Greetings from Tor's New Executive Director

Shari Steele

I am honored to be joining the Tor Project today as the new Executive Director. I've been a big fan of Tor for a long time—ever since I met founders Roger Dingledine and Nick Mathewson in 2004 and learned about the important work they were doing to provide anonymity for online communications. Today Tor is an essential part of the Internet freedom infrastructure. Activists around the world depend on Tor, as do whistleblowers, victims of domestic violence, and regular citizens who care about their privacy.

This incredible team of people has built an amazing organization. I hope to help grow the Tor Project by building a more sustainable infrastructure and a more robust funding base, as well as by achieving greater adoption of Tor products by mainstream Internet users. There's a lot to be done, but I think we'll have fun while working to make the Internet safer and more secure.

I look forward to meeting many of you in the coming weeks and months, and I welcome your ideas and suggestions.

Yours in freedom,
Shari Steele

Tags
community
jobs
leadership
executive director
Anon

Anonymous (not verified) said:

December 11, 2015

Permalink

Shari was the mother of the Electronic Frontier Foundation -- guiding it for 15+ years. This is the best possible outcome for the ED search. Welcome Shari!

Yes! I am very happy with how this ended up. There was a while there in the search process where we were trying to figure out what sort of backup plans might be workable, if we didn't find any great candidates. Then we found Shari, and she'd had some time after finishing the EFF spot to recharge, so the timing worked out really well.

Anon

Anonymous (not verified) said:

December 11, 2015

Permalink

Go Shari! Tor couldn't have hoped for a better leader. A leader that was behind one of the most important digital rights organizations of our time.

Anon

Anonymous (not verified) said:

December 11, 2015

Permalink

Congrats to both Shari and Tor!!! Shari is amazing leader.

meowelcome to the bridge

Hi, Shari Steele. You are welcome!
您好, 莎丽斯蒂尔. 欢迎您!
您好, 莎麗斯蒂爾. 歡迎您!

Please pay more close attention to the internet users inside GFW.
You will be our hero.

Thank you very much!

\m/

Namaste Shari,

Congratulations in your new position. Looking forward to exciting and interesting accomplishments that you no doubt will achieve.

And yes, we shall have fun as well as we make Tor & planet a phenomenal place to inhabit.

WELCOME! Truly, Shari is on the bridge!

Namaste,
imu.

Congrats, Shari! Great news for Tor.

Welcome Shari, and be sure that we will do our best to help you succeed in this role! Thank you for accepting to lead Tor!

I hope you save everyone because...

"Former CIA director: ‘We kill people based on metadata’ "
https://www.rt.com/usa/158460-cia-director-metadata-kill-people/

I'm still shocked at the audacity of some of the people involved in these huge government over-reaches. The one that I'm still upset about, from last year that I think not enough people noticed, was the "number of acceptable collateral murders for each person they wanted to kill with a drone strike" chart.

Tor isn't going to be able to fix all of the world's problems by itself -- not even all of the world's civil liberties problems. That's why it's key that we continue to be part of a larger ecosystem of great projects.

> I'm still shocked at the audacity of some of the people involved in these huge government over-reaches.

Another very important argument against encryption backdoors is that US federal agencies are by no means immune to corruption. DEA and DHS/CPB in particular are said to be riddled with cartel moles, a circumstance which clearly has the US political leadership very worried. The concern is that the few corrupt agents who are caught and convicted very likely represent the tip of a very dangerous iceberg:

http://motherboard.vice.com/read/there-might-still-be-crooked-cops-from…
There Might Still Be Crooked Cops from the Silk Road Investigation
Sarah Jeong
14 Dec 2015

> Former DEA agent Carl Mark Force was sentenced to six and a half years, and former Secret Service agent Shaun Bridges was sentenced to five years and eleven months. Their crimes were numerous: they stole bitcoin, compromised investigations, and Bridges even set up a cooperating witness for a theft that the agent himself committed, leading to Silk Road leader Ross Ulbricht, aka the Dread Pirate Roberts, issuing a hit on the witness. But Force and Bridges probably weren’t the only corrupt cops inside the Silk Road Task Force.

Long live TOR!

warm welcome <3

Thank you for the great news Torproject. Welcome Shari!

congrats on the new ceo!

curious to what you people think about shari's husband called 'Bill Vass' who has been openly associated with NSA etc. for years now:
https://en.wikipedia.org/wiki/Bill_Vass

not sure what to think here.

Yes, she was married to him throughout her great career at EFF too, and that wasn't a problem. Good thing we hired Shari, not her husband.

> Good thing we hired Shari, not her husband.

@ arma: speaking of spouses, let me try again to clarify something. Please believe that I am not trying to criticize anyone's character here, but to make a potentially useful suggestion (which also has some potential drawbacks):

I don't particularly care who Rachel is married to. I *do* care that she knows about stylometry. For this reason, I don't want her "working for DARPA" (well, doing academic research funded by DARPA grants), I want her to work for Tor Project.

One potential problem is that this proposal would raise the nepotism issue--- very awkward since I like to remind Tor users of NSA's infinitely nastier nepotism problem (Teresa and James Shea).

Lots of people in the technology field have at some point had some relationship with USG, even with DOD or spooky agencies. This certainly does seem to be a recurrent theme for Tor's leadership, which just raised the issue itself by announcing a matching fund drive from Rob Thomas of Cymru/Dragon.

However, one point to bear in mind is that working for DOD or even NSA for some time decades ago is a very different thing from recent work, because the entire USG has since 9/11 gone so far in adopting authoritarian and even fascistic notions of governance. In particular, the Pentagon ties of Bill Vass appear to be decades old. Much more recent apparent links between Rob Thomas and the most lethal enemy of Tor are a much more serious concern. I look forward to reading in this space Thomas's forthcoming (yes?) complete disclosure and frank explanation of the apparent contradiction between his matching drive and Cymru/Dragon's work with USG.

@ Shari: you certainly seem to be experiencing a baptism of fire in your new job! One of Roger's most admirable characteristics has been that he tends to keep his cool. His reaction to legitimate question about Rachel's work for DARPA on stylometry was an unfortunate exception. In my view, a carefully written but honest explanation in the Tor blog from Rachel, Rob Thomas themselves, and maybe even Bill Vass, would be the most effective way to avoid something the enemies of Tor want to create, a division between Tor users and the Project leadership.

Excellent ED hire Torians!

we are honored too.
do you plan removing the observatory feature ?
do you plan removing the http option (default) for an only https feature?
do you plan removing the windows tor-bundle ?
do you plan adding calomel addon ?
do you plan opening library-tor-relays in america, eu, russia, africa australia and not only for us/spanish books ?
do you plan adding on this blog (tor-blog) a box with three negatives options -spam/troll/off-topic - that the users can give their negatives opinions about the quality of the posts ?

Gosh. These are quite detailed questions -- an interesting choice of priorities. :)

For the first four, those look like Tor Browser development and strategy questions. Shari is not replacing the Tor Browser team -- you should go ask them what they think of those.

For the library Tor relay question, that one is best directed towards Alison, who is doing great work on evangelism and education around libraries, privacy, and freedom. I believe if all goes well she's going to have a cameo in the "State of the Onion" talk in Hamburg this year, so she can update everybody on her latest work.

And for the blog usability question, I would say this blog platform is held together by duct tape, but even the duct tape is showing its wear. We have been moving forward with plans to replace it, but I don't think they're as high priority as some of the other things I'm excited for our new execdir to come in and help with.

Welcome Shari !!

welcome :3

Good news. Hope looking into the possible banning of TOR in France and other countries will be high on the priority list, TOR is not just terrorists and pedos like the media pretends!.

Speaking of the France thing, I enjoyed the opinion piece by the fine people at Access:

http://www.dailydot.com/opinion/france-ban-tor-anonymity-threat-real/

yes but the article is oriented in a tor propaganda : no value.

"and regular citizens who care about their privacy"
=> Last but definitely not least. Strength in number, every single casual John Doe using the network makes the network stronger.

Otherwise, as everyone already said, welcome too :)

Yes indeed! The diversity of *types* of users is as key as the number of users. The more types of users we have, the more normal it is to be seen as a Tor user.

Hello Im happy to see your happy

How do you make STARTPAGE your default Tor search engine?

This is actually just a Firefox question. So, however you do it in Firefox.

(I tried clicking on the little magnifying glass in the search box, and it gave me a "change search settings" option. That looks promising!)

Doesn't seem to add.

https://addons.mozilla.org/en-US/firefox/addon/startpage-https-privacy-…

Please release an easy to use GUI based Windows client. There used to be one, and it wasn't stable... then you discontinued it... probably for good reason. Now for an updated easy to use client on the world's most popular platform.

Tor on Windows provides false sense of security and weakens security of the Tor network. Tor relays on Windows OS is bad for security of the Tor network, and Tor on Windows provides false sense of security to its users since Windows spies on everything and reports it all. We need to ban Tor on Windows so Windows users do not continue having a false sense of security and to also promote the move away from Windows to more secure systems.

Or at the very least, do not allow Windows computers to operate as a node, and on the Windows versions have a big warning that reads "WARNING: You are using a Windows computer which renders Tor useless at maintaining your privacy since your operating system is spyware. It is recommended to move to a Linux/Unix operating system"

About Tor relays on Windows I don't know, but banning Tor clients on Windows wouldn't make sense: as previously posted, the more people use it the better, because it makes every user one among a larger crowd.
Even if the security of those Windows users isn't optimal, it's not a problem if they don't actually need a superb security, and it grows the crowd which is a good thing for those who really do need optimal security.

Welcome :o)

Welcome Shari. Great to see you are settling into your new position nicely. I really look forward to watching where you take the Tor project to next. Best of luck for the coming months and beyond, and hope you have a splendid new year.

This is a suggestion I've made elsewhere but is it possible to make tor messenger users operate a relay node by default? So everyone enjoying the benefit of the IM is also "strengthening the network" as per above commenter?

I understand mobile is a different kettle of fish entirely but could we one day see a downloadable tor message app where the average pleb can not only use the IM functionality but contribute a node without needing any expertise to do so?

Back on topic - seems like a great hire, well done

Welcome!!!!!!!!!!!!!!!!!!!!!!!

Welcome! In recent statements you have alluded to not wanting to step on the toes of EFF in your new role at Tor. While I agree that Tor's main task is to provide tools, I believe that only through effective and public defense of the ideas of privacy and security will you see the mass adoption needed to make the tools useful in the first place.

Do the human verification captcha before entering various sites inject code into the Tor Browser to intentionally identify you or are you still protected behind Tor?

(Part One)

Welcome, congratulations and felicitations!

Roger has no doubt warned you that the Tor user base can be rather demanding, and I want to waste no time in proving that this is no exaggeration!

Roger just said something very important which bears repeating:

> Tor is part of a larger family of civil liberties organizations, and this move makes it clear that Tor is a main figure in that family.

I completely agree, and I believe that at a time when all the Western governments have apparently made a concerted sharp turn towards authoritarianism--- even fascism--- the biggest threat to the continued existence of the Project may be political or legal. Which is not to deny the gravity of the ever more diverse and sophisticated technical attacks which the Project will face in coming years.

For this reason, over the next few years I believe that the highest priority tasks for the leadership of the Tor Project are

o building even closer relationships with other civil liberties and humanitarian organizations (EFF, ACLU, RSF, MSF) and key technology NGOs (Citizen Labs, Debian, Tails, OSF),

o being always available to the most influential tech reporters as a source of apposite quotes responding to political attacks on Tor, crypto, etc.; this requires building personal relations and also following closely news stories (especially ones written by those same reporters),

o working with US legislative staff to ensure that as Executive Director of the Tor Project, you are invited to give testimony rebutting that from people such as FBI Director James Comey,

o working with other civil liberties groups and with STEM (Science, Technology, Engineering, Math/stat) professional organizations and US/EU universities to construct boycotts of NSA/DARPA/IARPA/GCHQ, and to craft Codes of Conduct for research on social media and communities such as Tor users, based upon the example of IRBs (but note that this requires simultaneously campaigning to oppose the dismantling of IRBs for medical research in the US threatened by numerous bills now before the US Congress),

o working with other civil liberties groups to encourage serious journalists to expose the most important post-Snowden story; to wit, thanks to Snowden, we know that FVEY is trying to steal everyone's lives/data exhaust, but too few people understand what they plan to do with our data exhaust: to use Bayesian predictive analysis (think IBM Watson) applied to Big Data troves to assign everyone individual citizenship scores, for such purposes as CVE programs currently being ramped up by US and EU governments, programs which specifically target youngsters aged 3-7 for scoring, suasion, and even such drastic interventions as removing children from their home.

That said, in the end Tor cannot exist without energetic and determined devs, and in coming years Tor will clearly need to enlarge the circle of critical developers. So keeping them happy and recruiting fresh blood must have a very high priority. I agree with a strategy I think I see the Project pursuing here, which acknowledges that Tor cannot match Google salaries, but leverages the fact that many people want to do challenging work which will really help a very large number of people, as opposed to simply trying to strike it rich (and the Project wouldn't want to employ people like that anyway--- they're too bribeable).

Tor Project is growing and must grow, and growth always presents problems which the Executive Director must track and ameliorate. One useful general strategy here (and I think Roger would agree) might be to adopt a modular philosophy, in which one continually re-evaluates political/technical goals of subprojects, taking account of the people involved and whom they work best with, to try to ensure that if some subproject becomes useful to many projects outside Tor, it can perhaps be split off into a new NGO, if that would be useful, or at least given freedom to expand gracefully inside Tor Project if not.

Fixing vulnerabilities as they are uncovered must always have a very high priority, of course. Here, urgent problems for the devs probably arrive according to a Poisson distribution, i.e. they tend to cluster. That's just in the nature of how these things work. The Project must continue to be able to take crises in its stride, without letting a bad stretch of serious bugs derail its longer term projects.

In particular, the Project must continue to try to see that further critical R&D gets done, whether as part of Tor Project or in a sister organization, for example

+ continuing research on GFC, SORM, and other censorship/surveillance technologies,

+ research to counter "out of band" deanonymization attacks such as Stylometry (a very hard problem, but I think that some far from useless technical countermeasures would be easy if time-consuming to achieve),

+ research to try to solve or ameliorate untoward consequences of core design decisions in current Tor, such as the most dangerous traffic correlation attacks (also a very hard problem, a fact which should be attractive to the right kind of researcher),

+ projects to develop and market low-cost countermeasures to hardware woes (such as more secure routers for ordinary people, working with industry to provide properly signed firmware upgrades for linux-friendly routers, "Faraday cage" bags, wide frequency scanners leveraging software-designed radio to search for suspicious RF transmissions),

+ providing encouragement to innovators with wild ideas (using drones and/or low power transmitters to build a grassroots open/free alternative to the existing internet, retroflector screens, TEMPEST countermeasures, etc), while gently discouraging obviously ill-advised schemes (e.g. dubious "Tor in a box" schemes).

(Part Two)

Over the next few months, I believe that the most urgent task for the Tor leadership is to join with other civil liberties groups in mobilizing the Tor userbase to speak out against attempts in the US and EU countries to exploit political hysteria to legislatively mandate backdoors in civilian encryption, "split keys" (see Shamir's Secret Sharing Scheme for example), "key escrow", or other "unicorns" being demanded by James Comey ("if unicorns don't exist, Silicon Valley must create them"). Here I think the most effective countermeasures may include:

o being ready with carefully crafted quotes when reporters call after the FBI's PR machine seeks to exploit each new "kinetic outrage" (e.g. San Bernardino, Bataclan), major cybercrime incidents, etc., to attack TM, TB, Tor, and encryption generally (analogies can be very effective),

o working with ACLU, EFF, EPIC, etc., to help journalists understand how medical privacy provides an example everyone can understand of why strong non-broken (backdoored) crypto is essential to protect ordinary citizens from very serious harm,

o working with ACLU, EFF to help journalists explain the four worst mathematical fallacies which underlie the Dragnet ("if we collect it all, we can use Big Data analysis to extract all those elusive needles" [sic]):

+ "prosecutor's fallacy": confusing Pr(E|H) with Pr(H|E); a nice concrete example uses E = person is male/female, H = person is color blind,

+ "base rate fallacy": even a "highly accurate test" for some specific condition or potential future event will flag mostly innocents when used dragnet style to try to predict rare conditions or rare events (e.g. to identify which Americans have some undiagnosed rare cancer, or which children aged 3-7 will in future commit some rare act such as a mass shooting)--- ask Roger about this!,

+ "creationist's fallacy": treating events which are not statistically independent as if they were, leading to multiplying lots of probabilities and coming up with an absurdly tiny probability that, for example, someone with a low citizenship score has been unjustly tainted in a "judgment by algorithm" (in the case of "naive Bayes" it requires further mathematical analysis to explain why claims that these errors "wash out" in CVE but not medical applications are fallacious),

+ "Simpson's paradox": a simple argument showing how "drilling down" into huge data sets is as likely to lead to greater confusion than to greater insight; a classic example shows with real data how a hypothetical just prosecutor in a death penalty case could repeatedly reverse her previous conclusions using the statistical analysis of multidimensional contingency tables as further variables are added,

(all of these points are related to the broader issue of criminal justice reform and concern about the fact that forensic "science" [sic] is in fact almost entirely pseudoscience founded upon serious misconceptions such as the four just outlined.

I might also mention the (counter-intuitive?) fact that probabilities and "preferences" are not transitive, so A > B, B > C, C > A are possible. This awkward fact is usually concealed from decision makers who are being pitched some computerized tool which allegedly can make hard decisions better than humans can.