Researchers from Carnegie Mellon are being accused of helping the FBI exploit a vulnerability that allowed investigators to gather information on users of Tor, an online tool that allows individuals around the globe to browse the Internet anonymously.
Tor Project, the not-for-profit group behind the technology, said on Wednesday that academics from Carnegie Mellon University made “at least $1 million” by helping the FBI de-anonymize Tor users earlier this year during the course of a criminal investigation.
“Such action is a violation of our trust and basic guidelines for ethical research. We strongly support independent research on our software and network, but this attack crosses the crucial line between research and endangering innocent users,” Tor said in a statement.
Tor allows users to stay relatively anonymous online by routing Internet traffic through various nodes around the world, in turn making it difficult for eavesdroppers to see where users are located or the websites they visit. It’s popular among whistleblowers, journalists, human rights workers and law enforcement officials who use the tool to mask their online activity, as well as individuals in repressive regimes where access to online content is restricted by the government.
Drug dealers and child pornographers also rely on the anonymity the technology provides, however, in order to operate on websites hosted on the Tor network — so-called “hidden services” where contraband can be bought, sold and bartered for without one’s real identity having to be revealed.
The latest discussion to concern law enforcement’s efforts to crack Tor erupted early on Wednesday when Vice’s Motherboard reported that court documents recently filed in the Western District of Washington revealed that investigators had identified an alleged drug dealer accused of selling narcotics through a hidden service, Silk Road 2.0, by way of a “university-based research institute that operated its own computers on the anonymous network” used by the online drug den.
Carnegie Mellon has yet to confirm it’s the “university-based research institute” named in court filings, but the attack as described shares overwhelming similarities with a presentation its researchers had planned to deliver at a hacking conference in August that ended up being nixed from the schedule at the last minute.
CERT/Carnegie Mellon researcher Alexander Volynkin had been scheduled to give a talk titled “You Don’t Have to be the NSA to Break Tor: Deanonymizing Users on a Budget” at Black Hat USA in Las Vegas. The presentation had planned to show that “a persistent adversary … can de-anonymize hundreds of thousands of Tor clients and thousands of hidden services within a couple of months [for] just under $3,000,” according to the synopsis.
“Apparently these researchers were paid by the FBI to attack hidden services users in a broad sweep, and then sift through their data to find people whom they could accuse of crimes,” Tor said in response to Motherboard’s report.
“I’d like to see the substantiation for their claim,” Ed Desautels, a public relations staffer at the school’s Software Engineering Institute, told WIRED this week in response to the allegations, adding that he was not personally aware of any payment being made to CWU in exchange for their research, contrary to Tor’s claims of a $1 million reward.
Nevertheless, Tor has outright accused the school of aiding the authorities and said in a statement this week that the attack establishes a “troubling precedent.”
“Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities. If academia uses ’research’ as a stalking horse for privacy invasion, the entire enterprise of security research will fall into disrepute. Legitimate privacy researchers study many online systems, including social networks — if this kind of FBI attack by university proxy is accepted, no one will have meaningful 4th Amendment protections online and everyone is at risk,” it read in part.
The group added that it seems unlikely law enforcement obtained a warrant to execute the de-anonymizing process discovered by researchers “since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once.”
“We teach law enforcement agents that they can use Tor to do their investigations ethically, and we support such use of Tor — but the mere veneer of a law enforcement investigation cannot justify wholesale invasion of people’s privacy, and certainly cannot give it the color of ’legitimate research,’ ” Tor said.
“Whatever academic security research should be in the 21st century, it certainly does not include ’experiments’ for pay that indiscriminately endanger strangers without their knowledge or consent.”
• Andrew Blake can be reached at ablake@washingtontimes.com.
Please read our comment policy before commenting.