Tor Devs Say They've Learned Lessons From Carnegie Mellon Attack, But Worries Remain That They're Outgunned And Outmanned

from the trust-no-one dept

Early last year, Tor suffered a massive attack that compromised the anonymity of its users over a period of at least six months. Soon after, the FBI launched Operation Onymous, which dismantled yet another round of darknet markets and left Tor developers and supporters desperately wondering what went wrong. Last month, Tor then dropped a bit of a bombshell: it claimed the FBI paid researchers at Carnegie Mellon $1 million to conduct a Sybil attack on the network. Running from January to July of 2014, CERT used just $3,000 in hardware to flood the Tor network with additional new relays that then modified Tor protocol headers to do traffic confirmation attacks.

As it turns out, a new report from Kashmir Hill at Fusion notes that Tor developers had ample forewarning that something was going wrong. In fact, a Tor supporter sent a message to the Tor mailing list early in 2014 highlighting the odd behavior of these computers, but it was effectively brushed aside by Tor developers as nothing to worry about. That has of course raised concerns among the 2 million people that use Tor every day -- activists, human rights workers, journalists, and security-minded computer users among them. The revelation has obviously also devastated the reputation of Carnegie Mellon and the CERT Coordination Center.

Both the FBI and the university continue to deny the claims, for whatever that's worth:

“The allegation that we paid CMU $1 million is inaccurate,” said a FBI spokesperson.

Meaning, if you're familiar with semantic FBI parlance, that it probably paid a few specific researchers (not the University itself) $999,999.

Regardless, Hill's new report provides a lot more insight into the attack by Tor chief architect Nick Mathewson, who admits it wasn't the developers' finest hour, noting that he originally overlooked the threat because he believed it was too ham-fisted to actually be performed in the wild:

"I don’t think this is the best response we’ve ever done to an attack situation,” said Mathewson by phone... "It didn’t occur to me that they would run the attack in the wild on random users," said Mathewson. “The way the attack was structured, it was a bad attack for anyone to get away with it. Once detected, it was very easy to block. It didn’t seem to me like a deep threat."

Of course, the end result of this oversight was not only the arrests and darknet site closures from Operation Onymous, but Operation Shrouded Horizon -- which targeted the Darkode black marketplace. And the markets are still reeling. Though it's always hard to differentiate an exit scam (where the site just runs away with the money held in escrow) from security concerns, numerous markets (like Middle Earth Marketplace) recently went offline claiming they're trying to implement upgrades that will make their drug bazaars more secure.

But Mathewson is quick to make the obvious point that while these arrests primarily targeted child pornographers and drug dealers, the attacks targeted everybody. And the use of supposed objective academics as attackers, the lack of warrants, and the lack of institutional oversight by Carnegie Mellon's Institutional Review Board sets a disgusting precedent for the security community:

"There’s an argument that this attack hurts all of the bad users of Tor so it’s a good thing,” said Mathewson. “But this was not a targeted attack going after criminals. This was broad. They were injecting their signals into as much hidden services traffic as they could without determining whether it was legal or illegal." "Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities,” wrote Dingledine in a Tor blog post, which also questioned whether Carnegie Mellon had gotten approval from an institutional review board, a process that exists to ensure that academics don’t harm human research subjects."

For what it's worth, Mathewson says the Tor team has made numerous code changes to better scan the Tor network for potential threats, and are working on an as-yet unfinished revamp of the hidden services design over the last year. Tor is also working on what Mathewson calls a "new cryptographic trick" that will allow a hidden services directory to send Tor users to a hidden site -- without the directory knowing where it's sending them. The developers have also apparently learned a thing or two about trust, Mathewson stating they're no longer "extending security researchers the benefit of the doubt on anything." Good idea.

The central question of course is whether Tor has the manpower needed to keep such an integral technology operational and secure. Eighty percent of Tor's $2.5 million budget still comes from the government, so Tor is operating a crowdfunding campaign to expand the funding base for obvious reasons. But Tor only has 22 full- and part-time employees, and 10 volunteers and academics who consistently contribute code, which directly contributed to the attack not being taken seriously earlier. As such we're left wondering if Tor can be trusted moving forward and, if not, what comes next for the millions of users that depend on Tor for perfectly-legal anonymous communications?

Filed Under: anonymity, attacks, fbi, hack, surveillance, tor
Companies: carnegie mellon, tor

Montana Newspaper Announces Plans To Reveal The Names Of All Previous Commenters, Despite Promises To Keep Them Secret

from the well,-that's-one-strategy dept

The Montana Standard, a newspaper in Butte, Montana has apparently decided on a new strategy for its online commenters, requiring "real names" to be associated with every comment. We've spent plenty of time arguing why this is kind of stupid, but many websites falsely believe that anonymity leads to less friendly comments, and using "real names" will magically make people nice (in our experience, people with real names can still be insufferable jackasses, while some of our best comments come from anonymous users, but...). But, that change in policy alone isn't that big of a deal. What is a big deal is that the Standard has decided to do this retroactively. As it stands now, and as it's been in the past, when you sign up to comment, it directly asks you for both your real name and your "screenname" and states pretty clearly that this is the name that will display with your comments: But on January 1st, all of that changes, and whatever people put in as their "real names" will show up. The Standard is allowing people who are concerned to email them before December 26th to argue for why their comments should be removed before the January 1st switch over, but it seems likely that many won't even realize this is happening. Lots of people have been using the comments on that post itself to criticize this plan, and Paul Alan Levy has written a thorough post explaining why this is so problematic:

The Standard’s retroactive application of its real name policy seems to me highly irresponsible. You can easily imagine a newspaper deciding that is not going to rely on anonymous sources in its news stories – certainly there have been media entities that have claimed to have adopted such policies. But can you imagine a paper doing so retroactively, leaving its stories online that were previously sources anonymously but replacing such categories as “inside source” with the name of a whistleblower, or replacing “highly placed official” with the name of the conniving government official speaking “candidly” about his internal adversaries under cover of source protection? “I’m sorry, Deep Throat, we have decided to tell Nixon and his henchmen who you really are.” You could have a number of unhappy sources, not to speak of some dead ones where the sources live abroad in a society or culture where dissent is not tolerated. The source’s life could be in danger even if the source lives inside the United States, if the source was talking about the Crips, or MS-13, or some militia group.

The Standard’s editor told Davis that it is publishing notice of its new policy, including the retroactive application, in both its print editions and web site, and that it “is sending emails to prior commenters, when it has valid email addresses.” (Although as of today, when I looked at the page where the site’s users register to be allowed to comment, there was no notice of any impending policy; to the contrary, the site still promises that the screen name “is the name that will be displayed next . . . for comments, blog posts, and more. Choose wisely!”) But depending on how long it has been since the Standard started accepting registrations, it is quite possible that users may have changed their email addresses, or have moved on to a new email address without ever canceling the old one, and hence they might not see the Standard’s notice. And it is also quite possible that some of the commenters may have made comments that place their economic or even physical security at risk from the individuals or companies that they criticized in online comments. Or, their comments might have revealed something about their own experiences or past conduct that they were willing to share with the public anonymously, making a valuable contribution to a discussion, but would never have been willing to provide had they known that their own names would be attached. The Standard could be putting livelihoods and more at risk through its retroactive changes.

Levy further tested the existing commenting system, discovering that it was, in fact, easy to sign up with fake "real names" -- including a test where he signed up using the name of the Standard's editor, David McCumber.

I was able to register with a completely invented name, in which I provided a real email address but no other truthful information in the various boxes on the registration page. The comment I posted is the only one that was posted on November 23, 2015 – it appears with the screen name “notmyrealname.” As a further test, I registered again today, again providing false information throughout the registration process, but this time the “real name” I provided was the name of the Standard’s editor, David McCumber, and the street address that I provided was the Standard’s own address. The comment duly appeared on the paper’s web site a few minutes later – it is there under the screen name “NotReallytheEditor.” So, presumably, this comment will appear on January 1 as having been posted by David McCumber.

Promising to keep people's names hidden, and then retroactively changing that with little notice seems like an incredibly irresponsible thing to do. One hopes that the Standard will reconsider.

Filed Under: anonymity, anonymous comments, butte montana, comments, david mccumber, real names
Companies: montana standard

Tor Project Claims FBI Paid Carnegie Mellon $1 Million To Deanonymize Tor Users

from the tying-together-loose-threads dept

First, let's go back a year or so. A few weeks before the big Black Hat Conference in 2014, it was announced that a planned presentation from two Carnegie Mellon University researchers (Michael McCord and Alexander Volynkin), entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" was pulled from the program, leading to lots and lots of speculation about what happened. Soon after this, the Tor Project announced it had discovered a group of relays that appeared to trying to deanonymize Tor users who were operating Tor hidden services.

A few months after this, the FBI and Europol suddenly took down a bunch of darknet sites and arrested people accused of running them (calling it "Operation Onymous") -- including arresting a guy named Blake Benthall for running Silk Road 2.0. At the time, we pointed out something odd in the criminal complaint against Benthall. While the complaint noted that the FBI had found the server that was running Silk Road 2.0 (in an unnamed foreign country) and imaged it, nowhere was it explained how.

A couple months after that (at the beginning of this year), the FBI announced the arrest of Brian Farrell, who the FBI claims was a close assistant to Benthall in running Silk Road 2.0.

Fast forward to last week -- and Farrell's lawyer filed a motion with the district court hearing his case, noting that, just last month, the Justice Department revealed to Farrell's legal team that some of the evidence came from a "university-based research institute" and that Farrell's defense team had requested additional discovery to get more info. From the motion (which oddly, none of the other press reports on this story published):

On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0. In response to this letter, undersigned counsel requested additional discovery from the government to determine the relationship between the “university-based research institute” and the federal government, as well as the means used to identify Mr. Farrell on what was supposed to operate as an anonymous website. To date, the government has declined to produce any additional discovery.

Farrell's lawyers asked for more time, noting that there was another case in the same court (more on that below), seeking the same discovery, and Ferrell's lawyers would like his case put on hold until the issue of discovery over the "university-based research institute" was settled in the other case. Vice then reported on this filing... leading the Tor Project itself to announce that it was pretty sure not just that the Carnegie Mellon research project from last year was the project in question, but that the FBI had paid CMU $1 million for that information, though the claim is from an anonymous source.

The Tor Project has learned more about last year's attack by Carnegie Mellon researchers on the hidden service subsystem. Apparently these researchers were paid by the FBI to attack hidden services users in a broad sweep, and then sift through their data to find people whom they could accuse of crimes....

[....]

We have been told that the payment to CMU was at least $1 million.

There is no indication yet that they had a warrant or any institutional oversight by Carnegie Mellon's Institutional Review Board. We think it's unlikely they could have gotten a valid warrant for CMU's attack as conducted, since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once.

Wired approached Carnegie Mellon who gave a pretty big non-answer in response:

When WIRED contacted Carnegie Mellon, it didn’t deny the Tor Project’s accusations, but pointed to a lack of evidence. “I’d like to see the substantiation for their claim,” said Ed Desautels, a staffer in the public relations department of the university’s Software Engineering Institute. “I’m not aware of any payment,” he added, declining to comment further.

This whole complicated scenario raises some pretty serious questions -- including whether or not the federal government paid a university to do research in a manner that would almost certainly violate university ethics rules on research on human subjects, but also which would allow the FBI to get all sorts of information on people without a warrant. As the director of the Tor Project, Roger Dingledine, told Wired:

“This attack…sets a troubling precedent: Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities. If academia uses ‘research’ as a stalking horse for privacy invasion, the entire enterprise of security research will fall into disrepute,” Dingledine writes. “We teach law enforcement agents that they can use Tor to do their investigations ethically, and we support such use of Tor–but the mere veneer of a law enforcement investigation cannot justify wholesale invasion of people’s privacy, and certainly cannot give it the color of ‘legitimate research.'”

“Whatever academic security research should be in the 21st century,” he concludes, “it certainly does not include ‘experiments’ for pay that indiscriminately endanger strangers without their knowledge or consent.”

And now... this issue moves over to the other case that Farrell's lawyers pointed out, which is a criminal case against someone named Gabriel Peterson-Siler, who was arrested earlier this year for child porn -- and whose lawyers learned from the Justice Department that some of the evidence against him, similarly came from this "university-based research institute." That's not directly said in the filings in that case, but Peterson-Siler's lawyer did make clear that something was up:

This case involves a national operation targeting users of a child pornography website on a network known as the Onion Router (TOR), commonly termed the darknet. The government and the defense recently discussed a potential discovery issue which involves highly sensitive investigative materials regarding the investigation into the users of the child pornography TOR website. This potential discovery issue has involved extensive consultation with multiple Department of Justice components in Washington, D.C., and, despite the diligence of the government, took time to resolve. Defense counsel was notified of the resolution of that consultation process on the same day, October 13, 2015, and the government and defense counsel have been in regular contact regarding next steps. Any ongoing discovery issues related to this matter may also require coordination with multiple Department of Justice components in Washington, D.C.

The date, October 13 when this was revealed, was the same date that Farrell's lawyers learned the same information. So, now, all eyes should turn to the Peterson-Siler case, to determine whether or not the details are going to come out about how the FBI got this info and whether or not it was legal. Unfortunately, Gabriel Peterson-Siler is anything but a sympathetic defendant here. He's facing charges for child porn, and, according to the detention order in this case, this is not the first time Peterson-Siler has been in court over such an issue:

Defendant is charged by Complaint with possessing matter containing visual depictions of minors engaging in sexually explicit conduct that had been transported in interstate and foreign commerce. He has a prior conviction for possession of child pornography, for which he served 14 months of confinement, and two years of sexual deviancy treatment. Defendant was on state court supervision at the time of some of the alleged offense conduct charged in this case, some of which was during or soon after the conclusion of the sexual deviancy treatment.

One hopes that this fact won't cloud the issue over whether or not the FBI should be allowed to pay university researchers to break Tor's anonymity and spy on people in large groups. But, that may be asking a lot...

Filed Under: alexander volynkin, anonymity, blake benthall, brian farrell, fbi, gabriel peterson-siler, michael mccord, operation onymous, silk road 2.0, surveillance, tor
Companies: carnegie mellon, tor project

James Woods Not Allowed To Find Out Name Of Guy Who Called Him A Cocaine Addict On Twitter

from the that's-not-how-this-works dept

Over the summer, we wrote about a positively ridiculous lawsuit filed by the actor James Woods, who apparently took offense to an obviously hyperbolic tweet, calling him a "cocaine addict." Woods felt that such a joke tweet deserved a $10 million lawsuit. The anonymous Twitter user hooked up with Ken "Popehat" White as his lawyer and made an anti-SLAPP claim against Woods for his lawsuit that seemed obviously designed to silence criticism on Twitter. Amusingly, one of the things that White's response pointed out was that Woods himself had referred to others on Twitter in a similar way: One of the most important parts of California's very good anti-SLAPP law (which is a way to fight back against lawsuits that are clearly just designed to shut someone up), is that it blocks all "discovery" efforts in the case until the anti-SLAPP efforts are decided. This is especially important, because it's often the discovery process that destroys peoples' lives -- costing them tons of time and money in responding to requests. In this case, Woods and his lawyer still sought to use the discovery process to find out the identity of the Twitter user who went by the user name "Abe List."

However, as Eriq Gardner at the Hollywood Reporter notes, the court has rejected this attempt, noting that it's way, way too early to get into that with an anti-SLAPP claim still in place:

L.A. Superior Court judge Mel Recana concludes that the defendant's mental state when making the tweet isn't material just yet in the case. In an order this week, the judge writes, "Defendant argues that if the court finds that the statement is a 'mere rhetorical insult,' then malice is irrelevant and defendant prevails. The court agrees that plaintiff is not entitled to discovery into malice at this stage. The anti-SLAPP motion is limited to whether the statement was a provable fact or a 'figurative rhetorical insult.' "

This is not surprising, but it's good to see that the court is following the proper procedures here and not letting Woods try to get around the anti-SLAPP process in order to identify the tweeter.

Filed Under: abe list, anonymity, anti-slapp, discovery, free speech, james woods, slapp

Popehat v. James Woods SLAPP-down Match; Coming Soon To A Court Near You

from the can-i-get-front-row-seats? dept

A month ago, we wrote about actor James Woods bizarrely suing a trollish Twitter user who had been mocking Woods on the site. The whole lawsuit seemed ridiculous. The specific tweet that sent Woods over the edge was this anonymous user (who went by the name "Abe List") saying "cocaine addict James Woods still sniffing and spouting." Soon after our post on the subject, Ken "Popehat" White posted an even better takedown entitled James Woods Punches the Muppet. That post has now been updated with a brief note that White has now been retained to defend the anonymous Twitter user. And, if that gets you excited for what to expect in the legal filings, well, you don't have wait. As first reported by Eriq Gardner at the Hollywood Reporter, White has filed the John Doe's opposition to Woods' attempt to unmask the guy. And it's worth reading.

Problem number one with Woods' suit is laid out right at the beginning of the filing, which is that Woods himself has a habit of accusing others of using illegal drugs as well, just as Abe List did: The filing shows other tweets from Woods that have similar words that Woods complained about Abe List using, such as "clown" and "scum." As the filing notes, it appears Woods thinks that he can use those insults towards others, but if anyone uses them towards him, it's somehow defamatory.

Plaintiff, an internationally known actor, is active on Twitter, a social media platform. There he is known for engaging in rough-and-tumble political debate. Plaintiff routinely employs insults like “clown” and “scum,” and even accuses others of drug use as a rhetorical trope....
But Plaintiff apparently believes that while he can say that sort of thing to others, others cannot say it to him. He has sued Mr. Doe for a derisive tweet referring to him as “cocaine addict James Woods still sniffing and spouting” in the course of political back-andforth.... He also complains, at length, that Mr. Doe has called him things like a “clown” and “scum.” Naturally, Plaintiff has himself called others “clown” or “scum” on Twitter.

The filing, quite reasonably, notes that these kinds of hyperbolic claims cannot be seen as defamatory, and since there's no legitimate claim here, there is no reason to do expedited discovery or to unmask Abe List, who is entitled to have his identity protected under the First Amendment.

Oh, and, not surprisingly, White will be filing an anti-SLAPP motion shortly, which may mean that Woods is going to have to pay for this mess that he caused.

The filing also notes that while Woods sent a subpoena to Twitter to try to seek Abe List's identity, the company turned it down as deficient. The full two page letter is in the filing below as Exhibit B, but a quick snippet on the First Amendment concerns: Meanwhile, Woods has already filed a response in which he is still seeking to uncover the name of Abe List, and which repeats more ridiculous claims about the whole thing, starting off with the simply false claim that the original "cocaine addict" tweet was likely seen by "hundreds of thousands" of Woods' followers. That's wrong. They would only see if they followed both Woods and the Abe List account, which very few did.

The filing, somewhat hilariously, claims that calling someone "a joke," "ridiculous," "scum" and "clown-boy" are not protected by the First Amendment. Which makes me wonder what law school Woods' lawyers went to. Because that's just wrong:

AL's outrageous claim appears to be the culmination of a mlaicious on-line campaign by AL to discredit and damage Woods' reputation, a campaign which began as early as December 2014. In the past, AL has referred to Woods with such derogatory terms as a "joke," "ridiculous," "scum" and "clown-boy." ... Although AL's rantings against Woods began with childish name calling, it has escalated beyond the protections of free speech, i.e., the First Amendment does not permit anyone to falsely represent to the public that another person is addicted to an illegal narcotic.

Um... but Woods himself did exactly that (see above). It's standard hyperbolic speech, which is clearly not defamatory especially when mocking a public figure like Woods who has a history of using the same sort of hyperbolic insults on Twitter. Even more ridiculously, Woods' lawyers claim that by saying that the statement was a joke, that's Abe List admitting that he knew it was a false statement. I can't see that argument flying. I can see it backfiring big time once the anti-SLAPP motion is made.

So, what about those similar tweets made by Woods himself? His lawyers tell the court to ignore those piddly things.

... to the extent AL or TG attempt to argue that the Court should consider other statements on their Twitter accounts, or any previous tweets by Mr. Woods, the argument is a red herring. First, there is no reason any of Mr. Woods' followers, all of whom were exposed to the defamatory statements, would even bother to investigate the speakers and/or their Twitter sites to determine if they were reliable sources. As to Mr. Woods, we are not aware of any false statements of fact made by Mr. Woods and his sometimes sharp commentary on political matters is irrelevant to the allegations here.

Except, uh, again, Woods suggested someone smoked crack, just like Abe List joked that Woods was a cocaine addict. And, again, Woods and his lawyers are just wrong that all of Woods' followers would have seen Abe Lists' tweets. They're just factually wrong.

You never know how courts will rule in any particular case, no matter how ridiculous, but I have a hard time seeing how Woods gets out of this without having to pay two sets of lawyers -- his own and Ken White -- for filing a clearly bogus defamation case designed to shut up (and identify) an anonymous Twitter critic. No matter what, James Woods may not be a cocaine addict, but he has made it clear that he can dish it out but can't take it back when people make fun of him. What a clown.

Filed Under: abe list, anonymity, anti-slapp, cocaine, criticism, defamation, discovery, free speech, hyperbole, james woods, ken white, popehat, slapp
Companies: twitter

Daily Dot Latest To 'Keep Conversation Moving Forward' By Not Letting Site Visitors Comment At All

from the muted dept

There's a raging trend afoot for websites to shutter their news comment sections, then insisting that they're doing this because they care so much about conversation on the Internet. A steady parade of websites have now stopped letting site visitors give public feedback, almost-proudly informing these muted site communities that this was done for the greater good of mankind. Really, companies just don't want to spend the time or money to weed the troll garden (or may not like having their writers publicly fact checked on site), and are shoving these communities toward social media to bury the "problem" permanently.

The name of the game is about being cheap and lazy without looking like you're being cheap and lazy, and the justifications being flung about by editorial staffs are equal part absurd and fascinating. Popular Science, for example, declared that on site discussion of news articles is "bad for science." The Verge recently decided to shutter news story comments to help "build relationships." Bloomberg recently killed news comments and insisted it wasn't a big deal because, hey, most people can't be bothered to comment and therefore news comments "don't represent our readership."

Few of these sites seem particularly concerned about the fact that shuttering comments makes it very clear they don't really value truly local community, and lack the willpower to nurture and protect on-site (or in app) participation. Nor do they seem to realize that data has shown that toxic comment sections can often be dramatically improved simply by engaging a little with readers.

The Daily Dot is the latest to put comments "on infinite hiatus," the site proclaiming it's basically giving up after a few of the bigger troll flare ups of the last few years:

This trend is about more than just raw engagement. It’s also about what kind of engagement we want to have. We’re at an interesting point in the history of the Web. In the wake of Gamergate, Celebgate, and the Reddit Meltdown of 2015, both publishers and social networks are grappling with the same fundamental issue: how to foster engagement and dialogue without inadvertently feeding the trolls in the process.

The solution: don't let anybody say anything publicly on your actual website. Ingenious! The site continues:

"The general consensus is that we need to detoxify the Web—to make it a cleaner, nicer, safer, and more inclusive place to live and work. Of course, at the Daily Dot, we would like to see a more civil, compassionate Web, but we want to be careful that in the name of fostering civility, we do not inadvertently kill all dissention.

The notion that you can somehow bring managed civility to the entire Internet seems like a fool's errand. You can bring civility to your own comment section, but again that takes time, money and effort that it's abundantly clear many websites aren't willing to provide. So instead we get esoteric, disingenuous, incoherent musings on how being too lazy to engage with your own readership will somehow save the broader Internet from the menacing troll hordes. Like other sites, The Daily Dot proclaims that "hey, we're still on social media" before dropping the now all-too-common line about how this is all about improving the conversation:

It’s a different route toward the same goal: to deliver the news to our readers, wherever they may live online, and to keep the conversation moving forward.

It's like putting duct tape on the mouths of everybody in town because of two jackasses at the pub, then proudly patting yourself on the back for spearheading an amazing revolution in kindness and communication. Obviously sites are free to insult and ignore on-site communities as they see fit, but it would be a notable improvement if they could do it without the nauseating hyperbolic claims that they're just trying to save the Internet from itself.

Filed Under: anonymity, comments, conversation, websites
Companies: daily dot

Everyone's A Bad Guy: German Regulator Orders Facebook To Drop Its Stupid 'Real Name' Policy

from the sigh dept

While it seems that too many people and organizations think that the problem with the internet is too much anonymity, there are those who see the opposite as being the case. Google, for instance, at one point instituted a "real name" policy for its platforms, arguing that areas like the comments section on YouTube, which required a real name login, would be worlds better if only everyone had to put their real names on their comments. It was a dumb idea for several reasons, including the complete unworkability of the policy and the fact that, haha, nothing can clean up YouTube's comments section, you silly fools. For these reasons, Google eventually dropped the policy and restored anonymity on its platforms, and yet somehow the world kept turning.

Facebook too has adopted a real name policy and it's been every bit as effective at tamping down unruly behavior. Which is to say that it hasn't. At all. And, in the meantime, valid reasons for wanting to be anonymous online are thrown by the wayside. As it turns out, one German privacy watchdog group considered this an important enough issue to go on the muscle and declare that Facebook must allow anonymous accounts on its platform. Per Bloomberg:

Facebook Inc. was ordered by a German privacy watchdog to allow users to have accounts under pseudonyms on the social network. Facebook may not unilaterally change such accounts to the real names of users and may not block them, Johannes Caspar, Hamburg’s data regulator, said in an e-mailed statement. The company, whose European headquarters are in Ireland, can’t argue it’s only subject to that country’s law, he said.

“Anyone who stands on our pitch also has to play our game,” said Caspar. “The arbitrary change of the user name blatantly violates” privacy rights.

Let's be clear: anonymous speech is an ideal I think everyone should embrace. That said, this move by the regulator is simply another step in an ongoing trend in which European companies appear to want to wield a heavy regulatory hammer on foreign, and especially American, companies. And that trend isn't a good one for a whole host of reasons. Nationalism when it comes to an internet that by definition ignores borders is going to create havoc in an online world that feeds off of open speech and communication. While privacy rights are a laudible goal, creating a patchwork of regulatory rules for companies whose business is the internet is certainly not. And European targeting of American companies in this respect is only going to create a regulatory proxy war that nobody will benefit from.

The most disappointing part of all of this is that this particular story never would have happened if Facebook, with its American roots, had simply stood up for basic American ideals, of which anonymous speech is counted. You simply can't even graze the history of America without encountering the immense importance of anonymous speech, from the publication of Common Sense to the Supreme Court's recognition of it being a basic American ideal. For Facebook to open the door to regulatory abuse by a foreign nation by not honoring this heritage is extremely disappointing. Facebook's reaction to this news is as maddening as it is nonsensical.

“The use of authentic names on Facebook protects people’s privacy and safety by ensuring people know who they’re sharing and connecting with,” the company said in an e-mailed statement.

Ensuring people's privacy by taking away part of that privacy is an interesting theory in that it's self-contradictory on its face. Like I said, there are no good guys in this story, mostly because Facebook has ensured it won't play that role.

Filed Under: anonymity, europe, germany, real names, regulations
Companies: facebook

I'll Put My Name On This Piece Declaring It Idiotic To Argue Against Anonymity Online

from the that's-just-wrong dept

This happens every few months -- whenever there's a flare up of "bad behavior" on the internet. Some genius thinks he can solve everything by just "getting rid of online anonymity." The latest to step into this well trodden, widely debunked, canyon of ridiculousness... is Lance Ulanoff over at Mashable. He seems to think that he's the first person to seriously consider the idea of doing away with online anonymity, and it only serves to show that he's barely thought through the issue at all. First off, it's simply wrong to associate anonymous comments with trollish comments. Yes, some anonymous comments are trollish, but most are not. And, in fact, many trollish, harassing comments come from people who have their real names attached to them. This has been studied widely, but Ulanoff doesn't even bother to look for evidence, he just goes with his gut. The largest single platform for harassment online... has been Facebook, which famously requires "real names." That hasn't stopped harassment, and nor would it do so on Reddit.

Ulanoff completely brushes off privacy concerns, by misunderstanding them. Completely:

Please, please, spare me all the privacy arguments. I know that each and every one of you is terrified that if your real names appear anywhere online, a cyber-crook will start wearing your identity like a cheap suit. Of course, you often forget that you’re sometimes complicit, in some fashion, in the crime: Answering phishing attack emails, using terrible passwords, not shredding your snail mail. Granted, sometimes the cyber thievery happens when hackers scoop up tons of private data on a third-party server.

Yes. This all happens. And I still want to end online anonymity – even if it does leave us a little more exposed online and, though not my objective, destroys Reddit.

Preventing cybercrime is not the main reason why people like to remain anonymous online (again, if that were true, why would anyone be using Facebook?). Many people have really good reasons for wanting to be anonymous online, having to do with not revealing details of their personal life. Want to have a discussion about surviving rape? Maybe you don't want to blast that out to the public. Hell, want to have a discussion about being stalked online? Perhaps not the best thing to put your name out there in public, right? Or what if you're criticizing a boss? Or whistleblowing? Or questioning anyone who has authority to make your life miserable?

Ulanoff lives in a privileged world where apparently he can't ever imagine needing to speak truth to power (this is a reporter?!?) or where he might want to be able to discuss things personally without everyone in the world knowing about it. Lucky him. Most of the world is not so lucky.

We need to shut down online anonymity and stop confusing it with privacy. The answer to protecting yourself online is not to be someone else and please do not talk to me about online identity as if it’s some fluid thing to be protected. If you officially change your name, your address, your email, your phone number, please, by all means, change it online. “FunkyDawg” is not your identity. It’s a handle.

On virtually all of my social accounts, I am “LanceUlanoff.” Granted, I’ve built a tiny online brand around my name, but I’ve also found this transparency much easier to manage than a bunch of random handles and identities. It also keeps me honest. I am accountable for the things I post on Twitter, Facebook, and Instagram.

Again, this is because you're in a position of privilege where you don't need to go in search of people to talk to about how your parents beat you. Or you don't need to find a community to talk to about coming out. Or about finding a new job. There are all sorts of reasons why anonymity matters, and Ulanoff doesn't seem to have considered any of them. And they're not just the "extreme" cases of rape or sexual orientation or things like that either. There are lots of reasons why people might not want to reveal their personal interests or hobbies. What if all of your co-workers are staunch Republicans and you secretly support Hillary Clinton? What if you don't really want the world to know that you are the world's most knowledgeable expert on the TV sitcom Taxi? It could be anything. Maybe you like steamy romance novels and you think your friends would make fun of you for that. Maybe you think hockey is a stupid sport, but all your friends are really into it. Not everyone's life is an open book, nor should it be. There are lots of reasons we don't reveal everything about us, and it takes quite a lot of ignorance to assume that just because you happen to live in a comfy situation where your life is an open book that everyone else's should be as well.

Even if sites like Reddit continue to allow members to hide behind screen names, they should know, in the Reddit system, who they are: Full name, age, birthdate and maybe even address. If Reddit does this, it will not only cut down the number of attacks, it will likely scrub Reddit of much of its disgusting, hateful and racist content. It might also help the site, assuming it survives, monetize more activity than it is now.

Again, this is a total myth. Facebook has much of that info and yet all sorts of hate and attacks happen on Facebook all the time. Ulanoff can't seem to get over his initial conflation of "anonymity" with "bad behavior." There is some overlap in the venn diagram, but it's nowhere near as complete as he seems to think it is. Also, if Reddit has that info, then it's at risk. Notice all those hacks and data leaks lately? How safe will the woman seeking help to leave her abusive husband feel knowing that some hackers might leak her name and address at any moment?

None of this, by the way, should hamper “Free Speech” on Reddit.

Yes, actually it will. A ton. Because all those people who would like to feel comfortable discussing things in such settings will go away. The Supreme Court itself has made it clear that anonymity is a key part of free speech. Ulanoff should familiarize himself with some of its statements, such as:

Anonymity is a shield from the tyranny of the majority. . . . It thus exemplifies the purpose behind the Bill of Rights and of the First Amendment in particular: to protect unpopular individuals from retaliation . . . at the hand of an intolerant society.

And yet, Ulanoff ridiculously thinks that he's the one protecting people from an "intolerant society" because he's too ignorant and too privileged to recognize all those people who rely on anonymity.

Oh, and then he closes it out with his own, incorrect, definition of the First Amendment:

I know that most of the members who hated Pao and wanted her out were angry about the necessary changes she was making and they often decried her actions as an attack on free speech. Sorry, but, in my book, hate speech does not equal free speech.

In your book it may not, but under the Constitution it does. That does not mean, of course, that Reddit needs to put up with hate speech. That's a decision for the company to make on its own. But Ulanoff's argument here is so confused as to be laughable. It's like a high school student who just discovered these issues and didn't bother to do any research before spouting off his opinion.

The facts are pretty clear: anonymous speech is incredibly important in protecting free speech, mostly in protecting people from harassment or risks. It is a key tool that allows people who are facing difficult situations to find each other and discuss. On top of that, most content from anonymous individuals online is perfectly reasonable and fits within community norms. Finally, requiring real names has never been shown to adequately limit trollish behavior. So Ulanoff is spouting off an idea that puts more people at risk, limits communities that need such connections the most and does nothing to actually stop trollish behavior.

If, however, these Reddit members really believe it is their right to harass, spew hate and post their insane ideas about various races, then do it without the mask of a user name. Put your real name and photo on the site. Stand up for what you believe in, you bastards.

Again the ignorance and the privilege shine through. Ulanoff can't imagine a world in which anyone would say something anonymously unless they're being a "bastard." You'd think that someone who has spent as much time online as Ulanoff apparently has would at least know enough to do some basic research, or at least talk to some people who actually do rely on anonymity every day.

Filed Under: anonymity, community, free speech, lance ulanoff, names, trolls
Companies: reddit

UN Report: Encryption And Anonymity Deserve 'Strong Protection'

from the not-just-a-matter-of-opinion dept

Techdirt has been following for a while a worrying move to demonize strong encryption, amid calls from politicians and senior law enforcement officials for it to be undermined or compromised. That makes a new report affirming the central importance of encryption (doc), from the UN's Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, David Kaye, particularly valuable. His report clearly inhabits a post-Snowden world, since it takes as its starting point the following:

Contemporary digital technologies offer Governments, corporations, criminals and pranksters unprecedented capacity to interfere with the rights to freedom of opinion and expression.

The report looks at ways in which encryption and anonymity can help to protect basic rights to privacy and freedom of opinion and expression, and explores to what extent governments may impose restrictions. In many ways, the most interesting aspect of his analysis concerns the right to hold opinions:

During the negotiations on the drafting of the [International Covenant on Civil and Political Rights], "the freedom to form an opinion and to develop this by way of reasoning was held to be absolute and, in contrast to freedom of expression, not allowed to be restricted by law or other power". The ability to hold an opinion freely was seen to be a fundamental element of human dignity and democratic self-governance, a guarantee so critical that the Covenant would allow no interference, limitation or restriction.

But as Kaye points out, the ability to hold opinions is now intimately bound up with technology:

Individuals regularly hold opinions digitally, saving their views and their search and browse histories, for instance, on hard drives, in the cloud, and in e-mail archives, which private and public authorities often retain for lengthy if not indefinite periods. Civil society organizations likewise prepare and store digitally memoranda, papers and publications, all of which involve the creation and holding of opinions. In other words, holding opinions in the digital age is not an abstract concept limited to what may be in one's mind. And yet, today, holding opinions in digital space is under attack.

Encryption and anonymity, he concludes, are powerful ways to preserve that right to hold opinions in a digital form:

The right to hold opinions without interference also includes the right to form opinions. Surveillance systems, both targeted and mass, may undermine the right to form an opinion, as the fear of unwilling disclosure of online activity, such as search and browsing, likely deters individuals from accessing information, particularly where such surveillance leads to repressive outcomes. For all these reasons, restrictions on encryption and anonymity must be assessed to determine whether they would amount to an impermissible interference with the right to hold opinions.

In terms of "permissible interference," the following factors are key:

Restrictions on encryption and anonymity, as enablers of the right to freedom of expression, must meet the well-known three-part test: any limitation on expression must be provided for by law; may only be imposed for legitimate grounds (as set out in article 19 (3) of the Covenant); and must conform to the strict tests of necessity and proportionality.

It's the last of those that is increasingly under the spotlight after Snowden's leaks revealed a global system whose underlying principle -- "collect it all" -- is the very antithesis of proportionality:

A high risk of damage to a critical, legitimate State interest may justify limited intrusions on the freedom of expression. Conversely, where a restriction has a broad impact on individuals who pose no threat to a legitimate government interest, the State's burden to justify the restriction will be very high.

Kaye picks up on this theme again in his recommendations, where he notes that encryption and anonymity are not just vital for the right to freedom of opinion and expression in the digital age, but also for other rights, including economic rights, privacy, due process, freedom of peaceful assembly and association, and the right to life and bodily integrity. As a result:

States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows. In addition, States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users. Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms). Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals (i.e., not to a mass of people) and subject to judicial warrant and the protection of due process rights of individuals.

One issue rather skated over there is what happens when court-ordered decryption is impossible. Kaye rightly notes that it is "a seemingly universal position among technologists that there is no special access that can be made available only to government authorities, even ones that, in principle, have the public interest in mind." Absent such backdoors, you can build systems where even the service providers cannot access messages, which renders court orders moot. Nonetheless, Kaye's report is important, because it offers a counter-argument to repeated assertions by the authorities that encryption is essentially something bad, used by bad people to do bad things. He also has an answer to those who claim that strong crypto will usher in a new Dark Age for law enforcement:

Governments have at their disposal a broad set of alternative tools, such as wiretapping, geo-location and tracking, data-mining, traditional physical surveillance and many others, which strengthen contemporary law enforcement and counter-terrorism.

That's a crucial fact that is almost always overlooked. Its appearance here is another reason why this new UN report is welcome.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: anonymity, encryption, human rights, privacy, un

Florida Governor Signs One Bill Protecting Free Speech... And Another That Undermines It

from the i-guess-they-balance-out?!? dept

On Thursday, Governor Rick Scott of Florida signed 44 bills into law, but two of them are particularly interesting to us. The first we wrote about back in March, SB 604, is a very problematic bill that undermines some basic free speech rights. It's the latest in a new push by Hollywood to undermine anonymity online as a backdoor attack on copyright infringement. Basically, it says that if you're distributing any sort of audiovisual work, you need to reveal who you are.

The implications here are massive. There are lots of cases where someone may wish to post certain audiovisual works without having to post their full name, address, phone number and email address -- as the law now requires. And the First Amendment has long protected the right to be anonymous. And yet, the Florida legislature and Governor Scott signed it without much serious concern about how it's stripping away the First Amendment anonymity rights of their citizens.

Oddly, however, in that very same batch of signed bills... is another bill that protects free speech rights: SB 1312, which expands Florida's (very, very weak) anti-SLAPP law. Like too many states, Florida's anti-SLAPP law originally only protected people in cases where they were sued over speech concerning government actions. The new bill expands that to "public issues" which is similar to many other anti-SLAPP bills. Considering the number of crazy defamation threats and lawsuits that seem to come out of Florida, this bill could be very, very useful in protecting free speech.

Getting the anti-SLAPP bill is really important, but losing anonymity seems really dangerous. These aren't just the sort of things that "balance out" either. Either you support the First Amendment or you don't. I'm glad that Florida has a better anti-SLAPP bill, but Governor Scott shouldn't have taken away basic First Amendment protections with the same stroke of his pen in signing the "true origin" bill at the same time.

Filed Under: anonymity, anti-slapp, copyright, first amendment, florida, free speech, rick scott, true origin