Tor Browser 6.5a1-hardened is released

The need for browser hardening is evident from leaks from the notorious intrusion-for-hire company Hacking Team, and from the disclosure of huge USG payments for hacks into onion service websites.

On the political side, support is coming from such surprising sources as former White House cybersecurity chief Ari Schwartz, who argues in a new paper that FBI should be forbidden from paying for hacks, specifically citing a huge payment for hack into an encrypted iPhone used by the San Bernardino killers:

http://www.theregister.co.uk/2016/06/17/fbis_iphone_hack_should_be_barr…
FBI's iPhone paid-for hack should be barred, say ex-govt officials
Cybersecurity bods argue for formalizing zero-day disclosure rules
Kieren McCarthy
17 Jun 2016

> Although the question over whether to disclose a security hole is complex, it is not so complex as to avoid a clear set of rules, say Knake and Schwartz. They don't agree with Bruce Schneier's argument that all zero-day holes should be disclosed immediately regardless of their potential value, and instead highlight a possible case where disclosure would result in the loss of valuable intelligence in an ongoing investigation.
>
> That does not include the FBI's $1.2m purchase of a hack, however. One of the paper's recommendations is that government agencies be "prohibited from entering into non-disclosure agreements with vulnerability researchers and resellers" – which is what the FBI did in buying access to the San Bernardino shooter's phone from an unnamed third party and then claiming it cannot disclose how it did so.

About a month ago some US legislators who expressed doubts about the effectiveness of FBI's rapidly expanding precrime programs, including its CVE programs targeting American schoolchildren, called for a careful scientific evaluation of FBI's precrime risk scores. Unfortunately, this brief window of opportunity for moment of sanity in the halls of USG power were torpedoed by the mass shooting in Orlando. As was the email privacy bill which had been expected, until the Orlando massacre, to pass unanimously.

FBI's dragnet surveillance programs almost always escape oversight. One of the very few exceptions is the enormously costly decades old disaster known as NEXTGEN, the FBI's much vaunted biometric identification program. After steady legal work by ACLU gradually revealed more and more clearly the failings of this program, GAO finally asked whether FBI's dragnet biometric programs are cost effective, and their report, just published, is extremely damaging to FBI's carefully guarded reputation:

http://thehill.com/policy/technology/283651-watchdog-fbi-doing-limited-…
Watchdog slams FBI's facial recognition database testing
David McCabe
15 Jun 2016

> The FBI has not appropriately tested its facial recognition database, according to a government watchdog report released on Wednesday. The agency maintains a database — called the Next Generation Identification-Interstate Photo System (NGI-IPS) — of photos and other biometric data that can be used in pursuing cases. The Government Accountability Office (GAO) said the agency had only done "limited" testing of its accuracy in situations in which officers were summoning a list of more than 50 potential matches, and did no testing when summoning a list of fewer than 50 potential matches. It also hasn’t tested the accuracy of the state and federal systems the FBI can access during investigations. “By taking such steps, the FBI could better ensure the data received from external partners is sufficiently accurate and do not unnecessarily include photos of innocent people as investigative leads,” said the watchdog.

For those familiar with ROC curves, a decade ago FBI tried to set some standards for the facial identification (in dragnet CCTV video) component of NEXTGEN. Specifically, they declared that the probability of false negatives to be below 5% and the probability of false positives to be below 2%, which is somewhat more stringent than some credit card fraud detection scores, and comparable to some medical testing scores. Five years after that when their own studies showed NEXTGEN was failing miserably to meet those standards, FBI simply dropped all accuracy requirements. Pretty amazing even for an agency with a century old track record at complete failure at every "national security" mission it has ever taken on, especially when FBI and its parent DOJ are pushing so hard for "evidence-based" precrime assessments of all American citizens.

And an excellent example of data journalism from Propublica has shown that the most widely used precrime scoring system in the US "justice" system [sic], from a little known Canadian company called Northpointe Inc, fails to meet even the low bar set for scoring systems which cannot result in persons being deprived of their freedom, much less the stronger standards common in clinical situations such as cancer testing (but not in psychiatric testing, where once again, unevaluated and dubious precrime scoring algorithms are sprouting like weeds, and being marketed to companies anxious about their employees and municipal governments anxious about local residents):

https://www.propublica.org/article/senates-popular-sentencing-reform-bi…

If you think COMPAS is bad, FBI's precrime scores are much worse, and far more dangerous, especially to privacy-minded citizens who use Tor (which USG tends to view as a "red flag" for all manner of suspected potential misconduct).

The GAO report also revealed the existence of a second vast FBI dragnet surveillance facial ID program, called FACE, which is also being developed without any oversight or requirement for meaningful evaluation.

Meanwhile, FBI is demanding that NEXTGEN and FACE be exempted from the Privacy Act, on of the very very few (outdated and weak) laws protecting some of the privacy of US persons, and they demand that the videos recorded by the hidden cameras be exempted from FOIA requests.

Among the controversial sources for NEXTGEN/FACE imagery are surveillance cameras which secretly placed on municipal utility poles, where they are hidden by "concealments" (in FBI parlance) to prevent alert passersby from noting the surveillance.

In recent court filings FBI has argued that revealing the location of the hidden cameras would violate the privacy of precrime suspects who have not yet been charged (naturally, because they haven't done anything wrong), or cause their unsuspected neighbors to become paranoid about USG intentions toward their own households. Because, you see, the pole cams record the comings and goings of everyone who passes by the hidden cameras, not just the current "person of interest". Even more striking, FBI argued that their own agents are afraid of having their identities leaked (perhaps the watching agents are also imaged sitting in their surveillance vehicles/trailers?). Reading into this zany arguments I see evidence that the USIC leadership is very anxious about being charged in absentia and maybe even extradited to face trial for war crimes:

http://thehill.com/policy/national-security/282689-former-cia-officer-f…
Former CIA officer faces extradition to Italy for Bush-era efforts
Julian Hattem
8 Jun 2016

> A former CIA officer appears set to be extradited to Italy over allegations about her role in the kidnapping and “extraordinary rendition” of an Egyptian man during the George W. Bush administration. Sabrina de Sousa told news outlets on Wednesday that the extradition process has already begun after the constitutional court in Portugal rejected her final appeal. If the process is finalized, she would become the first person to ever be charged, extradited and jailed over the CIA’s “extraordinary rendition” program, which was carried out under the Bush administration to seize suspected terrorists and bring them to another country for interrogation.
>
>In 2014, de Sousa was convicted in absentia by an Italian court for participating in the 2003 abduction of Egyptian cleric Hassan Mustafa Osama Nasr off a street in Milan and ferrying him to be questioned in Egypt. According to his wife and Italian prosecutors, the cleric, also known as Abu Omar, was subjected to beatings and electric shocks to his genitals.

Such is the political background which underlines the urgent necessity for projects like the Tor Browser hardening program.

I hope Tor users will consider making a donation to support browser hardening, reproducible builds, and other TP initiatives intended to counter unconstitutional state-sponsored-hacking and dragnet surveillance.