Slashdot Mirror
Tor Project Claims FBI Paid University Researchers $1m To Unmask Tor Users
An anonymous reader writes: Have Carnegie Mellon University researchers been paid by the FBI to unmask a subset of Tor users so that the agents could discover who operated Silk Road 2.0 and other criminal suspects on the dark web? Tor Project Director Roger Dingledine believes so, and says that they were told by sources in the information security community that the FBI paid at least $1 million for the service.
From the article:
"There is no indication yet that they had a warrant or any institutional oversight by Carnegie Mellon's Institutional Review Board. We think it's unlikely they could have gotten a valid warrant for CMU's attack as conducted, since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once," noted Dingledine.
"Such action is a violation of our trust and basic guidelines for ethical research. We strongly support independent research on our software and network, but this attack crosses the crucial line between research and endangering innocent users," he pointed out.
'Consultants' perform wide-scale, warrantless, attack against large number of individuals not even suspected of wrongdoing on behalf of FBI under the guise of 'research'(probably not IRB approved); FBI thanks them for their assistance and introduces the fruits of an operation that would have been dubiously legal in scope even with a warrant; much less without one.
News at 11:30.
Operation Onymous (which is what this is all about) wasn't all that and a bag of chips. Most of the sites they took down weren't the actual intended targets...they were replicas, meant to scam people who were trying to go to the authentic sites they were mimicking. Silk Road 2.0 was pretty much the only significant site that got brought down.
The challenge with dark web sites is that there's no central authority to anything. So, as easy as it is to set up a fake site on the normal web to capture logins or other information, it's even easier on the dark web. There's no warning that a certificate doesn't match a domain, no "verified domains" concept to make your browser turn green up in the address bar and make you all happy. If you don't know for a fact that the .onion address you're going to is valid, it could well be that you're at a copycat that's going to harvest your login, take your bitcoins and give you nothing in return, or whatever else.
It's kind of amusing to think that some academics might have been paid so much and yet accomplish so little, for want of basic understanding of that fact. Carnegie Mellon's people are no slouch (as the academic crowd goes, at least), but that makes this all the more poignant.
For your security, this post has been encrypted with ROT-13, twice.
Does it really matter who does the "uncovering"? Security through not-being-paid-by-the-FBI is not security.
So, the FBI paid someone to unmask TOR users, just like anyone could have paid anyone else to unmask TOR users. So what?
There are two issues here and neither of them are really with the FBI.
1. It is possible to unmask TOR users. This means that TOR is not fit for purpose. No further use or discussion of TOR is necessary. It is not capable of delivering what it promises on the tin.
2. CMU "researchers" are willing to be bad actors for a price. If you want to take issue with them, you would be justified.
The FBI paying someone to do what the FBI does, is not the fucking point. Don't allow yourself to be misdirected away form the fact that TOR is not fit for purpose.
'Consultants' perform wide-scale, warrantless, attack against large number of individuals not even suspected of wrongdoing on behalf of FBI under the guise of 'research'(probably not IRB approved); FBI thanks them for their assistance and introduces the fruits of an operation that would have been dubiously legal in scope even with a warrant; much less without one.
I'm the first to complaint about warrantless search of Americans, but I don't think this qualifies. If you're going to install software on computers you don't own in order to capture information, you need a warrant. If you're going to ask a private company to hand over data on their users, you need a warrant. If you're going to capture information that passes through your own hardware, even if it's encrypted, that's fair game. If you find a way to break the anonymizing network by creating your own fake relays to do it, as far as my judgement goes, the data was yours to play with, because it passed through your relays, and the research was legitimate, because you did find a flaw on the network.
The only thing I see wrong with this entire operation is that we have laws against what people can or can't take. It's their life, their bodies, their decision, and the FBI is wasting resources going after people who pose no danger to society (at least as far as Silk Road 2.0. The first Silk Road had the guy in charge trying to hire a hit man. Definitely not just a drugs thing. The investigation was legit, the research was legit, and it gives the Tor Project something to think about as far as improving their network.
for the FBI and the university to take:
If they are allowed to decrypt messages which are passing through "their" property, then:
a) Pay TV hackers must be allowed to decrypt the Pay TV signals ending at the cable box or coming from a satellite
b) Any ISP or whoever owns a router which transmits encrypted traffic is allowed to decrypt and read it.
Either the FBI and the university have to be punished like cable signal hackers and other bad guys, or the law covering those offenses is not worth the paper.