Privacy Highlight: Keynote with Roger Dingledine (Tor)

okay so I've got a little bit of time and way too many topics to talk about and some very bright lights so I'm gonna try to introduce a bunch of different things for you to think about over the next couple of hours as we do a bunch of panels so hi I'm Roger from Tor we're a non-profit we write privacy software uh we're it's open source uh it's an open network one of the fun things about Tor is the community around the world of developers and researchers we're a US 501c3 non-profit we've got millions of users who use it every day and we're part of the larger ecosystem of Internet Freedom privacy anti-censorship research okay so the first thing to think about when you're trying to think about a privacy system what's the threat model what sort of attacker are you imagining and so we've got Alice over here she's trying to browse the web to some website Bob where can the attacker be maybe the attacker is watching Alice's local network maybe it's Starbucks or the Tunisian internet agency or maybe the attacker is part of the network in the middle they're trying to infiltrate or run proxies or the take over part of the internet or maybe the attackers on the destination side maybe they're watching Wikileaks and they're trying to figure out who talks to them or maybe the attacker is the destination maybe at CNN and you want privacy from them so they don't get to build a database of what news articles you read so what are the other key Parts anonymity is not the same as encryption encryption is good you should use encryption but even when you're using encryption somebody watching you still gets to learn who you're talking to when you're talking to them how much you're talking to them and that's actually like the CIA doesn't try to break encryption at this point they build the social graph of who's talking to who they try to figure out who's in the middle of that social graph and then they break into your house and steal your laptop or or other attacks like that so how many people here recognize creepy NSA dude I see some hands okay so yeah there's this uh crazy or normal phrase from creepy NSA dude a couple years ago we kill people based on metadata and he just said it matter-of-factly like that's the the most ordinary thing in the world so Communications metadata is exactly what I'm talking about today and it didn't end there they've been hassling organizations like Facebook to become scared of rolling out end-to-end encryption so that back door versus protecting your users question is one that we're going to be talking a lot about today okay I actually only use the word anonymity when I'm talking to other researchers when I'm talking to my parents and and other ordinary citizens I tell them I'm working on a privacy system when I'm talking to Google and Walmart and other companies I work on communication security or network security because they don't care about privacy they don't know what anonymity is but security yeah they they do need that when I'm talking to governments military is law enforcement I work on traffic analysis resistant communication Networks and again it's the same security properties but if you go to the government and say I have a privacy system they don't know why they need that but if you explain that I have a mechanism for protecting against traffic analysis so you can send your Diplomat to Israel and nobody learns what her affiliation is when they're watching the hotel room now that's actually something they care about and then another category of people who who need this stuff are the human rights activists who are trying to get to BBC or other websites around the world and they can't get there so part of the fun of working on systems like Tor is getting all these different groups who need it for different reasons to blend together into the same anonymity set okay so how do you build one of these the easy answer is a centralized proxy like most VPN companies that you're used to where all the users send their traffic into the central point and it all comes out and the first problem there is uh what if that company is is going bad what if it wants to sell your data and so on and it's worse than that because even if that company is good there's still a central point where if you get to watch the traffic going in you can match it up with the traffic going out and it's pretty straightforward so years ago I was talking to one of these anonymizer companies and he was saying we never answer subpoenas if we ever answer to subpoena nobody would trust us ever again so of course we never answer subpoenas and then I was doing a talk for the U.S Department of Justice a year or so later and they're like why can't you be like anonymizer.com it's easy we send them a subpoena they send us an answer it's easy why can't you be like that so I I don't say this to pick on a particular VPN company the problem is the architecture the problem is the centralization it's the Privacy by by promise privacy by trust they have all the data they promise not to screw you and there's no way for you to be able to know whether they're going to follow through on those promises or not so the idea for Tor is distributed trust decentralized so there's no single place that knows both you and what you're doing so now it's about privacy by Design it's about the architecture of the system keeping you safe rather than about having a central Corporation and hoping that they follow through okay and the tour network has grown quite a bit over the past many years if you zoom back in time the graph also looks uh up and to the right so another thing that we've been wrestling with how do you measure the the safety that comes from from using Tor so one answer is the more volunteer relays we have all around the world the safer it becomes because the more relays we have the harder it is to be in a position to watch enough of them but another answer is diversity of why people use it we have hundreds of thousands of people in Iran using Tor right now and if they were all hardcore political dissonance that would be bad news for all of them the reality is that almost all of them are people who are looking at their web comics or their pictures of cute cats on Facebook and that got censored so now they're using Torah to get around the censorship and that ordinariness is critical to their security the fact that most people who are using Tor in a given situation are not the sorts of people that the attacker wants to collect is critical to safety okay so there's another piece I talked about Tor the network level privacy there's a second piece to what Tor is which is the web browser level the application Level privacy and that's things like cookies and what languages you prefer and what fonts you have installed and so on so the Tor Browser tries to protect all of that at the application layer and that's important for any application that's trying to use Tour all the cryptocurrency things out there long ago BitTorrent wrote your IP address in the application Level traffic so if you send your BitTorrent traffic over tour Tor does its job it anonymously sends your IP address to the other side that may not be what you had in mind so there's another fun piece of the browser side DuckDuckGo did a study a while ago on what people think private browsing mode is and many of them think it is what Tor Browser does they are mistaken private browsing mode only protects like somebody looking at the disk after you used that computer but there are systems like Brave that are integrating tour to make their private browsing mode actually private okay so there are a couple of lessons that I'd like us to think about over the course of today one of them is transparency so yes we're open source we're free software we give you design documents we give you specifications we say hi I'm Roger from Tor uh that transparency is critical to building a community that you can trust and always there's somebody in the audience who's like oh haha the anonymity people are talking about transparency haha uh no privacy is about choice and we choose to be transparent in order to be more trustworthy in order to be able to build grow sustain a community of people who who know each other and trust each other So speaking of growing that Community that's also a topic we're going to talk about in the panels today uh there are a bunch of different approaches to building your volunteer ecosystem do you do the cryptocurrency thing where you try to like let's make a market out of it let's assume capitalism is the right way to build things uh or do you take the anarchist approach where you assume that altruists will help you out funding is tied into this also do you do you get government funding do you charge your users do you try to create a cryptocurrency those are all crummy for different reasons uh happy to chat about that speaking of community Framing and getting high profile users and having them be the sorts of people that that people think of when they think of your tool is is an important step and we'll talk about that more in the plausible deniability panel but Ed is one of the higher profile users of Tor and the fun thing about that we only know that he used Tor because he told us so there are a lot of people out there successfully using Tor who haven't mentioned it to us we can't put them on a slide as a case study another uh more messy example there's a fella named olabini in Ecuador who is being prosecuted for basically being in the wrong time at the wrong place with the wrong friends and he has recently been declared innocent which is awesome but one of the reasons why I got involved as an expert witness there is he used Tor as part of the claim that they had against him so we got to try to teach the judges there what tour is why it's ordinary why everybody uses it all the time okay so another thing technology is not neutral so power imbalances are Central to how tour works and why tour is important if you are a vulnerable person tore is more useful for you than if you're a government or a large organization and I think this this framing originally came from Harry a while ago technology is not neutral technology is inherently political if you don't think through the impact of your tool you're going to accidentally end up reinforcing the existing power structures so if you want to build a decentralized thing that is more useful for vulnerable people then you need to think through how to build that decentralized tool and that doesn't mean that we need to like or endorse all the people who use our system Somewhere Out There are who are trading child exploitation stuff and if they use Tor their screw you I don't want you doing that you're hurting my system you're hurting the other people who need good privacy for the system so there's definitely a discussion to be had around absolute Free Speech Boo versus how do you frame things how do you community build but the the other important point there the system needs to not have back doors the system has to be agnostic about what sort of user is using it but that that's very different than how we how we frame it how we talk about it which users we highlight So speaking of crypto Wars I think we've got a panel on that coming up soon one of the things we need to do is look at the win that we got from https so 10 15 years ago everybody's using HTTP no encryption and now it's normal your bank does it everybody expects it ever like your browser pops up a thing saying there's not encryption this is bad something's gone wrong so at the same time while that debate was happening the NSA reveal came out and and we learned that the NSA watches you more carefully if you use encryption or they store your traffic for longer if you use encryption and at the same time we learned that maybe they record traffic from Tor users longer because they can recognize that it's torque so at the time we had some people saying oh man I'm not going to use Tor because I hear the NSA watches you more if you're going to use Tor so imagine me coming here and saying I'm not going to use https because I hear people look at me more when I use encryption so I'm going to not have any encryption and that'll keep me safe that's crazy talk nobody would would say that so part of the challenge we have in the communications metadata question is how do we get to the point where all of this is normalized enough that everybody expects to be protected against traffic analysis against people looking at their metadata and then the other piece of that is we need as many ordinary users doing ordinary things normalizing this as we can this was actually a blog post by Facebook a couple of years ago talking about how they looked at their data set to find out that millions of people are logging into Facebook each month over tour and you you need that ordinariness in the system okay another topic that I've only got one slide for is about censorship censorship implies surveillance if you are in Tunisia or Australia or wherever censoring is happening they're watching you to learn whether they want to allow you to get to that website or not so there's also a recurring theme where palantir Cisco blue coat Intel and so on these Western companies are the ones building the oppression tools that then get deployed in Syria and Saudi Arabia and so on and censorship is becoming more common around the world we've got Sweden Denmark the Netherlands Belgium England they're all excited about censoring the internet they're all rolling out their censorship infrastructure so we've got a lot of policy work to be done there it's not just Iran and Russia and so on another key thing to think about in terms of how to be safer is the Privacy research so we have a huge community of people around us who are in Academia who are doing privacy research uh trying to attack Torah trying to understand Torah trying to improve tour because uh Torah is hard to break so that's where the fun challenge is and that's where the respect comes from when you write your research paper and the the flip side of that is that we need to help them clarify identify research papers and so on problems that we need solved okay and then for the last thought and I'd be happy to chat more about any of these calls to action understand the risks of centralized architectures I think in the cryptocurrency space you're pretty good at knowing decentralization is important let's all think more about the slippery slope that is internet censorship I didn't talk much about it in the 15 minutes but there's a lot more to talk about help us with the Privacy research there's a conference called petsymposium.org volunteer with Torah Run part of the infrastructure a relay a bridge snowflake is one of the anti-censorship approaches we've got and we're a nonprofit so feel free to donate and with that I am out of time and I'm going to hand it to the next panel thank you [Applause]