Tor Open Hack Day in Berlin (for everyone)

I'm new to all this will eff let me search the deep web?

> somebody told me that using a tor browser is illegal in the USA

Because the USG has (unconstitutionally) implemented numerous secret laws, it is impossible to be sure, but on the basis of openly published laws, as of 6 Oct 2015, I believe that this is false. Should CISA pass both houses of the US Congress (it is expected to come up for a vote in the Senata early next week), this may change.

Generally, it appears that the secret laws are mainly invoked to gather evidence against someone the government dislikes, after which they can be charged under published laws and prosecuted in open court without undue fear of revealing the secret laws. Such "fishing" would be rigorously proscribed by any government which is sincerely respectful of the Rule of Law.

One point to bear in mind, which has been emphasized by privacy-minded cryptographers such as Bruce Schneier, is that the "Western democracies" are increasingly using a nasty repression stratagem which was formerly restricted to the worst authoritarian regimes, in which someone the government dislikes is arrested and confronted with evidence of previous activity which was not illegal or even seen as particularly "suspicious" at the time, but which later became illegal or came to be considered dangerously "deviant".

For example, unforeseen shifts in the US political winds might lead to future prosecution of members of the Unitarian Church who are currently involved in (currently legal) assistance to undocumented aliens, or people performing human rights monitoring in a country which is currently regarded as friendly or neutral, but next year might be under ISIL control. The USG interpretation of very broadly worded laws is also subject to change without notice. In particular, human rights and medical aid workers in Syria, Iraq, and Afghanistan must accept the risk that a local social services group they work with today might next month be unexpectedly designated as a "terror group".

A related issue involves "mission creep", in which terms such as "terrorist group", "material assistance", "cyberattack" and "weapon of mass destruction" have been steadily extended by US federal prosecutors, often to the point of absurdity. For example, Congress clearly intended that "WMD" denote things like nuclear weapons, but in the past five years this term has been steadily degraded to include such things as hand grenades and sawed-off shotguns. For example, it seems quite possible that hobbyist drone operators doing sketchy things which are legal today (but probably shouldn't be) may be retrospectively prosecuted using novel interpretations of current laws, especially in the event of such foreseeable tragedies as careless operation of a hobby drone resulting in a mid-air collision and causing the crash of a wildfire-fighting aircraft.

Schneier and friends are not of course suggesting that anyone engaged in relief work cease their humanitarian activities out of an abundance of caution, but are rather attempting to explain why the "collect it all and store it forever" mentality of agencies like NSA is so poisonous for any democratic society.

> and that just by connecting to TOR your ISP can potentially flag you to authorities

Published Snowden leaks confirm that NSA attempts to use its global surveillance machine to record every connection to the Tor network, or more precisely to the Tor Directory Authorities. This means the bad guys know that someone using a computer with a certain external IP address was using Tor on a certain date, give or take about 60 minutes. They also confirm that NSA attempts to save indefinitely any encrypted packets, which would include all Tor data streams because Tor uses TLS. The so-far published leaks also show that NSA attempts to record any attempt to obtain the IP of a bridge (a special node which helps people in places like Iran, China, and Australia evade government blocking of normal access to the Tor network). See

https://blog.torproject.org/blog/being-targeted-nsa
phobos
3 July 2014

> Tor's anonymity is based on distributed trust, so observing traffic at one place in the Tor network, even a directory authority, isn't enough to break it. Tor has gone mainstream in the past few years, and its wide diversity of users -- from civic-minded individuals and ordinary consumers to activists, law enforcement, and companies -- is part of its security. Just learning that somebody visited the Tor or Tails website does not't tell you whether that person is a journalist source, someone concerned that her Internet Service Provider will learn about her health conditions, or just someone irked that cat videos are blocked in her location.
>
> Trying to make a list of Tor's millions of daily users certainly counts as widescale collection. Their attack on the bridge address distribution service shows their "collect all the things" mentality -- it's worth emphasizing that we designed bridges for users in countries like China and Iran, and here we are finding out about attacks by our own country. Does reading the contents of those mails violate the wiretap act? Now I understand how the Google engineers felt when they learned about the attacks on their infrastructure.

One crucial role which Directory Authorities play is in eliminating from the network any nodes which are "known bad", typically because they have been seized by police. For example, in autumn 2014, Europol seized numerous Tor nodes in connection with an attempt to take down some hidden services. See

https://blog.torproject.org/blog/thoughts-and-concerns-about-operation-…
Thoughts and Concerns about Operation Onymous
phobos
9 Nov 2014

> If your relay was seized, please also tell us its identity so that we can request that the directory authorities reject it from the network.

It is widely suspected that NSA or another intelligence agency may have been behind an incident in which someone compromised some Directory Authorities, fortunately narrowly missing their presumed goal of compromising enough to take over the entire Tor network. See

https://blog.torproject.org/blog/tor-project-infrastructure-updates
phobos
22 Jan 2010

> In early January we discovered that two of the seven servers that run directory authorities were compromised (moria1 and gabelmoo), along with metrics.torproject.org, a new server we'd recently set up to serve metrics data and graphs. The three servers have since been reinstalled with service migrated to other servers.

Ironically, the Snowden leaks reveal that JTRIG (the "effects" unit of GCHQ which attacks dissidents with malware and psyops) itself uses Tor and operates its own hidden services. It is virtually certain that NSA does the same. Because the cyberspooks mostly understand that breaking into networks always creates opportunities for other attackers (because breaking into networks always carries the risk of unforeseen consequences), it seems implausible that FVEY would attack a resource it relies upon for daily operations. If so, heavy-handed operations like Operation Onymous which seize Tor nodes, or cyberwar actions which attempt to compromise Directory Authorities, may suggest conflict between police agencies like Europol/FBI and intelligence agencies like NSA/GCHQ/CIA and military partners which use Tor for their own purposes, and need the rest of us so that they can "hide in the noise" our own Tor use provides.