On the recent Black Hat 2014 Talk Cancellation

I'd like to try to interject some common sense into the discussion.

First, to quote from a marketing flier put out by one of our enemies (a zero-day vendor which sells to oppressive governments), the things people say when they think they are talking among their own kind offers the most reliable insight into their real capabilities and intentions. And the Tor-related documents from the Snowden trove which have been published so far are unequivocal. From the "Tor Stinks" presentation:

"We will never be able to de-anonymize all Tor users all the time. With manual analysis we can de-anonymize a very small fraction of Tor users, however, no success de-anonymizing a user in response to a TOPI request/on demand"

Note that this presentation was first presented in 2007 and then updated in 2012, so the quoted paragraph succinctly summarizes NSA's (lack of) capabilities over the period 2007-2012.

Someone wrote above "That would also explain the deanonymization techniques they allude to in their "Tor Stinks" presentation - they've been able to deanonymize a particular target who's actively using the network." This claim is directly contradicted by slide which I just quoted.

What NSA presenters actually said was that in a small number of cases, they were able some years ago to de-anonymize particular targets who were not using Tor properly (not using up to date Tor Browser bundle or Tails), or made "Epic Fail" errors such as logging into an unencrypted non-anonymous social media account while using Tor. The presenters specifically said that they CANNOT deanonymize a particular target (unless said target made some elementary error while using Tor).

"Looks like someone bought this Tor deanonymization technique. Otherwise there would be no reason for not giving the Tor team full disclosure."

The most likely reason for the sudden cancellation is that the "researchers" probably violated the US "Wiretap law", and Carnegie-Mellon lawyers stepped in to prevent them from publishing their alleged list of (some) Tor users's IP addresses. Another possible explanation is that the claims were so overblown that they amounted to a disinformation campaign.

I suggest that whenever Tor users read about some startling claim to "de-anonymize the Tor network", they should bear in mind these considerations:

1. Abstracts to "computer insecurity" talks generally overstate what was actually achieved and also the novelty of the reported research. The researchers are often competing against other talks held at the same time at the same conference, and they want a large audience with extensive media coverage, in order to keep their grant money coming in.

2. Researchers have claimed for years that "heavy" Tor users can be de-anonymized by governments, or even by individuals running a few fast Tor nodes.

3. Newly discovered de-anonymization methods are unlikely to be "universal" in scope. Almost always they are only effective under certain circumstances, such as Windows users, users whose Tor is mis-configured, or who have downloaded some insecure add-on for their Tor Browser, or who enable Javascript), or against a particular subset of Tor users, such as frequent users of particular hidden services.

4. National police services around the world (including USA and the Netherlands) have been complaining for years that they are losing the ability to wiretap persons they wish to spy on, and keep demanding increased authority to punt malware to all Tor users, in order to try to see what they are doing. Such heartfelt alarmism is fully consistent with the picture presented in the leaked NSA/GCHQ documents: our enemies are having great trouble deanonymizing Tor users.

5. Few if any nations have more draconian national cybersurveillance systems, anti-privacy and anti-dissenter laws than Russia. Yet the Russian government has been forced to ask for help from private sector experts (for which we should read: Russian cybercriminals) because, it seems, they too are having great trouble controlling the Tor using public inside their borders.

6. Experienced detectives are fond of saying "police work is 90% bluff", and the same goes for intelligence agencies. This claim also finds a great deal of support in published documents from the Snowden trove. For example, the recently published "Chinese Menu" of tools offered by JTRIG (a GCHQ cyberwar unit) includes about two dozen items which are intended for "information operations" characterized by disinformation, impersonation, and social media manipulation. To this one should add the well-oiled news media manipulation machinery which is often employed by the US/UK security services.

7. The single most important lesson from the most authoritative sources (such as the Snowden leaks, whistleblowers like William Binney, and historians like Matthew Aid and David Kahn) is that the War on US is an ongoing conflict. Sometimes one side gains a momentary advantage before the other pulls ahead again. In any arms race, it is good advice to avoid panic when the other side appears to have won a battle.

8. Never make the mistake of viewing the War on US only in terms of technological tools. Think strategically. Consider not only possible technical innovations (for good or evil), but economic and political aspects, and bear in mind lessons from history. When one studies the Snowden leaks and surveys the War in a broader context, there is much reason to think that the authoritarians are on the wrong side of history, that the reason they feel such desperation that they know they are losing. One reason for this is that the notions of the nation state and of the rule of law are rapidly becoming irrelevant. It is a strange irony that even while the security services rant against "anarchist elements", in fact it is the governments themselves which are increasingly abdicating the idea that governments should try to govern, in favor of the idea that governance is best left to multinational corporations like Comcast.

www.governingalgorithms.org
www.policyreview.info/articles/analysis/governance-algorithm