The People Who Risk Jail to Maintain the Tor Network

http://motherboard.vice.com/read/the-operators

by Errorcod3 • 11 years ago

209 72 11 years ago

motherboard.vice.com

I think Tor is great, but I just can't trust the people operating the exit nodes.

You are wise not to. Not everyone who is an exit is on your side. It is better to assume that they are going to do everything nasty possible to you and your data.

cpncrunch• 11 years ago

Also, you should probably assume that the FBI is monitoring the exit node you are using.

mindslight• 11 years ago

Why would you ever have to?

(see also: The Internet is great, but I just can't trust the organizations running the backbone.)

cwyers• 11 years ago

Well, except the backbone has no alternatives, and the whole point of something like Tor is to mitigate one's lack of trust in the people running the backbone. If Tor is insecure, all you're gaining by using it is letting a bunch of three-letter agencies know that your traffic is potentially more interesting than the average.

Buge• 11 years ago

Yes, many exit nodes are malicious. That's why you should always use https when using tor.

mrsteveman1• 11 years ago

I've seen at least one exit node present an invalid certificate for any requested https:// url, but that's loud and obvious.

at-fates-hands• 11 years ago

So what are options besides Tor right now? Is anybody working on anything more secure?

patcon• 11 years ago

I2P?

dublinben• 11 years ago

It depends on what you're looking for. Tor is still the best at what it does. Alternatives like Freenet solve completely different problems.

zupreme• 11 years ago

This is actually a good piece. It sticks to the facts without an evident attempt to push an agenda either for or against Tor.

The operator ("Richard") seems relatable to a fellow tech like myself, and by the end of reading this I found myself thinking, "Maybe I should run an exit node too, since I have used Tor quite a bit".

All in all, a good piece.

plg2• 11 years ago

I thought Tor originated with the U.S. navy?

fiatmoney2• 11 years ago

It did. And the State Department & CIA use it to promote subversion activities in other countries. And the FBI and NSA try to crack it & discourage its use to monitor everyone's traffic.

"The government" isn't a monolith; it's made of quasi-independent agencies often operating at cross purposes.

dzhiurgis• 11 years ago

"The government" isn't a monolith;

And somehow individual is expected to be.

plg2• 11 years ago

it's just strange to me that on the one hand parts of the government would be trying to "crack" this system that ... other parts of the government came up with

wouldn't it render the system not-as-useful if it were to be "cracked" or weakened?

AJ007• 11 years ago

And still funded by the Federal government.

fiatmoney2• 11 years ago

Every paragraph of this piece has me yelling "NEVER TALK TO THE POLICE" at my monitor. Had they wanted to, it would have been incredibly easy for the FBI to spin any of the many quotes in this article into a "false statement" and an insta-felony, just out of spite.

If you're going to run an exit node, find an attorney beforehand. You don't necessarily need to put them on retainer, but figure out who you're going to call instead of walking into an FBI field office like, frankly, an idiot.

mg1982• 11 years ago

It reminds me of the astounding naivete of Aaron Swartz's girlfriend (or whatever she was at the time) in talking to the FBI and then being surprised that they were just looking for shit to pile on him and nothing else.

Don't talk to the cops: https://www.youtube.com/watch?v=i8z7NC5sgik

ternaryoperator2• 11 years ago

And if they ring your doorbell and ask to come in, the answer is "No, we'll talk outside." Once you let them in, anything they see is fair game.

jsmthrowaway2• 11 years ago

This meme bugs me because it is possible to heed the advice while still speaking to the police. I find that the only people who parrot it are those who have never been on the other end of the table. I've seen random people run over and advise a witness to "not talk to the police" while they were describing what happened to an officer at the scene of an accident. You can't package deeper context with something simple like "don't talk to the cops" and expect people to understand it. I think this general advice does more harm than good because of the way it's delivered.

The correct conclusion to come away with from the advice is to be vigilant when interacting with those who have the power to prosecute you, and often that means invoking your right to remain silent -- but not always. You should also know when you need a lawyer -- again, not always. If the cops knock on your door because they're looking for a lost kid, calm down and get over yourself, they're not looking for you.

Sadly, you and me get that, but others take the advice to the extreme and I've seen both of my examples firsthand.

jacquesm4• 11 years ago

Not everybody subscribes to the super cynical worldview, you'd be surprised how many people live their whole lives in exactly that state of naivety. We're all brought up with platitudes like 'the police is your best friend' and 'we live in a state with fair justice'. Given that it's no wonder that people will actually try to cooperate with police expecting justice to be done. You're essentially blaming the victim here.

aric• 11 years ago

Exactly. This piece caused endless sighs throughout. It's especially unfortunate for someone running an exit node to not have his wife and himself up to speed on their civil rights, not knowing to say anything but a polite maximum of wanting a lawyer. Anything you say or do may be used against you... Those aren't random words to frighten. They mean it.

golemotron2• 11 years ago

Had they wanted to, it would have been incredibly easy for the FBI to spin any of the many quotes in this article into a "false statement" and an insta-felony, just out of spite.

Here's the part of "don't talk to the police" that scares me. A LEO that would spin you into a felony would probably completely lie about what you say to pin a felony on you too. Moreso if you irritate by being silent.

christianbryant7• 11 years ago

It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons. I don't think there should be any argument there, Tor operator or not.

However, we have every right to anonymity and to encrypt our communications and data such that only those we want to see it can. So what to do?

Perhaps Tor operators can perform some act of vigilantism and expose criminals like the above without incriminating themselves through booting out and releasing the data of the pedophiles, terrorists and what have you.

Being a revolutionary and a lover of freedom is not a crime, and the criminals who give us a bad name are making it one.

golemotron2• 11 years ago

It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons. I don't think there should be any argument there, Tor operator or not.

The sage advice is to help but at your lawyer's discretion. Never talk to law enforcement without a lawyer. It is dangerous and never in your interest. https://www.youtube.com/watch?v=6wXkI4t7nuc

christianbryant7• 11 years ago

No argument here on that note :-)

maxlybbert2• 11 years ago

Perhaps Tor operators can perform some act of vigilantism and expose criminals like the above without incriminating themselves through booting out and releasing the data of the pedophiles, terrorists and what have you.

If Tor allows the exit nodes to access that data, (1) it's not very secure, and (2) it won't be long before the ability to monitor that data will become an obligation to monitor it.

simoncion2• 11 years ago

You may already know, but in case you don't:

Tor exit nodes get access to:

1) The network traffic that they've been asked to proxy.

2) The IP address of the previous hop in the Tor network that relayed that traffic to them.

IIRC, Tor currently runs a regular request through an entry node, a -er- middle node, and an exit node.

a3_nm2• 11 years ago

It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons.

It is a moral responsibility only when you agree that what the criminals are doing is morally wrong. For many current overreaching definitions of "pedophile" or "terrorist", for instance, I would disagree with this, and I would find it morally wrong to cooperate with law enforcement.

(This is talking about morals, not the law. Cooperating may, of course, be a legal obligation.)

christianbryant7• 11 years ago

Somewhere else in this thread I also note that I understand the definition of "terrorist" and "pedophile" may mean different things to different people in different countries, from both a legal and personal moral standpoint. However, does that then mean your moral obligation to cooperate with law enforcement should still not kick in once you personally feel something wrong is happening? The thing is, I am not speaking about a "legal" obligation here.

I support offensive hacktivism which is illegal in most respects, though not all. My "legal" obligation is to give up good people who are trying to exact moral justice for crimes they have knowledge are occurring, but for which no "legal" justice can be obtained, for whatever reason. However, I would not feel personally morally just in giving up those hacktivists. But if the persons in question the police are pursuing are criminals who partake in child pornography, or terrorist activities against innocent people - and my personal definition of both these terms falls both within American legal definitions and within my own personal definitions - then again, I believe it is my moral obligation to cooperate with law enforcement.

I accept the complexity of human beings and the difficulty of fully defining right and wrong, but I also know that helping bring criminals who can bring nothing positive to humanity and are also performing hurtful acts against innocent people is a necessary process within the ecosystem of human social evolution.

A_COMPUTER• 11 years ago

I don't think there should be any argument there

I'll argue against that point. I don't live in a system where I can trust that helping the police won't be turned around on me because they're just looking for somebody to pin charges on or because of bullshit laws that shouldn't be a law to begin with.

I have assisted the police exactly one time, when I witnessed a kidnapping, but I had to be extremely cautious because my roommate was a marijuana smoker before the state I lived in at the time had legalized it, and he had his stupid paraphernalia all over the apartment. The cops wanted to come in to ask me questions but I couldn't let them in the house because I didn't know what shit was lying around, so I had to make up a ridiculous excuse to do the entire questioning outside on flimsy lawnchairs in the yard. I was put into the position of trying to decide if I should risk fucking over my friend or not report a kidnapping.

bjwbell• 11 years ago

You just admitted to lying to law enforcement which is most likely a crime in your jurisdiction.

Just to reiterate, yes the police are not on your side. My dad had his arm broken by police purely for not obeying a voluntary evacuation order (forest fire).

christianbryant7• 11 years ago

Perhaps I should add a provision, then, that states that if you know you yourself or those associated with you will be harmed in the process of cooperation in a fashion that outweighs the need to bring the offender to justice, and you have at your disposal other means to help bring the persons to account (ties to hacktivist resources, or some other form of "non-traditional" justice such as vigilantism, etc), then you also have the option to take action in that way.

In other words, the moral obligation is at its root to eliminate the threat to society, but in a way that keeps others from being brought down with that person.

Yes, this is all hard to untangle, especially in today's American and European legal systems, but as more and more people are arrested and go to jail for fighting for what they believe is "right" for human society, the more aware those in power to make changes to those legal systems will be, and hopefully will move to see that change implemented sooner than later.

christianbryant7• 11 years ago

I'll reply to everyone at once here since the same concern for the most part is being conveyed. 1) Regardless your personal definition of "pedophile" or "terrorist" I believe there are crimes that a solid selection of persons across humanity can agree are not acceptable. But I realize there is no universality of beliefs, so I will be flexible here. I'm actually not saying you _should_ cooperate with law enforcement, only that, accepting that the law is _supposed_ to be upholding human decency, then we _ought_ due to moral responsibility help them. But... 2) if we do that, must we also sacrifice anonymity and the right to privacy? All the examples below illustrate that what we ought to do can often get us harmed; so the solution? 3) Vigilantism on the part of conscientious Tor operators; that is, boot the offenders, release the data to the public that they are trying to keep private, and let someone else deal with them. What, you believe that some sacred law among the cyber underground has now been broken? In prison, they kill pedophiles. This is not snitching but a combination of self-preservation (getting law enforcement off your scent) and universal justice (because there must be crimes "we" can "all" agree aren't conducive to a healthy life, a progressive universe and the continuation of the species as advanced.

MichaelGG2• 11 years ago

Broadcasting the exact usage of Tor exit nodes would be a net loss for privacy. While everyone should be using HTTPS over Tor and treating the exit node as they would a massive public open WiFi spot, not everyone does so. Putting such users at risk publicly exposing accidental usages of HTTP doesn't help.

Furthermore, releasing the previous-hop starts to degrade the privacy of Tor, a little bit. That's not a good thing.

LE can figure out how to go after "pedophiles and terrorists" using other gumshoe techniques, instead of trying to downgrade everyone's opsec.

Not to mention this idea of vigilantism is... a terribly bad idea (to put it politely)? You're actually advocating that people go lynch/kill others based on Internet traffic logs. Nothing's stopping all sorts of sites from embedding links to "bad" content and framing people. Or, exit nodes can just fake the log information if they wanted to.

belorn2• 11 years ago

There is a moral responsibility to help your fellow citizen against unreasonable prosecution, especially when police works under the incentive to get higher "stats".

As a citizen, we also have a moral responsibility to demand more efficiency from our government. Tracking criminals should be done under the scrutiny of cost-benefit, which mean they shouldn't focus on getting logs from software which do not log. They should not spend time chasing people when they lack evidence, and whose intent is publicly know (tor exit nodes does this). An IP address is neither DNA, fingerprint or a photo, but rather an address. If you saw a criminal going into a hotel, or going towards a specific road, you don't send the army and pull out everyone who lives there early in the morning. You knock doors, ask for witnesses and behave respectful until further evidence is gathered.

As professionals, we have any additional moral responsibility to protect innocents. We don't share logs, we don't share records, and we don't share journals. Administrators, medical personal, priest, help-lines, lawyers, and so on need to take a stand for people in their care. At times we can't tell the damage that careless behavior can cause, and innocent bystanders might get killed while chasing a criminal.

And then you balance those moral responsibilities and try to do the right thing.

christianbryant7• 11 years ago

I don't disagree with you. That is why I believe the onus is on the owner of the ecosystem where illegal activities are occurring to take action, to boot out the users attached to the activity and, if it makes sense to do so, to put their materials out where it can be found.

There is no simple answer, I know. Maybe for an Admin to do this without being 100% sure to whom the data belongs is tantamount to framing someone, should the data have been placed by another party. I just can't see _nothing_ being done; if not handed over directly to the authorities, then at least personally do the most your own conscious dictates.

The difficulty of the scenarios is not lost on me...

draugadrotten• 11 years ago

It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons.

While I agree that it may be a moral responsibility to cooperate with the "good" of law enforcement, the issue is more complex.

For one, law enforcement is not always "good". Rodney King.Floyd Dent.Julian Assange.Aaron Swartz. The list is long.

Second, the moral imperative to cooperate with law enforcement is not the only moral obligation one has. An adult have a moral responsibility to his wife, children and family, as well. Even US law recognizes that the bond between husband and wife is stronger than cooperation with the law.

Snesker• 11 years ago

I don't think you or the police have any obligation or right to track pedophiles. I think you mean child molesters, exploiters or slave owners.

Your post really challenged me, because I've been thinking of the issue in an us-versus-them mindset (we being criminals).

christianbryant7• 11 years ago

This exchange by far has been the most illuminating for me. I think I've done a decent job of explaining the root comment, but as of now the paragraph has a down vote to -4. So, I'm very curious: Is it the suggestion that Tor operators take some moral high ground in the case of users of their Tor infrastructure who are participating in the trafficking of children, or terrorists who are utilizing Tor near-anonymity to prepare for their next attack? Or, is it the idea that I am suggesting that any involvement be had at all?

Because, while I started the proposition as pointing to cooperation with law enforcement as the right thing to do if approached for questioning as a Tor operator when malicious persons are bring tracked on your network, I offered alternatives to that such as booting off the users, ejecting their data, so forth.

Does one simply create tools like Tor and then walk away, let the tools do what they do, and let others be responsible for dealing with the negative aspects?

I think this is an interesting conundrum and parallel in some fashion to the gun industry defense arguments here in America. Keep in mind, I am a builder of Tor servers - it is a software application, and like a gun, not illegal here in America. This difficult idea I'm presenting here of having some ownership of who uses your Tor infrastructure is not something I present lightly.

This is a valuable conversation and I'd love to hear more perspectives.

aestetix• 11 years ago

It's worth noting that if you want to support Tor exit nodes but do not want to run your own, you can donate to the Noisetor project. Noisebridge, a 501c3 nonprofit, has sponsored an exit node for several years now: http://www.noisetor.net

liotier• 11 years ago

And the French equivalent: https://nos-oignons.net

mirimir3• 11 years ago

For this reason, and others listed on the Tor Project website, operators are strongly advised to only run their exits remotely, by renting out server space.

Better yet, do that anonymously. Always work via Tor. Use a false identity. Pay with well-mixed Bitcoins. Observe good OPSEC.

TazeTSchnitzel• 11 years ago

That doesn't sound like a good idea. When law enforcement come knocking, your position is less defensible if you seem to be trying to hide your tracks.

mirimir3• 11 years ago

If your OPSEC is adequate, they won't know where to come knocking.

The People Who Risk Jail to Maintain the Tor Network

Related Stories