Monday, January 12, 2015

Tor Majority Use is Criminal

After reading Pierluigi Paganini's article on Hacking the Tor Network: Follow up [http://resources.infosecinstitute.com/hacking-tor-network-follow/]  and 83 Percent of Tor hidden service traffic flowed to Pedo websites. Study finds            [http://securityaffairs.co/wordpress/31690/cyber-crime/pedo-websites-tor-network.html ],  I started to wonder if Tor was something other than what it appears.  It always looked like a good service that prevented bad people from getting information about me from some of those connections I was making to Chinese and Russian websites.  Now it turns out, I was in the minority of people using Tor for legitimate research.  Most of them were looking for child porn and drugs.  It is almost like discovering that most people go to the supermarket to have an orgy, and you are going for groceries.  
That smile didn't mean the bread was fresh, after all.  

Tor is really just a small part of the Internet, and nobody would argue that the Internet was a criminal enterprise because so many people use it for criminal purposes.  But, if we were to find out that 83% of the users of the Internet were using it for criminal purposes, we might have a different feeling about it.  We might even look towards regulation or policing, at least that part that we control.  We could equally look towards finding out where those criminals are and try to prosecute them.  That hasn't worked out very well because we have some countries like China and Russia who think their national strategy to steal information from anyone who has it is good policy.  It certainly works for them.  Russia is often accused of being a kleptocracy - an oligarchical government that controls its national resources and funds for its own benefits rather than that of its people.  [for a good discussion of Russia  see Duty: Memoirs of a Secretary at War, by Robert Gates]  We are never going to get rid of their criminal underground.  

Tor is a U.S. based organization [ https://www.torproject.org/about/contact.html.en#mail ]  with mostly good intentions.  Privacy is good.  Anonymity is good, especially when visiting websites that might be located in places trying to take advantage of everyone who goes there.  Other governments, less tolerant of dissent, are equally interested in stopping Tor from operating.  These are all really good reasons for having a service that does what this one does.  But, it still makes me wonder if the enterprise is good if 83% of it is used for criminal purposes.  How far are we willing to go to allow them to continue as a public service organization if a majority of the transactions are criminal?  

The law enforcement community seems willing to allow them to continue and taking advantage of the occasional case that compromises portions of their user database.  Once they get in, as they did in Silk Road 2.0, they can map out the users and find the distributors.  For now, they seem to be content with that strategy.  Maybe the good they do outweighs the bad.  Not very many prosecutors are keen on making value judgements like that, but we shall see if it lasts.  



No comments:

Post a Comment