Tor users are selected and monitored by the NSA as extremists

https://translate.google.com/translate?sl=de&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.heise.de%2Fnewsticker%2Fmeldung%2FXKeyscore-Quellcode-Tor-Nutzer-werden-von-der-NSA-als-Extremisten-markiert-und-ueberwacht-2248328.html&edit-text=

by sveme • 12 years ago

214 139 12 years ago

translate.google.com

mkal_tsr2• 12 years ago

"According to the source code will be labeled as extremists in XKeyscore users when they search the internet for anonymizing tools like Tor or Tails, thanks to the global monitoring of search queries."

Holy fuck this is disturbing.

Does someone have access to a human-translated copy or similar article?

VMG• 12 years ago

It's based on a report by the TV station ARD. The video shows source code printouts, here are screencaps:

http://i.imgur.com/3flJ50Y.png

http://i.imgur.com/NRMY6Qo.png

Edit: some say it's not really the XKeyscore code: http://blog.fefe.de/?ts=ad4bdd72

mkal_tsr2• 12 years ago

"Edit: some say it's not really the XKeyscore code"

Yeah, looking at the code it definitely involves TOR, but I'm really interested in the "searching for these Tools -> you're now flagged" claim+proof because that is just so wrong.

AlyssaRowan5• 12 years ago

Mmm, looks about right to me...

Think of it a bit like crm114, but less hairy, bigger, and searching all your traffic.

That's not directly part of a selector but a support library, so I highly doubt anyone is targeted purely on that - but it is probably part of attempted traffic correlation attacks on Tor.

They're not very successful.)

sveme• 12 years ago

Trying to human-translate the first part of the article:

XKeyscore-Sourcecode: Tor-Users are marked and surveilled as extremists

According to an analysis of the XKeyscore sourcecode by German public broadcasters ARD and WDR, people showing an interest in anonymization on the web by, for example, googling for "Tails" or "Tor" will be added as extremists to an NSA database and monitored from thereon.

That's at least the gist of it. I'm pretty sure you'll get more background once the anglosphere awakens.

arethuza• 12 years ago

What if you are interested in geology and are looking for granite tors?

http://en.wikipedia.org/wiki/Tor_%28rock_formation%29

[NB I am interested in geology and I probably have searched for "tor scotland" or similar at some point]

haakon• 12 years ago

And what if you're interested in Norse mythology? Or people named Tor (a common name at least in Norway)?

No, in the age of universal surveillance, it's best to conform to a narrow norm.

mxfh• 12 years ago

Or is just into Soccer, Architecture or older Literature, since "Tor" in German means gate or goal, or just a foolish person. Semantics matter.

http://de.wikipedia.org/wiki/Tor

prof_hobart2• 12 years ago

It's difficult to believe that this is all it takes (or if it is, why they aren't just including everyone).

Tails is hardly an uncommon word, with a meaning entire devoid of any terrorist connection.

And so is Tor - it may not be that common elsewhere, but tor means "rock on top of a hill" and various places have it in their name. I've stayed the High Tor hotel in Derbyshire before, and as it was to see a fireworks festival they may have spotted various picture of explosions that I posted - I wonder if that set any triggers off.

_pmf_• 12 years ago

And so is Tor - it may not be that common elsewhere, but tor means "rock on top of a hill"

"Tor" is also the German word for "gate" (the common term, not something exotic), so I assume it's quite safe to discard the claim as bullshit.

wes-exp• 12 years ago

Keep in mind search engines often know what link you click on, and NSA probably also monitors which site is subsequently visited pursuant to a keyword search.

kijin• 12 years ago

Simple keyword recognition à la "He said Treadstone! Track him down!" only happens in movies. If a one-man startup can develop the technology to analyze a bunch of packets to and from a person and determine whether he is interested in rocks on top of hills or the anonymization tool, I'm sure the NSA can do even better.

grkvlt6• 12 years ago

It's a pretty basic and obvious problem with keyword searching and data reduction that will have been solved a long time ago. A very simplistic model would have words like 'Tor' and 'Tails' increment an 'interestingness' counter, along with other terms like 'Bomb', 'Jihad' and so on. Once the counter passes a threshold, you look at the messages. As I said, this is basic stuff, there are much better and smarter ways to do this. In fact, there are entire large companies that exist to write software that carries out searching of data by keyword; Google springs to mind!

Do all these people writing 'I searched for Glastonbury Tor, now I'm on a terrorist watch-list, stupid NSA, Hah!' really believe that they system works like that?

cottonseed• 12 years ago

why they aren't just including everyone

They are. At least, that's my takeaway from the Snowden revelations. They are just using various and overlapping justifications for it, e.g., Schneier's notion of robustness of NSA surveillance programs [0]. The NSA's goal is to collect everything from everyone. Therefore, they want to use the broadest and most expensive justifications and criteria for collection.

[0] https://www.schneier.com/blog/archives/2014/01/how_the_nsa_t...

noir_lord2• 12 years ago

Create a "Fight the NSA button" that links to a google search for Tor or Tails then post it on everything.

If they really are doing this (and considering recent events I would lean that way) that would seem like an effective irritant.

EDIT: For clarity, the button should explain what it will do, putting someone on a watch list without their consent is not a moral thing to do.

spacefight3• 12 years ago

Or embed a google search within an iframe.

noir_lord2• 12 years ago

The button requires user action, the iframe is passive I'm not convinced getting someone put on a watchlist without them taking a specific action is a particularly moral thing to do...

For the sake of clarity I wasn't suggesting the button be put on without a clear explanation of what it did.

im3w1l• 12 years ago

A referer field would let "them" see it for what it what. I previously did a hn-submission on how to do this without leaking a referer field.

http://bracka.se/hn/csrf.html

Since then, onion.to has gone down, so the first iframe wont work, but the second two will.

dan_bk• 12 years ago

Next, they'll just filter out those attempts to make noise.

It's a cat-and-mouse game and also needs a solid (i.e. political) solution.

grkvlt6• 12 years ago

It would seem like an effective waste of your time. Do you really imagine the NSA cannot filter out things like that? Keywords generated by a program are easily recognised by source or content, and are simple to filter out. I imagine they are looking for a sequence of events like: 1. Search for 'Tor', 2. Download of Tor application, 3. Encrypted traffic from the same source. Look up CEP (Complex Event Processing [1]) systems and what they are capable of.

[1] http://en.wikipedia.org/wiki/Complex_event_processing

higherpurpose• 12 years ago

NSA policies are simply insane and/or lazily thought out. I mean we even learned a while ago that not using Facebook makes you "suspicious" - Seriously? Or maybe watching a certain type of Youtube videos.

My point is I wouldn't single out just Tor here. They probably have dozens of other such idiotic policies that lead to abuses and putting people on "lists" that then they can take revenge on, such as through adding them to no-fly lists and so on, with very little to no recourse for the people affected (if they even ever find out about if or why they're put there, since it all tends to be secret).

What happened to innocent until proven guilty? The NSA is simply out of control and needs to be reined in, otherwise expect abuses against people that haven't even heard of Tor.

Shish2k• 12 years ago

we even learned a while ago that not using Facebook makes you "suspicious"

I tried googling for evidence of this ("nsa not using facebook suspicious"), and this comment (posted 56 minutes ago as of my writing) is the top google hit, with others being irrelevant o_O

Do you have a link to support this? At this point I am wondering if it's safe to assume all conspiracy theories are true by default, and lack of evidence is evidence of conspiracy to cover it up...

haswell• 12 years ago

Remove "nsa" from your query, and you'll find a long list of relevant results. There was quite a bit of coverage around the web a year or two back about this topic, but never in the context of the NSA as far as I know.

jdong• 12 years ago

NSA uses several different parameters to identify potential targets.

E.g a Tor user with no Facebook profile who recently spent two months in Syria, sound suspicious?

The fact that someone doesn't make a Facebook profile stands out, the fact that someone is using Tor stands out and the fact that someone is taking regular trips to Syria stands out.

Nobody's getting arrested for using Tor, or not having a Facebook profile. But those are things used in evaluating people.

fchollet• 12 years ago

Is it possible that this, and the release of this information, is part of a NSA strategy for deterring people from using TOR or encryption? Internet users will now be too scared to be put on some list to even look up information about TOR or PGP.

mkohlmyr2• 12 years ago

Admittedly I'm not well versed in TOR and how secure it actually is but surely it would be more actionable for major intelligence agencies to operate a number nodes in the network and use them to attempt to track and mitm requests?

As for encryption I haven't seen much to indicate a deterrence strategy, but maybe I'm not following the media as much as I should.

alextgordon• 12 years ago

Read this: http://cryptome.org/2013/10/nsa-tor-stinks.pdf

"Current: access to very few nodes. Success rate negligible because all three Tor nodes in the circuit have to be in the set of nodes we have access to"

Crito• 12 years ago

It seems to me that the two tactics could be complementary. If you discourage people from using Tor, then you don't have to devote as many resources to the people that use Tor.

giancarlostoro• 12 years ago

Wouldn't it be shown on American / English media then?

jonnybgood5• 12 years ago

No, I don't think this article is providing facts.

The US government created Tor and has been a major sponsor since it's inception. It would be against US government (State Department) interest for people to stop using it.

caio1982• 12 years ago

If by extremists they mean freedom extremists then that's fine with me, bring it on NSA.

nobodyshere• 12 years ago

Anyways, if they are trying to justify doing that by fighting with terrorists, I'd say the terrorists have already won.

Create• 12 years ago

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world.

This should not actually be a complicated inquiry.

http://www.theguardian.com/technology/2014/may/27/-sp-privac...

dm24• 12 years ago

I was talking on the phone to someone in another country (a US friendly country) and the other person mentioned Tor. The second he got to the end of the word the phone call cut out. I haven't had a phone call cut out in years except that one time.

It was most likely a complete coincidence but it would be very interesting if anyone else has ever had a similar experience.

probably_wrong• 12 years ago

Whenever I finish a Skype call, I immediately get a message supposedly from the other person with a 4-digit number. I don't know what that number means yet. Also, my phone's wifi will not turn off since last week.

Those are all probably just coincidences, but then again, it would also fit in the kind of behavior I'd expect to observe from spyware, either state-sponsored or just the usual kind. In any case, the NSA has made it very easy to become paranoid.

randallsquared• 12 years ago

If you're using Skype on Linux, it's the number of seconds of the call. Skype on Linux hasn't been updated in so long that the client doesn't always know what to do with what it's sent; if you're using Skype on Mac, that's when it tells you that you just got off a call with so-and-so for such-and-such time, but on Linux, it just prints out the literal number of seconds and it's done.

delian66• 12 years ago

I had the same problem, when I used the 4.2 linux version of the Skype client. It seems that it was a protocol mismatch between the Windows and Linux versions of the Skype client, and the 4-digit number is the duration of the call in seconds.

AlyssaRowan5• 12 years ago

Does the other person know what that means? Is it their phone unlock code?

e455b3283• 12 years ago

It was not a coincidence. I created an account just to respond because I've been waiting years to have my experience... "validated".

The same exact thing has happened during phone conversations I've had except with a different word. And I first noticed it years ago but it was post-9/11. When it happened I thought the phone call dropped by accident. I called back and picked up where I left off telling the same story. At the same word the call dropped again. I called back again and said "uhh, that was weird. Did you notice it cut off again when I said _______?" And the call dropped once more. At that point there was no plausible way it was a coincidence. The next time I called, I decided not to test it again.

I've been looking out ever since for some mention of this somewhere. Never saw one until now.

aatos• 12 years ago

What was the word?

dm24• 12 years ago

It would be very interesting to be able to reproduce that happening and be able to test what it does and does not "detect".

I would imagine that foreign terrorists would speak in their native language. Any sophisticated terrorist would use code-words (Get on the train and trigger the Goat). Does the system pick up if you spell out a word?

It's certainly possible but there's not much reason why the phone calls would consistently drop unless that was their method of preventing terrorist activity.

It's known that all calls around the president are monitored for X miles, so the technology is certainly in place and in use.

grkvlt6• 12 years ago

It was absolutely a coincidence. What on earth would the rationale be for an intelligence agency to cut off a call as soon as they heard a term of interest? I think your tinfoil hat is leaking.

mpyne3• 12 years ago

Jesus Christ people, learn about the birthday paradox someday, please.

pkinsky• 12 years ago

I've heard similar stories from people making international calls to China.

amalcon• 12 years ago

I find it unlikely that this is intentional. To do intentionally intentionally would require human monitoring (or more powerful context analysis than I've heard of): "Tor" is a homophone for "Tore" and "Torr", and in a few accents it's very similar to "Tour". It's also a prefix for a lot of words. At least "Tore" and "Tour" are more common in conversation than "Tor", and I'd expect things like "Torrent" to also be more common.

In the case of human monitoring, cutting the call off immediately is an odd response: usually both spooks and law enforcement would rather keep listening to get more information. An automated system might try to do that, but only one whose designers don't care if it's noticed: if my phone cuts off whenever I talk to a foreigner about a tour, I'm surely going to notice.

There could have been something fishy going on there, but it doesn't fit the usual threat models in non-dictatorial regimes.

dm24• 12 years ago

I agree that it was most likely a coincidence, other than server access any intelligence agency would have no reason to monitor me.

Even if you were near the president and said on the phone or over a radio "Shoot the president's head" it could be completely justified depending on context (if you were a production crew talking to a camera operator for instance). It would be nearly impossible to sort out the false positives and even if you could it wouldn't prevent much because of code-words that could be used.

Then again, we all know that bugs happen, there might have been a new system in place. It would be conceivable that the phone/tower/something received a bad command when the "recording" started and it caused the call to drop.

I say "hacked" and "stolen" on the phone all the time, but those would likely be on the list of "calls to record".

Istof2• 12 years ago

The same didn't happen to me when talking about bombs with someone in another country. Could it be because it was VOIP?

DamnYuppie• 12 years ago

I am obviously highly suspicious because I have not only searched for but used TOR. It is handy when you want to price compare flights. I also don't like Facebook, I wonder where I am ranked on the NSA's list of potential terrible people?

fredley• 12 years ago

For a while I taught a security course which included information about how Tor works. I did a lot of googling around Tor and anonymity in general. I must be on a few lists by now.

shill• 12 years ago

You might have a record in the Hitlerian maincore database.

http://en.m.wikipedia.org/wiki/Main_Core

jonnybgood5• 12 years ago

Pure unadulterated sensationalism. The NSA scandal is a moneymaker. No surprise that it's coming out of German media after the leaks about Merkel.

It is in the US government's interest for Tor to thrive, it even uses Tor.

why-el• 12 years ago

There are factual statements in the article that you could respond to. That's how a constructive comment should be.

jonnybgood5• 12 years ago

What factual statements? It's vague and ambiguous. XKEYSCORE is also not just a computer program. This is not real source code of XKEYSCORE as you wouldn't hard code Tor or any targeting vectors in to the source. It's not how the NSA operates as we've already seen. This is the biggest giveaway that the source code they're showing is fake.

Are we to accept any article about the NSA without question?

Nemcue• 12 years ago

Uh — someone has the XKeyscore sourcecode? How'd they get their hands on that? Is this verified?

jonnybgood5• 12 years ago

That's what I'm still trying to figure out. How do we know if it's even real?

manyman8992• 12 years ago

exactly. this is fear mongering propaganda

VexXtreme• 12 years ago

So would this XKeyscore thing know what you're searching for if you're not logged into your Google account and you're behind SSL? Would that imply they have private keys to Google SSL certificates?

jeletonskelly• 12 years ago

Yes, they probably can. One of the early NSA leaks showed that the NSA had compromised the private networks of many large tech companies. It would be safe to assume this gave them access to tons of unencrypted data about users and behavior. The NSA is using a graph database to store all sorts of data and then joining data across domains to get a fairly complete picture of your digital life.

joeyspn• 12 years ago

I guess the answer is yes... breaking (or by-passing) SSL must be a joke for a gazillion dollars funded agency (think "heartbleed" zero-day).

manyman8992• 12 years ago

i'd say monitoring every single communication going in and out of your country and storing it is pretty extreme don't you think? I can't imagine any tor users really give a damn what the nsa think about them. The NSA are clinically insane

dspillett4• 12 years ago

I'm not sure why people seem surprised by this.

Any sufficiently (i.e. correctly) encrypted content/traffic should be indiscernible from any other of the same scale. While there are ways to infer what sort of traffic is being carried from certain packed inspection and statistical techniques (a bulk HTTP transfer will look different to a peer-to-peer one and both will look very different to an interactive SSH session, and so on) you can't do that for the content.

There are five groups using Tor and similar by my understanding (in no particular order): criminals (including terrorists, people trafficers, illegal drug industry people, and so forth), the oppressed and freedom fighters (depending on your point of view a lot of people in this category might belong in the first one instead and vice-versa), the paranoid who think the whole world is out to get them, those wanting to protect all their content+comms whether secret or not out of principal, and those who are simply experimenting with it (out of "random" interest, academic interest, or because they work in a relevant/related field).

The proportion of nefarious types (relative to the total user-base) routinely using Tor is going to be significantly higher then the proportion of such who are not, so the authorities are naturally going to look to Tor for that reason. They are not saying that they think everyone using Tor is a terrorist, they are saying some are but we can't tell who so we are going to check everyone.

The only way this will change is if everything is thusly protected, so there will be no difference between the diversity of Tor users and the diversity of the overall population.

fooqux2• 12 years ago

I'd hate to be one of those people, but I'd enjoy some kind of citation on that claim that the majority of Tor users are using it for nefarious purposes.

I may be stretching here, but I think most of us would probably agree that monitoring or outright shutting down Tor would be OK if the nefarious usage was 100%. More interesting is, at which point do we consider monitoring morally wrong as that percentage approaches zero?

bcl2• 12 years ago

All you need to do is look at the hidden services listed on any of the .onion directories. This is why I stopped running a node -- I just can't justify helping criminals, even if I have no way to know which data passes through my system.

Abraln• 12 years ago

He never said the majority of tor users are criminals, just that the proportion/percentagefraction is higher than non-tor traffic.

cryptophile3• 12 years ago

It does not even matter that "the majority of Tor users are using it for nefarious purposes". Any attempt at intimidation will work out exactly the other way around.

Doing anything that the NSA do not like, is "cool"; even more so in the global scene.

Seriously, if you want to get people to use Tor, all you have to say is that the NSA do not like it.

gwern• 12 years ago

but I'd enjoy some kind of citation on that claim that the majority of Tor users are using it for nefarious purposes.

I don't know about exit nodes, but at least for hidden services that seems to be true (assuming you count torrents and drugs as 'nefarious'). See http://www.verisigninc.com/assets/labs/Measuring-the-Leakage... / http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf / http://donncha.is/2013/05/trawling-tor-hidden-services/

javajosh2• 12 years ago

I'm not sure why people seem surprised by this.

Not to get too meta, but this 'lack of surprise' thing has become a too-common reaction. I mean, objectively, what's more important - that the NSA is labeling Tor users as extremists, or whether or not you found this new information 'surprising'? Apart from being a distasteful brag, I don't think the assumption is correct. I'd imagine most people's response to be 'anger' or 'depression' or 'concern', although of course it's impossible to know for sure.

But what I really object to, and why I hope people stop using this language, is that it asserts that our collective reaction (however it is characterized) is more important than the story itself. In a very subtle way, it refocuses the argument and lets the NSA off the hook, and indeed, blames us for our having silly, outdated ideas like that our government might value and even protect our right to anonymous speech, rather than criminalize it.

As for the rest, it's possibly true that ubiquity is the only way forward.

marktangotango2• 12 years ago

> our right to anonymous speech

You lost me here. Privacy, yes, anonymity? Where is that in the Constitution (assuming you're a USA-ian).

ryanpardieck• 12 years ago

I strongly agree with this. Not only is the "why is anyone surprised" a cynical ploy at seeming "sophisticated," but it serves to make people feel foolish for their initial anger, distrust, fear, sense of betrayal etc. And they have very good reason to feel those things! But we look at them with blank, bored eyes and ask why they're surprised.

I mean, do we really expect anyone else to seriously care about this stuff, when we kind of subtly mock them for having initially cared at all?

"I'm not sure why anyone's surprised" is the nerd version of being too "cool" to ever care about something.

dspillett4• 12 years ago

* Apart from being a distasteful brag*

I don;t intend to come over as bragging, but given what is widely know surprise is simply not a sensible reaction if you keep up with the relevant news.

Constantly being surprised by this sort of thing means people simply aren't learning from the recent past. People seem to go from surprised, to offended/angry/disgusted, to apathetic, to completely forgetting until next time, to being surprised again.

I'm not sure what the answer is unfortunately, aside from maybe "stay offended/angry/disgusted and nag and nag and nag and nag and nag until things change or you are arrested".

pdkl95• 12 years ago

"Better late than never" is a concept that badly needs to be used here. Even if someone IS horribly late in realizing something, scaring them away with dismissive language is just going to make the problem worse in the future.

cryptophile3• 12 years ago

The NSA strategy of spying on everyone only works when most people are not aware of it. The surprise element is now gone. They can undoubtedly already see the effect of the recent scandals in a serious decrease in quality of the information that they collect. The entire internet is now slowly but surely moving to stronger forms of encryption. On the long run, it probably means that the entire internet will go dark for them. In other words, the ones who wanted to see everything will end up seeing nothing at all.

Zigurd3• 12 years ago

The Snowden revelations also killed two other illusions:

1. Putting the state-actor threat in the too-hard pile is a viable security plan.

2. If you sell to governments, especially the US government, you can also sell internationally to strategically important customers and not provide a "trust nobody" level of security. "Trust that I have implemented no back doors."

Going dark simply means providing the level of security that was always needed against mafia-connected state-actors and other high-level threats. And it means adapting to the level of trust (i.e. none) required to do business across multiple sovereign nations that want real autonomy of action.

vajorie• 12 years ago

Psst,

It also records details about visits to a popular internet journal for Linux operating system users called "the Linux Journal - the Original Magazine of the Linux Community", and calls it an "extremist forum". [1]

Hush puppy, it's okay to call absurd that which is absurd. It won't bite you.

Oh, wait...

[1] http://daserste.ndr.de/panorama/aktuell/NSA-targets-the-priv...

plicense• 12 years ago

Lol what about Tor developers?

forgottenpass• 12 years ago

They're already on the list of boat-rockers to harass at airports.

http://en.wikipedia.org/wiki/Jacob_Appelbaum#Detention_and_i...

rett12• 12 years ago

I suppose everyone here is already on a list anyway. Everyone who leaves a criticism for the NSA. Everyone who up votes this conversation and other similar ones. Everyone who contributes to OSS Privacy. Everyone who misspells Thor. How useful can this really be when there's so much noise?

IgorPartola2• 12 years ago

One possible solution to this would be for Firefox to integrate Tor with their private browsing mode. That would give the Tor network a huge spike in traffic. I have no doubt in my mind that the NSA can and probably does monitor every bit of traffic everyone sends, but the more inconvenient and muddled we make it the better.

I think we can all assume we (HN readers/posters) are on the NSA lists. Lots of us mentioned Tor and the NSA online. "He who must not be named" will show up as soon as you say his name and all that. The question is whether this puts you into actual risk. I sincerely hope not, but this shit is really getting out of hand.

Taek• 12 years ago

I'm sure that the NSA also has a large array of lists. Having a list called 'extremists' and 'terrorists' helps you get warrants, even if the list is merely composed of people interested in protecting their anonymity.

Tor will never take off on its own. There are many stigmas, and many barriers. Furthermore, in the past year to two years, pretty much every service has blacklisted all Tor exit nodes. It used to be moderately easy to sign up for Gmx (and, three years ago, even gmail) over Tor without needing a phone number. Many websites block all exit nodes from posting (though most at least allow viewing).

I would dislike to see this as a feature in Firefox until Tor is easier to use. In principle it makes sense and I support the idea, but in practice it would make private browsing very frustrating. I also imagine that you'd have a much more extreme supply vs. demand problem if this happened, reducing an already slow Tor to barely usable speeds.

javajosh2• 12 years ago

One possible solution to this would be for Firefox to integrate Tor with their private browsing mode.

I really like this idea. The practical downside is that Tor is generally very slow.

BTW I'm not entirely sure how the NSA can justify an anti-Tor stance, when anonymous speech is clearly protected by the First Amendment. Without something like Tor, true anonymous speech on the Internet is impossible; therefore Tor, or something like it, is a necessary tool to maintain that right.

(Anonymous speech has been historically important, when people would print and distribute anonymous pamphlets about political issues. Honestly, I am concerned about criminal use of Tor too, and would be perfectly happy to have a version of Tor limited to political speech and organization.)

john_b• 12 years ago

"BTW I'm not entirely sure how the NSA can justify an anti-Tor stance, when anonymous speech is clearly protected by the First Amendment."

Well, at least they are consistent with their stance on the Fourth Amendment. Namely, that both are subservient to the 0th amendment: "The right of the people to be monitored^H^H^H^H^H^H^H^H^H protected by their government, even against their will, shall not be questioned."

IgorPartola2• 12 years ago

BTW I'm not entirely sure how the NSA can justify an anti-Tor stance, when anonymous speech is clearly protected by the First Amendment.

Welcome to America, where the constitution is up for interpretation by agencies who have no obligation to disclose anything to anyone. The problem with the NSA is not even that it does all these things. It's that they operate as a sort of rogue arm of the government and if anyone tries to question what they do from within the government they can choose not to answer questions.

jeorgun• 12 years ago

I really like that idea; enough so that I do all of my private browsing through Tor.

Of course the downside to that, besides all the inconveniences of Tor, is that it gets associated in the public mind with both extremist criminals and porn. Maybe the NSA isn't so concerned with the latter, but Tor's image is bad enough has it is. I doubt this would really make it more politically savvy to support it.

plg• 12 years ago

What if we had a system where there was a constant stream of random bytes coming to/from every IP address out there... and when you wanted to send actual information, you always sent it encrypted ... then everyone would be an extremist and encryptors would no longer stand out.

Istof2• 12 years ago

If everyone's communications were properly encrypted, you probably would not need useless random bytes sent down the pipes since there is so much data being transfered on the internet.

grkvlt6• 12 years ago

Yes, this would defeat traffic analysis, but it only works if everyone is using the same shared channel, or if each user maintains a channel with every other user they might ever wish to communicate with. Every user must also check each packet to see if it is encrypted with their public key (requiring an extensive PKI) and is a valid message for them, which is expensive. The bandwidth required is also enormous for anything other than a very limited number of participants.

Sure, Tor achieves some of these goals, and if everyone used Tor all of the time then it would make the NSAs job much more difficult, but it isn't ever going to happen, for obvious operational and practical reasons.

nnnnni• 12 years ago

Well, I guess that the FBI is full of extremists. They use Tor to stay anonymous just like everyone else.

lowlevel• 12 years ago

German is difficult. German run through google translate, even more so.

mullingitover• 12 years ago

I have to wonder if it'd be possible to DDOS the NSA by having everyone do 'dd if=/dev/random of=supersecretstuff.txt count=1024 bs=1048576' and post large files full of random bits all over the web.

The NSA would be obligated to collect and store every damn one of those huge blobs of random bits on the off chance it'd be used later as a one-time pad, or that it's encrypted secrets that they need to investigate. It costs nothing to generate random bits, but it costs > 0 to store that data. Sooner or later they'd just run out of disk space.

AlyssaRowan5• 12 years ago

No.

But finite state machines take finite amounts of time and memory to run - and even though it runs 'nearline', XKeyScore is not invulnerable to targeted resource exhaustion attacks.

Tor users are selected and monitored by the NSA as extremists

Related Stories