The NSA has been revealed to mark and consider potential “extremists” all users of the internet anonymizer service Tor. Among those are hundreds of thousands of privacy concerned people like journalists, lawyers and rights activists.
Searching for encryption software like the Linux-based operating system Tails also places you on the NSA grid, as Lena Kampf, Jacob Appelbaum and John Goetz revealed on the German site Tagesschau. The report is based on analysis of the source code of the software used by NSA’s electronic surveillance program XKeyscore.
Tor is a system of servers, which routes user requests through a layer of secured connections to make it impossible to identify a user’s IP from the addresses of the websites he/she visits. The network of some 5,000 is operated by enthusiasts and used by hundreds of thousands of privacy-concerned people worldwide. Some of them live in countries with oppressive regimes, which punish citizens for visiting websites they deem inappropriate.
But merely visiting Tor project’s website puts you on the NSA’s red list, the report says. But more importantly it monitors connections to so-called Directory Authorities, the eight servers, which act as gateways for the entire system.
The NSA was particularly surveilling German-based Tor Directory Authorities. One is operated by the Germany-based hacker group Chaos Computer Club, the other by computer science student Sebastian Hahn, who told journalists that the revelation is “shocking.”
The system itself doesn’t appear to be compromised however, but the NSA gets data like IP addresses of those using it, enough to cross-reference them with other databases the agency has access to.
There are indications that NSA may be collecting not only the metadata of the people on the list, but also read their email exchanges with Tor and analyze the full content of intercepted connections.
An interest in Tor is not the only way to make it to NSA’s watch list. Even web searches for other encryption software makes you a target as well, the report said.
Disturbingly, NSA programmer comments in the source code label those picked up by the American system “extremists.”
The report says XKeyscore marks all people that hit the red light on its grid, with the exception of those connecting from members of the Five Eyes, a group of countries cooperating in intelligence gathering, namely the US, UK, Canada, Australia and New Zealand.
It was not immediately clear how the authors of the publication obtained the source code of XKeyscore software, but the existence of the system was revealed in 2013 through documents leaked by whistleblower Edward Snowden.
Ironically, Tor was originally created for the US Navy and still receives a major part of its funding from the US government – the same government that considers its users “extremists”.
Anonymous experts told Boing Boing that the new leak may come from a second source, not Edward Snowden as nothing of the kind had ever been seen this in the original Snowden documents or intended publications.