Holenderski rząd wydał oświadczenie (angielskie tłumaczenie tutaj) w którym poparł stosowanie mocnej kryptografii przez podmioty prywatne i rządowe w celu ochrony bezpieczeństwa danych użytkowników i ochrony prywatności. Podkreślając rosnącą rolę usług elektronicznych w kontaktach pomiędzy państwem, a obywatelami, Holenderskie władze stwierdzają także, że stosowanie odpowiedniego szyfrowania zwiększa także zaufanie do państwa. Holandia planuje bowiem aby do 2017 roku mieszkańcy mogli załatwić wszelkie sprawy związane z administracją rządową przez internet – a ta przetwarza w końcu wrażliwe dane takie jak zeznania podatkowe czy informację o ubezpieczeniu zdrowotnym. Co jednak najbardziej interesujące, oświadczenie odnosi się także do kwestii potencjalnego wprowadzenia obowiązkowych backdoorów w kryptografii stosowanej na terenie kraju lub prawnego ograniczenia możliwości stosowania konkretnych algorytmów.
Zachowanie obecnej partii rządzącej w Polsce, która poprzez próby umniejszenia roli władzy sądowniczej wydaje się zmierzać wszelkimi dostępnymi środkami w stronę rządów autorytarnych, naturalnie nie nastraja pozytywnie co do poszanowania wolności obywatelskich w tej kadencji. Bardzo niepokoi również podejście rządu do służb specjalnych – nagłe i radykalne zmiany kadrowe, a także doświadczenia w funkcjonowaniu służb z okresu 2005-2007 sugerują, że władza może traktować je instrumentalnie. Również do celów związanych z inwigilacją aktywistów i grup nieprzychylnych władzy.
Celem tego postu nie jest jednak gdybanie o tym jak może być, a oraz przedstawienie podstawowych środków które mogą być pomocne w ograniczeniu możliwości.
When one year ago Blackhat presentation during which researches were supposed to show how they successfully conducted deanonymisation attack against Tor was cancelled, speculations gone through the roof. The most probable scenario, which I also supported, was that scientists defied ethical and legal boundaries and effectively committed an offence by conducting illegal interception of internet traffic. Now, motion filled in case of Brian Richard Farrell, owner of SilkRoad 2.0, which describes how Farrell was identified based on “information obtained by a ‘university-based research institute’ ” almost directly suggests that the research results were used in this case and that was the reason for cancelling presentation. Then, speculation concentrated on how come, or if at all, Institutional Review Board (IRB) have green lighted such research. Now, it seems that truth is far more concerning. According to Vice and Tor project, apparently FBI has paid Carnagie Melon University researchers one million dollars for executing newly developed against Tor users and passing gathered data to law enforcement. On the other the university claims that it was forced to hand out the results by subpoena.
Both scenarios seems to be equally troubling in terms of both ethical and legal considerations. First of all, I strongly believe that role of researchers and law enforcement agents has to be strictly separated. This does not mean that academic community has no rule in supporting LEAs’ efforts (through both research in areas of criminology, legal analysis and developing technical means of investigation), however once the actual operations are ongoing, they should be executed be LEOs exclusively. There are many reasons for this. First of all, scientists generally are not required to possess knowledge about criminal procedure required to collect evidence in a way that will ensure they are admissible in court. Second, scientists are not subject to the same level of disciplinary oversight that is (or should be) imposed on the members of law enforcement. Finally, civilians should not be expected to perform tasks (such as interception of traffic) that are only legal when conducted as a part of law enforcement operation.
Furthermore, there are significant problems and considerations in regards to the very process of obtaining evidence in Farrell’s case. If Carnegie Mellon was really forced to hand out research, is it possible that there was a pressure put on IRB to authorise the research? If not, how come research on subjects unable to provide consent was deemed to be acceptable? Does obtaining information from external source of information such as academic institution means that standard procedural safeguards does not apply? How come research conducted was not offence under US law? As long as all those questions remains unanswered, this incident should be a stark warning sign of possible abuses that might result from lack of proper oversight over ‘cooperation’ between law enforcement and academic community.
Some argued that cooperation between Carnegie Mellon and the government should not be surprise to anyone, as Software Engineering Institute is known to be funded by federal government and have ties with the Department of Defense. While this might explain why study was conducted in the first place, and why it produced particular results, it provides no consolation in terms of securing procedural safeguards. Model of obtaining evidence that involves greenlighting research, which is unacceptable from the point of view of scientific ethics, and than claiming the results as “source of information” is certainly very convenient way of bypassing criminal procedure in cases that involve digital anonymity. Let’s not forger that how controversial was FBI’s story of tracking down Ross Ulbricht, owner of the original Silk Road, with some claiming that the Bureau completely made up story that was included in criminal complaint. Furthermore, the very idea of conducting massive deanonymisation operations against suspects who could be outside the US, is not straightforward when it comes to obtaining a warrant.
Involvement of SEI as quasi-governmental entity raises questions about role of CERT’s credibility in terms of they contribution to public cybersecurity as well. The fact that vulnerability was not disclosed to Tor project would indicate that potential usefulness of exploit takes priority over securing the network. While this would be in line with policy of stockpiling zerodays for offensive use, it is not something to be expected from CERT, which claims to work in the interest of community. And if the decision to publish or use particular vulnerability is made on case by case basis, then who makes the decision?
Whether scientists were forced or paid, all these questions stem from a single decision – a decision to blur the line between investigation and science, and outsource evidence gathering to a non law enforcement entity. Consequences of this decision, most importantly how materials gathered will be assessed by court, will be a significant signpost for future collaborations between academics and LEOs.
When David Cameron announced during #WeProtectChildren summit that GCHQ will join forces with National Crime Agency in order to effectively tackle problem of child pornography in Tor he, probably unintentionally, made a rather sweeping statement about role of intelligence agencies in process of fighting crime. GCHQ’s primary function after all is spying on foreign entities and protecting national security of the UK. In fact Intelligence Service Act 1994 names three functions of the agency: mentioned national security with emphasis on foreign and defence policy, economic well-being of the UK (again with emphasis on foreign actors) and in the last place support of the prevention and detection of serious crime. Status of use of the SIGINT in domestic matters is therefore not as obvious as it could be interpreted from Cameron’s words. Even in the UK, which generally have relaxed legal boundaries regarding law enforcement authority, power to authorise interception of communication by GCHQ still lies in the hands of the Secretary of State. Note has to be made that it is not yet clear what will be the form of cooperation between GCHQ and NCA – perhaps GCHQ will provide only technical assistance (i.e. forensic service) without resorting to more aggressive capabilities.
For some types of operations this kind of cooperation is natural – for example counter intelligence efforts most often rely on work of domestic intelligence, or specialised counter intelligence, agencies which disclose gathered materials in the course of court proceedings. However, that is true for intelligence agencies operating within borders of the country by default i.e. MI5 or FBI. The problem is that nowadays governments try to shift, or at least partially redirect, focus of foreign signal intelligence into tackling local threats. This is without a doubt result of use of more sophisticated tools by criminals. It is hard to argue with Cameron’s assessment, that use of Tor requires special efforts from law enforcement as well as use of measures available only to specific entities. At the same time question remains whether already existing regulations keep up with quick changes in actual policy.
Prezentacja dwóch badaczy z uniwersytetu Carnagie-Mellon o sensacyjnym tytule ‘Nie musisz być NSA aby złamać Tora’ już od pierwszych zapowiedzi budziła wiele kontrowersji. Tweet Runy Sandvik który początkowo wydał się być jedynie głosem rozczarowania związanym z brakiem współpracy i wymiany informacji pomiędzy naukowcami, a ekipą Tora okazał się jednak być niemal proroczy gdyż prezentacja została usunięta z grafiku konferencji. Ze zdawkowych na razie informacji wynika, że w sprawę musieli zaangażować się prawnicy uniwersytetu, którzy jak się wydaje zabronili komukolwiek mówienia czegokolwiek. Jedyne co jest pewne to, że prawnicy poinformowali organizatorów BlackHat o braku zgody placówki badawczej na wygłoszenie referatu. Biorąc pod uwagę, że badacze korzystali z zasobów uniwersytetu i prowadzili badania w ramach pracy naukowej uniwersytet może skutecznie zablokować upublicznienie efektów prac.
Jakie mogą być jednak przyczyny takiego obrotu spraw? Tor project zapewnia, że nie wnosili o wyłączenie prezentacji z planu konferencji – apelując jednocześnie o etyczne i odpowiedzialne prowadzenie badań związanych z siecią. Jak na razie najbardziej prawdopodobna wydaję się teoria, iż badacze – zapewne nieumyślnie – popełnili przestępstwo. Jeżeli prowadzili nasłuch sieci bez uzyskania zgody użytkowników (co jest niemal pewne) naruszyli Wiretap Act który zabrania nieuprawnionego przechwytywania komunikacji elektronicznej. Tłumaczyło by to również zdawkowe wyjaśnienia i brak komentarzy ze strony uniwersytetu, którego prawnicy dobrze wiedzą o potencjalnym ryzyko związanym z komentowaniem jakichkolwiek aspektów potencjalnego postępowania karnego. Oczywiście testowanie de facto ataku na sieć komputerową na rzeczywistych użytkownikach, a nie w warunkach laboratoryjnych, zakrawa co najmniej na lekkomyślność. Szczególnie dziwi to w obliczu doświadczenia obu badaczy – trudno uwierzyć, że równie chętnie testowali by np.: exploit umożliwiający zdalny dostęp. Być może odkrycie było tak ekscytujące, że twórcy zapomnieli skonsultować swoich działań z przepisami prawa.
Tak czy inaczej mam nadzieję, że prędzej czy później wyniki przeprowadzonych badań zostaną ujawnione. Wnioskują z opisu dostarczonego przez badaczy, który zakładał użycie łączy o wysokiej przepustowości i długi czas (kilka miesięcy) konieczny do skutecznego ataku. Niektórzy podejrzewają, że atak miał polegać na ustanowieniu kontrolowanych węzłów sieci. Duży transfer sprawiłby, że węzły te byłyby wybierane przez klientów podłączających się do sieci jak ‘entry guards’ które mają zapobiegać ujawnianiu użytkowników. Teoretycznie wybierane są one losowe i tylko one wybierane są jako pierwszy węzeł połączenia. Kontrolując zarówno entry guard jak i węzeł wyjściowy identyfikacja użytkowników byłaby już jak najbardziej możliwa.
To jak szybko rozwiązana zostanie zagadka prezentacji zależy w dużym stopniu od tego czy faktycznie doszło do popełnienia przestępstwa i czy władze USA zdecydują się na wszczęcie postępowania. Jeżeli prawnicy uniwersytetu uznają, że jest realna szansa na rozwiązanie sprawy w sądzie to komentarze będą ograniczone do minimum. Być może jednak udostępnione Tor project fragmenty prezentacji poskutkują oświadczeniem na temat faktycznej skuteczności ataku.
There are few topics as controversial and unambiguous at the same time as child pornography. While everyone agrees that sexual exploitation of children is heinous crime and lot of resources has to be concentrated on ending it, questions of what exactly constitutes of child pornography, how to fight to what extend it should be prohibited (production? possession or just gaining access?) remains unanswered. Furthermore due to sensitivity of subject it often causes knee jerk reaction and stream of emotional, rather than rational, arguments which is visible especially in public legislation debates. After all who would ever oppose laws that enables law enforcement to fight child pornography more efficiently, even if civil liberties are left behind in the process. However, even putting aside this aspect, laws often goes to far within their own frameworks or lack coordination between various bills that tries to grasp their straws. That was the case with convention on cybercrime as well as number of national laws.
Convention on cybercrime, signed in 2001 and effective for 10 years now, contains title on child pornography, defined as ‘content related offence’. Furthermore legislators went as far as providing definition of what is child pornography, definition which is rather strict as it includes “a person appearing to be a minor engaged in sexually explicit conduct” and “realistic images representing a minor engaged in sexually explicit conduct”. While reasoning behind such wording is not hard to explain – often it is hard to judge if person is really minor, the implications are quite serious. First of all, it is possible to prosecute someone for producing computer images of child pornography, which might be morally questionable but certainly no children are harmed in the process. Problem becomes even more complex given that many jurisdictions omits ‘realistic’ part in their statues. Case in Sweden, which reached Supreme Court, concerned manga translator who was fined for downloading drawings presenting minors in sexual context. As the case made its way through appeal process, important aspect was whether drawn figures could classified as a person. Prosecution argued that even specific characteristic which were common for manga characters (huge eyes, distinctive anatomy) did not change the overall qualification. While court of appeal upheld this line of reasoning, ultimately supreme court overruled the verdict, saying that drawings were not realistic enough to fall under legal definition. On the other in the US, man was given 15 moths in federal prison after pleading guilty to possession animated pornographic images of minors. While drawings were not manga characters there were not far off in terms of realism. As it is stated in plea agreement one of them depicted “Bart Simpson cartoon character (a minor) standing up and receiving oral sex from the Maggie Simpson cartoon character (a toddler) who is also nude“. Important to note that it is still plea agreement – not unlikely signed due to fear of harsher sentence. Similarly manga collection was ruled to be child pornography, after defendant entered plea bargain under advice of his lawyer. Attorney reasoned that due to obscenity of images he would be found guilty by jury (problem of entering plea bargains out of fear is a topic for another article). These examples from two sides of the Atlantic shows how important might be such distinction. The problem of stricter approach is obvious – people have gone to jail due to committing an act where no one was even remotely harmed. Furthermore it should be questioned what such statues aims to achieve. Is it in place to catch potential child abusers – which is a stretch and in many countries probably unconstitutional one, or perhaps even thoughts about intercourse with minors deserve punishment. However if the latter is the case, even leaving out thought crime aspect, why laws are limited to drawings? Would literary description be treated the same. Ultimately victimless crime aspect makes such provisions most disturbing, and it is hard not to think about slippery slope aspect.
Second, thinking about convention on cybercrime, essential is that in many cases law enforcement is solely responsible for discovering internet child pornography rings, way before public prosecution comes into action. In such scenario it is often up to computer forensic technicians to decided whether person depicted is minor or not. Also if person has to just ‘appear’ to be minor, what about professional pornography labelled as ‘schoolgirs’ and ‘teens’. Does fact that everybody really knows that porn stars are over 18, makes it exception to the law? Danger of this kind of approach is uncertainty of law and putting too wide interpretation margins in judiciary process. In case of criminal law, where convictions significantly burdens convicted it is unacceptable, especially that there are little advantages resulting from it. Finally the very inclusion of child pornography in cybercrime convention is questionable, and in my opinion is example of poor legislation. Catalogue of ‘cybercrimes’ could extended ad infinitum, by just adding ‘committed using computer’. While it could be argued that crime such as fraud significantly changed its structure and form by including computers, in case of distributing child pornography, other than scale of possible distribution, there is hardly difference between video tape, dvd, and hosting a hidden service. Bottom line is whether there is a point in adding another piece of legislation. If the aim of convention would be to harmonize legislation of different countries, than it has to be noted that there is already in place Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse. Which does include its own articles on child pornography. Furthermore in case of convention on cybercrime, there is possibility of opting out of the ‘generated images’, ‘appearing as minor’, ‘possessing child pornography in a computer system or on a computer-data storage medium’ and ‘ procuring child pornography through a computer system for oneself or for another person’ parts which make it rather poor instrument of harmonization.
Unfortunately it seems that sensitive nature of the problem seriously hinders putting effective laws in place. Moral panic which leads to convicting people of possession manga certainly does not help with adequate distribution of law enforcement resources, always limited in case of computer crimes. Also it seems unlikely that significant changes will happen in near future, as once laws are in place there are few people who would try to soften them. The sad truth is that such process is counter productive to crime detection, something that we cannot afford in this case.
Unfortunately I had to significantly throttle down creating this blog recently – this is partially due to stacking up of ‘usual’ responsibilities, but also partially due to the fact that I’m involved in organization of law / IT conference – Net Attacks 2014 which happens at Nicolaus Copernicus University in Torun. It might be the only event in Poland that enables discussion between lawyers, netsec professionals and government agencies – be sure to check it out at http://www.atakisieciowe.umk.pl/. Beside taking part in organizing I’m also preparing lecture on law enforcement’s struggle with anonymity provide by Tor. Here I’d like to present sneak peak of my research combined with some thoughts that probably won’t make it to the final cut of the lecture / article.
It’s indisputable that Tor bundle changed fundamentally access to Internet anonymity. Ease of use and almost foolproof mechanism were the elements which guaranteed massive popularity, as well as made it perfect platform for some forms of criminal activity. Drug dealing and child pornography exchange are primary examples of such use. Level of protection delivered by Tor is more than enough to evade law enforcement and with minimal additional knowledge and care render conventional investigation techniques completely useless. In this circumstances LEA are basically left with three options: leveraging very design of Tor, utilize 0-day exploits on software of Tor bundle and basically hack the machines of criminals or use social engineering combined with leveraging carelessness of users to gain data sufficient to capture criminals. However, it is important to remember that law enforcement is bind by law which in many cases is far behind bleeding edge of technology. This situation is especially apparent in civil law countries where often every action taken by LEA have to be strictly detailed in law acts with very little room to adjust to changing situation. Of course it is equally important to keep in mind civil liberties and human rights aspect. Such detailed instruction makes all the operations very transparent and keep agents from abusing their power. On the other hand perhaps more relaxed in terms of legislation, but based on court warrants system allows better adaptation to specific cases.
Two greatest ‘weakness by design’ aspects of Tor are vulnerability to global passive adversary and lack of encryption of data leaving exit nodes. First still seems to remain in the realm of theory and it’s not likely it will become significant option for law enforcement. Even though experiments prove their effectiveness, resources required to pull such operation off and need for basically blanket approval to sniff on extremely large chunks of network make it impossible to use in any country with even elemental privacy safeguards. Second option (exit node eavesdropping) is definitely more interesting both in technical and legal terms. First of all it does work great! Experiment presented by Swedish researcher Dan Egerstad proved that setting up even small exit nodes in various locations can yield amazing results with captured emails from various embassies and government agencies. Furthermore Egerstad claimed that both some of these accounts were already compromised be people using similar technique and that some large exit nodes are just to conveniently placed in places like Washington D.C. and have to large bandwidth not to be set up by the government. And while up to this point everything sounds great it is still probably poor method for crime fighting. First of all blatant capture and analysis of all data that leaves certain node in on par with massive blanket surveillance that we are aware of now, after Snowden’s revelation. As such it should be discouraged, and if used will face the same problems with using it as evidence as NSA programs are facing now. Also let’s not omit the fact than exit node sniffing does not reveal IP addresses, only messages sent.
However, FBI took entirely different route when trying to break child pornography circles. After capturing creator of Freedom Hosting, and at the same time gaining control of its servers, agents injected malware on services hosted by FH. Malware wasn’t anything spectacular and required carelessness on the side of Tor user, but proved to be good enough for its job. At the same time though, it opens the discussion about limits of tools LEA can use. The exploit used was a 0 day for Firefox, using it meant basically exposing every other browser with the same configuration and same version to be attacked. On the other hand exploit was already outdated when released since latest release of Firefox was already patched against it. Since use of such technologies is relatively new it is not surprising that law is far behind. In Poland doing anything similar would be probably impossible to do, not even due to harsh restrains on LEAs but because there is nothing even remotely similar discussed in Polish legislation.
Finally there is a case of Dread Pirate Robers and whole series of events that lead to his identification. However if you would like to hear about that please join me at Net Attacks 2014 🙂