How Has Tor Helped You? We Need Your Stories

The only fsf-approved distro I know of is Trisquil, and it's not very popular and so probably hasn't been pounded on and hardened like, say, Debian. Also Trisquil isn't necessarily designed with extensive security features. Thus I would highly recommend to you Qubes OS with a Whonix VM. It's not fsf-approved, but there's a bit of a tradeoff between privacy and security here. It depends on your threat model. To me, it's more important that an adversary's malicious payload be contained withing a Qubes VM, than to worry that my WiFi card's driver might be spying on me or something. However, really any GNU/Linux will offer better privacy (and probably security) than Windows, so the choice of distro isn't all that important.

Hi Steph,

Glad to see this

> Raise funds from new sponsors and individual donors to diversify our funding and ensure Tor remains independent, robust, and secure

and hope to soon see Isela (the incoming Executive Director) post that this continues to be a top priority for Tor Project.

I have a suggestion about gathering stories. In addition to asking "how have you used Tor?", I suggest asking "what made you start using Tor?". I think some of these stories could help people who haven't tried Tor Browser better understand why they should possibly consider trying it.

The book by Julia Angwin, Dragnet Nation, opens with a horrifying anecdote, not involving Tor, but clearly explaining one very good reason why people might want to use Tor, namely secret scraping of web forum posts. This anecdote is directly relevant to the post above about a mental health condition.

I experienced a similar scraping issue at another legal and seemingly innocuous on-line forum--- not a medical forum, but as it turned out also a forum of great interest to spooks, which was quite a shock to almost all members--- in which the scraping was not authorized by the forum operators, but was done by a Third Party, as part of a USIC contract. Nasty.

Another issue forum users should be aware of is that people who ask to "friend" you might very well be spooks or cops, especially if you are an activist. It doesn't matter whether or not your group is non-violent since the spooks always claim that anyone *might become* violent in the future, so they "need" to spy on non-violent groups too [sic]. "Friending" members under false pretenses is a very common and cheap way to keep an eye on your group. So common that it often happens that a UC working for one agency reports an agent provocateur working for another agency. Some of the best documentation for this comes from The Guardian's years of reporting on abuses by police agencies in the UK monitoring peaceful environmental groups and social justice groups. Further extensive documentation of abuses by civilian and military spooks operating in the USA comes from documents obtained under FOIA by ACLU and EFF. This issue is in the news again right now because some major tech-cos are now stating that their real-name policy extends to police officers, who presumably will continue to violate the Terms of Use. (Who is Facebook going to call when they catch an FBI agent using a false identity in his/her Facebook account?)

Oh yes, why are US medical forums of interest to spooks? Well, one major job of any non-USG intelligence agency is to assess the stability of the USA, and physical/mental health issues experienced by the general population are part of that assessment. Why would GRU rely on official USG statistics when it can go to the source and scrape at scale stories told by US patients themselves? Sure, the result is a messy dataset, but machine learning can deal with that well enough to keep the GRU bosses happy. And FBI is very interested in keeping an eye on anyone they suspect might be "unstable", so they monitor mental health forums too. All the world's spooks and cops have decided that because technology enables them to presume present or future guilt (of something, anything) in everyone, their intelligence/LEA missions demands that they take advantage of the technology. Ethical considerations are never a part of decisions whether or not to use some new "investigative technique". That's how cell-site simulators (Stingrays), "lawful interception" [sic], state-sponsored malware, aerial surveillance, and so much more, secretly came into such wide use. They did these things because they could, without any regard for the many severe ill consequences for society as a whole, not to mention for individual lives damaged by abuses of technology.

Just one more reason why the shibboleth that "if you have done nothing wrong, you have nothing to fear from state-sponsored cyber campaigns" is dangerously incorrect. Just because you cannot think of a reason why someone might want to spy on Grandma doesn't mean that they have not thought of a reason. And in fact, they have thought of a large number of reasons. It's safe (for them), it's easy, it's cheap (after the initial investment), so why wouldn't they spy on Grandma and everyone else?