Tor Project Claims FBI Paid Carnegie Mellon $1 Million To Deanonymize Tor Users
from the tying-together-loose-threads dept
First, let's go back a year or so. A few weeks before the big Black Hat Conference in 2014, it was announced that a planned presentation from two Carnegie Mellon University researchers (Michael McCord and Alexander Volynkin), entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" was pulled from the program, leading to lots and lots of speculation about what happened. Soon after this, the Tor Project announced it had discovered a group of relays that appeared to trying to deanonymize Tor users who were operating Tor hidden services.A few months after this, the FBI and Europol suddenly took down a bunch of darknet sites and arrested people accused of running them (calling it "Operation Onymous") -- including arresting a guy named Blake Benthall for running Silk Road 2.0. At the time, we pointed out something odd in the criminal complaint against Benthall. While the complaint noted that the FBI had found the server that was running Silk Road 2.0 (in an unnamed foreign country) and imaged it, nowhere was it explained how.
A couple months after that (at the beginning of this year), the FBI announced the arrest of Brian Farrell, who the FBI claims was a close assistant to Benthall in running Silk Road 2.0.
Fast forward to last week -- and Farrell's lawyer filed a motion with the district court hearing his case, noting that, just last month, the Justice Department revealed to Farrell's legal team that some of the evidence came from a "university-based research institute" and that Farrell's defense team had requested additional discovery to get more info. From the motion (which oddly, none of the other press reports on this story published):
On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0. In response to this letter, undersigned counsel requested additional discovery from the government to determine the relationship between the “university-based research institute” and the federal government, as well as the means used to identify Mr. Farrell on what was supposed to operate as an anonymous website. To date, the government has declined to produce any additional discovery.Farrell's lawyers asked for more time, noting that there was another case in the same court (more on that below), seeking the same discovery, and Ferrell's lawyers would like his case put on hold until the issue of discovery over the "university-based research institute" was settled in the other case. Vice then reported on this filing... leading the Tor Project itself to announce that it was pretty sure not just that the Carnegie Mellon research project from last year was the project in question, but that the FBI had paid CMU $1 million for that information, though the claim is from an anonymous source.
The Tor Project has learned more about last year's attack by Carnegie Mellon researchers on the hidden service subsystem. Apparently these researchers were paid by the FBI to attack hidden services users in a broad sweep, and then sift through their data to find people whom they could accuse of crimes....Wired approached Carnegie Mellon who gave a pretty big non-answer in response:
[....]
We have been told that the payment to CMU was at least $1 million.
There is no indication yet that they had a warrant or any institutional oversight by Carnegie Mellon's Institutional Review Board. We think it's unlikely they could have gotten a valid warrant for CMU's attack as conducted, since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once.
When WIRED contacted Carnegie Mellon, it didn’t deny the Tor Project’s accusations, but pointed to a lack of evidence. “I’d like to see the substantiation for their claim,” said Ed Desautels, a staffer in the public relations department of the university’s Software Engineering Institute. “I’m not aware of any payment,” he added, declining to comment further.This whole complicated scenario raises some pretty serious questions -- including whether or not the federal government paid a university to do research in a manner that would almost certainly violate university ethics rules on research on human subjects, but also which would allow the FBI to get all sorts of information on people without a warrant. As the director of the Tor Project, Roger Dingledine, told Wired:
“This attack…sets a troubling precedent: Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities. If academia uses ‘research’ as a stalking horse for privacy invasion, the entire enterprise of security research will fall into disrepute,” Dingledine writes. “We teach law enforcement agents that they can use Tor to do their investigations ethically, and we support such use of Tor–but the mere veneer of a law enforcement investigation cannot justify wholesale invasion of people’s privacy, and certainly cannot give it the color of ‘legitimate research.'”And now... this issue moves over to the other case that Farrell's lawyers pointed out, which is a criminal case against someone named Gabriel Peterson-Siler, who was arrested earlier this year for child porn -- and whose lawyers learned from the Justice Department that some of the evidence against him, similarly came from this "university-based research institute." That's not directly said in the filings in that case, but Peterson-Siler's lawyer did make clear that something was up:
“Whatever academic security research should be in the 21st century,” he concludes, “it certainly does not include ‘experiments’ for pay that indiscriminately endanger strangers without their knowledge or consent.”
This case involves a national operation targeting users of a child pornography website on a network known as the Onion Router (TOR), commonly termed the darknet. The government and the defense recently discussed a potential discovery issue which involves highly sensitive investigative materials regarding the investigation into the users of the child pornography TOR website. This potential discovery issue has involved extensive consultation with multiple Department of Justice components in Washington, D.C., and, despite the diligence of the government, took time to resolve. Defense counsel was notified of the resolution of that consultation process on the same day, October 13, 2015, and the government and defense counsel have been in regular contact regarding next steps. Any ongoing discovery issues related to this matter may also require coordination with multiple Department of Justice components in Washington, D.C.The date, October 13 when this was revealed, was the same date that Farrell's lawyers learned the same information. So, now, all eyes should turn to the Peterson-Siler case, to determine whether or not the details are going to come out about how the FBI got this info and whether or not it was legal. Unfortunately, Gabriel Peterson-Siler is anything but a sympathetic defendant here. He's facing charges for child porn, and, according to the detention order in this case, this is not the first time Peterson-Siler has been in court over such an issue:
Defendant is charged by Complaint with possessing matter containing visual depictions of minors engaging in sexually explicit conduct that had been transported in interstate and foreign commerce. He has a prior conviction for possession of child pornography, for which he served 14 months of confinement, and two years of sexual deviancy treatment. Defendant was on state court supervision at the time of some of the alleged offense conduct charged in this case, some of which was during or soon after the conclusion of the sexual deviancy treatment.One hopes that this fact won't cloud the issue over whether or not the FBI should be allowed to pay university researchers to break Tor's anonymity and spy on people in large groups. But, that may be asking a lot...
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: alexander volynkin, anonymity, blake benthall, brian farrell, fbi, gabriel peterson-siler, michael mccord, operation onymous, silk road 2.0, surveillance, tor
Companies: carnegie mellon, tor project
Reader Comments
Subscribe: RSS
View by: Time | Thread
this from the folks who
[ link to this | view in chronology ]
Govt-sponsored research ?
CMU simply danced with the one who brung them.
By the way, where are the IEEE & ACM ethics committees when you really need them?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
since they are totally ignoring the chain of custody...
-what stops them from planting evidence?
-how can anyone check if the evidence is fake?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Response to: Anonymous Coward on Nov 12th, 2015 @ 10:07am
Parallel Corruption.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
Too bad there isn't a taxpayer based selection system in place that could prevent this type of fraud,waste,abuse. At least then we could attempt to block these overreaches. $150 from my income tax alloted for FBI-CMU project to deanonymize TOR? No thanks; I'll select a NASA project to fund instead.
Plus, if a university is found guilty of assisting in these "unofficial" ops, no taxpayer funding for you (plus all the negative media attention you deserve!) Win-Win.
[ link to this | view in chronology ]
Re: Re:
I agree they shouldn't waste taxpayer money at all (and my comment was meant to be tongue and cheek) but they're going to waste it no matter what. So, at the very least, this is not how I want them to do it.
[ link to this | view in chronology ]
Re: Re:
"Nice university, be a shame if some scandal happened to it..."
[ link to this | view in chronology ]
[ link to this | view in chronology ]
This could turn out very badly for researchers
I work at a university and am well aware of the role of IRBs. IRB review is necessary for anything that even vaguely hints that it involves human subjects and it's deliberately set up to be (somewhat) adversarial and independent in nature. The IRB does not care that you're a star professor with a million-dollar grant: they'll tell you no just as much as they'll tell some first-year grad student.
So IF this is correct and IF researchers at CMU bypassed their own IRB, then there is going to be hell to pay.
[ link to this | view in chronology ]
Re: This could turn out very badly for researchers
[ link to this | view in chronology ]
Re: This could turn out very badly for researchers
It can't any other way, otherwise universities wouldn't be allowed to study pollution, traffic, queuing theory on subways, or a whole to of other things where humans are remotely involved. Human testing rules are more about tests done specifically on individuals, like drug tests, psychological testing, sleep studies, and so on. There are no human subjects in any of this, just the data created by humans.
Put another way, "no humans were harmed in this project".
[ link to this | view in chronology ]
Re: Re: This could turn out very badly for researchers
"Nobody was harmed so it's ok to let the Government violate your rights!"
This does not work in reality. Period. If there is evidence law enforcement violated laws/the Constitution to get what they wanted then these men should go free, evidence dropped. "But you are a monster! They molest children!" So? Law enforcement should have thought about it before skirting outside their obligations. If anything happens from here it's not the judge that dismiss the case that should be blamed but rather the idiot inside the FBI that thought it's ok to violate the law to get their ends.
[ link to this | view in chronology ]
Re: Re: This could turn out very badly for researchers
Everyone knows that TOR users don't count as human beings.
[ link to this | view in chronology ]
Re: Re: This could turn out very badly for researchers
While you, my little apologist friend, may claim that there is no harm in loss of freedom or imprisonment, I disagree. In fact, I say you're full of shit.
[ link to this | view in chronology ]
That's not a non-answer, that's the kind of answer you'd expect when someone's guilty of what you're accusing them of, but is confident that you won't be able to find enough evidence to prove it in court.
If they were innocent of what they're being accused of, they'd have said so, and gone out of their way to provide evidence of their innocence given the severity of the accusation, rather than going with a response that basically amounts to 'You can't prove anything'.
[ link to this | view in chronology ]
"We paid the university to research a way to unmask Tor users so that when we have a Valid Warrant(tm) we can do so. In the course of their research, they stumbled across blatant criminal activity, which we NEVER asked them to look for, that they then passed on to us. So while what they did might have violated the ethics rules of the university, the completely unsolicited evidence they turned over to us is entirely above board from a legal standpoint."
[ link to this | view in chronology ]
Copyright
Who else will come forward (Educational Institutions) before it comes out that they too were complicit with illegal Federal operations?
And, it's already been asked, but yeah, where were their Ethics Committees and Watchdogs? I sat on the Ethics Committee at my University, and I would have jumped at the chance to "reprimand" actions like these...
[ link to this | view in chronology ]
Re: Copyright
Obviously, CMU avoids that problem by keeping people like you off of their Ethics Committee.
[ link to this | view in chronology ]
What do they have to worry about if they get caught blatantly breaking the law? A paid promotion, national security don't pry or get sent to jail by the criminals behind this sort of thing.
I mean who is going to stop governmental agencies from breaking the law. Who will force them to face serious consequences for their crimes. Currently no one can.
[ link to this | view in chronology ]