Tor does not stink: Use and abuse of the Tor anonymity network from the perspective of law

Computer Law and Security Review

Volumn 32, Issue 1, 2016, Pages 111-127

  Minárik, Tomáš ^a   Osula, Anna Maria ^a  

^a NATO Cooperative Cyber Defence Centre of Excellence   (Estonia)

Author keywords

Anonymity; Content liability; Criminal investigation; Evidence; Freedom of expression; Human rights; Personal data; Privacy; Tor; Tor exit node

Indexed keywords

CRIME; DATA PRIVACY; LAW ENFORCEMENT; SOCIAL ASPECTS;

ANONYMITY; CRIMINAL INVESTIGATION; EVIDENCE; FREEDOM OF EXPRESSION; HUMAN RIGHTS; TOR; TOR EXIT NODE;

LAWS AND LEGISLATION;

EID: 84957849367     PISSN: 02673649     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.clsr.2015.12.002     Document Type: Article

References (113)

1. "Tor Stinks" presentation The Guardian 4 October; 2013 http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document accessed 19 September 2014
2. J. Ball, B. Schneier, and G. Greenwald NSA and GCHQ target Tor network that protects anonymity of web users The Guardian 2013 4 October http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption
3. BBC News Austrian police raid privacy network over child porn http://www.bbc.com/news/technology-20554788
4. T. Brewster New UK cyber police chief: we need skills to de-anonymise Tor crooks TechWeekEurope 2013 10 October http://www.techweekeurope.co.uk/news/tor-anonymisation-nccu-cyber-crime-129249
5. E. Çalişkan, T. Minárik, and A.-M. Osula Technical and legal overview of the Tor anonymity network 2015 NATO Cooperative Cyber Defence Centre of Excellence Tallinn https://ccdcoe.org/multimedia/technical-and-legal-overview-tor-anonymity-network.html
6. R. Chirgwin Princeton boffins sniff Tor users' IDs from TCP ACKs and server sweat The Register 2015 16 March http://www.theregister.co.uk/2015/03/16/raptor-another-way-to-snoop-on-tor-users/
7. CJEU C-291/13; Sotiris Papasavvas v O Fileleftheros Dimosia Etaireia Ltd and Others http://curia.europa.eu/juris/document/document.jsf?docid=157524&doclang=EN
8. CJEU C-293/12; Digital Rights Ireland and Seitlinger and Others http://curia.europa.eu/juris/liste.jsf?num=C-293/12
9. Columbia Insurance Company, Plaintiff, v. Seescandy.com; Sees Candys, Web Service Provider, No. C-99-0745 DLJ, United States District Court for the Northern District of California, 185 F.R.D. 573; 1999 U.S. Dist. LEXIS 12652; 51 U.S.P.Q.2D (BNA) 1130; March 8 http://cyber.law.harvard.edu/property00/domain/Sees.html
10. Consolidated version of the Treaty on the Functioning of the European Union http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:12012E/TXT
11. L. Constantin Rogue, malware-spewing Tor exit node tied to cyber espionage group http://www.pcworld.com/article/2848292/malware-served-through-rogue-tor-exit-node-tied-to-cyberespionage-group.html
12. Convention for the Protection of Human Rights and Fundamental Freedoms a'European Convention on Human Rights' (ECHR), Rome; 4 November; 1951; ETS No. 005, as amended http://www.echr.coe.int/Documents/Convention-ENG.pdf
13. Convention on Cybercrime Council of Europe Convention on Cybercrime, List of Signatories and Ratifications http://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/185 2001
14. J. Cook There's Already a Silk Road 3.0 http://www.businessinsider.com/theres-already-a-silk-road-30-2014-11
15. J. Cook Tor director claims some government agents are secretly helping him, undermining intelligence operations Business Insider 2014 22 August http://www.businessinsider.com/tor-director-says-intelligence-agents-tips-him-off-2014-8
16. Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p 60-71.
17. Council of Europe Declaration on freedom of communication on the Internet (Adopted by the Committee of Ministers on 28 May 2003 at the 840th meeting of the Ministers' Deputies) https://wcd.coe.int/ViewDoc.jsp?id=37031
18. Council of Europe Recommendation No. R (2000) 7 of the Committee of Ministers to Member States on the right of journalists not to disclose their sources of information Adopted by the Committee of Ministers on 8 March; at the 701st meeting of the Ministers' Deputies http://www.coe.int/t/dghl/standardsetting/media/doc/cm/rec(2000)007&expmem-EN.asp 2000
19. Council of Europe The Margin of Appreciation https://www.coe.int/t/dghl/cooperation/lisbonnetwork/themis/echr/paper2-en.asp
20. Cybercrime Convention Committee (T - CY) Ad-hoc Subgroup on Transborder Access and Jurisdiction Council of Europe T-CY Guidance Note #3: Transborder Access to Data (Article 32), Draft for Discussion 2013
21. R. Dingledine Trip Report: Tor Trainings for the Dutch and Belgian Police https://blog.torproject.org/blog/trip-report-tor-trainings-dutch-and-belgian-police
22. R. Dingledine, and J. Appelbaum C3TV - The Tor Network: We're Living in Interesting Times 12 http://media.ccc.de/browse/congress/2013/30C3---5423---en---saal-1---201312272030---the-tor-net work---jacob---arma.html 2013
23. R. Dingledine, N. Mathewson, and P. Syverson Tor: The Second-Generation Onion Router http://www.onion-router.net/Publications/tor-design.pdf
24. Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, OJ L 178, 17.7.2000, p 1-16.
25. Directive 2002/58/EC of the European Parliament and of the Council concerning 'the processing of personal data and the protection of privacy in the electronic communications sector' (Communication Privacy Directive) OJ L 201/37
26. Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ L 105, 13.4.2006, p 54-63.
27. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p 31-50.
28. Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on Information Society services, OJ L 204, 21.7.1998, p 37-48.
29. ECHR http://www.echr.coe.int/Documents/Convention-ENG.pdf
30. Electronic Frontier Foundation https://www.eff.org/torchallenge/
31. Electronic Frontier Foundation The Legal FAQ for Tor Relay Operators https://www.torproject.org/eff/tor-legal-faq.html.en
32. L. Essers Tor exit node operator convicted of abetting spread of child porn http://www.pcworld.idg.com.au/article/549645/tor-exit-node-operator-convicted-abetting-spread-child-porn/
33. Estonian Penal Code RT I, 12.03.2015, 7; entry into force 01.05.2015.
34. Ethiopia Introduces Deep Packet Inspection https://blog.torproject.org/blog/ethiopia-introduces-deep-packet-inspection
35. European Court of Human Rights European Convention of Human Rights http://www.echr.coe.int/Documents/Convention-ENG.pdf
36. European Parliament Parliamentary questions, Answer given by Mr Barrot on behalf of the Commission 16 April http://www.europarl.europa.eu/sides/getAllAnswers.do?reference=E-2009-0969&language=EN 2009
37. European Parliament Parliamentary questions, Answer given by Mrs Reding on behalf of the Commission 16 October http://www.europarl.europa.eu/sides/getAllAnswers.do?reference=E-2009-4374&language=EN 2009
38. European Union Agency for Fundamental Rights and Council of Europe Handbook on European Data Protection Law p 144 www.echr.coe.int/Documents/Handbook-data-protection-ENG.pdf 2014
39. EUROPOL Press Release: Global Action Against Dark Markets on Tor Network https://www.europol.europa.eu/content/global-action-against-dark-markets-tor-network
40. EUROPOL: About Us https://www.europol.europa.eu/content/page/about-us
41. D. Francis Spies Like Us: Germany Spies on Allies, Too http://thecable.foreignpolicy.com/posts/2014/08/18/spies-like-us-germany-spies-on-allies-too
42. Gallagher S.; Law enforcement seized tor nodes and may have run some of its own ArsTechnica http://arstechnica.com/security/2014/11/law-enforcement-seized-tor-nodes-and-may-have-run-some-of-its-own/
43. German Federal Constitutional Court, Judgment of 27 February 2008 - 1 BvR 595/07.
44. German Federal Court of Justice Vorlage an Den EuGH in Sachen "Speicherung von Dynamischen IP-Adressen" http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2014&Sort=3&nr=69184&pos=1&anz=153
45. D. Gilbert Iraq Crisis: government blocks access to tor project following ISIS insurgency International Business Times 2014 16 June http://www.ibtimes.co.uk/iraq-crisis-gvoernment-blocks-access-tor-project-following-isis-insurgency-1452879
46. Graham Templeton The Silk Road 2.0 is Now Bigger and Better than Ever Before: What's the FBI to Do? http://www.extremetech.com/extreme/182083-the-silk-road-2-0-is-now-bigger-and-better-than-ever-before-whats-the-fbi-to-do
47. A. Greenberg End of the Silk Road: FBI Says it's Busted the Web's Biggest Anonymous Drug Black Market http://www.forbes.com/sites/andygreenberg/2013/10/02/end-of-the-silk-road-fbi-busts-the-webs-biggest-anonymous-drug-black-market/
48. A. Greenberg Laura Poitras on the Crypto Tools That Made Her Snowden Film Possible http://www.wired.com/2014/10/laura-poitras-crypto-tools-made-snowden-film-possible/
49. S. Greer The margin of appreciation: interpretation and discretion under the European convention on human rights Human rights files No. 17 2000 Council of Europe Publishing http://www.echr.coe.int/LibraryDocs/DG2/HRFILES/DG2-EN-HRFILES-17%282000%29.pdf
50. T.-I. Harbo The function of proportionality analysis in European law 2015 Brill Nijhoff 10.1163/9789004289475
51. A. Hern How has David Cameron caused a storm over encryption? The Guardian 2015 15 January http://www.theguardian.com/technology/2015/jan/15/david-cameron-encryption-anti-terror-laws
52. K. Hill How did the FBI break Tor? Forbes 2014 7 November http://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-law-enforcement-break-tor/
53. C. Hoffman HTG Explains: Is Tor Really Anonymous and Secure? http://www.howtogeek.com/142380/htg-explains-is-tor-really-anonymous-and-secure/
54. J. Hruska Russia might ban Tor and virtual private networks http://www.extremetech.com/computing/199231-russia-might-ban-tor-and-virtual-private-networks
55. M. Husovec Munich Court Asks CJEU About Injunctions Against Operators of Open WiFis http://www.husovec.eu/2014/10/munich-court-asks-cjeu-about.html
56. P. Hustinx Protection of personal data on-line: the issue of IP addresses Revue Légicom 2009 https://secure.edps.europa.eu/EDPSWEB/webdav/shared/Documents/EDPS/Publications/Speeches/2009/09-04-15-adresses-IP-EN.pdf
57. International Covenant on Civil and Political Rights New York; 16 December; 1966; 999 UNTS 171 (ICCPR) http://www.ohchr.org/EN/ProfessionalInterest/Pages/CCPR.aspx
58. B.-J. Koops Police investigations in internet open sources: procedural-law issues Comput Law Secur Rev 29 2013 654 665
59. B.-J. Koops, C. Cuijpers, and M. Schellekens Analysis of the Legal and Ethical Framework in Open Source Intelligence EU FP7 2011 p 20
60. B.-J. Koops, J.-H. Hoepman, and R. Leenes Open-source intelligence and privacy by design Comput Law Secur Rev 29 2013 676 688
61. M. Lee Ed Snowden taught me to smuggle secrets past incredible danger. Now I teach you https://firstlook.org/theintercept/2014/10/28/smuggling-snowden-secrets/
62. T. Lokot Belarus bans tor and other anonymizers Global Voices 2015 25 February http://globalvoicesonline.org/2015/02/25/belarus-bans-tor-and-other-anonymizers/
63. Moody, Famiglietti & Andronico, LLP Tor Project Financial Statement 2013 and 2012 https://www.Torproject.org/about/findoc/2013-TorProject-FinancialStatements.pdf
64. J. Mullin Silk Road 2.0, infiltrated from the start, sold $8M per month in drugs http://arstechnica.com/tech-policy/2014/11/silk-road-2-0-infiltrated-from-the-start-sold-8m-per-month-in-drugs/
65. National crime agency wages war on Tor "Darknet" anonymity Telegraph 10 October; 2013 http://www.telegraph.co.uk/technology/internet-security/10369880/National-Crime-Agency-wages-war-on-Tor-darknet-anonymity.html?mobile=basic
66. C.A. Newman After the silk road conviction, tor must be protected The Guardian 2015 19 February http://www.theguardian.com/media-network/2015/feb/19/after-the-silk-road-conviction-tor-must-be-protected
67. P.H. O'Neill Iran blacklists Tor network, knocking 75 percent of users offline http://darkwebnews.com/news/iran-blacklists-tor-network-knocking-75-percent-users-offline/
68. P.H. O'Neill The darkest net http://kernelmag.dailydot.com/issue-sections/features-issue-sections/10407/history-child-pornography/
69. Onion Routing http://www.onion-router.net/
70. Operator of Silk Road 2.0 Website Charged in Manhattan Federal Court FBI Press release http://www.fbi.gov/newyork/press-releases/2014/operator-of-silk-road-2.0-website-charged-in-manhattan-federal-court
71. P. Paganini Hacking Tor and Online Anonymity http://resources.infosecinstitute.com/hacking-tor-online-anonymity/
72. K. Poulsen FBI Admits It Controlled Tor Servers Behind Mass Malware Attack http://www.wired.com/2013/09/freedom-hosting-fbi/
73. Report of the Office of the United Nations High Commissioner for Human Rights The right to privacy in the digital age http://www.ohchr.org/en/hrbodies/hrc/regularsessions/session27/documents/a.hrc.27.37-en.pdf
74. Request for a preliminary ruling from the Landgericht München I (Germany) lodged on 3 November 2014 - Tobias Mc Fadden v Sony Music Entertainment Germany GmbH http://curia.europa.eu/juris/document/document.jsf?text=&docid=161644&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=150051
75. Russia offers $110,000 Tor bounty BBC News http://www.bbc.com/news/technology-28526021
76. J. Scheckter The DMCA Safe Harbor Remains Intact After Viacom v. YouTube http://sunsteinlaw.com/the-dmca-safe-harbor-remains-intact-after-viacom-v-youtube/
77. M.N. Schmitt Tallinn manual on the international law applicable to cyber warfare 2013 Cambridge University Press
78. B. Schneier Anonymity and the Internet https://www.schneier.com/blog/archives/2010/02/anonymity-and-t-3.html
79. B. Schneier How the NSA Attacks Tor/Firefox Users with QUANTUM and FOXACID https://www.schneier.com/blog/archives/2013/10/how-the-nsa-att.html
80. C. Sogholan Researchers Could Face Legal Risks for Network Snooping Cnet; 24 July http://www.cnet.com/news/researchers-could-face-legal-risks-for-network-snooping 2008
81. SS Lotus, Fr v Turk, 1927 PCIJ (ser A) No 10, at 4 (Decision No 9) (Permanent Court of International Justice).
82. The Invisible Internet Project https://geti2p.net/en/
83. The Telegraph Angela Merkel: spying between friends is unacceptable http://www.telegraph.co.uk/news/worldnews/europe/germany/10403437/Angela-Merkel-spying-between-friends-is-unacceptable.html
84. Thoughts and Concerns about Operation Onymous https://blog.torproject.org/blog/thoughts-and-concerns-about-operation-onymous
85. Tor Abuse FAQ https://www.torproject.org/docs/faq-abuse.html.en
86. Tor Annual Report 2012 https://www.Torproject.org/about/findoc/2012-TorProject-Annual-Report.pdf
87. Tor FAQ: So I'm totally anonymous if I use Tor? https://www.torproject.org/docs/faq.html.en#AmITotallyAnonymous
88. Tor Metrics - Direct users by country https://metrics.torproject.org/userstats-relay-country.html
89. Tor metrics - relays and bridges in the network Tor Project https://metrics.torproject.org/networksize.html
90. Tor Project website How to read our China usage graphs https://blog.torproject.org/category/tags/china
91. Tor Project https://www.torproject.org/
92. Tor Project Bittorrent over Tor isn't a good idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea
93. Tor Project Tor Plus VPN https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN
94. Tor Reduced Exit Policy https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy
95. Tor Sponsors https://www.Torproject.org/about/sponsors.html.en
96. Tor Users https://www.torproject.org/about/torusers.html.en
97. Tor wiki List Of Services Blocking Tor https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor
98. Tor Quick Summary of recent traffic correlation using netflows https://blog.torproject.org/blog/quick-summary-recent-traffic-correlation-using-netflows
99. Tor: Overview https://www.torproject.org/about/overview
100. D.A. Tysver ISP Liability http://www.bitlaw.com/internet/isp.html
101. UK Parliamentary Office of Science and Technology The Darknet and Online Anonymity POST note 488 http://www.parliament.uk/briefing-papers/POST-PN-488.pdf 2015
102. United Nations General Assembly Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue A/HRC/23/40 http://www.ohchr.org/Documents/HRBodies/HRCouncil/RegularSession/Session23/A.HRC.23.40-EN.pdf
103. United Nations General Assembly A/HRC/29/32; Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, David Kaye http://www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session29/Documents/A.HRC.29.32-AEV.doc
104. United Nations Office on Drugs and Crime Comprehensive Study on Cybercrime February http://www.unodc.org/documents/organized-crime/UNODC-CCPCJ-EG.4-2013/CYBERCRIME-STUDY-210213.pdf 2013
105. Universal Declaration of Human Rights (New York; 10 December; 1948; UNGA Res 217 A(III) (UDHR) http://www.un.org/Overview/rights.html
106. Van Eecke P., Truyens M.; Liability Legal analysis of a single market for the information society (SMART 2007/0037) p. 39; Chapter 06 http://ec.europa.eu/information-society/newsroom/cf/dae/itemdetail.cfm?item-id=7022
107. Versatile InfoRmation Toolkit for End-Users Oriented Open-Sources explOitations (VIRTUOSO http://www.virtuoso.eu/
108. Voskuil v. the Netherlands; no. 64752/01, ECHR; 22 November; 2007 http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-83413
109. I. Walden Computer crimes and digital investigations 2007 Oxford University Press
110. I. Walden Privacy and data protection C. Reed, J. Angel, Computer law: the law and regulation of information technology 7th ed 2011 Oxford University Press Oxford
111. K.D. Watson The Tor network: a global inquiry into the legal status of anonymity networks Wash. U. Global Stud. L. Rev 11 2012 715 http://digitalcommons.law.wustl.edu/globalstudies/vol11/iss3/6
112. William Weber's blog 2 July; 2014 https://rdns.im/court-official-statement-part-1
113. Working Party 29 Working Document on Surveillance of Electronic Communications for Intelligence and National Security Purposes 14/EN WP 228 24 http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp228-en.pdf 2014