The Trouble with CloudFlare

Or provide the site operators with an alternative, such as Akamai, Amazon Cloudfront, Google Shield, and numerous other CDNs and reverse proxies. Not that they'll take any advice from a mere Tor user.

We now have some answers about the infamous CMU/SEI breakage of Tor (or maybe just hidden services?): it seems that Army Research Laboratory (ARL) hired SEI (Software Engineering Institute) to "research" dragnet style Tor breakage, and FBI then subpoenaed CMU to get the "experimental" data.

This procedure (agency A commissions "research" then agency B subpoenas the raw data) could quickly become commonplace since many recently passed laws contains very broad exceptions to privacy rules for "research" (not further specified).

Here are the most relevant portions of the document (a ruling by Judge Richard A. Jones in the Farrell case being heard in Seattle, WA) which contains the revelations:

> the defendant’s IP address was identified by the Software Engineering Institute (“SEI”) of Carnegie Mellon University (CMU”) when SEI was conducting research on the Tor network which was funded by the Department of Defense (“DOD”). The government previously produced information to the defense that Farrell’s IP address was observed when SEI was operating its computers on the Tor network.
> ...
> SEI’s identification of the defendant’s IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny.
> ...
> In the instant case, it is the Court’s understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that their communications can be directed toward their destinations. Under such a system, an individual would necessarily be disclosing his identifying information to complete strangers. Again, according to the parties’ submissions, such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under these circumstances.

Ars asked some lawyers to comment and they made some useful points:

http://arstechnica.com/tech-policy/2016/02/judge-confirms-what-many-sus…
Judge confirms what many suspected: Feds hired CMU to break Tor
A 1992 case about paper shredders may also shed some light on Tor privacy question.
Cyrus Farivar
24 Feb 2016

> A federal judge in Washington has now confirmed what has been strongly suspected: that Carnegie Mellon University (CMU) researchers at its Software Engineering Institute were hired by the federal government to do research into breaking Tor in 2014. The judge also made a notable statement in his court order that "Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network."
> ...
> Neil Richards, a law professor at Washington University in St Louis, said that this "reasonable expectation of privacy" for Internet users is "an open one." The so-called third-party doctrine, which stemmed from the 1979 Supreme Court decision Smith v. Maryland, found that telephone users do not have a privacy interest in the phone numbers that they dial, as the phone company has access to them.
>
> "Law enforcement have argued that this sharing rationale applies to all Internet and digital data held by third parties—ISPs, e-mail providers, fitness trackers, cloud storage providers, etc," Richards told Ars. "The strong form of this argument is nonsense. Law enforcement in the past also argued that they didn’t need warrants to open mail or tap telephones, and ultimately lost on both counts. The Supreme Court hasn’t ruled on e-mail yet, but lower courts require a warrant for e-mail, and the Supreme Court has made clear in recent cases that a majority of Justices are very concerned about digital privacy and are eager to extend the Fourth Amendment to that, just like they did for telephone calls in the 1960s."
>
> Mark Rumold, an attorney with the Electronic Frontier Foundation, concurred.
>
> "The expectation of privacy analysis has to change when someone is using Tor," he said. "Rotely applying precedent leads to bad results, like courts finding that someone 'clearly' lacks a privacy interest in their IP address, even though they're using technology specifically designed to protect that privacy interest."

Vice has cited Mike Perry's previous post in an update to its story on the ARL/CMU/SEI revelation:

https://motherboard.vice.com/read/carnegie-mellon-university-attacked-t…
Confirmed: Carnegie Mellon University Attacked Tor, Was Subpoenaed By Feds
Joseph Cox
24 Feb 2016

> Update 25 Feb: In a statement, the Tor Project told Motherboard that "the Tor network is secure and has only rarely been compromised. The Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU) compromised the network in early 2014 by operating relays and tampering with user traffic. That vulnerability, like all other vulnerabilities, was patched as soon as we learned about it. The Tor network remains the best way for users to protect their privacy and security when communicating online."

Not surprisingly, FBI is refusing to divulge how the SEI attack worked:

http://www.theregister.co.uk/2016/03/29/fbi_tor/
FBI: Er, no, we won't reveal how we unmask and torpedo Tor pedos
No NIT software exploit code for you
Iain Thomson
29 Mar 2016

ACLU has uncovered at least 63 other cases in which DOJ has invoked the All Writs Act of 1789 to force "technical assistance" in unlocking smart phones:

http://arstechnica.com/tech-policy/2016/03/feds-used-1789-law-to-force-…
Feds used 1789 law to force Apple, Google to unlock phones 63 times
"These cases predominantly arise out of investigations into drug crimes."
David Kravets
30 Mar 2016

> ...
> the law allows for judges to issue orders for people or companies to do something despite Congress not passing laws to cover specific instances. The All Writs Act is the law that led a federal magistrate ordering Apple to write code and unlock Farook's phone, an order that was no longer necessary because the authorities said Monday they cracked the phone without Apple's assistance. The government also said it wouldn't hesitate to use the "court system" to require other tech companies to weaken their security, too.
>
> According to the American Civil Liberties Union, the US government has cited the All Writs Act in 63 cases since 2008 to compel Apple or Google to assist in accessing data stored on an iPhone or Android device. Most of the orders involved Apple. "To the extent we know about the underlying facts, these cases predominantly arise out of investigations into drug crimes," said Eliza Sweren-Becker, an ACLU attorney.

For the court documents uncovered by ACLU, see:

https://www.aclu.org/court-documents-related-all-writs-act-orders-techn…
Court Documents Related to All Writs Act Orders for Technical Assistance
All Writs Act Orders for Assistance from Tech Companies

And new cases are rapidly arising. I urge TP to track these and continually formulate how TP would respond legally if a (politically/legally, not technically) similar situation to these smart phone cases arises which involves Tor:

http://thehill.com/policy/cybersecurity/274884-fbi-not-sure-it-can-unlo…
FBI not sure it can unlock iPhone in Arkansas homicide
Cory Bennett
1 Apr 2016

> The case is being closely watched as it comes on the heels of the FBI announcing it had been able to hack into an iPhone used by one of shooters in the San Bernardino, Calif., terrorist attack. The FBI had previously claimed such a hack was impossible without Apple’s help, even seeking a court order compelling the tech giant to assist. The bureau’s success has raised questions about what other devices it may now be able to access. Police have hundreds of seized iPhones around the country they would like to access. The Arkansas request was quickly taken up as the potential first test case of the FBI’s method, although it was not clear the same tactic would work for the devices in the homicide case.

http://arstechnica.com/tech-policy/2016/03/father-begs-apple-ceo-to-hel…
Father begs Apple CEO to help unlock his dead 13-year-old son’s iPhone
"I think Apple should offer solutions for exceptional cases like mine."
Cyrus Farivar
31 Mar 2016

> An Italian father has reportedly written to Apple CEO Tim Cook, pleading for help to unlock his dead 13-year-old son’s iPhone 6 so that he can retrieve the photos stored on it.
> ...
According to the AFP, Fabbretti’s son Dama was diagnosed with bone cancer in 2013, and he passed away in September 2015.
>
> In a February 2016 interview with the Italian newspaper La Repubblica (Google Translate), Fabbretti said that Dama had given his father access to the phone via TouchID fingerprint authentication, which was saved on the phone, but that wasn’t enough, as the phone was powered off when he found it. Newer iPhones running iOS 8 or later, including this one, require the full passcode after reboot.
>
> Fabbretti said that he has contacted Apple tech support, which told him they were sorry for his plight but lamented that there was nothing they could do.

In a somewhat analogous case in the UK, Lauri Love has been ordered by the UK's principal state-sponsored-criminality agency, NCA (National Crime Authority), to divulge the passphrases to the encrypted devices seized back in 2013:

http://arstechnica.com/tech-policy/2016/03/uk-cops-tell-suspect-to-hand…
UK cops tell suspect to hand over crypto keys in US hacking case
Lauri Love faces extradition to US over hitting Federal Reserve, among others.
J.M. Porup
31 Mar 2016

> At a court hearing earlier this month, the UK's National Crime Authority (NCA) demanded that Lauri Love, a British computer scientist who allegedly broke into US government networks and caused "millions of dollars in damage," decrypt his laptop and other devices impounded by the NCA in 2013, leading some experts to warn that a decision in the government's favor could set a worrisome precedent for journalists and whistleblowers.

https://theintercept.com/2016/04/01/british-authorities-demand-encrypti…
British Authorities Demand Encryption Keys in Case With “Huge Implications”
Ryan Gallagher
1 Apr 2016

> BRITISH AUTHORITIES are attempting to force a man accused of hacking the U.S. government to hand over his encryption keys in a case that campaigners believe could have ramifications for journalists and activists.
> ...
> Naomi Colvin, a campaigner for transparency advocacy group the Courage Foundation, told The Intercept that she believed the case could have “huge implications for journalists, activists, and others who need to guard confidential information” — potentially setting a precedent that could make it easier in the future for British police and security agencies to gain access to, or to seize and retain, encrypted material.
>
> Colvin said that the Courage Foundation, which is raising funds for Love’s legal defense, is backing him because “his case fits in to a pattern of political prosecutions of hacktivists and other truthtellers.” She added: “From our work with some of our other beneficiaries — particularly Jeremy Hammond and Barrett Brown — we’re very familiar with the prosecutorial overreach, inflated damage figures, absurd sentencing, and discriminatory prison treatment, including frequent spells in solitary confinement, that is common in these kinds of cases.”
>
> The encryption key demand is set to be the focus of an April 12 court hearing, at which a judge is expected to rule on whether Love should be ordered to turn over his passwords. But regardless of the hearing’s outcome, Love has no intention of turning over his encryption keys.
>
> “I don’t have any alternative but to refuse to comply,” he told The Intercept. “The NCA are trying to establish a precedent so that an executive body — i.e., the police — can take away your computers and if they are unable to comprehend certain portions of data held on them, then you lose the right to retain them. It’s a presumption of guilt for random data.”

I applaud his courage, and urge all Tor staffers to consider how they would act if they encounter "rubberhose cryptanalysis".

Sen. Ron Wyden, Rep. Ted Lieu, and others in the US Congress have been warning that the public does not understand the nature of the recent loosening of NSA's rules for sharing the personal information of US citizens gleaned from its dragnet with FBI.

https://theintercept.com/2016/04/01/intelligence-community-olive-branch…
Intelligence Community Olive Branch on Data Sharing Greeted With Skepticism
Jenna McLaughlin
1 Apr 2016

> In a post on one of the intelligence community’s favorite blogs on Wednesday, [Robert] Litt, general counsel for the Office of the Director of National Intelligence, outlined new intelligence data-sharing guidelines that he said will be released soon. The post, on Just Security, was essentially a response to reporting last month from the New York Times’s Charlie Savage that the NSA would soon be sharing with other government agencies the raw, unfiltered intelligence from the depths of its massive overseas spying programs.
> ...
> Patrick Toomey, staff attorney for the ACLU’s National Security Project, questioned Litt’s assumptions. “The premise of Litt’s response seems to be that there is an impermeable barrier — or ‘wall’ — between the FBI’s intelligence and law-enforcement roles. But that’s the wall the [intelligence community] spent the last 15 years tearing down,” Toomey wrote in an email. In fact, ever since the September 11 terror attacks, the intelligence community has been working to get information out of agency “stovepipes” so that it can be better used to stop terrorist attacks — even though that was not actually the problem pre-9/11. When conducting criminal investigations, the FBI can currently search through data the NSA gives it from programs run under Section 702 of the Foreign Intelligence Surveillance Act. Those programs are designed to target the communications of overseas persons, but “incidentally” grab some American communications, too. Those FBI searches have been likened to “backdoor surveillance.” “It seems very likely that the new 12333 procedures will permit the same thing, giving the FBI nearly unfettered access to an even bigger pool of data,” wrote Toomey.

An essential point for Tor users: NSA documents leaked by Snowden show that NSA regards all Tor users as "un-American" by default, a policy which I believe they eventually admitted in public.

USG spokespersons, including Litt, claim that "privacy is respected" and "civil liberties are protected", but Wyden and Lieu says quite the opposite is true:

http://thehill.com/policy/national-security/274773-spy-office-denies-al…
Spy office denies allegations that NSA data will be used for policing
Julian Hattem
31 Mar 2016

> A top lawyer for the nation’s intelligence agencies is pushing back on mounting criticism about new plans to widely share intercepted data throughout the federal government. Robert Litt, the general counsel for the Office of the Director of National Intelligence, confirmed that the change in policy is “in the final stages of development and approval,” in a post on national security legal blog Just Security on Wednesday. But Litt denied allegations that the change would allow the FBI and other agencies to use the sensitive data for domestic law enforcement matters, which members of Congress had speculated could be unconstitutional.
> ...
> Earlier this month, a bipartisan pair of House lawmakers warned that the potentially “unconstitutional” and “dangerous” move might allow law enforcement agencies like the FBI to use the NSA’s data — which is collected in the course of its foreign intelligence work — for policing matters within the U.S. “NSA’s mission has never been, and should never be, domestic policing or domestic spying,” Reps. Blake Farenthold (R-Texas) and Ted Lieu (D-Calif.) wrote.

This new controversy may explain the sudden resignation of the head of the PCLOB (Privacy and Civil Liberties Oversight Board):

https://www.truthdig.com/eartotheground/item/david_medine_leading_us_pr…
David Medine, Leading U.S. Privacy Watchdog, Resigns Unexpectedly
31 Mar 2016

> After years of service, David Medine is resigning as chairman of the Privacy and Civil Liberties Oversight Board (PCLOB). The board was established after the 9/11 attacks to bolster counterterrorism efforts in the United States and protect Americans’ privacy rights in the face of expanding surveillance.

It would be impossible to overstress the fact that the threat faced by The People in CWII can be characterized in decreasing order of importance as:

* political
* legal
* technical