Study: What is the value of anonymous communication?

Strong work. Go, Dragons!

Dear Andrea and Rachel:

You didn't say it, so with your permission, I will:

Published research studies which tend to

* debunk the Comey/Putin narrative ("All Tor users are current or future cybercriminals"),

* present a positive view of Tor (as a tool used to create good things for other people everywhere),

are desirable because they can

* help to make Tor more mainstream, and thus harder for Comey/Putin to destroy,

* assist Tor's fund-raisers in quelling fears from potential non-USG funding sources that they might be prosecuted by the US DOJ for abetting "terrorism".

But there are potential dangers also and I think it is crucial that potential participants in your survey be aware of these, and that you (the researchers) attempt to pro-actively address them.

When researchers issue such appeals I think it is critically important to be fully transparent about who is funding the research, and how potentially dangerous raw survey data will stored, controlled, and divulged (or not) to third parties.

Some questions you should address: could FBI secretly obtain names and addresses of participants by issuing to Drexel U an NSL? Could the researchers be subpoenaed by the Grand Jury impaneled in Eastern District of Virginia which is rumored to be searching for the "second leaker"? How does present (rapidly expanding) or possible future "information sharing" among US agencies affect the privacy of the raw data for your survey? If the raw data is stored long term (perhaps at a journal's website, in order to enable other researchers to verify your statistical analysis), could it not become subject to future mandatory sharing requirements which we cannot presently anticipate?

Bearing in mind

* recent comments from FBI Director Comey about Tor and encrypted communications,

* multiple attacks on Tor users (especially, users of at least some Tor hidden services) from FBI and the Dutch National Police, which have been extensively discussed in this blog,

* multiple "academic research" projects which apparently passed identifying data of real Tor users suspected of something or other to FBI,

I believe that a certain level of paranoia about "academic research" on Tor-- even when conducted by well disposed researchers-- is amply justified.

Please recall that well intentioned NIST employees trusted NSA employees whom they thought they knew well, which turned out to be a terrible mistake which potentially endangered all users of citizen crypto. I don't want the same thing to happen with Tor.

Further, as some have pointed out on tor-talk, the aforementioned academic research which aimed to "out" real Tor users featured a notable absence of any known institutional review board (IRB) proceedings, as would otherwise be customary for studies on human subjects. Has your survey been approved by Drexel's IRB?

To repeat: I don't question your intentions, for which Roger has vouched. (I concede that if Tor users can't trust Roger, they can't trust anyone-- see above for some hints about why some of us feel that some degree of paranoia is plainly appropriate for Tor users.) But I am worried that you might not appreciate how you research might be abused by certain parts of the USG whose intentions are not so nice.

The USIC has an intense and growing interest in identifying Tor users and understanding how we might use Tor to threaten "US national interests", or to put it more plainly, the self-interest of the US political/financial elite. This interest is plain to see in a vast research program, employing among other means seemingly innocuous "surveys" such as your proposed Tor survey.

I would be much happier if I knew that you are both well aware of the scope of a massive USG effort to identity and tag alleged potential future "Enemies of the State", focusing on (predictably)

* Somali immigrants,

* returning and possibly embittered US military veterans,

* members of SPLC enumerated "hate groups",

* suspected anarchists,

* Tea party members,

* persons with extraordinary software skills,

* suspected Snowden sympathizers,

* suspected "radical environmentalists" (PETA, etc),

* Occupy organizers,

* communists,

and (here's the shocker)

* American children as young as 3-7.

I echo recent urgent appeal from The Intercept asking for leaks of more documents related to the vast CVE (Countering Violent Extremism) effort from NCTC; see

https://firstlook.org/theintercept/2015/02/09/government-develops-quest…
Is Your Child a Terrorist? U.S. Government Questionnaire Rates Families at Risk for Extremism
Murtaza Hussain, Cora Currier, and Jana Winter
9 Feb 2015

Possible leakers include social workers, ER doctors, school principals, kindergarten and primary school teachers. (I wish I were joking, but sadly, I am not.) People in these fields who work in Boston, Minneapolis, Los Angeles, and some other areas have already received NCTC sponsored questionnaires similar to the one published by The Intercept, and the public needs to know about these horrifying documents. Some of the surveys or questionnaires may carry the emblem of NIH or CDC (Centers for Disease Control) but don't be fooled: the agency which is behind this effort is NCTC.

The fact is that NCTC/USIC has become convinced that "terrorism" defined broadly can be understood in epidemiological terms, as an infectious disease.

Talk to a PETA "tabler" on your campus? Then you've been "exposed" to animal rights activism, and must be monitored, or even quarantined, lest you in turn infect others.

Some of the groups targeted by NCTC are predictable from past episodes of government hysteria: Somali refugees are the explicit focus of the research of people like John Horgan

https://en.wikipedia.org/wiki/John_Horgan_%28political_psychologist%29

and also appear to be targeted by the NCTC CVE document cited above.

But the biggest and must vulnerable group has never before been regarded by the USG as "potential Enemies of the State" [sic]: American children, all of them, of ages ranging from 3 to 7.

The NCTC's rationale for identifying and monitoring (over an almost always peaceful and uneventful lifetime) of "potential future problem persons" is this: NCTC and other parts of USG are convinced that ACE (Adverse Childhood Experiences) are a reliable predictor of who will become:

* a terrorist, "school shooter", or garden variety criminal,

* a blogger expressing views which challenge the political elite,

* a participant in hypothetical future mass street protests,

* a future financial burden on the state,

* etc.

Such surveys have been conducted in the recent past by companies such as ICF International. The Wikipedia article

https://en.wikipedia.org/wiki/ICF_International

has been bowdlerized, but until recently ICF's home page boasted of their lucrative USIC contracts. Less well known is their contract with the UN, which allows them to conduct "health research" in countries including Pakistan, Iran, and North Korea. No kidding. Their Pakistan subsidiary is named in the official report as being implicated in the fake vaccine campaign run by Dr. Afridi in Abbottabad for the CIA, whose sole purpose was to obtain blood samples from children living in the household of a mystery man who turned out to be Bin Laden. This episode was an particularly pointed example of how "medical research" can be perverted to harm people.

If you are unconcerned by state-sponsored extra-judicial assassination of bad people such as Bin Laden, please consult the ACLU for the ultimate danger to good people which seems to invariably result when good people allow governments to act unjustly toward bad people. Also please note that we should resist easy acceptance of the premise that his young children whom the US Special Forces assault exposed to mortal danger are themselves doomed to become terrorists if not thwarted. And I should stress the fact that, simply because they were directly exposed to gun violence in the Abbottabad raid, they would be tagged by NCTC's dragnet even without their genealogy, just like innocent youngsters in cities like Damascus (or Baltimore).

(As you know, Seymour Hersh just published an article claiming that top Pakistani intelligence officials had been keeping Bin Laden out of view. The version I heard at the time differs slightly: the Pakistani political leadership was kept in the dark, and Bin Laden himself was not aware that at least one high ranking Pakistani intelligence official knew exactly where he was living.)

The War on US has become a war on our *children*. Is this, at long last, the point where the People will finally cry, "Enough!?"

I'd like to end by asking you to ask yourselves how your research might fit into the ever growing surveillance-industrial complex; please see

http://www.salon.com/2015/05/16/the_dwight_eisenhower_lesson_america_fo…

for a recent passionate critique by a former US military officer who is apparently just as horrified as I am by the rampant militarization of American society, to the extent that pacifists are being progressively dehumanized by state-sponsored propaganda organs.

This post is another attempt by myself to open a dialog with Roger, Rachel, Nick and others closely associated with Tor about the persistent and ever more troubling issues raised by accepting USG funding, certainly from DARPA but also even from allegedly "innocuous" sources such as NSF, NIH, CDC, which may simply cover for NCTC or USIC. I hope the moderator will accept in the spirit of dialog. IMO, in the discussion of complex and politically charged topics, Tor Project should always prefer argument to censorship.

@arma what ever happened with that study of relays with all the scapy data?

also i support the idea behind this study, but offering Tor users Amazon gift cards and Skype credits--I mean...Skype credits???!?!!--makes me question whether these people understand the population they're trying to study.

I would be eager to participate, but the idea of someone purchasing credits for a service widely known to be backdoored to compensate me for participating makes me feel gross. I'd like to suggest these profs offer participants bitcoins instead, or at least the option to have them donate $20 back to the Jitsi people or The Tor Project or EFF or something that's less diametrically opposed to users' interests.

offering skype credits for giving up your personal information?

what does this has to do with tor?

i hope that the researchers at least acknowledge the bias in the answers to their questions, as in "no privacy conscious tor user would fill this out or no privacy conscious tor user could be bought off by offering skype credits to them" (which i guess is lot of tor users).

As others have pointed out:

1. Title of research study
Privacy, Anonymity and Peer Production

We offer the option to reimburse you with $20 for your help and time. If you choose to be reimbursed, we will send you an Amazon gift card or Skype credit (whichever you choose) in the amount of $20 and you will be asked to email us the confirmation number or sign a receipt

All three methods facilitate a loss of Privacy, Anonymity and Peer Production.

Bitcoin is a much better solution.

I use Tor, but I value my privacy more than a trackable $20

Can non-US-persons also participate in this study?

"We believe we can learn important things from you about how people achieve privacy online"

Our comments to this blog (although public) are more anonymous than the methods proposed for this study.

(quoted from the consent form) You will be asked to read through the consent form and ask questions or share concerns, if any.
We will set a time that is convenient for you to do the interview.
We will decide on the means of doing the interview. This could be online or on Drexel’s campus.
We will talk to you about your privacy practices for 30-90 minutes.
With your permission, we will voice-record the interview. We might quote you in our research paper; however, if we do use any of your words in our paper, we will remove all identifying information. We are serious about your privacy and we will take care that no identifiable information will be used in our report.
We offer the option to reimburse you with $20 for your help and time. If you choose to be reimbursed, we will send you an Amazon gift card or Skype credit (whichever you choose) in the amount of $20 and you will be asked to email us the confirmation number or sign a receipt. If you are local, we can reimburse you in cash in the amount of $20. You do not need to accept payment to participate.

If the research was done using moderated blog comments while using Tor, and the comments were only acknowledged and recorded, but not posted, the objectives could be met, without influencing other people's comments, and without privacy leaks.

"how they write blog posts, edit Wikipedia articles, contribute to open source projects on GitHub, post on discussion forums, comment on news articles, Tweet, write reviews, and many other things."

Me: "I use Tor!"

They: "Hey, you must be one of those super smart hyper creative people. What are doing online."

Me: "Um, I just browse the web".

They: "What was that, you are kidding, right?"

I sent them an email. I told them I don't think I got enough things to share for a full scale interview, but I explained how gmx.com allows people to register email accounts there using only the Tor Browser Bundle. I also mentioned that if they get in contact with GMX(for whatever reason) that they forward that I'm a user that would look forward to pay for any services there if they offered a Bitcoin payment option :)

arma wrote:

> Plenty of Tor users are happy to come forward as Tor users and talk about themselves. If you super duper need to stay anonymous at all times, I suggest not participating in (this round of) the study.

But this introduces an explicit bias into the study, which will reflect only the self-reported habits of self-reported Tor users who desire a twenty dollar gift card so badly that they will happily self-report on their activities while using Tor.

Or are you saying that the Project should simply ignore the needs of anyone who "super duper needs to stay anonymous"?

And is it not.. unseemly.. when the Exec Dir of the Tor Project almost seems to be poking fun at people who feel a need to remain anonymous?

I don't want readers of this blog to be left with the impression that someone at Tor might decide that some Tor users "really need to be anonymous" (critics of Putin?) and some "do not really need to be anonymous" [sic] (critics of Comey?).

What kind of people use Tor?

Here's one answer: people who are determined to change "how things are done in our society".

Anonymous writings are all about challenging the existing power structure. Tha was true in 1775, and it remains true today.

I hope that this episode has been a learning experience, that you will abandon the present study, think hard, read a lot, and come back when you have a much better plan for conducting research which might ultimately result in good things for The People rather than the government.

Research is not necessarily a bad idea, but when you are surveying Tor users, for reasons which should be obvious, you can't mindlessly follow the USG information sharing play book for "how surveys are done in our society".

Not sure if this has been posted before but Firefox users using Tor should be aware of the WebRTC vulnerability which affects recent versions of Firefox.

>The researchers want to investigate the ways in which various limits,
>like CAPTCHAs, or even blocking access to sites entirely, inhibit or
>don’t inhibit Tor users’ ability to create things online.

my first thought was, that this might result in a cookbook for those
parties that want to force their suspect people to not look at other
(independent ?) sources of information.

And this is what I do still think now.

greetings

PS: a bonus of $20 for the participants is a nice idea. But would it be
feasible for people who REALLY NEED the help of tor for not being put
into gulags or tortured to death.

"Information is power." Gordon GeKKo

Andrea here - apologies if this appears twice, posting from a bus with unreliable internet.

To clarify what is meant by identifying information- that's stories someone might tell in an interview that would be recognizable to people who know them. We don't collect names or save information like email addresses with our data. The only exception to this is, in order to provide compensation, the university requires a paper trail. To work around this we inserted language to make it clear that people can decline payment and still contribute to the research. We also discussed the Google problem and included options to return the form using alternate methods. Again, this is because we are required to obtain documentation some way or another and we are trying to provide options that allow people to mask their identities. In general I agree with you all, these are work arounds, not optimal solutions. Thanks for the suggestion of allowing contributions in lieu of payment - I've had a number of discussions with people about this and other recommendations. Tor users have been great to talk to.

> this is because we are required to obtain documentation some way or another and we are trying to provide options that allow people to mask their identities

You simply cannot let your sponsor dictate how you will run your study. Clearly you need to abandon this study, find another sponsor, and think through the privacy issues. Then maybe put out a pre-proposal and request comments here, since users may point out further issues you missed.

Andrea et al.: you and other academic researchers running "social science" studies or surveys on living human subjects simply cannot continue to follow the USG's play book.

Tor is or ought to be all about breaking down barriers to citizen participation, not about enabling USG to conduct business as usual.

“By understanding the contributions that Tor users make, we can help make a case for the value of anonymity online”

Really? Make a case? Why?