only one stirring up the pot here (and working pretty hard at it) seems to be the article's author.
The headline of the article certainly implies, even if it doesn't actually state, that these researches are actually facing charges. According to the article referenced, there is no mention whatsoever of any criminal investigation, or any evidence that these researchers have even been contacted by authorities. As far as I can tell, the entire article is based on speculation by the EFF and others. It is hard to imagine that wiretapping laws would apply here since (a) the researchers running the exit node are offering a free service and are not in the networking "business", (b) people running Tor voluntarily send their data out to Tor nodes, (c) as an exit node operator, these researchers probably cannot identify the actual people engaging in this communication (at least that should be the case if Tor is running properly), and (d) the study they released only shows aggregate data, and doesn't reveal the private communications of individual users. Doesn't there have to be a specific victim in order for wiretapping charges to apply? (IANAL, I'd love to hear from lawyers on this point.) How is this different from any other network usage study?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
testing