Slashdot Mirror
Researchers Face Jail Risk For Tor Snooping Study
An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."
The link to the study is borked. Correct link: http://www.cs.washington.edu/homes/yoshi/papers/Tor/PETS2008_37.pdf
...music publishers?
...the researchers could also face up to 5 years in jail for violating the Wiretap Act.
I'm sure they'll be granted retroactive immunity for this. Seems to be the latest fad in Congress these days.
How could these researchers not know that they were engaging in illegal wiretapping?
On the other hand, the story is hypothetical. No charges have been filed, and there's no real evidence that the government could give a flying flip.
Apparently, US Telcos can snoop all they want and it's perfectly legal, now!
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
I guess if they get jail time, the lesson to learn is "Do as I say, not as I do."
Interestingly, I was once banned from /. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.
The /. admins were very nice and restored my access almost immediately but I found the whole process interesting.
Not unless they have millions to spend on lobbyists.
What is the difference between what they did and say leaving your wifi access point open to snoop on anybody that might connect to that? Either way, the other people chose to actively connect to YOUR equipment. If it is your equipment, you should have every right to monitor it in any way you see fit.
Don't wiretap. The government hates competition.
Of course we should jail them. According to the Bush administration, science is a major threat to our country!
SJW: Someone who has run out of real oppression, and has to fake it.
...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.
Tor does encrypt data passing through the network, and it does obfuscate the source and destination... That's kind of the whole point. But unless the traffic is inherently encrypted (e.g. SSL), the exit node has to spit out unencrypted data, otherwise the final destination would have no idea as to what it was receiving.
Speaking of the Bush administration and violating wiretapping laws...
No problem, they just need to argue that, as operators of a Tor exit node, they are a telecoms company, then they get free retroactive immunity.
I am TheRaven on Soylent News
IANAL, but following the link from the article to
18 USC 2511, reading 2(d)
"It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."
Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?
I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication ...
Code or be coded.
How is their study either unethical, or illegal as you have claimed? Ignoring your hypothetical marijuana study as completely irrelevant you seem to have missed the key points in what they did.
They did not run a "wiretap" as claimed. They monitored the traffic at a tor node that they controlled. People willingly sent them the information that was supposed to be private.
Their study is a scientific investigation into whether the privacy claims of Tor can be sustained. They cannot - the system is open to abuse. This is an entirely ethical study into the claims made by Tor, and furthermore this is exactly how good empirical science should work.
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.
If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:
* Just about everything done by CAIDA.
* The papers at IMC - the Internet Measurement Conference.
* Data at CRAWDAD - the Community Resource for Archiving Wireless Data at Dartmouth.
A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.
Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.