FBI Harassing Core Tor Developer, Demanding She Meet With Them, But Refusing To Explain Why

from the not-cool-fbi dept

Isis Agora Lovecruft is a lead software developer for Tor and has worked on Tor for many years, as well as on a variety of other security and encryption products, including Open Whisper Systems and the LEAP Encryption Access Project. And, apparently, the FBI would really like to talk to her, but won't tell her (or her lawyer) exactly why. It's really worth reading her whole post, which starts with an FBI agent showing up at her parents home and leaving a card, and then later phoning her mother's cell phone while she was at work a few days later. Lovecruft had a lawyer reach out to the FBI agent in question, which resulted in an odd discussion:

Word got to my lawyer in the US, who decided to call FBI Special Agent Mark Burnett, on that Friday, saying that he represented me and my family. Burnett said the FBI simply wanted to ask me some questions. My lawyer responded by stating that, as my invoked representation, all questions should be directed to him rather than to me or my family. The agent agreed, paused while some muffled male voices were heard in the background, and asked to call back in five minutes.

Five minutes later, Burnett called back and said, “I don’t believe you actually represent her.” Burnett stated additionally that a phone call from me might suffice, but that the FBI preferred to meet with me in person. After a pause he said, “But… if we happen to run into her on the street, we’re gonna be asking her some questions without you present.”

Complicating matters was the fact that Lovecruft was deep into the process of moving permanently to Germany, and actually had just been visiting her family in the US. She worried about whether or not she'd even be able to leave, though eventually flew back to Europe without incident. She notes that once back in Germany, she was focused on getting all the documentation in order to get her official residence visa in Germany when the FBI again came looking for her:

The day before my appointment, I spoke with my lawyer. He had received another call, this time from a FBI Special Agent Kelvin Porter in Atlanta.

Lawyer: Hello?

Agent: Hello, this is Special Agent Kelvin Porter at the FBI field offices in Atlanta. I’m calling concerning your client.

Lawyer: Yes. Why are you trying to contact her?

Agent: Well… as before… we would strongly prefer to meet her in person. We have teams in Los Angeles, San Francisco, Chicago, New York, and Atlanta keeping an eye out for her.

Lawyer: Your colleague mentioned last time that you would accept a phone call?

Agent: We would strongly prefer to meet her in person. We… uh… have some documents we’d like her opinion on.

Lawyer: Umm…? What documents?

Agent: Anyway, if she’s available to meet with us, that would be great, thanks.

It didn’t exactly help with the stress of applying for a residence visa to know that there were teams in five cities across America keeping an eye out for me. However, I’m glad to say that, the next day, my residence visa was approved. Eight hours afterwards, my laywer received a voicemail saying:

Agent: Hello this is Special Agent Kelvin Porter, we spoke two days ago regarding your client. Umm… well… so the situation with the documents… it’s umm… it’s all fixed. I mean, we would of course still be happy to meet with your client if she’s willing, but the problem has… uh… yeah… been fixed. And uh… yeah. Just let us know if she wants to set up a meeting.

So, that seemed to settle things for the time being -- though still made her nervous. That last conversation happened in January. But it appears that last week, the FBI came knocking again, and apparently said they want to serve her with a subpoena.

The FBI has contacted my lawyer again. This time, they said, “She should meet with one of our agents in San Francisco to talk. Otherwise, are you the point of contact for serving a subpoena? She’s not the target of investigation, but, uh… we uh… need her to clear up her involvement or… uh… potential involvement in a matter.”

She's (reasonably) worried that whatever the FBI is planning to ask her about or serve her with comes with a gag order and she won't be able to speak about it. She also notes that she's got a personal warrant canary, which might be worth watching for obvious reasons.

But, honestly, the part that struck me as most interesting about all of this is the incredible amount of stress that this obviously caused for her. It doesn't matter if the FBI says she's "not a target," having the FBI come looking for you can really shake you up. Especially when they won't provide any details:

I didn’t talk to anyone who wasn’t already in regular contact with me, fearing I might endanger them — some thug might show up at their mom’s door or make some threats to their lawyers — and I didn’t want to risk harming people I care about. It hurt to not tell my friends what was happening. I felt gagged and frightened. I wanted to play chess in the park. I wanted to learn duets on the piano. I wanted to ride bicycles through the ancient groves in the park in the endless Californian sunshine. I wanted to bring homemade vegan gluten-free brownies and stickers from collectives in France to my friends at the EFF. To be selfish, I wanted to read the number theory papers I’d just downloaded and play with a new pairing-based cryptography library I’d just been given the source to, but I couldn’t do those things either, simply because I was too stressed out to think straight.

I got absolutely no work done.

That, right there, is a clear description of the chilling effects that this kind of thing can cause. And that's a shame. As she later notes, her paychecks for working on Tor come from the US government. She's not a spy or a criminal. She's working on software that makes everyone safer. And no matter what the reason for the FBI's interest, it's ridiculous that someone should have to go through this kind of process.

Filed Under: fbi, harassment, isis agora lovecruft, tor
Companies: tor project

Tor Project Claims FBI Paid Carnegie Mellon $1 Million To Deanonymize Tor Users

from the tying-together-loose-threads dept

First, let's go back a year or so. A few weeks before the big Black Hat Conference in 2014, it was announced that a planned presentation from two Carnegie Mellon University researchers (Michael McCord and Alexander Volynkin), entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" was pulled from the program, leading to lots and lots of speculation about what happened. Soon after this, the Tor Project announced it had discovered a group of relays that appeared to trying to deanonymize Tor users who were operating Tor hidden services.

A few months after this, the FBI and Europol suddenly took down a bunch of darknet sites and arrested people accused of running them (calling it "Operation Onymous") -- including arresting a guy named Blake Benthall for running Silk Road 2.0. At the time, we pointed out something odd in the criminal complaint against Benthall. While the complaint noted that the FBI had found the server that was running Silk Road 2.0 (in an unnamed foreign country) and imaged it, nowhere was it explained how.

A couple months after that (at the beginning of this year), the FBI announced the arrest of Brian Farrell, who the FBI claims was a close assistant to Benthall in running Silk Road 2.0.

Fast forward to last week -- and Farrell's lawyer filed a motion with the district court hearing his case, noting that, just last month, the Justice Department revealed to Farrell's legal team that some of the evidence came from a "university-based research institute" and that Farrell's defense team had requested additional discovery to get more info. From the motion (which oddly, none of the other press reports on this story published):

On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0. In response to this letter, undersigned counsel requested additional discovery from the government to determine the relationship between the “university-based research institute” and the federal government, as well as the means used to identify Mr. Farrell on what was supposed to operate as an anonymous website. To date, the government has declined to produce any additional discovery.

Farrell's lawyers asked for more time, noting that there was another case in the same court (more on that below), seeking the same discovery, and Ferrell's lawyers would like his case put on hold until the issue of discovery over the "university-based research institute" was settled in the other case. Vice then reported on this filing... leading the Tor Project itself to announce that it was pretty sure not just that the Carnegie Mellon research project from last year was the project in question, but that the FBI had paid CMU $1 million for that information, though the claim is from an anonymous source.

The Tor Project has learned more about last year's attack by Carnegie Mellon researchers on the hidden service subsystem. Apparently these researchers were paid by the FBI to attack hidden services users in a broad sweep, and then sift through their data to find people whom they could accuse of crimes....

[....]

We have been told that the payment to CMU was at least $1 million.

There is no indication yet that they had a warrant or any institutional oversight by Carnegie Mellon's Institutional Review Board. We think it's unlikely they could have gotten a valid warrant for CMU's attack as conducted, since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once.

Wired approached Carnegie Mellon who gave a pretty big non-answer in response:

When WIRED contacted Carnegie Mellon, it didn’t deny the Tor Project’s accusations, but pointed to a lack of evidence. “I’d like to see the substantiation for their claim,” said Ed Desautels, a staffer in the public relations department of the university’s Software Engineering Institute. “I’m not aware of any payment,” he added, declining to comment further.

This whole complicated scenario raises some pretty serious questions -- including whether or not the federal government paid a university to do research in a manner that would almost certainly violate university ethics rules on research on human subjects, but also which would allow the FBI to get all sorts of information on people without a warrant. As the director of the Tor Project, Roger Dingledine, told Wired:

“This attack…sets a troubling precedent: Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities. If academia uses ‘research’ as a stalking horse for privacy invasion, the entire enterprise of security research will fall into disrepute,” Dingledine writes. “We teach law enforcement agents that they can use Tor to do their investigations ethically, and we support such use of Tor–but the mere veneer of a law enforcement investigation cannot justify wholesale invasion of people’s privacy, and certainly cannot give it the color of ‘legitimate research.'”

“Whatever academic security research should be in the 21st century,” he concludes, “it certainly does not include ‘experiments’ for pay that indiscriminately endanger strangers without their knowledge or consent.”

And now... this issue moves over to the other case that Farrell's lawyers pointed out, which is a criminal case against someone named Gabriel Peterson-Siler, who was arrested earlier this year for child porn -- and whose lawyers learned from the Justice Department that some of the evidence against him, similarly came from this "university-based research institute." That's not directly said in the filings in that case, but Peterson-Siler's lawyer did make clear that something was up:

This case involves a national operation targeting users of a child pornography website on a network known as the Onion Router (TOR), commonly termed the darknet. The government and the defense recently discussed a potential discovery issue which involves highly sensitive investigative materials regarding the investigation into the users of the child pornography TOR website. This potential discovery issue has involved extensive consultation with multiple Department of Justice components in Washington, D.C., and, despite the diligence of the government, took time to resolve. Defense counsel was notified of the resolution of that consultation process on the same day, October 13, 2015, and the government and defense counsel have been in regular contact regarding next steps. Any ongoing discovery issues related to this matter may also require coordination with multiple Department of Justice components in Washington, D.C.

The date, October 13 when this was revealed, was the same date that Farrell's lawyers learned the same information. So, now, all eyes should turn to the Peterson-Siler case, to determine whether or not the details are going to come out about how the FBI got this info and whether or not it was legal. Unfortunately, Gabriel Peterson-Siler is anything but a sympathetic defendant here. He's facing charges for child porn, and, according to the detention order in this case, this is not the first time Peterson-Siler has been in court over such an issue:

Defendant is charged by Complaint with possessing matter containing visual depictions of minors engaging in sexually explicit conduct that had been transported in interstate and foreign commerce. He has a prior conviction for possession of child pornography, for which he served 14 months of confinement, and two years of sexual deviancy treatment. Defendant was on state court supervision at the time of some of the alleged offense conduct charged in this case, some of which was during or soon after the conclusion of the sexual deviancy treatment.

One hopes that this fact won't cloud the issue over whether or not the FBI should be allowed to pay university researchers to break Tor's anonymity and spy on people in large groups. But, that may be asking a lot...

Filed Under: alexander volynkin, anonymity, blake benthall, brian farrell, fbi, gabriel peterson-siler, michael mccord, operation onymous, silk road 2.0, surveillance, tor
Companies: carnegie mellon, tor project

Tor Developers, Privacy Wonks Desperately Searching To Figure Out How The Feds Broke Tor To Find Hidden Servers

from the the-hunt-is-on dept

As we mentioned in last week's post on the arrest of Blake Benthall, the alleged operator behind Silk Road 2.0, the arrest was actually part of a larger global effort to take down around two dozen "darknet" websites. While the Benthall indictment does talk about an undercover Homeland Security employee who infiltrated Silk Road 2.0 to gather evidence, a key part of the evidence gathering is left vague: how did officials find the actual servers that were supposedly hidden by Tor? In the past few days, a big effort has been undertaken by a bunch of folks, including key Tor developers to try to work out how all of this happened:

Over the last few days, we received and read reports saying that several Tor relays were seized by government officials. We do not know why the systems were seized, nor do we know anything about the methods of investigation which were used. Specifically, there are reports that three systems of Torservers.net disappeared and there is another report by an independent relay operator. If anyone has more details, please get in contact with us. If your relay was seized, please also tell us its identity so that we can request that the directory authorities reject it from the network.

But, more to the point, the recent publications call the targeted hidden services seizures "Operation Onymous" and they say it was coordinated by Europol and other government entities. Early reports say 17 people were arrested, and 400 hidden services were seized. Later reports have clarified that it was hundreds of URLs hosted on roughly 27 web sites offering hidden services. We have not been contacted directly or indirectly by Europol nor any other agency involved.

Tor is most interested in understanding how these services were located, and if this indicates a security weakness in Tor hidden services that could be exploited by criminals or secret police repressing dissents. We are also interested in learning why the authorities seized Tor relays even though their operation was targetting hidden services. Were these two events related?

The Tor post lists out a number of possible scenarios under which the hidden servers were located, including bad operational security (opsec), SQL injections (because, of course), Bitcoin deanonymization and attacks on the Tor network. That last one is getting a lot of attention for a variety of reasons. Kashmir Hill over at Forbes has an interesting post exploring the possible connection with the cancelled Black Hat talk from this summer about identifying Tor users, which was done by some Carnegie Mellon researchers. Around that time, Tor also revealed that its network had been compromised, and asked everyone to upgrade to patch vulnerabilities. Many assume these two things were connected.

If you control enough of the Tor network, it’s possible to get a kind of bird’s eye view of the traffic being routed through it. It was clear that Tor thought the Carnegie Mellon researchers were responsible. The researchers refused to talk to the press, but a conference spokesperson told Reuters the talk was canceled because the researchers hadn’t cleared the release of their work through their department, the Software Engineering Institute, which receives funding from the Defense Department. At the time, many assumed that the university pulled the plug on the talk because of academic ethics considerations and the gray legal zone it was in, with the researchers casually intercepting Web traffic. But maybe it got pulled because the researchers were revealing a law enforcement technique that the government did not want publicized. If nothing else, it’s highly likely the information the researchers collected about “drug dealers and child pornographers” made its way into law enforcement hands. McCord said he was “unable to comment on the matter.” Carnegie Mellon’s SEI declined comment about the canceled talk and about whether it had provided information from the research to law enforcement.

Hill also quotes Nicholas Weaver with some thoughts on what happened:

“I am 95% certain that law enforcement did a mass de-anonymization attack on Tor hidden services,” says Nicholas Weaver, a researcher at the International Computer Science Institute. He called any link to the earlier research “circumstantial.” But he points out that the work the researchers did was expensive. A “back of the envelope estimate suggests that whoever was running the attack on Tor at the beginning of the year using [Amazon hosting services] spent at least $50,000 in computer time,” says Weaver. That’s not the kind of money an academic can spend on a hobby project.

Meanwhile, one of the (still free) operators of a Tor hidden site that was taken down by the feds, Doxbin, has stepped forward to release a bunch of log files and related information to potentially track down how it was discovered (he posted on a mailing list using the amusing subject line of "yes hello, internet supervillain here." This has resulted in much more speculation on what kind of attack was being run.

As it stands, no one (other than law enforcement) knows exactly how this came down, but I would imagine that it won't be long until people have figured out what likely happened, and fixes are put in place. This, of course, is the nature of any sort of anonymization effort. People will always break it for some reason or another, and then it's just an ongoing back and forth to fix holes and improve the system...

Filed Under: attacks, hidden services, hidden sites, privacy, tor
Companies: tor project

Ridiculous Lawsuit Filed (And Now Dropped) Against Tor Project Gets Even More Ridiculous: Now Involving Hate Group Leader

from the wait,-what? dept

So, yesterday we wrote about the already bizarre lawsuit filed by Jason Lee Van Dyke, a Texas lawyer, on behalf of Shelby Conklin, against a revenge porn site, Pinkmeth, and (even more ridiculous), the Tor Project. There were many, many problems with the lawsuit, starting with the cluelessness of Van Dyke in going after the Tor Project, when he clearly had no idea what it was or did, or any idea about how Section 230 of the CDA works (in fact, it appears he misrepresented a similar case, in which GoDaddy was protected by Section 230). There were also some problems with the First Amendment aspects of this, and Van Dyke's argument that aiding someone in being anonymous was some sort of aiding and abetting of law-breaking. Thankfully, this morning Van Dyke admitted that he was dropping the Tor Project from the lawsuit -- though he doesn't appear to have apologized or admitted to his own errors. Instead, it appears he's been doubling down -- which we'll get to later in this post.

But first, the story has taken a different twist, as Jay Wolman in our comments pointed to something even more bizarre: Van Dyke claimed that Pinkmeth's "address" (also where he had the lawsuit served) was the same address as Kyle Bristow, Esq. Pinkmeth had previously facetiously indicated that Bristow was its attorney (and uses a picture of Bristow on its Twitter account). But it's clear that whoever is behind Pinkmeth is joking. Bristow and Van Dyke have worked together to try to shut down revenge porn sites like Pinkmeth in the past, and Pinkmeth is clearly mocking Van Dyke by claiming that Bristow is its lawyer.

But Van Dyke still "served" Pinkmeth at Bristow's offices, knowing that it's bogus. As Wolman notes, since Van Dyke knows this is not actually Pinkmeth's offices, what he's done clearly borders on "fraud on the court." Meanwhile, our friends at Above the Law have even more on this situation, including the fact that Bristow was declared the leader of a hate group while he was in college, who has openly advocated racist and homophobic positions.

As for why Bristow, who appears to have rather stone-aged views of the world, is now focused on fighting revenge porn? Well, his argument kind of speaks for itself:

“Revenge pornography is nothing more than a manifestation of liberalism,” Bristow said. “Most victims on revenge pornography websites are young, white, blonde, middle class, American women. Women who the pornographers can link to conservatism or Christianity are especially targeted for harassment.”

Yes, as Above the Law notes, Bristow is against revenge porn because it's "defiling white blondes in an effort to undermine Christianity." As bad as we think revenge porn sites and their operators are, somehow I doubt that's the goal. Either way, Van Dyke pretending to believe that his buddy Bristow actually represents Pinkmeth is just the latest in a long line of problems with the lawsuit...

Meanwhile, as another commenter on our original story pointed out, Van Dyke appears to be freaking out on Facebook, threatening to sue people who are posting negative reviews of his firm: Sometimes, combined with the threats of lawsuits, he directly threatens physical harm on people: And, much of the rest of the time, he's displaying just the sort of "professionalism" we're sure that the Texas bar approves of: Separately, when someone sent him a copy of my original article, he laid out his own "legal strategy," in which he explains that he's filing this on the expectation that Pinkmeth will default and then he'll get his injunction (some of the companies that he's seeking the injunction to apply to may have a word or two to say about that). Oh, and at the end, he flat out admits that "it's my job to violate the civil rights of people like you." Lovely.

Filed Under: fraud on the court, jason lee van dyke, jason van dyke, kyle bristow, revenge porn, shelby conklin
Companies: pinkmeth, tor project