Good morning everyone, my name is Eric Jardine.
I'm an assistant professor of political science at Virginia Tech
and the organizer of this event, along with Grace Wheaton
who's sort of been the bulwark
against all things going wrong and she's been very helpful
and sort of got this all put together. What we're going to be talking about
over the course of today is the dark web,
cryptocurrencies very broadly defined, and just generally anonymity granting
technologies writ large. There's sort of I would
say three or we'll say two sort of
definitions of the dark web, one of which Gareth Owenson, who is our first speaker,
will really go into detail about, which is sort of the hard technical
formal side of the dark web, so this would be the Tor hidden services that's
our stuff which will all become apparent in a moment we also have
with some of the presentations sort of a softer definition which is sort of the
growth of online extremism. This can be enabled by
anonymity granting technologies, but doesn't necessarily have to be hosted on Tor.
And so there's sort of a hard definition
and the soft definition of the dark web, but we're going to be talking a little
bit about both and it's just sort of useful to bear in mind that we're doing
that purposefully, not due to any sort of sloppiness on our part.
So we have a number of great panels over the course of today.
The first panel with Gareth Owenson,
as you'll see in the agenda sort of looking at indexing of the dark
web and that will really kick off our discussion.
We have been indexing dark web markets with Nicholas Christin, bitcoin and
cryptocurrencies as a panel, extremism malware markets and public use
of Tor followed by a discussion about teaching and training
new dark web analysts. Once we move into the afternoon we
had intended to have a few FBI speakers present in the afternoon of giving
us a practical hands-on policy perspective and unfortunately
that sort of fell through so we're going to have a more general policy panel
that will sort of take what we've sort of discussed during the course of the
day and sort of talk about things we missed
other policy issues and how we can leverage some of the research insights
that we've talked about some of the expertise in
the room to try to sort of come up with actionable sort of insights on that
basis and so that should be a good sort of turn of events. A few things
administratively before we get into the conference itself: first off there is
going on right now a live stream that is also going to be recorded and hosted on
the website so this will be on the ECB website
we're probably going to share it on other websites so if you
are sort of adverse to that this is sort of all the speakers have
given approval to have their presentations in recorded and live
streams so they're all on board but if as an audience member
you don't want to be recorded then I would suggest either
taking the questions offline if it's of highly sensitive or something
like that if you are okay with that if you're okay with being
recorded then the the stipulation then becomes you need to talk into the mics.
We have a decently sized room acoustics
don't seem too bad but in order for it to get recorded at all you have to click
the mic there's a little vertical button you just click that that
will turn it on and we can kind of go from there
there is a lunch that occurs from what is it here 11 40
or 12 15 to 130 that's going to be out this way where the coffee was served
there's gonna be a series of rooms there that'll be also opened up so you
can have places to sit and this will be a chance for everybody to sort of mingle
and discuss further issues and that kind of thing.
i think unless Grace has anything else i think
okay so i think that that sort of wraps up
uh my just sort of introductory comments I just want to thank you all
for being here and also I should say I also would like to thank the various
funding organizations uh internal too and Virginia Tech in
particular that kind of helped get this up and running we have a banner out
there with all their logos there's a number of great associations from the
Institute for Society Culture and the Environment
at Virginia Tech, the national capital region office
of the vice president, the integrated security
destination area at Virginia Tech, Bluestone Analytics provided support
and the government services technology coalition
as well as infragard ncr we're all sort of involved in helping get this up and
running and it certainly wouldn't have been possible without
all of that very generous support so thank you to all of
those individuals. So with that I'm going to turn
over to Joe who will be the moderator for our first section and invite Gareth up as well.
Good morning everybody, I'd like to introduce Dr. Gareth Owenson.
Gareth is a senior lecturer in the school of computing
at the University of Portsmouth, UK holding the PhD in computer science and
a BSc in internet technology. His work over the past 10 years has
specialized in internet security, cryptography, and
distributed systems, in particular dark nets and cryptocurrencies.
He has conducted some of the broadest scanning of these systems
and is an expert of indexing the dark net. He is a member of the pervasive
computing research group at the University of Portsmouth
and regularly works with both the U.S. and U.K. governments on issues of dark web
indexing and use. So without further ado, Dr. Gareth Owenson.
I personally like starting techno conferences on technology with
technology problems because it's the best way to show that we're totally
here we are so general forward backwards later
that's great thank you very much all right can you hear me okay
um yes so my name's Gareth Owenson, I'm from University Portsmouth in the UK.
My research interests essentially are in understanding
what Tor is used for, by whom. From a scientific perspective there's obviously
a big debate about the dark web as to whether it's sort of a freedom thing or
whether it's a crime thing and obviously there's a spectrum of views in between.
My personal interest is trying to understand that from a scientific
perspective and informed policy as to how lawmakers
should make policy around the dark nets but also to have law enforcement tackle
some of the criminality so i'll try and present
you a broad picture of what the dark net looks like today and over the last few
years and hopefully you can make up your mind as to
what you think about it as today goes on okay so i'll go through a brief uh
description of Tor and how it works um some studies on the content of what's
on Tor on on the dark within Tor some of the
future developments which they're going to be deploying or which are currently
in the process of deploying and then what i think are some of the
policy levers which could be applied to Tor
and what i think some of the impacts of those could be i'm not necessarily
saying you should do one thing or not or another
i'm just going to say well these are some of the things that are technically
possible and what the impact of them would be if you
were to do them
so as a show of hands how many of you have used Tor?
okay okay so maybe about 75 percent so Tor's principal or rather stated aim
is to provide anonymity and privacy on the internet so that is to allow people
to browse the internet um without their user activity being
tracked where they're going which websites they're going to
uh what their interaction is with those websites and the way in which it
achieves that is it has a network of relays through which you bounce your
traffic so say for example i want to go on to
facebook.com so this is me on the left hand side here
i'm the user this big block in the middle is the tor network
and on the right hand side is the facebook
facebook servers what will happen is i'll type in facebook.com into the tour
software and my traffic will be bounced through
three relays within the tour network based around the world and exit from the
very last one and go directly to facebook's website
as far as facebook's concerned i'm coming from the tor network they don't
know where i am or where i'm located as far
as anyone looking at my traffic here entering the
tour network all they can see is that i'm talking to the tour network
but they can't see what i'm doing so you get different properties at different
points within the network at the end of the network at the end of the link
they know what you're doing or rather where you're going but they don't know
who you are and at the start of the network they
know who you are but don't necessarily know what you're doing
now there's one extension to this or one extra additional feature which tour
offers and this is commonly known as the dark web in in most circles and
it's called tor hidden services the feature of this service is the
ability to host a website or host a service of some kind
anonymously so in this scenario you go to facebook
everyone knows where facebook servers are located
the purpose of hidden services is to be able to host a server
anonymously so that no one knows where the server is
and also so that the people visiting that service are also anonymous so both
the service and the user are anonymous to each other
but they can still communicate and pass data to each other
for example browse web pages and those sorts of things and this is
typically what's known as the dark net and the subset of those services
which offer web-based services are often known as the dark
web so the dark web being a subset of the dark net
so so i guess some questions you might ask of who runs the tour network
uh there's an organization called the tour project which is a charity
um part funded by the u.s government the state department of the national science
foundation who runs the relays within the tor
network uh good question some of them are privacy activists some
of them are completely unknown some of them require huge spends on the
relays and no one knows who runs them government eight government agencies
definitely run relays but in general the idea is there's so
many relays there's a good mix of mixed mix of them and if one were to be
compromised then that doesn't necessarily break the
security of the whole the whole system so if you happen to go through a bad
relay certainly in the latin sort of middle step there
that doesn't necessarily cause you any any great harm
so who's using tor tor correct statistics from all of our relays on
that network as to the country in which they're connecting to the tor
network from now i've got two tables here if you look
at the one on the left hand side this is the proportion of users
connecting from different countries to regular standard relays within the
tour network and you can see there's a you know the sort of western
nations feature quite prominently the us the uk often feature very highly on this
of course this changes day by day this is sort of daily statistics from
yesterday now the table on the right hand side is
the proportion of users connecting into the tor network
using a technique which is designed to circumvent
a censorship a technique called bridges which tour use which are relays within
the tor network which are not publicly known about
which you can't get a complete list of them or at least you can't get a public
list from the tour project project of them
and there's a slight difference as you can see in the distribution you've got
countries like iran and turkey showing up in the evasion techniques and
that may be a function of the fact that some of these countries
censor access to websites and to the tour network um
china went through a period where it tried to censor access to the tour
network although they didn't try particularly hard
um so what are the potential uses of um of tour um this is the bit where to get
sort of a little bit a little bit murky um if you go on the tour project's
website they list all of these definitions or all of these types of
users on the left hand side here so they say that for example
whistleblowers will use tor because you know they may wish to leak documents
to a newspaper but they want to remain anonymous to the
newspaper so if the newspaper gets compromised there
their identity isn't leaked journalists may use it
if their own countries which censor access to sites to gain access
out of those countries bloggers to publish blogs
i.t professionals to get around their corporate i.t policy on what they can
access which i think is that what they're
alluding to there law enforcement to hide
that law enforcement are surveilling a suspect but the fact that someone's
using tor is very very noisy so you know if someone's using tor it's
quite obvious that they're using tor so if you're law enforcement and
surveilling a suspect the fact you're using tor
raises an eyebrow potentially so it's not necessarily a good thing for those
cases and then two other uses they list at the bottom business people
and in quotation marks normal people um and then the famous users on the
right-hand side so these are which tor gets a great deal of press for
a drug marketplace is which the next speaker is going to talk about so i'm
not going to talk too much about the drug marketplaces child abuse
material which um i'm going to talk about quite a bit because that's what
part of my research has been about and then edward snowden who is the chap
who leaked many of the nsa and gchq in the uk's uh secrets online
uh via grand greenwood he's one of the most famous person to allege
to have used tall now in terms of scientific evidence
there's lots of scientific evidence for the criminal uses of tor
dart net marketplaces child abuse material and so on and so forth
there's a fairly solid consensus on that as for the uses on the left-hand side
here it's a little bit more tenuous and that just because i say there is no
scientific evidence that doesn't mean or sorry there's little scientific evidence
that's not the same as saying there's no evidence i'm just saying it doesn't meet
the bar for scientific publication and that
may be because you know if you're an activist in a
in a country then obviously you're doing it in secret and so it's difficult
it's difficult to collect data on that um and so it's not a
necessarily a black and white picture here as to as to what's going on
but then if you're trying to come today and get a feel for is it good or bad
there's not enough scientific information to let you to you know to
enable to reach that sort of solid conclusion as to where to sit on the
spectrum
so for those of you who've used tor how many of you have gone to hidden services
to onion sites okay so perhaps half of you that have
used tor um so this little picture at the bottom
here is a picture of the tor browser the tour browser is based on firefox if you
use firefox before it looks very similar to what you see on the screen here if
you launch the tour browser the additional
capability you have is to type in urls where the top level domain is dot onion
these are these are dark net sites if you go to one of these sites
the site is anonymous to you or whether it's location is difficult to determine
and you're anonymous to the site or your location is difficult to determine
in relation to the site um if you type in a regular address in here
so you've got a bbc dot code uk or new york times
then your traffic will be routed through the tor network and your connection to
the site will appear to be coming from the tor network
so as far as the new york times is concerned
you're just traffic exiting the tour network they won't know where your home
identity is
so how big is the darkness this is the question i often get asked um it changes
with time there's quite a huge churn of hidden services there's a very
high turnover of hidden services on the darknet so the the number sort of
changes fairly regularly it tends to average around about 60 000
hidden services according to the tour product the
methodology which they use to collect hidden services
now the tour products collect the cumulative total of hidden services in
any 24-hour period so they say in a particular day we see
60 000 unique hidden services or unique to
onions essentially um that doesn't mean they're all up
concurrently in fact half disappear within 24 hours
um but that gives you an idea for sort of the size but it's relatively small
compared to the open web you know we're talking about a small number of sites
does anyone know what these big spikes are
nor do i
a number of sites
um so there's these huge spikes you see occasionally um
tour obviously grants a huge amount of anonymity the spikes often only last for
a few days which makes it difficult to study
uh what that what they're made of it's suspected they're probably botnets
infected machines connecting connecting to tor that's the the leading
theory i think but um because of the short duration which the
spikes last for it's rather difficult to sort of prove that through measurement
i've not done that correlation i don't believe so no
but
so what are the methods then for studying the dark net well the simplest
one is you can take a web crawler you can
point it at some common websites so a common starting point is the hidden wiki
which is a wikipedia style site with a list of links to you know sites
on the dark web where you might start and your crawler simply goes about
following hyperlinks from that place until they've followed
all of the hyperlinks available across the darknet the vast majority
of papers which you read um or studies which you read
will follow this methodology they'll start at something like the hidden wiki
or reddit or something like that and they'll simply follow hyperlinks
until they reach all of the sites this allows you to sort of understand
what the distribution of content is on the dark net
uh it doesn't allow you to measure the popularity of sites so how many people
are going to each individual sites the other method for
sort of working out what goes on the dark net is there's this there's a sort
of telephone directory of sites on the dark net but the
telephone directory is not held in one place
it's spread out across all of those relays within the tor network
so you can run special relays that participate in this telephone directory
and every single day you get to see different parts of the telephone
directory so over time you can build up a list of
sites on the dark net that gives you a more complete picture there's a handful
of studies which you have including one which i'm going to talk
about in a second which of you is this methodology
and it allows you to see sites which are not linked to so you might think that
for example some activist sites may not be linked to because people
don't want to publicize the fact which the sort of thing which they're doing
now if you break the the sort of the list of onions down in
the types of um service which they're offering
about 75 as of recently um of these are offering a website of some
form which you can go to and you can visit web pages on those things
and this this sort of web-based content on the dark
net the dark web as it's called is the most studied thing if you read studies
on it the vast majority will be on the dark web component and if you see
drug drug marketplaces for example you know those are all web-based
services being offered on the dart net the other part is non-web-based sites so
these are traditional sort of internet-based services which
are not offering a web page so for example
some types of chat email as a classic example
um like remote access to machines and things to sort of administer them
um bitcoin zero net which is another dark net which seems to have popped up
using tor quite recently and botnets all sort of fall into this
category there are there's one study that i'm thinking off
the top of my head which has looked at this
and one of mine which is currently under peer review
which should come out shortly hopefully which has looked at this particular part
why is this part not studied very well that's because it's difficult to study
it right it's difficult to classify all of these diverse types of content
and put them into categories it's very easy to do it with websites
and some of these types of services are not easy to interrogate to understand
you know sort of the nature of what it is what it is they're doing
as i said earlier there's a very high turnover of hidden services so most
hidden sites disappear after 24 hours why is that the case who knows
some of the measurements i've done recently suggest that most of the ones
which disappear within 24 hours are part of the zero net darkness
there's another dark net that's recently emerged called zero net
and they're using tor to provide part of the anonymity
of that darkener so it appears that a big chunk of those sites are actually
um zero net base sites as for the rest good question
it may simply be people trying it out for a short time you know trying out for
a few hours and then closing the site down
and and never doing i've certainly set up more onions
that have lasted a short period of time than i have that have run for any period
of time about 15 of the sites so
all of the dot onions exist for more than six months and these tend to be
things like the drug marketplaces some of the child abuse sites
the markets for guns and sort of the ones which are getting most of the
visitors the sites which don't get very many
visitors are the ones which tend to disappear
after some period of time so that's pretty much in lines with what you'd
expect the proportions i've listed here between
the dark web and the non-web it does vary over time as i said it's quite high
turnover of hidden sites since that means
portions do change a little bit a few years ago it
the 75 25 were around the opposite way and that's because the non-web-based
sites was essentially made up by botnets a huge influx of botnets using tor
something called skynet at the time in terms of content then on the dark web
this is a study i did in 2014 essentially we call the dark web
measuring at those directories so we see all sites over time which could be
which are published on tour we call them we visit each site in turn we classify
them into a particular category based on the content in which they offer
and as you can see most of the sites are orientated around drugs
some kind of bitcoin fraud usually things like bitcoin mixers
which are sort of like a money laundering scheme for bitcoin
there's a small number of whistleblower sites these typically
run to typically tend to be run by news agencies um
who are you know wanting to receive documents from whistleblowers
fake credit cards fake passports pornography
child abuse news sites chat sites gambling bitcoin gambling type sites
if you look at most studies on the dark web this is
broadly the picture they'll show you know drug marketplaces typically tend to
be the most frequently occurring and then
sort of this range of other types of services
which are all sort of in some way related to sort of criminal activity
um but of course not all the things here are are criminal
now the next thing we did was okay well this is the number of sites in each
category well because we're running these nodes
in the tour network where we can measure the popularity of hidden sites
the next thing we do is okay where are people actually going when we break
things down into categories where are the most users going to which
category of content are most of the users going to
and this is the if you've seen any of the press coverage
um a few years ago over this this is the shocking graph
we found at the time so this is back in 2014 over 80 percent of the visits to
sites were going to child abuse based sites
now that was four years ago as of recently that's around about 40
percent with drug marketplaces taking up about
25 of requests um so at the time i went to the tour
project and i said well this is this appears to be what's
going on and their response was well it's probably law enforcement law
enforcement are the ones pressing refresh all the time on on on
child abuse sites which i didn't think really stood up to much scrutiny
so i've kept an eye on developments and law enforcement investigations over the
last couple of years and i'm going to give you some examples of
some rather big cases around child abuse which have happened on tour
so oh dear someone doesn't like that
it does look like a cable problem isn't it but i don't know which cable
which cable one is supposed to pull oh you pulled the cable did you
okay so over there over the last um four years since we published those results
i mean the number of child abuse prosecutions on tour um
has been enormous like i can't possibly list all of them in the time that i've
got available here so i've just picked a couple
which i think are perhaps big important cases
over the development of time but there have been you know 20 plus
child abuse websites which have taken being taken down by law enforcement
so the first major case was a as a group called freedom hosting a chat called
the chat running a group called running a service called freedom hosting which
was a free dark net hosting service so if you
wanted to host content on the dot net you go to him and it
set up a website and you can put some content on it it turns out you know if
you speak to most people who try to run hosting services on the dot net they
have a problem with trying to use their service to host child abuse
material now that certainly was the case with freedom hosting
it later found out it was later found out at the time everyone was saying well
you know the guy's just a hosting service so he's not actually publishing
this content people are coming to him renting the service
and then they are the publishers of the content it actually turned out the guy
that was running freedom hosting um was actually a participant in hosting
this content um on on the dark net and at the time i
think it was the dublin police called him the largest perpetrator of
child pornography on the on the planet at the time just by the sheer number of
services he was offering in late 2014 um a site called playpen
was taken down it had over 200 000 registered users
more than 20 000 images of child abuse and i've been on panels before
where i've i've pointed out this child abuse problem and people have said well
the child abuse thing it's it's just i don't know what the age of consent is
here is it 18 is it sorry it varies by saying let's
say let's say it's 18. so the sort of the
comment i've had on panels before as well
it's just 18 year olds with their 17 and a half year old partners and they're
sort of sharing sexting images and that's what the material is
no this is not what the material is the material is you know babies from three
months old up to sort of middle teenagers it's the
most vile stuff you could possibly imagine child's play more recently has
been taken down this had over a million registered users
on it what's notable about child's play is
that it was hosted in the european union
but what they wanted to do was to run the site for some time once they'd found
out where the site was located they want to run the site for some time to snare
the people using the site publishing content
and downloading content now in the european union
none of the jurisdictions allow law enforcement to host
and distribute child abuse material so the site was moved to australia where
the jurisdiction is slightly more friendly to this
and the australian police ran the child abuse site for several months
in an attempt to snare some of the users and identify them
and bring them down for a rest um
the operator of this site was also an active abuser of child of children as
well and then more recently i don't know if
anyone has seen this in the news has had quite a bit of precedent in the uk
um so all the previous ones are i don't know
like vanilla child pornography i guess as sort of the distribution of images
and those sorts of stuff sort of traditional what you'd expect um
from this field um there is has been over the last
couple of years an emergence of something called
hurt core um child abuse which is a rather sadistic version of
of child abuse this chap called matthew folder is a british
or rather was a british academic and he is what's called a hurt core pedophile
and essentially he grooms children into you know
late teenagers mid teenagers into sending pictures of themselves in
compromising positions to him he will then use those pictures to
blackmail them into doing sadistic things and the most upsetting
example i heard was a couple of his victims he
blackmailed into abusing their younger siblings
so their younger brother or sister was abused by that elder
that elder sibling
so matthew the police say there were over 200 victims from from
matthew there were several suicides from children who committed suicide because
of this it took the police three years to identify him because of
tour right they they were on he was on his
right on on uh he was on their radar but they were unable to identify him
because of tour um had they been able to identify him
there would have been far less victims and a few people may be alive today as i
said there are many more examples i mean you do a google search i mean quite a
lot of them don't actually get much press
but often in the us you have a much more freer legal system where you can see
sort of testimony from fbi agents and things like that there are loads of
examples um you know easily 20 20 sites that
have been taken down over the last few years so law enforcement
is having some success but it's usually when these people make mistakes
as when they're when they're able to identify them but tour is very much a
significant hindrance to them identifying these people
so where's tor going um what's coming up next so tor have just
deployed something called hidden services version three the previous
version the dot onions record hidden seven
hidden services version two the main difference from a user perspective is
the site the dot onion the url is much longer
it's over 50 characters before the dot onion
what is the main sort of security advantage of this is it prevents
academics law enforcement whatever from collecting a list of sites
on the darknet the only way from this point to discover sites
is if they're linked to from somewhere else which which you already know about
so they're already linked from the hidden wiki or some other site you know
about so the risk with this is um you end up
with communities like some of the ones we've talked about
who can essentially hide completely because there's no way to
learn about um you're asking a question or
yeah so do people just make up those characters
um
no no it's connected with the encryption key
but there's a way to brute force essentially some of the first few
characters so you can sort of have something that
starts with that looks recognizable but the rest of it will look like random
okay um so the principal problem here is we're no longer
able to find out about um sites which are not linked to anywhere
and so crawling will be the only mechanism to learn about what's going on
the dark net so one of the questions i asked um about
six months ago is okay what impact is this going to happen if we
can't find out about sites and being an academic i want to study the dark net
and understand what it's used for what impact is that going to have
because i suspect the likely impact is that
i'm going to say well of the sites we can see many of them are criminally
orientated and the response will be yes but there's
all these secret sites which you know are doing good stuff which are
not linked to anywhere that you're missing as part of your study
well i decided so i applied this sort of applied a scan to the current onions
we've got and i said okay well which are the onions we've got which ones are
the link to and which ones are not and then look at the comparison between
the two categories from an understanding of what's going on in the dark clip it
doesn't appear to make any difference you can still get a fairly good idea as
to what's going on in the dark net but it may be a hindrance more to law
enforcement
so what policy delivers could you apply now
i'm not suggesting any of these i'm just going to tell you what i think is
technically possible and what some of the implications of
them are and perhaps we'll have some discussion
discussion about them so back in 2014 when i showed the tour project my
results about the child abuse sites my suggestion to them was
they have the technical ability to block hidden sites
from being accessed by modifying the tor software so you could easily take the
child abuse sites out of the system their response to me at the time was
they have no wish to do that or no intention to do that
they don't believe in any form of censorship whether it's child abuse or
whether it's freedom activists and they're not going to engage in it
i've seen no shift in that policy so i don't think there's necessarily
going to be a change in that anytime soon but they have the technical ability
to do that to block sites their argument one of their arguments at
the time was well if we're producing a block list of sites which people can't
go to then who is watching us well i think
that argument falls flat on its face because the way in which
tor works is that list would be a public list anyone can scrutinize the list to
see which sites are blocked what's going on
here um so that's
i mean that to me seems fairly uncontroversial right it seems a win-win
situation you can take most of the bad or have rather have a
significant sort of um deterrent effect on the bad on tour
whilst keeping some of the good uses that seems a fairly uncontroversial
measure from from my point of view the tour project as i said at the
beginning are principally funded by the national science foundation and the
state department
my personal view is that perhaps the state department should perhaps leverage
their funding influence to direct more the
direction of the tour project the tour projects do have other funding
sources but the state department contribute
about a million dollars a year so there's a significant chunk of that
budget um to the to the tour project so they
have a particular clout i think in doing that and then the
last two
which are a bit more controversial um and
if you're attacker you may be thinking why is he suggesting these things
the first thing is well a government could block tor
and the response to that normally is that well china has tried to block tour
and they've been unsuccessful china has made some very
naive attempts to block tour it is possible to block tour
but not absolutely so if you block something you deny access to it
you can make it significantly harder to access
that will deter obviously users if something is is harder to use that's
going to turn people away from using it what's likely to ensue i think if you
engage in a blocking strategy is the tour projects we'll end up in
this sort of cat and mouse game where they are producing counter measures and
we're trying to block them and we sort of go around in circles
circles of that um as to whether or not they'll be
effective i'm not entirely sure um and the final one i put here which is
perhaps even more controversial is you could deploy a policy of
disruption and that is your intention is to degrade the service of
tor so much that people no longer use it and the bandwidth or the capacity which
tour offers you can think of it like a road
the road's not very wide so for a government to degrade the service of tor
so that it's no longer practically usable it's not very
expensive so it's certainly possible to do that
and you may argue well okay we may enter a cat and mouse game
with that as well i mean the reality is it's much easier to degrade service than
it is to protect against the degrading mechanisms for degrading that service um
so i think they'll probably have slightly
less effect on that as i said i'm not advocating any method
my goal is to try and present you these are some options that are possible and
you know that you could perhaps think about and decide whether or not
that they are interesting or not which brings me
neatly on to questions and discussions and what have you
sure
so thank you very much gareth very interesting um
i have a a couple of questions i need to throw them out and see what your
thoughts are so you mentioned the sort of the two-part
uh dark web you've got the the web-based content and then the dark net based
content um and you were pointing to the idea that
a lot of the dark net component is sort of composed of bots
and this room brought to mind cloud for players policy from 2016 where they
started just blocking all traffic coming out of the tor exit
nodes cloudflare and so i was wondering if you could
speculate a little bit on the sort of on what they were saying was that were they
sort of in the right there okay the other two just real quick to
throw them all out um uh you said that from from 2014 when you
did that initial uh tracking of site visits to now you
had a reduction from 80 to around 40 for child abuse imagery there's a lot of
ways that proportion could change was it a reduction in child abuse
imagery traffic or was it an increase in the other traffic to other types of
hidden services so i mean the portions vary right
around that but i mean the drug marketplaces and the child abuse
material is the most prominent over time but so the proportions vary
you know sort of week to week and what have you and then the last just
quick thought i had was with the the child's
play case where they were running the servers out of australia to
do you know anything or can you speculate at all about the actual
invest network investigative techniques that they were using because it sounds
like techniques they've used in other
takedowns where they're infecting the systems with malware but i was wondering
if you knew any more of this yeah yeah i'd love to talk about that yeah yeah
okay let me do the first one first so um one of your suggestions was so right
at the very beginning i said one of the uses for tour is you you go to regular
websites through tour and tour just anonymizes where your traffic's coming
from so i go to facebook and facebook don't know
where i'm coming from so this traffic coming out
out of the tour network here and going to sort of regular websites you don't
know who it's coming from but it's just coming out of the tor network
we generally call this exit traffic is the term
that we tend to use it for it because the last hop in this chain
is called the exit node now
what is coming out of regular tour right so we can we talked about the dark net
but what and one of the points that's often made
is well you're just talking about the dark net and the dark nets you know just
one component of tour what about the regular users for tour
what's coming out as exit traffic this is a little bit more difficult to
study because if you're on an exit node and you start
watching the traffic coming out there's a legal question there as to whether
you're intercepting traffic it's certainly a legal glare legal gray
area as to as to what you can do now cloudflare which is the point you
are making they sit in front a lot sit in front of
a large number of websites on the internet and they sort of
provide protection against denial service attacks and those sort of stuff
so they have visibility of traffic going to their clients
websites they said correct me if i'm wrong eric but i
think they said 80 percent of traffic which they were receiving from tour was
bad um and so they i think they had a policy
at some time of deterring tour traffic from coming to
their sites um and you'll find that's a fairly common
policy among many organizations they will block traffic
coming from the tor network not because it's all necessarily bad but just
because just so much of it is bad that it's just a hassle that just rather not
have so many so few of their users are using tour if any
they just don't care about that proportion
i am aware of people who have run exit nodes
um private corporations and studied the traffic sort of sort of designed
algorithms that sort of classify the traffic
and that conclusions have been very much the same you know a big proportion of it
is malicious in some form you know sort of causing some kind of
harm trying to compromise systems um posting comments spam and those sorts
of things and the last thing you asked me about
was the knits
so one of the ways to identify where well okay so let's say we've got a
criminal site and law enforcement want to identify
where the people are which are running this site they've got a couple of
different mechanisms they've got a social engineering
mechanism they put officers in there they try and
you know befriend the people start running running the site themselves and
then sort of leverage that to try and identify where the site
the site is and there's certainly been some examples of that
the other approach is that the site operator makes some mistake in the way
they configure their site and that leaks where that site is hosted
and that is believe it or not much more common than you think it is um
so after that point law enforcement know
where the server is hosted and they can go to the data center take
control of the server and they can essentially continue running the site
they've then got a problem they know potentially at this point who's running
the site but they want to know now who the users
are but with the child abuse sites you know anyone coming to that site is
going to be committed in the uk at least we'll be committing a criminal offence
just by the mere fact of downloading images
you know when they enter one of the forums so one of the approaches
the fbi have taken i think in collaboration with the nsa is to deploy
something called a network investigative technique
and that is on the site when someone enters a forum which
provides images or provides some content which is unaware for them to download
they send back to our web browser and exploit that
that exploits the vulnerability within firefox the web browser
and runs some code on that computer and that code essentially connects the fbi
server and says hey here i am here's my ip address
here's the identifier for my computer here's my username my computer name
et cetera et cetera et cetera everything to sort of connect the person to that
particular access and it ties the person up directly to
the access of that forum at that particular point in time
many of the law enforcement prosecutions of users appear to be via this technique
there comes a slight problem though and that's when when law enforcement go to
court defense say well we want to know how you
identify as our client um and law enforcement then have to make
a decision do we disclose the technique and potentially lose the capability
um or do we just drop the case and in the vast majority of cases
i've seen i think in fact all the cases the prosecutions have been where the
person's pled guilty and therefore they haven't had to
disclose how the technique works and those that have not pled guilty have
essentially got off scot-free because the fbi haven't wanted to give away a
capability which they have so i think that answers your question i
think yeah sure so my question is
excuse me in terms of policy options to what extent
do the people who work at the tor foundation who are developing the
software and refusing to do some of those things
that you were talking about did they have
um potential criminal liability and could
you know what would be the implications of using the criminal justice system
to prosecute them for an aiding and abetting or or
some similar kind of crime i'm not a lawyer um
i think if they were criminally liable in some way they probably would have
been and there was a political will there
already then they may have been prosecuted already
my personal view of the tour people um having met them is that they're you know
they're well intentioned but naive i think and that's that's that's my view
you know they they believe that you know tour is a good thing
and they dismiss all evidence of the bad things which are happening you know sort
of just sort of push it out of their mind
and focus on the good things um that's my personal view of what
i think that viewpoint is um i don't think i quite answered your
question but i can't answer the legal thing i don't think
um sure
just follow up with that what what's the rationale of the state department for
financing funding tour there must be some some positive dimension they see
and let's hope the state department so yeah
so my my what i believe is the reasoning for
the state department funding it is because
the the argument that the topic says well people in repressive regimes are
using tor and so it's sort of bypassing censorship
allowing activists i think we had some discussion yesterday you gave some
examples of of cases where you where you've seen
that happen and they'll say just because there's a lack of scientific evidence of
it happening doesn't mean it's not happening it just means that
there's not it's not going to meet the scientific test for publication
sure um just to have to uh to that answer one of the main reasons why it
responded is that it's very useful for people who are uh working undercover
so a high school teacher in syria 10 years ago
who's not really a high school teacher the last thing you want to
let the local government know is that you're connecting to a state department
website yeah so it essentially obfuscates you
know where sort of hides where you're going
um there is a there is a a question i mean so this is the
argument which is often is often made um the reality is if you're using tor
it's quite obvious you're using tor so if the
regime you're in has an opposition to tour you know suspects you're doing
something they can see that you're using tor
there are other options you can use vpns and things
which are probably less visible you know just because of the way in which
they're more distributed and sort of less easy to identify that's going on
so there are other options um that's i believe the main motivation is for the
facilitating the access to the internet in repressive regimes
and you know from a scientific point of view it'll be great to get some solid
evidence for for that going on you know something
quantifiable but i think just given the nature of it you're
never going to get that like that kind of evidence because it's done in secret
right and there's a harm to people potentially so
that's a that's a problem from a scientific perspective i think is trying
to try to quantify you know the sort of the
distribution of things distribution of types of users
so earlier uh you speculated that maybe the reason the traffic to
uh child abuse sites was so high was maybe law enforcement officers
sitting there and hitting refresh so if the purpose of tour is that
you know the person visiting the site is anonymous how could you even in
principle determine you know what proportion of the visitors
are from law enforcement you can't unless you
run the site and even then you can't necessarily answer it yeah so it's
that's the problem right you know i'm measuring anonymous
statistics essentially of visitors to sites and so i if someone comes as well
it's just law enforcement going to the site i can't disprove that i can't i
can't prove it either way i can't tell you what
proportion of users but i think it doesn't pass the common sense test
in in my view but that's not a scientific answer
so
so you mentioned earlier that the the use of tor is rather noisy as far as i
imagine network analysis identifying individuals on on the
at least communicating to the tor network uh why do you think there hasn't
been efforts or have there been efforts to
potentially just sort of identify where people are using tor
so you know the tor project has obviously the metrics that you provided
about we're seeing tour users in usa and
france but more specifically perhaps you know just identify points of access
uh of torah users uh and use that for whatever benefit that may that may
provide maybe you're you know creating some real
blacklist like hey these individuals are on tour and you know potentially
maybe affiliated with something else i don't know what do you what do you
think about that so you i'm not sure what you're asking
me sorry i guess so for example so i'm on the tor network yeah right you
said that there's signatures associated with that
right and i obviously imagine those are being captured via network analysis
yeah yeah so then uh have you seen any efforts
to use that information to just pause basically identify where
people are accessing toward from i know there's
a lot of you know protection and anonymity provided through uh the torah
network but there's also means to discover individuals
it's very easy so um i've got the diagram up here so if you want to
identify client ips so ip addresses people using the tool
network you just run an entry note i got a so-called guard node
which you can run for relatively small sums of money now and that gives you a
fraction of users like a random sampling essentially of
users entering the tournament and that will give you their home ip address
or wherever that wherever it is they're connecting from um
is that answering a question yeah so there are there are some other
mechanisms within tor to try and hide the fact that you're connecting to
the tor network um from policy's perspective
i don't think it really makes much difference um
you know you can stop most of these mechanisms via some way or another if
you were to if that was a route you wanted to go
down um you know there are tor does have a
component to it which is the invasion of censorship and which is the ability to
connect to the tor network when someone is caught you know doing
interception of traffic and trying to detect tour traffic
and this is essentially what china tried to do trying to try to have a couple of
so china has a great the so-called great firewall of china
which sort of inspects traffic leaving china
and blocks access to certain websites um china went through a phase of trying to
block tour traffic using some relatively
simple techniques for identifying tor traffic
which were you know fairly trivially got around which will sort of spurn some
of the additional capabilities which is torah has added to try and sort of
circumvent that kind of censorship or denying of
access i guess
just a follow-up and please do correct me if i'm wrong here my impression was
also that the onion encryption that's used
uh to hide content as it moves the network is also distinct
and so isps i believe for an eye users isp should be able to
identify if a particular user is firing up tor was my impression i may be
wrong but yeah so an isp will have knowledge
yeah if someone for someone visiting tour there are some methods of access
where it's a bit more difficult to determine but yeah for the vast majority
of users the isp will be able to identify they're
using tor so it's a really good example of this um i think it was at mit
is it mit or harvard of a chap and was due to satisfy his final exams
and um i presume had been out partying and under revision or whatever
so he married a bomb threat into internality to get the exam canceled the
exam was cancelled um mit knew
the email had come through tour but of course tor hides who it was and with our
first assumption was well i mean who wants to get an exam
cancelled right this is possibly the student the set of students that are
taking the exam first of all so then they went to their network
systems and said okay well who in the in the university was connecting to tour
at the time this email was set and i think there were like two or three
people and they just went and knocked on the
door and said hey was it you that sent the bomb threat and the guy's like oh no
how did you find me oh we just admitted it
yeah so there are yeah yes you know you don't necessarily get that i'll give it
to you and then so so following that that thread so as
far as isp's potentially identifying individuals why
in terms of maybe policy level have you not seen or have
have we seen countries uh working with private industry
to just being able to sort of say hey listen we would like access
to information that we can use to identify people on on the dark web
what sort of collect statistics or something over who's using it
um well yeah like you said isps can you know determine potentially
who using tor right and while using tor is not illegal
like it's like using a cell phone you can use cell phone for legal and legal
illegal things and transactions and stuff like that
so i'm not sure how useful the just knowing that someone's using tor
unless you have some context it's not necessarily that exactly so
you have contextual you know evidence to you know you hope that this is
sort of another medium to follow that follow an individual or
you know an entity so to speak yeah i mean i guess if you're if you're in a
regime where the law is less rigid and you don't want
activists then you know the fact that someone's using
torn may very well be enough evidence just to put them in prison
so you don't need the certainty of something well or they don't need the
certainty in some circumstances to do that i guess from an
organization's point of view you know having knowledge of who's
connecting to tour in the organization is really useful because someone could
be trying to exfortrate secrets you know corporate
documents and those sorts of stuff and tour
and likewise having knowledge of traffic coming into your network from tor is
also useful um it's relatively easy to do that
there's a public list of relays and you can just filter for traffic
coming from to and from those relays so i'll come take a second
thanks for your talk has there been any effort to create different versions of
tor that would provide some of the benefits but then if you
applied some of your policy proposals to filter out some of the negative effects
i really thought about doing that actually in 2015 was
was splitting forking the tour project and um
essentially having an ethical version but i didn't think it would get much
traction so i didn't bother
as a cynical view maybe i was just going to say sort of in
response to this gentleman's question i suspect at least that in the u.s
if the government wanted verizon or comcast or someone to give them a list
of all of the customers who were visiting the tor network they would need
a subpoena i'm sorry they need a warrant they'd need a national security letter
they'd need something right there's going to be some
protections in u.s law that would prevent that company from just
turning over all of that information you know just blindly saying oh well we
suspect somebody in this group is doing something wrong so give us information
on a million people yeah i mean that's the the
proportionality test i guess is the the test essentially talking about isn't
it so yeah and wouldn't it be the case in terms of
like an alternative tour um
the benefits if any come from it such as using it
in a repressive regime only works if there's a lot of users right if there's
only 15 people using it if i'm using tor yeah what what what
motivation do i have to use the ethical version
i mean the the view is i think that you would transition people running the
relays to the ethical version and then that would affect all users
regardless of which version of tor they're using as long as it used the tor
network but um and that still could be done today
um i don't know why they don't do it um just seems like such an easy way from
from my point of view um
um would you please go back to the slide uh with the nation the by nation list
between these two lists is it something about
national policy regimes in various countries
russia engaged
skills and
i don't know um there are anonymous statistics
i don't know anything about the users that are using them i mean
um you know there's 100 1578 in the uae um this could be privacy
activists it could be private entities crawling the dark net
for threat intelligence you know it could be government calling it
i have no idea who they are or what they're using it for
when the suggestion is that if not on the right hand side of this list
because they're using sort of an anti-censorship technique to access the
tour that they're in a country where you know
access is slightly more restricted but in terms of technical difficulty to be
on the right hand side of this list it's not enormously harder to go on the
right hand side as it is to be on the left-hand side here
so not today anyway um um can you help us understand you mentioned
one of the policy options may be to block certain
types of websites
for example um if that were to be implemented i mean how
what's the uh what's the implementation piece
who makes these decisions or do you interact with
to negotiate to switch that policy so without understanding that i don't
understand
how any particular category okay so you're asking me how would you
go about implementing it you know who has control to do this type of
and think thing some practicality to it the first question is how to negotiate
so establishes the policy
so the tour project have the control i mean to implement the block list
as long as sort of the participants within the network deploy the changes
to it so it's the tall project that have the ability to do it
so it's essentially about influencing them into agreeing to it their stance to
me four years ago was just a resounding no
um the government contributes quite a big
chunk of their funding and i thought that would be a good way
to drive something like that especially as i don't think it's that objectionable
certainly not to sort of an average person i don't think
it's that objectionable i mean people within the tour project might take
objection to it um just on sort of a principle of no censorship of any kind
uh type viewpoint um
and that's one route i might try so you know the condition of the funding is
that you you implement this
okay
okay so you have this browser looks just like firefox
if you type in a web address in here which you can access through a normal
web browser you're using tor just regularly to
access that website anonymously if the web address you type in there
ends in dot onion then you're accessing the dark web and
then both you and the site are anonymous to each other
and that's that's the from the user experience that's the difference between
the two and if you're following links and stuff
you know you may not even notice the transition
unless you're looking in the address bar where the url is you may not even notice
the transition from an open site to a dark net site you know
that's the sort of experience is very similar
um it's almost it's identical essentially
sure yeah okay okay i think that's it for uh
one more question um not a question just if we could get everyone to use the
microphones having a very hard time hearing responses and questions
okay and that wraps it up thank you very very much