Greetings from Tor's New Executive Director

> irrational optimism ... which the USG is trying to exploit in its inward facing CVE programs, which stress the doctrine of "resiliency", a code word for the governments displeasure with the fact that more and more citizens are not content to make do with less and less

Jay Stanley of ACLU offers some useful insights on how the global depression (or whatever euphemism one prefers) exacerbates pre-existing threats to civil liberties and human rights:

https://www.aclu.org/blog/free-future/economic-stagnation-and-political…
Economic Stagnation and Political Turmoil Test Our Civil Liberties
Jay Stanley, Senior Policy Analyst, ACLU Speech, Privacy & Technology Project
15 Dec 2015

> If these economists are correct, history suggests that we could be in for a period of sustained political instability. And that, in turn, will have big implications for our civil liberties.

@ Shari:

I want to make sure you are aware of yet another category of looming potential threats to the community of cybersecurity-privacy-anonymity promoting research/tools (particularly Tails Project, a close ally of Tor Project).

You probably know Ron Deibert of Citizen Labs, and I hope you have read his excellent book Black Code! No human rights organization could be more critical to the circle to which Tor Project belongs than Citizen Labs, which has played an outstanding role in recent years in documenting horrific abuses by governments which buy tailored exploits of zero-day vulnerabilities from corporations such as Gamma International and Hacking Team.

Unfortunately, several current USG proposals threaten security research such as that performed so well by Citizen Labs.

One proposal before the US Congress should sound familiar to veterans of Crypto Wars I: some members want to criminalize cybersecurity auditing tools such as airodump-ng (included in Tails):

http://thehill.com/policy/cybersecurity/263650-lawmakers-revolt-over-an…
Lawmakers revolt over anti-hacking regs
Katie Bo Williams
18 Dec 2015

> At issue is the implementation of a little-known international agreement [the Wassenaar Arrangement, a household term in human rights circles] governing export regulations for so-called intrusion software — digital hacking and surveillance tools that the agreement’s crafters were concerned could be used by to crack down on journalists and dissidents.
>
> Security experts have long argued that the arrangement defines “intrusion software” too broadly, effectively outlawing the export of legitimate tools that companies use to test and fortify their own defenses.

Another theme in these proposed bills is familiar from the CISA fiasco--- a bill which was nominally intended to address the horrendous state of USG/corporate cybersecurity, but which actually does nothing to improve cybersecurity, while giving NSA even more dragnet surveillance powers. Namely, the new push to redefine software as munitions is nominally intended to curtail companies like Gamma International from selling to the most brutal regimes on the planet, but actually does nothing to do that, and instead would criminalize legitimate security research.

A poster just mentioned, somewhere in this blog, security researcher and staunch Tor "asset" Jacob Appelbaum, who played a key role in exposing the NSA/ANT catalog which another poster just mentioned somewhere else in this blog:

http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-…
hopping for Spy Gear: Catalog Advertises NSA Toolbox
Jacob Appelbaum, Judith Horchert and Christian Stöcker

Yesterday, Juniper Networks, a major provider of commercial firewalls and routers, announced that it has discovered what it delicately calls "unauthorized code" in several of its products. As Dan Goodin was quick to point out at Ars, this may well represent the NSA/ANT FEEDTROUGH malware uncovered by Appelbaum et al:

http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-fi…
“Unauthorized code” in Juniper firewalls decrypts encrypted VPN traffic
Backdoor in NetScreen firewalls gives attackers admin access, VPN decrypt ability.
Dan Goodin
17 Dec 2015

> [the] article published by Der Spiegel reported that an NSA operation known as FEEDTROUGH worked against Juniper firewalls and gave the agency persistent backdoor access.
>
> "This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers," the article reported. "Thanks to FEEDTROUGH, these implants can, by design, even survive 'across reboots and software upgrades.' In this way, US government spies can secure themselves a permanent presence in computer networks. The catalog states that FEEDTROUGH 'has been deployed on many target platforms.'"

As you know, a major issue here is that US military returning from active conflict zones often become police officers, and frequently want to continue to use the surveillance tools which they previously used against overseas "terror suspects":

https://theintercept.com/2015/12/17/a-secret-catalogue-of-government-ge…
2015-12-17T17:23:15+00:00

> THE INTERCEPT HAS OBTAINED a secret, internal U.S. government catalogue of dozens of cellphone surveillance devices used by the military and by intelligence agencies. The document, thick with previously undisclosed information, also offers rare insight into the spying capabilities of federal law enforcement and local police inside the United States.
>
> The catalogue includes details on the Stingray, a well-known brand of surveillance gear, as well as Boeing “dirt boxes” and dozens of more obscure devices that can be mounted on vehicles, drones, and piloted aircraft. Some are designed to be used at static locations, while others can be discreetly carried by an individual. They have names like Cyberhawk, Yellowstone, Blackfin, Maximus, Cyclone, and Spartacus. Within the catalogue, the NSA is listed as the vendor of one device, while another was developed for use by the CIA, and another was developed for a special forces requirement. Nearly a third of the entries focus on equipment that seems to have never been described in public before.
>
> The Intercept obtained the catalogue from a source within the intelligence community concerned about the militarization of domestic law enforcement.

A related potential threat to Tails and other tools which by default partially spoof the unique machine ID of a laptop or other device running Tails: several bills being introduced in the US Congress (similar bills are being introduced in the EU) would criminalize anyone using "multiple devices", which could criminalize using Tails (without disabling the anonymization unique identifier spoofing feature). Indeed, given NSA's history of creative Top Secret redefinitions of words to mean whatever they want them to mean, "multiple devices" could perhaps ultimately be secretly reinterpreted to mean anyone who uses any Tor circuits (which involve multiple nodes), or maybe even anyone who uses the Internet ("anything which is not expressly forbidden to NSA is regarded as permissible"):

http://thehill.com/policy/cybersecurity/262918-gop-bolster-surveillance…
GOP: Bolster surveillance in wake of attacks
Jordain Carney
11 Dec 2015

> A trio of freshman Senate Republicans, including one White House contender, is trying to up pressure on Congress to pass new surveillance legislation, saying it's needed to defeat "radical Islamic jihadism" after a string of recent attacks.
> ...
> [Rubio's bill] would also make permanent two other provisions of the NSA reform bill tied to "lone wolf" suspects and those who use multiple devices, as well as a portion of the Foreign Intelligence Surveillance Act that allows the NSA to collect vast amounts of information about Americans’ and foreigners’ behavior on the Internet, which is set to expire in 2017.

Another potential danger to Tor users may come from the increasingly common practice of US LEA agents buying malware and spy gear "off the shelf". Some of these tech savvy agents have even gone into business to sell spy gear built on top of some of the same open source tools we all use every day:

http://www.theregister.co.uk/2015/09/09/us_police_search_stolen_kit_by_…
US cop goes war-driving to find stolen gear by MAC address
Richard Chirgwin
9 Sep 2015

> In a move that opens up a whole new world of "swatting," Iowa City's The Gazette reports that city [police] officer David Schwindt has created software to go war-driving for MAC addresses.
>
> He calls the software L8NT (oh, "latent," l33t-speak from a policeman no less), and with a suitable antenna, it will try to match any MAC addresses it encounters with "known stolen goods."
>
> Schwindt acknowledges that people might not have ever noticed the MAC address of their laptop, desktop, tablet, mobile phone, refrigerator, smart TV, or broadband router. Of course, if the Wi-Fi is turned off or the device is powered down, it's not going to be visible.
>
> The Register notes that while MAC addresses are assigned on a unique basis by the IEEE, they're no longer immutable, meaning any tech-savvy crook with time to spare can hide the provenance of stolen goods. Then there's ploys like Apple's decision to randomly change iThings' MAC addresses, which Cupertino implemented in iOS 8 as a way to make it harder to identify devices connecting to public WiFi networks.
>
> Schwindt promises that his software doesn't look for any personally sensitive information while it's scanning for contraband MAC addresses, but could create another problem if a malefactor with the right information created a new "swatting" attack by entering a target's home gateway via the nearly-always-unchanged default password, then giving it a MAC address that will interest the police.

Swatting is a real phenomenon, and a very dangerous one, as Linux security guru Brian Krebs can testify. LEA induced swatting would be a novel and particularly ugly twist on this kind of potentially deadly "prank".

Far more expensive (and dangerous) tools such as Stingrays are being bought "under the radar" by police unions and public-private partnerships which claim exemption from FOIA laws, rather than by police departments themselves. This is nothing less that money-laundering by LEAs.

A closely related issue is the rapid growth of vigilantes who are adopting technology to pursue people they identify as fitting some objectionable "signature". One problem here is that such vigilantes are no less likely to dox entirely innocent people than are the pros when it comes to dragnet surveillance:

http://www.theregister.co.uk/2015/12/01/gchq_v_privacy_international_bu…
GCHQ can hack your systems at will – thanks to 'soft touch' oversight
Privacy International battle exposes 'bulk' warrants
1 Dec 2015
Alexander J Martin

> The "soft touch" oversight regime for GCHQ's offensive hacking activities has been revealed during an IPT hearing, which has received two sets of complaints to hear over the course of this week – one from Privacy International, and one from an international coalition of internet and communications service providers which Privacy International assisted.
>
> The complaints regard the offensive hacking, or computer network exploitation (CNE) activities, of GCHQ, which are alleged to have been unlawful under the Computer Misuse Act 1990, as well as in violation of Articles 8 and 10 of the European Convention on Human Rights. The agency denies the allegations

One of the worst problems with FVEY dragnets, especially in the UK, is that these are subject to little real external oversight. But vigilantes are subject to no oversight whatever.

What could go wrong? Consider for example the advent of ubiquitous microdrones, bearing in mind the fact that in the US, anyone can fly a camera or taser-equipped or machine shotgun equipped microdrone to within 25 feet of someone they dislike (in the EU the standard is more like a hundred meters):

http://www.slate.com/blogs/future_tense/2015/12/11/drones_can_take_pict…
And Now Drones Can Take Pictures at Night
Justin Peters
11 Dec 2015

> the [Chinese] dronemaker DJI plans to introduce a drone camera that uses thermal imaging to provide visibility in sub-optimal conditions. The Zenmuse XT, developed in conjunction with the imaging company FLIR Systems, basically uses an object’s heat signature the way that normal cameras use visible light: by illuminating the object and allowing the camera to see it. Because an object’s heat signature can be detected in darkness as well as light, thermal photography is ideal for night-vision applications. Basically, night vision is great for finding people who are hiding or otherwise concealed. Rescue workers searching for survivors in, say, an earthquake could use a thermal-imaging drone to find people at night as well as in the daytime. Are you a fleeing criminal seeking to evade the police by hiding in a nearby cornfield? Well, tough luck, pal: The cops’ thermal-imaging drone will quickly blow your cover. Want to always win at hide and seek? Have I got the drone for you!

All that might sound great to the casual reader, but consider the widespread abuse of thermal imagers to track all citizens in US cities experiencing "civil unrest", which has extensively documented by the ACLU, most recently in Baltimore, MD.

Imagine what the OK vigilante described in this story (or an ethically-challenged paparazzo) would do with a thermal-imager equipped DJI drone:

http://arstechnica.com/tech-policy/2015/12/john-and-alleged-prostitute-…
Alleged john, prostitute busted by drone, face criminal charges
Beware the sousveillance state: Anyone can film you in public.
Cyrus Farivar
4 Dec 2015

> An Oklahoma man has received the distinction of being the first "john" in the state to be criminally prosecuted and arrested after being caught in the act by a drone. Local police records show Douglas Blansett, 75, was arrested and released on Thursday. That's according to local anti-prostitution Oklahoma City-based activist and private investigator Brian Bates, who has run JohnTV.com for years, a collection of videos of suspected sex workers and their johns.

Some US vigilante groups are already using popular DJI drones (the most popular models cost under 2000 USD) to create on-line databases offering "mugshots" of persons unfortunate enough to be homeless (or to be mistaken for homeless persons):

http://www.salon.com/2015/08/27/what_some_of_the_richest_people_in_amer…
What some of the richest people in America say about the poor when they think no one is listening
27 Aug 2015

> The group was founded by residents of Murray Hill and Kips Bay, predominantly wealthy neighborhoods on the east side of midtown Manhattan, where buildings have doormen and British-sounding names like the Wilshire, the Sycamore and Windsor Court. On its website the group says its mission is to “improve quality of life and public safety” in the neighborhood; it also runs a closed Facebook group where members post pictures of people they think are homeless.

Other vigilantes (or blackmailers?) are targeting drivers passing through "Red light" areas:

http://arstechnica.com/business/2015/12/new-open-source-license-plate-r…
New software watches for license plates, turning you into Little Brother
Cyrus Farivar
5 Dec 2015

There appears to be, as yet, no US law which would prevent a vigilante from arming his drone with pepper spray or taser devices. Could protesters who show up at Trump rallies be targeted by Trump supporters operating armed drones? It seems not beyond the realm of possibility.

One of the most frustrating aspects of these novel civil liberties issues is that, as the CISA and Wasenaar debacles show, any attempt to get the US Congress to address them intelligently is likely to be traduced by the enemies of privacy and civil liberties into further surveillance bills disguised as anti-vigilante bills.

This all seems to be part of the growing acceptance in governments and even among technologically illiterate ordinary people of the false principle that "surveillance will effectively address any social problem" [sic]. When in fact, the dragnet solves no existing problems, even while introducing new ones. Such as providing new technological tools to government officials who "break bad". Imagine what the cops described in this story might to with a DJI thermal imager equipped consumer microdrone:

http://www.salon.com/2015/12/14/the_terror_behind_daniel_holtzclaw_the_…
The terror behind Daniel Holtzclaw: The horrific truth about police & serial abuse
An Oklahoma City officer has been convicted on dozens of charges of abuse. But he isn't alone
Eesha Pandit
14 Dec 2015

Overall, these novel privacy and civil right problems provide us with a political opportunity even as they present us with unwanted new dangers. The problem is: how can US-based civil liberties groups like Tor Project work within a broken political system, one increasingly veering towards a Chinese-style authoritarian shame-based society, to guarantee that the human rights enshrined in the US Constitution (and various EU and UN documents) are respected in an age of rapidly developing intrusion technologies, while ensuring that attempted legislative fixes are not subverted by our enemies into bills which fail to address the issues they are nominally intended to fix, while granting our enemies even more invasive warrantless dragnet surveillance powers?