Snowden Ran A Major Tor Exit Relay, Hosted CryptoParty In Hawaii While Waiting For Greenwald To Reply

from the teaching-tor-and-truecrypt dept

Kevin Poulsen over at Wired has the interesting story of how Ed Snowden both ran a CryptoParty in Hawaii while waiting to hear back from Glenn Greenwald after his first email, and also apparently hosted a Tor node. In October of 2012, we wrote about the CryptoParty movement, launched by digital rights activist Asher Wolf, and apparently Snowden thought it was a good idea as well. The details seem fairly straightforward, though it does suggest (yet again) that he was legitimately interested in protecting the American public, rather than (as some continue to argue) working for some "foreign power." At the CryptoParty, he apparently taught folks how to use TrueCrypt and Tor.

Perhaps more interesting is the news that he ran a Tor exit relay. The story kicks off with Snowden emailing Runa Sandvik, a key Tor developer, asking if she can send him some Tor stickers that he can pass around at work. It's long been noted that Snowden has a Tor sticker (along with an EFF sticker) on the laptop he uses, but now we know where and how he got it. But in that email, he noted that he ran a "major tor exit" relay:

In his e-mail, Snowden wrote that he personally ran one of the “major tor exits”–a 2 gbps server named “TheSignal”–and was trying to persuade some unnamed coworkers at his office to set up additional servers. He didn’t say where he worked. But he wanted to know if Sandvik could send him a stack of official Tor stickers....

“He said he had been talking some of the more technical guys at work into setting up some additional fast servers, and figured some swag might incentivize them to do it sooner rather than later,” Sandvik says. “I later learned that he ran more than one Tor exit relay.”

Of course, some may also point out that one minor weakness in Tor is that malicious exit node operators can do some spying on users -- at least opening up the question of whether or not Snowden was running that exit relay for himself (and being good about it) or running it for the NSA.

Either way, to get the stickers, Snowden gave Sandvik his real name and address, and she mentioned plans to be in Hawaii, leading to the idea of hosting a CryptoParty, which turned into reality:

Sandvik began by giving her usual Tor presentation, then Snowden stood in front of the white board and gave a 30- to 40-minute introduction to TrueCrypt, an open-source full disk encryption tool. He walked through the steps to encrypt a hard drive or a USB stick. “Then we did an impromptu joint presentation on how to set up and run a Tor relay,” Sandvik says. “He was definitely a really, really smart guy. There was nothing about Tor that he didn’t already know.”

“Everything ran very smoothly,” she adds. “There were no questions about how to do things or where to put the chairs. Maybe he’s just really good at organizing events.”

As for the timing, Snowden apparently emailed Greenwald for the first time 11 days before the party, and was still waiting for a reply when the party happened...

Filed Under: asher wolf, crypto party, cryptoparty, ed snowden, runa sandvik, tor, truecrypt

CryptoParty Like It's 1993

from the it's-a-secret,-pass-it-on dept

As Techdirt stories regularly report, governments around the world, including those in the West, are greatly increasing their surveillance of the Internet. Alongside a loss of the private sphere, this also represents a clear danger to basic civil liberties. The good news is that we already have the solution: encrypting communications makes it very hard, if not entirely impossible, for others to eavesdrop on our conversations. The bad news is that crypto is largely ignored by the general public, partly because they don't know about it, and partly because even if they do, it seems too much trouble to implement.

The CryptoParty movement hopes to do something about that by inviting people to come along to informal meetings to learn about crypto, how to install it and how to use it in everyday computing in order to strengthen their privacy and protect themselves from surveillance. The driving force behind the idea is the Australian digital rights activist Asher Wolf, well known on Twitter. The specific impetus came from approval of the Cybercrime Legislation Amendment Bill 2011 by the Australian Senate. Here's what it will do, as explained on the academic blog The Conversation:

The bill effects changes in the Telecommunications Act 1997 and Telecommunications (Interception and Access) Act 1979 and will force carriers and internet service providers (ISPs) to preserve stored communications, when requested by certain domestic authorities (such as the Australian Federal Police), or when requested by those authorities acting on behalf of nominated foreign countries.

This means a warrant will be needed before the police or security agencies can force carriers or ISPs to monitor, capture and store website use, data transmissions, voice and multimedia calls, and all other forms of communication over the digital network.

That's not quite as bad as mandatory logging of all online activity, but the Australian government is working on that too, as are many other countries. Against that background, the idea of self-organizing parties introducing people to the world of crypto spread rapidly around the world, as the wiki page listing past and future events indicates. One party, in Berlin, led to a new, complementary project: a manual on crypto for beginners:

The CryptoParty Handbook was born from a suggestion by Marta Peirano and Adam Hyde after the first Berlin CryptoParty, held on the 29th of August, 2012. Julian Oliver and Danja Vasiliev, co-organisers of the Berlin CryptoParty (along with Marta) were very enthusiastic about the idea, seeing a need for a practical working book with a low entry-barrier to use in subsequent parties. Asher Wolf, originator of the CryptoParty movement, was then invited to join in and the project was born.

This book was written in the first 3 days of October 2012 at Studio Weise7, Berlin, surrounded by fine food and a lake of coffee amidst a veritable snake pit of cables. Approximately 20 people were involved in its creation, some more than others, some local and some far (Melbourne in particular).

The well-known "book sprint" approach was used, together with open source software, and the final result was released as open content under a cc-by-sa license:

The facilitated writing methodology used, Book Sprint, is all about minimising any obstruction between expertise and the published page. Face-to-face discussion and dynamic task-assignment were a huge part of getting the job done, like any good CryptoParty!

The open source, web-based (HTML5 and CSS) writing platform Booktype was chosen for the editing task, helping such a tentacular feat of parallel development to happen with relative ease. Asher also opened a couple of TitanPad pages to crowd-source the Manifesto and HowTo CryptoParty chapters.

As might be expected with such a major project about a complex and sensitive topic put together so quickly, there has been some criticism of the results, notably the inclusion of the weak PPTP for creating Virtual Private Networks. Nonetheless, the CryptoParty movement and the associated Handbook show what can be achieved by committed volunteers coming together across the Internet in a very short time.

Of course, there's still the question of whether this project will have any major impact on the use of crypto by general users. After all, it's not as if people haven't been recommending the thoroughgoing application of encryption for everyday tasks before. As the by-now venerable Cypherpunk's Manifesto put it:

We must defend our own privacy if we expect to have any. We must come together and create systems which allow anonymous transactions to take place. People have been defending their own privacy for centuries with whispers, darkness, envelopes, closed doors, secret handshakes, and couriers. The technologies of the past did not allow for strong privacy, but electronic technologies do.

Those words were written back in 1993, and here we are in 2012, still fighting the same battles with the same tools. Will things be any different this time?

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: crypto, cryptoparty, encryption, privacy