Sunday, November 15, 2015

FBI Accused of Paying Carnegie Mellon $1 Million to Break Tor

It has been recently reported that the head of the Tor Project has accused the FBI of de-anonymizing Tor users with the help of Carnegie Mellon computer science researchers. They have suspected the FBI of paying $1 million to CMU researchers to access the vendor side IP addresses of the Silk Road 2. If the claims are true, it shows what great lengths the FBI is going through to stop the illegal trade of drugs on the darkweb.

It was reported in January 2015 that a Homeland Security search warrant revealed that from January to July 2014 a “source” provided law enforcement with “particular IP addresses” of those who accessed the vendor side of the Silk Road 2. By July, the Tor Project was able to find and stop the attack, concluding that it was the same Carnegie Mellon researchers who a few weeks earlier canceled their Blackhat presentation on a low cost way to de-anonymize Tor users. Both the FBI and CMU have not responded to any claims of collaboration, but Ed Desautels, a spokesman for Carnegie Mellon’s Software Engineering Institute, did not deny the accusations, stating “I’d like to see the substantiation for their claim,” adding, “I’m not aware of any payment.”

If the reports are true, this could be extremely troubling for users of Tor. Not only does this breach violate our 4th Amendment rights, but it also demonstrates that you never know who will breach security a person’s security for just money. With our civil liberties being challenged everyday, we cannot allow the FBI to circumvent the law and use universities for their own dirty work. Although not many details have surfaced, you can never know how many innocent users were caught in the crossfire. Roger Dingledine, Tor Project Director, agrees stating “Such action is a violation of our trust and basic guidelines for ethical research. We strongly support independent research on our software and network, but this attack crosses the crucial line between research and endangering innocent users.”

No comments:

Post a Comment