Wisconsin Public Television University Place  Computers, Privacy and the Government: The Tor Network  Roger Dingledine  3/12/13 UP846  cc >> Good evening and welcome to Science in the Public for 2013. I'm Eric Schatzberg. I'm the director of the Robert F and Jean E Holtz Center for Science and Technology Studies at the University of Wisconsin Madison. Science in the Public, as well as the Holtz Center's programs, are funded entirely entirely by a generous bequest from the estate of Robert and Jean Holtz. Robert Holtz was an alumnus of the UW College of Engineering, and he made this bequest to encourage just the kind of event we're having today. Bob Holtz believed in promoting better public understanding of science and technology. This program is one way that the Holtz Center fulfills its mission. To introduce tonight's topic and speakers, I'll turn the microphone over to this year's event organizers. They are Alan Rubel, faculty member in the School of Library and Information Sciences, and Tom Ristenpart, a faculty member in computer sciences. >> Thank you very much. 

So, I'm Tom Ristenpart, and I'll just be introducing Roger Dingledine, who's going to be our first speaker, and then Alan will introduce our second speaker. And what we'll do is we'll have two talks, each about 40-45 minutes. We'll, between the first and second talk, have a few minutes for questions, but really try  and get the second talk going, and then we'll have open questions at the end from the audience. So, it's my pleasure to introduce Roger Dingledine. He is the director of the Tor Project. He did his bachelor's and master's at the Massachusetts Institute of Technology. For his master's thesis he did work on the Free Haven Project, which was an early system for doing censorship resistant storage of data on the internet. Since then, he's been very active working in the Tor Project. He was one of the original authors of the system. It's used all over the world now. 

There's more than 500,000 users making use of it for privacy enhancing communications online. And so, I'll stop talking now. We'll have Roger come up and give a talk about that. Thank you. Let's welcome him. [APPLAUSE] >> Does this work? Can you hear me? Test, test. Okay, perfect. We should probably mute this so that you don't get some sort... [INAUDIBLE]  Okay, great. >> That's what I'm here for. 

>> Let's stick with what we've got. It works. Okay, so, I'm Roger Dingledine, and I'm going to tell you a little bit about lots of different pieces of Tor. So, Tor is free software. It's a program that you can install on your computer, and the idea is it routes through a network of volunteers so that somebody watching your local network can't figure out which internet destinations or websites you're going to. Somebody at the website end can't figure out where you're coming from. And no single volunteer in the middle gets to learn both who and where you are and also what you're doing. So those are the three types of anonymity that we focus on, and I'll talk a little bit more about each of those as we go. So, Tor is lots of different things. It's the software I was talking about. 

It's the volunteer network. There are about 3,000 people who run relays around the world, and your Tor client builds a path through them. It's also a protocol. As researchers, we describe how you can build your own compatible Tor network, and several different groups have. One of the other fun things about Tor is the community of people all around the world. Basically, every city I go to these days has a professor with a research group and a grad student writing a paper about Tor, whether it's political science or computer science or law or all sorts of things. So, basically, everywhere around the world there are people excited and helping the Tor community. Another fun part about Tor is the diversity of funding we've had. We started out funded by the US Department of Defense. And from there we were funded by a civil liberties nonprofit in California called EFF, Electronic Frontier Foundation. 

So, it was fun getting both of those organizations to realize that they both cared about having Tor succeed even though they usually are at odds with each other in lots of ways. And from there we were funded by another US government group called the International Broadcasting Bureau. You've never heard of them, but you've probably heard of Voice of America, Radio Free Europe, stuff like that. And then we were funded by Google and NSF and the US State Department. We've recently gotten funding from the Swedish organization called Sida, which is the US aid equivalent, the foreign ministry. And we recently got funding from the Knight Foundation. They care a lot about journalists. They want us to help teach journalists, both in the US and abroad, how to not get into trouble from information security. So, that diversity of funding hopefully strengthens the community. So, Tor is also a 501(c)(3) nonprofit. 

We've got a couple of goals. The main goal is I want to build tools to keep everybody on the internet safe for all definitions of safe. And once I'm done with that simple goal, I also want to teach everybody in the world what it means to be safe. So, right now you get some set of tools in front of you, and somebody says use a VPN and somebody else says use Tor and somebody else says use encryption, nobody in the broader community has a good handle on how you evaluate these options and decide which one is appropriate. You've got a bunch of corporations trying to lie to you and make you use their product, so I'd like to give people the intuition about how to evaluate these things on their own so they can decide what counts as safe for their situation. And we've got some number of users, it's an anonymity system so I'm really not sure how many we have. [LAUGHTER] But I would say more than 100,000 and less than a million people are running Tor clients today. It's up in the many hundreds of thousands mark. Okay, so, this will be among the more complex slides, but I figured I should put a computer science piece into this. So, as a computer security person, one of the first questions we ask is, what's the threat model? What adversary do you expect? What's the problem you're trying to solve? So we've got Alice over here, and she's trying to browse the web to some website Bob, and the question is, where can the adversary be? What are we worried about? So, maybe the adversary is watching Alice's local network. 

Maybe that's the people running the Starbucks wireless network. Maybe that's the monopoly teleco in Tunisia. Anybody who gets to watch the user side. Or maybe the adversary is on the Bob side. Maybe it's somebody trying to watch WikiLeaks to try to figure out who is publishing documents to them. Or maybe the adversary is Bob. Maybe it's CNN.com, and they want to know who all of their users are and where they're coming from so that they can advertise to them better. Or maybe the adversary is somewhere in between. Maybe it's one of the large telephone companies like AT&T and, therefore, NSA because they have made a deal with AT&T. So there are a lot of different places that the adversary could be, and if they are in all of these places, we lose. 

I'll explain that a little bit more in a bit. Another important point. Anonymity is not encryption. I talk to a lot of corporations who say, well, yeah, that's nice, but I use a VPN so I don't need that Tor thing. I'm all set. Thanks. And you should use encryption. Encryption is good. But even when you're using encryption, somebody watching your traffic gets to figure out who you're talking to, how long you're talking, how much you're talking, when you're talking, and none of the intelligence  agencies try to break encryption anymore. It's all about let's build a social graph of who's talking to who. 

Let's find out who's in the middle of that social graph, and then we break into his house and steal his computer or look at it or whatever else is required in order to be able to break the system. Nobody tries to actually break the encryption anymore. There are always weaker links. And then there are other variations. There are a bunch of peer to peer file sharing systems on the internet that are more aimed on the plausible deniability, you can't prove it was me. And there are a few problems with that. One of them is maybe you can claim you can't prove it was me the first time, but the 40th time you're the one involved in the transaction and you keep saying you can't prove it was me this time either, that starts to get pretty bad. Especially if they line up 10 bloggers in Saudi Arabia and each of the 10 of them says you can't prove it was me, that's not good news for any of the 10 of them. I want something where the system is stronger than that. And then there are a bunch of what we call single-hop proxy systems. 

There are a lot of commercial anonymizers where they say, I promise I won't look at any of your traffic. So I'm relaying all the traffic, but I promise I won't look at it. Okay, okay, I look at all of it. I promise I won't log anything. I promise I won't write anything down. Okay, I log all of it. I promise I won't tell anybody what I'm seeing. And I don't know what the fourth line is, but I want something stronger than that. I was talking to the CTO of Anonymizer.com many years ago, and he was telling me we never answer subpoenas. If we ever answered a subpoena, nobody would trust us again. 

Our users would abandon us. Our business would disappear. So then I was doing a talk for the Department of Justice, and one of the lawyers interrupted me part way through and said, why can't you be like anonymizer? It's great. We send them a subpoena, they send us an answer. It's easy. Why can't you be like that? [LAUGHTER] So, one or more of them is bluffing. And part of the point is I have no idea which one. The design of the system should not be about privacy by policy or privacy by promises. It should not be the case that they could screw you and they promise not to. You need a technical architecture where they do not have the information. 

It's not a matter of they could but they try not to. It's a matter of because of the design of the system, there is nobody who knows both who you are and what you're doing. Okay, so, I actually only use the word anonymity when I'm talking to other computer science researchers. When I'm talking to my parents, I tell them I'm working on a privacy system because anonymity is kind of scary but privacy is a good American value. [LAUGHTER] When I'm talking to corporations like Google and Walmart, I work on network security or communication security. Again, it's the same system, it's the same security properties, but it depends on how they look at it. From the corporation side they say I want to be able to buy things online without somebody watching my network connection, learning who my suppliers are or who my collaborators are and so on. And when I talk to militaries and law enforcement, I work on traffic analysis resistant communication networks. And, again, it's the same system, same security property, but when you go to the military and you say, I have a security tool, they say, no, no, there are plenty of snake oil beltway bandits who sold us plenty of security; we don't need any more of that. But then when you say, I have a tool that lets your diplomat, when he goes to Israel, resist traffic analysis of neighboring countries, then they stop and they think and they say, wait a minute, I do need something like that and I don't have anything that does it right now. 

And then the fourth category is the reachability side. The people who say, I want to get to BBC or Facebook, and the government I'm in tries to censor those, so now this is a way to get around the censorship. So, part of the goal of Tor is to get all these different communities into the same network so that they can blend together. You can't have a cancer survivors anonymity system or everybody will know why you're using it, and suddenly you have less anonymity than you were hoping for. So the fact that we have FBI people and Russian activists in the same network is part of its strength. Okay, so, how do you build one of these? The easy answer is you put a big central computer somewhere and all of the various users ask for web pages, and it fetches them and hands them back. And that works great except it's a big centralized point of failure, so all you have to do is break in and you get to see everything or you send them a subpoena or you go steal their computer or you threaten them or you do a business deal with them. The list goes on and on of ways of single points of failure can fail. But it's worse than that. From a statistics perspective, all you have to do is look at the traffic flows going in and the corresponding traffic flow going out, and then you can say, wait a minute, these things match up, they look the same, I'm pretty sure that that user talked to that destination. 

And since these things are centralized, there's basically one wire going in to the computer, and it's the same wire coming out. And if you can tap that or ask somebody for a copy of the traffic going back and forth, then you can match up every user to every destination. And the math there is surprisingly easy. So, the goal of Tor is to distribute the trust over multiple relays so there's not single point that gets to learn about both where Alice is and where Bob is. And that means that if R1, if the first relay is evil, he sees that Alice is using Tor but he doesn't know what she's doing. And if R3 is bad, he sees somebody it talking to Bob, but he doesn't know who is talking to Bob. And if R1 and R3 are both bad and they get together and share notes, then we lose because R1 sees a certain traffic pattern, R3 sees, basically, the same traffic pattern, they can realize that it's the same user they're looking at. So, it's not perfect, but that means that the diversity of the Tor network is part of what provides the security or the anonymity. The more of these purple boxes we have, the more volunteer relays we have all around the world, the less attackers are in the right position to be able to match up incoming traffic to outgoing traffic. So far so good? Am I talking at a level that is too technically complex or too technically non-complex? Or just right? >> Just right. 

>> Just right. Okay, the Goldilocks question. [LAUGHTER] And there's crypto but I'm basically going to ignore that, except to point out a few things. One of them is the white lines over there between R3 and Bob are not encrypted. Tor does not magically encrypt the internet. This confuses a lot of our users because they think, I installed Tor, therefore everything is encrypted. Everything is encrypted between the users and the relay, but when it pops out of the Tor network, it comes out as whatever you put in. So, if you're in Starbucks and you're logging into your Facebook account, you should be using https:// to connect to Facebook, otherwise anybody in Starbucks can watch what you're doing. Same thing over Tor. If you're logging into Facebook over Tor, you should still be using https:// otherwise anybody between R3 and Facebook gets to watch you log-in and learn your password and what your friends are and so on. 

So, all of those rules that hopefully you've learned about using encryption when you're talking to websites that you're sending sensitive information to, you should also use those while you're using Tor. Okay. Okay, so, this is a graph over the past couple of years of the number of relays we had. So, we started with 1500 relays a few years ago, and we're up to about 3,000 relays. But this is the wrong graph to look at because the relay question is not the right one. The right one is, what's the capacity? How much bandwidth can these relays handle? And we started with a little under 500 megabytes per second on average in 2010, and we're up to 3500 megabytes per second on average of capacity. So, we've multiplied by seven the capacity of the network over the past couple of years. So, that's a good sign. On the other hand, the purple line is the load on the network. It's the number of those bytes that are actually used by people at a given time. 

And if you talk to a computer science networking person and you say, I'm using 80% of my network, what do you think? They will ask you how it possibly works at all because from their perspective once you're using more than about 20% or 30% of the network then it's all congested, everybody's unhappy with the performance, it basically falls over. We're way beyond that point, which means the Tor network is overloaded. We have far more people trying to use it than we have volunteer relays who can handle the capacity that they're trying to add. So that means that we need volunteers around the world, including people in this room. I've been talking to Tom, a professor here, who wants to set up a relay as part of his research. So the more relays we have, the more of these people that I was talking about and will talk about we can help to have free and safe communications. Okay, so, our story starts back in 2009 when Iran was, they first had an election and somebody won the election, but that person isn't actually in power. And there were a lot of people who were really angry in Iran that their election had been stolen, and a lot of people were, at that point they started filtering a little bit, so there were a lot of people using Tor to get around the filtering. I have China here on the same graph. So that was sort of the good news. 

Then, September of 2009, here's the bad news that follows that. In October 1 of 2009, China had the 60th anniversary of some dude becoming in charge in China, and they were really proud of that and they wanted to do a lot of censorship to make sure that they stayed in control, or at least they showed everybody that they were still in control. So they censored a lot of things One of the things they censored was the public Tor relays. So, those 3,000 relays I talked about, all of the Tor clients need to be able to get that list in order to use the Tor network So that means China can get the list and they can just put each one of them one at a time in their firewall roll and then, bam, no more Tor connections for you. So, fortunately, we had anticipated that. It's a public list. You have to figure that the adversary will get it eventually. So the fix that we had for that was what we call bridge relays. And the idea is it's the same software, it's mostly the same configuration, the only difference is the public relays are in a big list everybody sees and the private bridge relays are not given out to everybody at once. So the goal is you give a bridge address out to people who need them without letting the bad guys learn all of them. 

So that's still not a great arms race, but at least it's better than the previous arms race which was you publish everything and hope the bad guys don't see it. So, I'm going to skip over some of the details there, but there are a couple of ways you can block the Tor network. The first one is you block the IPs, as I described. Another answer is you look at the traffic flows. You say, the thing I'm looking at looks like https://. It looks like Firefox talking into Apache. But, actually, if I look really carefully, I can tell that it's Tor talking on the wire, not somebody browsing the web. So, if you can distinguish those, then you can filter the Tor traffic without filtering all the web browsing traffic. And I'll talk some more about examples of that. And then the fourth example, the fourth way is just block the website. 

And that's surprisingly effective because a lot of the people who are used to using censorships or convention tools think of them as web pages. So, they're used to going to the website and then using the website to get around the censorship. And when TorProject.org gets blocked, they say, well, that was nice. Tor used to work. Now it doesn't work. And the website gets blocked, but the Tor software still works fine. This is confusing for a lot of the users. So, this is a graphical demonstration of the bridge idea. The idea is let's get a bunch of the users to sign up as bridge relays and they don't have to be fast and they don't have to be stable. They can show up and let somebody connect from the censored area through them into the Tor network, and the goal is that you have thousands of relays but you have many more of these secret bridge addresses. 

So, this is the bad news slide from before where the connections fell off from China. And knew that this would happen eventually, so we had put out a new version of the software that had bridges supported. We translated it into Chinese and said, when Tor stops working, what you need is a bridge, here's how you get one. And the result of that was over the course of about a week, 30,000 people switched during the censorship, especially because a lot of the other circumvention tools didn't work for that week. So, there were a lot of people who used to use Tor and a few other things, and then suddenly they all stopped working, and if you have a neighbor who's using Tor and a bridge, suddenly you start using that and you're a happier camper. Unfortunately, that was then and this is now. So, the arms race with China is not going so well. And I'd be happy to chat more about that later on. But I'm going to leave China out of it and talk about some other countries. So, I was talking about the Tor website being blocked. 

In China, if you try to go to the Tor website, either it doesn't work at all or it takes a long time or something like that. In the Middle East, you end up with these really colorful block pages. So, on the one hand, it's good. They're not lying to you. They're actually saying that website you tried to go to, you shouldn't try to do that. That's a bad website for you to look at. And they try to have friendly people. I think the one down there is from Qatar. I mean, oops, we're fascists. [LAUGHTER] They try to make it fun. 

They try to make it, I hope you don't mind too much that we're censoring you. And some of these, I think this one even has a little forum saying if you think we've blocked this website by mistake, please send your name and address and email. [LAUGHTER] And we'll put you on a list of people who have contacted us. So, I don't know if many people do that, but at least it's an idea. Okay, so, moving forward. China blocked us by looking at the IP addresses and blocking the IP addresses. Iran started in early 2011 looking at the traffic flows. So they found a way to distinguish what Tor looks like when it's sending packets back and forth from what normal web browsing looks like when it's sending packets back and forth. And we weren't really expecting this step in the arms race. So they bought their, it's called deep packet inspection, DPI. 

They bought their DPI box from a corporation you may have heard of called Nokia Siemens. And there's a European-ish corporation which operates the censorship and surveillance infrastructure for the Iranian regime. And we were not expecting the sort of attack that they did, so it took us a few weeks before we figured out this is how they're doing it, this is how we should counter it, and we put out a new version. It worked fine from there. Egypt, a week or two after that. So, January 25 of that year was when the whole Egyptian revolution thing happened. And you can see where they blocked Facebook. That's where everybody gets Tor. And you can see where they unplugged the internet. That's the flat line down there. 

And my favorite part of this is the steady state afterward is twice the steady state before. There are a lot of people who are saying, okay, so we had this thing that CNN called a revolution, the military is still in charge, all the surveillance infrastructure is still in place, now that I've learned about this Tor thing, I'm going to keep using it because I know they're still watching me. And then, so everybody wrote articles about Egypt. They pulled the plug on the internet. Obama had discussions about whether there should be a US version of this so that we can unplug the internet in times of unrest. Libya did something much more subtle. Libya just basically turned down the bandwidth so that it was no fun to use the internet and everybody stopped. So, nobody writes news articles about that because you go to a journalist and you're like, the internet is slower than usual in Libya. [LAUGHTER] I don't understand, why would that be a news article? So, they did that for a while, and it slowly came back as they were doing their revolution. Syria, as an exciting point, Syria has, had at least, a lot of people using Tor. 

This little blip right here was the little, so the red dots here are statistical drops, and the blue dots are statistical jumps. So, some of them might actually be censorship events, but most of them are just, gosh, that went up faster than I thought or down faster than I thought. So, that little red blip right there is Syria testing out a tool called Blue Coat, which is a Sunnyvale, California, company. They sell a DPI device. And they mostly market it to, like, Boeing and other large American Corporations. But once you've built one for Boeing, you might as well sell it to Syria also. [LAUGHTER] And that's sort of extra sad because, so there's a list of countries that the US is not allowed to sell anything to, and Syria and Iran and North Korea and so on are on it. So you might wonder, why is Blue Coat operating the surveillance infrastructure for Syria? That's an excellent question for either the political scientists in the room or the politicians in the room. You'd think we'd be able to solve that at some point. And it's especially bad because, I think, two years ago we, the internet community, found a misconfigured computer in Syria. 

And we looked at it in detail and it had a huge list of logs. And it was misconfigured because here we were looking at all the logs, and it was one line per web request and it said here's the IP address of the person, here's the browser they were using, there's the URL that they were asking for, and here's whether we censored it. This was tens of gigabytes of detailed logs of everything everybody in Syria had tried to look at and whether they got censored accidentally published to the world. And at the top of these logs it said Blue Coat version such and such. So, a bunch of people went to Blue Coat and said, hey, did you know that you're running the firewall in Syria? And Blue Coat said, no we're not. And then they said, no, no, here at the logs that say they are. And Blue Coat said, no we're not. [LAUGHTER] And then they actually got the serial numbers from the computers from having some people, like, walk into the machine room and take pictures. And then Blue Coat said, gosh, we sold those to Dubai. I have no idea how they could have gotten into Syria. 

But we have disabled them. We've turned off all the updates. There's no way they're going to get any more update rules. So, then we logged into the Blue Coat update servers pretending to be those serial numbers, and they offered us updates. So, basically, every step of the way, they've been lying, and nobody seems to care. Okay, so, the next time Iran tried to filter us was here. So you notice it took us a little while here. This time they did it and over the course of something like 18 hours we said, hey, wait a minute, this is how they're doing it. It's basically a variation on how they did it last time. Let's put out a new version. 

So that worked very well. Basically nobody even noticed. It was a 16-hour delay or something. And, at that point, Iran became the number two country using Tor. So, US, Germany, Iran, then US, Iran, Germany. So, there's a huge upswing, which I don't have a newer version of this graph, unfortunately. It doesn't look quite as optimistic. So, the next step in Iran, right here, Iran turned off all SSL. So, any time you try to go to an https:// website, it fails. And since Tor tries to look like going to an https:// website because who would block that, turns out Iran would block that. 

So, for a four and a half day period in February, no Gmail, no Facebook, no Tor, no lots of things. And it turns out that we had been testing out some tools to try to look like something else, and we got to test them out for that weekend and they worked well. I'll talk about them in a bit. So, at the same time, Kazakhstan is using a filter rule that is very similar to what China started using right about the same time. So, does that mean that China builds a DPI box and sells it to Kazakhstan? Does that mean that Kazakhstan's internet upstream, their internet provider is some place in China? Is it a coincidence? I don't know. But bad news for you if you're in Kazakhstan trying to use Tor. [LAUGHTER] Ethiopia, also around the same time, they bought some sort of western product to do their censorship, I haven't figured out which one, but right about here is when they did a bunch of publicity saying we blocked Skype. Those damn Skype users, we finally got rid of them. [LAUGHTER] And it's not like they were trying to oppress freedom of speech and so on, though they didn't mind that as a side effect, mostly this was was a teleco monopoly thing. The Ethiopia monopoly telephone company didn't like the competition from those Skype users, so they lobbied the censorship infrastructure to get rid of the Skype users. 

And it worked for a while, but now they're back. So that's another lesson that we might learn. Okay, so, I talked a little bit about the Blue Coat side of things. Once upon a time, a lot of these firewalls were stateless and they were simple, and now they're much fancier. So the Burma case, Burma basically turned off its internet 10 or 15 years ago and hasn't turned it back on. It sort of worked, but it's so slow that nobody's willing to do much on the internet there. Iran, on the other hand, so it turns out that if your goal is to stay in charge, what you should not do is become the highest per capita blogger country in the world and then try to censor your citizens. Too many people in Iran know what the internet is supposed to be, so there's no way that this situation is going to be stable. China, on the other hand, is doing a great job of, okay, so we've got Twitter, Chinese people have their own sort of Chinese Twitter. We've got Facebook; they've got Chinese Facebook. 

We've got democracy; they've got Chinese democracy. [LAUGHTER] So, all of these things, they've got it better. There's no reason for them to go to our part of the internet. So, because they're big enough, they can actually afford to do that. So, they're slowly turning down the bandwidth for the connection to the outside world, and nobody minds because all of my friends are on Weibo or some other thing, so why would I need to get to your social network? So, part of the challenge here is a lot of these censorship things are built by western corporations. I was talking to a guy at a company called Fortinet a while ago, and they're yet another California company that builds censorship tools for American corporations, and I was talking to him and I said, oh, you're the company that built the firewall for Burma. And he said, of course we wouldn't do that. We're a good upstanding American corporation. So, I helped him find the picture on the internet of the Fortinet sales guy shaking hands with the guy running the Burmese junta holding box that says Fortinet. [LAUGHTER] And they were really proud at the time that they did the business deal. 

It's only later that it seems a little bit embarrassing, but not really because you might as well profit. There's no reason not to. So, it turns out that they don't run the Burmese firewall anymore because Cisco out-competed them. So now Cisco runs the firewall for Burma. And I was talking to the guy who runs the internet agency in Tunisia, and he was telling similar stories about, yeah we use SmartFilter. He was actually the first country that said, we do purchase an American corporation. It's called SmartFilter. We pay $1.5 million every year in licensing fees. Boy, could that money go into food for our citizens. Maybe we shouldn't be doing this. 

The even scarier part there, so they outsourced the operation of SmartFilter to some foreign corporation. He wouldn't tell me which one. I'm guessing somewhere in France or something. So, the result of that is there's a company in France that gets to decide what the Tunisian military can look at on the internet. So, this is not a privacy thing. This is a national sovereignty thing. Okay, so that was the good news for Syria. The bad news, lately they've just been filtering SSL. They've been turning their internet bandwidth down. They've been doing all sorts of tricks that make using the internet no fun, including using Tor. 

And then, in Iran, just last Thursday they put out a huge list of new filtering, and I'm still, I spend my days talking to researchers and I spend my nights talking to people in Iran trying to figure out what's going on in their network. We found a couple of rules that they've been filtering with. We got rid of those rules. Now it looks like they're doing something much more subtle which is if you match all of the rules, then we drop your connection, but if you only match some of them, then we throttle your connection. And that's much harder for me to track down. It used to be that I keep twiddling things until it works again, and when it works, I'm done. Now I twiddle something and it's still slow. Did I fix it? Was that the right thing? So, it's much harder from my perspective to debug what they've done. So, the fix in general is we need to stop trying to look like https://. We need to come up with other transports, other transform mechanisms so that the Tor client becomes a little stub that can convert your traffic into something else, and then the Tor bridge becomes a little stub that can unconvert it. 

So, there's a group at Waterloo who's working on a project called Skype Morph which is making your Tor traffic look like Skype video. There's a group at CMU that has a similar project that's trying to make it look like http://. The professor who introduced me has another project they're working on that's similar to try to convert Tor traffic into something that the firewall won't notice or won't care about. So, that's the future of these things. And the goal is to separate it so that Tor can pay attention to the anonymity side, and the pluggable transport can pay attention to the anti-filtering side or the blocking resistance side. Okay, so, there are a couple of different definitions of anonymity that we might talk about. So, one of the pieces of safety comes from the diversity of relay locations. I talked about that at the beginning. The more relays we have and the more different places they are, then the fewer attackers are in the right place to be able to beat it. But the second definition of anonymity comes from the diversity of types of users. 

So the fact that we have 50,000 users in Iran, almost all of them are using it just to get to Facebook. You blocked the social networking site I want to go to, so I'm going to use Tor and I'm going to get around it. And the fact that we've got 50,000 people going to Facebook means that the 500 people who are dissidents in the Green party using Tor have somebody to blend into. So the fact that they find Tor on your computer doesn't really tell them much about why you have Tor or what sort of a person you are. So we need that safety in numbers or diversity of uses in order to make being a Tor user not scary by itself. The extreme opposite of that, let's say you're in a Sudanese refugee camp, and somebody is blogging anonymously about the conditions in the Sudanese refugee camp, and you're the only one with a laptop and an internet connection. Tor is not going to solve your problem. Pretty quickly, they're going to start guessing that you're the one publishing these things. Okay, so, another thing to keep in mind. Tor is only a piece of the puzzle. 

There are a lot of other things that Tor is not going to be able to do to keep you safe. For example, if you have spyware installed on your computer that watches all of you keystrokes, then the fact that you're using Tor is not going to fix this. Beijing has a new law a few years ago saying every internet cafe, you have to provide your national ID when you walk in, and there's a video camera looking at your screen that takes snapshots every, like, 60 seconds or something. So, if you're in that situation, Tor is not going to solve the problem because you still have an actual video camera watching you use the internet. Now, I'm told in that case it's not so bad because the first person who walks in that morning reaches up and turns it away, and nobody every turns it back. So there are human solutions to these sorts of things. But it's an example of a situation where once we get to that point, Tor by itself is not going to do it. And I was talking to a group of Vietnamese activists a while ago, and they were telling me stories like, yes, I use encrypted Skype but there's a guy across the street with a parabolic microphone listening to every word that I say. So, yes I'm using encryption, but it's not working, it's not doing what I want. I go to the bathroom, they break into my house, and they steal my laptop and install stuff on it. 

And then when I come out, yes I use encrypted Skype, but it doesn't do what I want. And one of them was, it got to the point, there was a group of six Vietnamese activists who were using PGP, which is a mail encryption program, to talk to each other, and, at one point, the plain text, the decrypted version of one of these mails, was published in the national newspaper the next day. So then everybody was saying is PGP broken? Is one of these people a mole? What's going on here? How did they decrypt this thing? And a bunch of people were looking at the laptops they were using, and they eventually found the answer. The answer is they were all using Microsoft Windows, and if you want to use Vietnamese support in Windows, it doesn't come by default. So, you install your Windows, you go to the place that everybody goes to to fetch the keyboard driver and so on for Vietnamese, you install that, it has been backdoored by the Vietnamese secret service. Oops. So the answer is every single person in the world using Windows and Vietnamese is surveilled by the Vietnamese secret service. Holy cow. Tor is not going to solve that problem. Another version. 

I hope that the version of Tor you have is really the right version of Tor. So, one of my nightmare scenarios is China, rather than just dropping connections to TorProject.org, they make a copy of the website. They mirror it locally. They change the Tor download. All I see is people sending me mail saying Tor works again, and it's faster than it was before. It's great. This is wonderful. I'm a happy Tor user. But they're not using Tor. They're using Yellow Dog Tor or some other variation that isn't keeping them safe. 

And Skype actually had exactly that happen to them. They made a deal with a company in China called TOM, and there's a version of Skype called TOM-Skype that everybody in China uses, and it's backdoored, and they're watching everybody, but that's how it works. So the answer for that situation, the answer for the do you really have Tor, is on my business card is my PGP key, so you can come get me, you can come talk to me in person, you can find my business card, you can get my PGP key, you can use it to check that the tarball that you got is signed correctly by me if you understood that sentence. [LAUGHTER] Which basically zero people in the world will understand that sentence. So, I've given my business card to tens of thousands of people in America and Europe. I've given it to thousands of people in China. I hear they have more people than that. [LAUGHTER] So, this is an unsolved problem from a technical perspective. How do we actually make sure that the version of Tor you have is the real one? The answer they have in Iran is you get it on a USB key from a friend who is smarter than you. So, that sort of works. 

It scales pretty well as long as you have smart friends. I'd like to have some better answers. Another issue. Australia censors their internet. Denmark censors their internet. England censors their internet. Sweden censors their internet. Every year, there are a group of politicians who attempt to start censoring the US internet. Canada is getting pretty close to censoring their internet. So, there are a few problems with that. 

One of them is, when the US State Department goes to China and says you are a bad government because you censor your internet, China quite reasonably says, why are you picking on me? I'm just keeping my citizens safe just like everybody else. Why are you claiming that I'm different from Denmark? They're doing exactly the same thing. And it's especially sad, so Australia, the way that this works is some politician says there's something on the internet really bad, we've got to censor it. So they either buy some western product which lets them do all sorts of censorship or they build their own thing, and they end up having a beautiful gooey in front of them, a beautiful graphical interface, with a whole bunch of things they could censor. Do you want to censor sports, democracy, stock quotes, porn? What do you want to censor? And they've got one thing checked because that's what their law said they should do. So every day they come into work, they've got some political problem happening, they say if I just check that second box, that problem is going to go away. And before they know it, down the slope they have slipped, and they're censoring more and more things. And Australia is especially sad because they outsourced it to some for-profit corporation, and that for-profit corporation basically decides what Australian citizens can't see on the internet. So they have an anti-abortion website. They picked a political party to censor because that one wasn't in charge enough to get out of being censored. 

They end up having a website from a dentist that's on the censorship list. Nobody quite knows why. And the bad thing is, he can't get off the list. There's not mechanism to say, actually, I'm not a bad website, can you take me off the censorship list? Because nobody who thought about the laws every thought about any sort of policy for solving this sort of thing. So the second problem is, when I'm talking to people about the horrible censorship in China and Iran and Syria and so on, it's really easy for people in America to say, well, yeah, that's a problem with over there-istan. It's a good thing I live in a free country. And hopefully we'll talk a little bit more in the second speaker about what can go wrong over here. But part of what we need to do is not think of it as them and us. All around the world there are people trying to control information. So we spend our time on lots of different things. 

I think I'm running low-ish on time, so I'm going to skip a lot of this. But, basically, a lot of the stuff I work on is performance and scalability to try to make the Tor network faster for most users and try to be able to handle more users. We try to work, we have our own version of Firefox that tries to keep you safer than Firefox does. And that is driving us mad trying to keep up with Mozilla and all of their updates every time they put out a new version. The latest one said, hey, how about you just tell your GPS coordinates to every website you go to. Wouldn't that be great because then they can interact with you better? That turns out to be bad news for Tor users, so we had to find that and figure out how to disable it. And then we work on the blocking resistance or convention, the bridge, the pluggable transport stuff, and then advocacy education. If you got to metrics.TorProject.org, you will find all the graphs that I used and all the data behind them. So we try to be open and public and transparent about all the stuff that we collect. So, part of the challenge here, technical solutions are not going to solve the whole problem. 

The main problem in places like China is that a lot of people there are saying I'm so glad my government keeps me safe on the internet. And as long as most people are saying that, or they also say things like I just bought a third television, this isn't so bad, then there's no social pressure to fix this. And, in fact, it's spreading the other way where Sweden says, oh, my gosh, there's bad stuff on the internet. We must protect ourselves from it. Let's censor the internet. So, we're sort of slipping in both directions at once. So, I think that was my, yes, so, I actually succeeded at matching the time allotted. [APPLAUSE]