Some thoughts on Hidden Services

It would appear that something happened, requiring the need to pull all the HS. Perhaps there is yet another weakness not fully disclosed. I shall wait and see the outcome.

I have the impression that Roger spends much of his time in private discussions with government officials, trying to persuade them not to declare Tor outright illegal. While I recognize the importance of such liaisons, I feel that the Project also needs to engage our friends in the mass media (they are not many, but they do exist) to try to counter the constant barrage of propaganda from the Surveillance Industrial complex which attempts to falsely tar all Tor users with the labels of "porn peddlers", "human traffickers", "narcotics traffickers", and "terrorists".

The recent tragedy in Paris is already being exploited by our enemies in a renewed media onslaught targeting Tor, PGP/GPG, and pro-democratic social forums. This media campaign is clearly intended to increase public support for proposals that Western governments should declare illegal the use of strong citizen cryptography, Tor, providers of encrypted email, phone, or chat services, and other democracy-promoting resources.

But the Tor community can use recent events to argue that the answer is not no Tor, or less legal Tor, but much more Tor. In particular, I think we can and should argue that these events show why satirical publications such as The Onion, and blogs such as Emptywheel which frequently criticize powerful state institutions, and maybe even "mainstream" news outlets such as CNN, even academic discussions of politically sensitive subjects such as global warming, should transition to anonymous publication behind Tor hidden services.

Propaganda is dangerous. Our communities should not underestimate its ability to create a deeply entrenched anti-Tor mindset in the political leadership. As an example: I understand that several episodes of recent "cop dramas" broadcast in FVEY countries included statements (by a character) such as "90% of the web is hidden by Tor, which is used exclusively by criminals and terrorists" [sic]. This manifestly absurd claim appears to conflate the "Deep Web" with the "Dark Web", yet it is liable to be believed as literally true by many persons who lack experience in skeptical thinking, potentially including politicians who in the new year will be voting upon new laws giving even more arbitrary powers to the political police. One such false statement in a popular entertainment might be harmless, but hundreds such could easily lead to very widespread and severe misconceptions.

("Deep web": the content of all computers connected to networks which are connected somewhere sometime to the Internet-- for example emails in internal email servers operated by companies such as Sony. "Dark web": the content of websites provided to Tor users as a hidden service.)

I believe that "propaganda" is not an inappropriate term for how Tor and other democracy promoting tools are being portrayed by Hollywood and Fleet Street. Among the most significant disclosures in the recent Sony leaks was evidence of extensive "advice" from CIA to Hollywood concerning how American movies should reflect the current party line from the Surveillance state.

I think it is important that everyone in the Tor community understand how extensive and relentless is the assault by the State upon the rights of the citizen to privacy, freedom from unwarranted searches of our persons and our homes, freedom from governmental reprisals and oppression, and freedom of expression. Because the principal reason why Tor is so essential in the modern world is that it is one of the very few tools which can help maintain the balance between the powers of the State and the rights of the citizen.

A recent and particularly troubling example of the assault by the State upon grass roots organizations which seek to promote democracy has recently been reported by Riseup Networks. Before providing a link to that report, I would like to provide some background which may help to explain why the incident is significant for Tor users worldwide.

Well-informed persons have been warning for several years that Western governments are edging toward a policy of mass arrests for purposes of "preventative detention" of persons whom predictive analysis drawing upon Big Data resources has identified as allegedly posing a potential future danger to the State. From a recent interview of John Podesta, lead author of the recent report on Big Data:

http://www.spiegel.de/international/world/interview-with-obama-advisor-…

"SPIEGEL: In your report on NSA and "big data" for President Obama, you describe the potential opportunities and threats of this technology. What dangers do you see of big data in the hands of a surveillance system like the NSA?
Podesta: I think about it more in the context of law enforcement. You begin to -- particularly with predictive analytics -- blur the line between the presumption of innocence and targeting individuals."

(The interviewer misspoke: in fact Podesta was explicitly forbidden to discuss NSA dragnet surveillance; the Podesta report discusses only the dangers posed by commercial companies such as lenders and health insurers who are using Big Data tools. Nevertheless this report is well worth reading for further background on the topics discussed here.)

A recent editorial in The Guardian sketches some of the dangers to democratic free societies which are posed by the increasing use of predictive analysis by frightened government officials seeking to identify in advance persons who allegedly pose potential future dangers to the State:

http://www.theguardian.com/uk-news/2014/dec/02/youre-the-bomb-are-you-a…

One fundamental problem with predictive analysis, when governments attempt to predict rare events, is that it can't possibly work. The mathematics of Bayes's rule shows clearly that in such cases, almost everyone flagged by predictive analytics is *innocent* of the algorithmically generated charge:

http://boingboing.net/2014/12/06/stats-based-response-to-uk-tor.html

And even at such a social cost, the mathematics also shows that a substantial fraction of the tiny (tiny!) number of people who might really become dangerous in future will evade mass arrest dragnets powered by predictive analysis.

Such problems have not stopped the Surveillance industrial complex from enthusiastically marketing commercial "solutions" which use Big Data repositories to provide "threat ratings" in real time to police officers:

http://blogs.reuters.com/great-debate/2014/12/12/police-data-mining-loo…

The first generation of such real time threat scoring policeware tools are crude, but it is clear that as widespread information sharing by governmental agencies and private companies becomes more extensive and intrusive, police officers will be provided in real time with more and more sensitive information about anyone they encounter during their workday. One of the more troubling possibilities is that they will not only know who posts comments critical of the police (unless the poster used Tor!), they may know our financial and medical histories, and even disciplinary records from our educational histories.

A civil rights lawyer recently pointed out in Techdirt that, contrary to repeated assurances by government officials in American court cases and congressional testimony that the RFPA and HIPAA acts "provide strong privacy protections" [sic] for the financial and medical records of US persons, these laws in fact contain very broad exceptions for law enforcement and "national security" agencies:

https://www.techdirt.com/articles/20141211/doj-misleads-court-about-med…

The declared interest of the security services in tracking medical history as well as social media postings is clear from a spate of recent news articles focusing on a particularly vulnerable minority group:

http://www.homelandsecuritynewswire.com/dr20141222-about-40-percent-of-…

The interest of the police in disciplinary incidents which can often be found in educational records is clear from the demands the Surveillance state is making upon social media providers. These demands raise the troubling possibility (discussed in another context in the Podesta report) that large numbers of children might be flagged early in life as "potential terrorists" simply because they talked back to a teacher, or were caught smoking in the halls:

https://www.techdirt.com/articles/20150106/07295429606/uk-bill-nursery-…

Labeling a child as a "potential future terrorist" seems unlikely to help assure that a young person will enjoy equal opportunities in society. The Podesta report offers a clear discussion of the danger that Big Data may be misused by the private sector to create a new Jim Crow; this danger is even more severe when Big Data is misused by the State. And the eagerness of the security services to screen kindergartners reveals what they are really thinking when they cry "think of the children!"

Some people have long been under suspicion simply because they belong to a minority group suspected by paranoid government officials of posing a potential danger to the State. Last year, the newly elected mayor of NYC Bill Blasio, forced NYPD to finally shut down the notorious Muslim Unit founded a decade ago by a controversial secret police operative with ties to Israeli intelligence, David Cohen. This unit spied upon Muslim citizens in the greater New York area for many years simply because of their religious affiliation. Its activities ranged from bugging mosques to mapping eateries owned by Muslims. Unfortunately, the recent tragedy in Paris immediately led to calls from Cohen's many ardent supporters in the US press to start it up again:

http://nypost.com/2015/01/07/police-connecting-dots/

As Mike Masnick noted at Techdirt, former DIRNSA Michael Hayden also grabbed the opportunity to reiterate the continual demand by the secret police for even more surveillance and arrest powers:

https://www.techdirt.com/articles/20150108/07011929629/sickening-police…

In testimony given before Congress some years ago, Hayden hinted that NSA uses computer modeling in conjunction with predictive analytics in order to draw up "kill lists". The same method can potentially be used by national police organizations to draw up lists of persons to be rounded up in mass arrests):

http://spectrum.ieee.org/computing/software/modeling-terrorists

Further, both Riseup and Tor communities are under increasingly virulent attack by misguided and increasingly authoritarian Western governments, by such means as propaganda, media campaigns, and if all else fails, by cyberattacks.

State-sponsored malware assaults targeting individual citizens have unfortunately long since moved from the hypothetical to the actual. One example where the FBI used a crude cyberattack to target a high school student, who had been accused by a source but against FBI had no evidence, is discussed here:

http://www.usnews.com/news/articles/2014/11/06/surveillance-is-not-enou…

The global academic community is also slowly waking up to the severe danger to free expression which is posed by oppressive measures being enacted by governments all over the world, such as the demand that professors report students (and students report professors) who attempt to discuss politically provocative ideas in the classroom:

http://www.theguardian.com/uk-news/2015/jan/12/make-universities-exempt…

The Tor Project focuses on the technical rather than the political, yet by the very nature of its democracy-promoting aims, it is highly political in nature. This means both that it belongs to a constellation of organizations under continual attack by (seemingly) every national, provincial, and local government in the world, and also that it enjoys a natural alliance with other organizations which have similar goals of empowering ordinary citizens to become politically active in a constructive way.

Many activists around the world use Riseup Networks email accounts, or exchange information in mailing lists hosted by Riseup. This collective is so important for human rights, animal rights, ecological justice and social justice movements worldwide that the Tails version of Tor browser includes a link to Riseup email, on the assumption that anyone who uses Tails is likely to also use Riseup.

A recent incident in Spain which targeted the Riseup community clearly demonstrates that the issue of preventative detention by Western governments is not merely hypothetical. According to a statement from Riseup Networks:

http://en.squat.net/2015/01/06/spanish-state-security-is-not-a-crime-ri…

"On Tuesday December 16th [2014], a large police operation took place in the Spanish State. Fourteen houses and social centers were raided in Barcelona, Sabadell, Manresa, and Madrid. Books, leaflets, computers were seized and eleven people were arrested and sent to the Audiencia Nacional, a special court handling issues of 'national interest', in Madrid. They are accused of incorporation, promotion, management, and membership of a terrorist organisation. However, lawyers for the defence denounce a lack of transparency, saying that their clients have had to make statements without knowing what they are accused of. '[They] speak of terrorism without specifying concrete criminal acts, or concrete individualized facts attributed to each of them'. When challenged on this, Judge Bermúdez responded: 'I am not investigating specific acts, I am investigating the organization, and the threat they might pose in the future'; making this yet another case of apparently preventative arrests."

Four of the detainees have been released, but seven have been jailed pending trial. The reasons given by the judge for their continued detention include the possession of certain books, 'the production of publications and forms of communication', and the fact that the defendants 'used emails with extreme security measures, such as the RISE UP server'"

In other words, simply using a Riseup email address is seen by some governments as grounds for suspicion or even mass arrests. We should stress once more: terrorism is very rare, so almost everyone placed in preventative detention on suspicion of possibly posing some future threat to the State will not in fact pose any such threat.

Political dissidents worldwide have been put on notice that Western "democratic" nations no longer provide a safe haven from which activists can work to promote human and civil rights in dangerous war-torn regions such as Syria. This has terrible implications for the future of democracy everywhere.

Persecuted people need hidden services. Democracy needs hidden services. The world needs hidden services.

Je Suis Charlie