DoJ Official Gets Tor Pedophile Data Point Wrong, Wrong, Wrong

MISTAKEVILLE, USA—Mistakes happen, but when they come from the nation's top law enforcement department on issues of increasing importance to many Americans—namely, cyber security and cyber safety—it's a problem. Such a mistake apparently took place this week during a "State of the Net" conference in Washington when, according to Wired's Andy Greenberg, "U.S. Assistant Attorney General Leslie Caldwell discussed what she described as the dangers of encryption and cryptographic anonymity tools like Tor, and how those tools can hamper law enforcement." Greenberg continued, "Her statements are the latest in a growing drumbeat of federal criticism of tech companies and software projects that provide privacy and anonymity at the expense of surveillance. And as an example of the grave risks presented by that privacy, she cited a study she said claimed an overwhelming majority of Tor’s anonymous traffic relates to pedophilia." Specifically, Caldwell is quoted as stating at the conference, "We understand 80 percent of traffic on the Tor network involves child pornography.” Challenged on that claim, Greenberg reports, "In a series of tweets that followed Caldwell’s statement, a Department of Justice flack said Caldwell was citing a University of Portsmouth study WIRED covered in December. He included a link to our story. But I made clear at the time that the study claimed 80 percent of traffic to Tor hidden services related to child pornography, not 80 percent of all Tor traffic." Oops. Bad data point. Presumably an innocent mistake, the potential implications of such an erroneous claim could be huge, especially if legislators actually believe it. And considering the extreme rightwing bent of the current Congress, and especially the House, it's possible that the claim will stick despite being false. As Greenberg goes on to explain, the difference between how most people use Tor and the uses it's often put to in the so-called "dark web," are significant. "The vast majority of Tor’s users run the free anonymity software while visiting conventional websites, using it to route their traffic through encrypted hops around the globe to avoid censorship and surveillance," he wrote. "But Tor also allows websites to run Tor, something known as a Tor hidden service. This collection of hidden sites, which comprise what’s often referred to as the 'dark web,' use Tor to obscure the physical location of the servers that run them. Visits to those dark web sites account for only 1.5 percent of all Tor traffic, according to the software’s creators at the non-profit Tor Project. "The University of Portsmouth study dealt exclusively with visits to hidden services," he continued. "In contrast to Caldwell’s 80 percent claim, the Tor Project’s director Roger Dingledine pointed out last month that the study’s pedophilia findings refer to something closer to a single percent of Tor’s overall traffic." [Emphasis in original] Greenberg goes on to note that even the 80 percent data point for CP on hidden services on Tor might be misleading, since "the pedophilia sites [represent] only 2 percent of Tor hidden services," but whatever the true amount of traffic looking for or trading images and videos of child sexual abuse may be, they are, as Greenberg rightly states, "troubling." That said, Greenberg points out that it is equally troubling to have one of the nation's top law enforcement officials conflate "Tor hidden services with Tor itself." "After all," he concludes, "some of the most central non-hidden-service applications of Tor are to enable Internet users in countries like China and Iran to evade their governments’ online repression, and even allowing US intelligence and law enforcement to gather data online without detection. Both those uses explain why much of Tor’s funding comes directly from the American military and Department of State." Of course, from such contradictions mighty laws are made. And would anyone be surprised to learn that some in the government would like to reserve anonymous surfing for official use while denying it to citizens, and be willing to cite false data to that end?