Onion routing

Back in August 2018, I wrote a post called "Secret messages". In that post, I discussed how in elementary school my friends and I devised a rudimentary "secret language" to send coded messages to each other without our enemies knowing what we were writing. I then discussed a little bit of modern cryptography (which I described as "the scientific study of sending secret messages"), specifically the RSA encryption scheme. This post is a bit of a follow-up to that post.

With today's technology, it is quite easy to send someone a secret message that not only can be read only by the intended recipient, but also allows the intended recipient to verify that the message was not modified by an eavesdropper or "man-in-the-middle". It happens everyday on the Internet: see the part of this blog's URL that says "https". That 's' there is extremely important. It means that you can trust that this blog post was delivered to you by Google's Blogger platform securely; while the blog post was being transmitted to you as a series of messages over the wires that make up the Internet, no one eavesdropping could read the messages as they were being sent, and when you received the messages, you could verify that none of them were modified by an attacker in the middle.

There is, however, a limitation: an eavesdropper could see where the message was going and also oftentimes who sent the message. This information is not private; after all, in order for the routers in the middle to deliver the message successfully, they need to know what the destination is, and if the sender expects some kind of response, the destination needs to know who the sender was. In other words, although the modern Internet makes it quite easy to ensure confidentiality (no one can read the communication) and integrity (no one can tamper with the communication while it is in transit), it is a much trickier task to ensure anonymity (no one can see who sent the message or where it is going).

For most Internet users, anonymity is not all that important. In most cases, we want the websites we communicate with to know who we are so that they can provide us with relevant services, such as when we want to access our financial information on our bank's website or when we want to buy movie tickets. The bank needs to know whose record to pull up, and the movie theater needs to know who to give the tickets to. However, it is also not difficult to brainstorm cases where a user might want to seek anonymity on the Internet. For example, perhaps they want to express a controversial opinion on the Internet that might expose them to harassment, persecution, or otherwise damage to their reputation in "real life".

This issue is critical in countries where the freedom of expression is not necessarily guaranteed to all, but importantly, one does not need to live in such a country to exercise the right to express an opinion anonymously. In August 2019, I wrote a blog post about McIntyre v. Ohio Elections Commission (1995), which is a case in which the Supreme Court of the United States struck down an Ohio law that prohibited anonymous campaign literature on the basis that it violated the First Amendment to the U.S. Constitution, which prohibits the government from abridging the freedom of speech. In deciding McIntyre, the Supreme Court justices looked to the Founding Fathers for advice, and they found that the Founding Fathers routinely engaged in anonymous political writing, a famous example being The Federalist Papers, a collection of essays written by Alexander Hamilton, James Madison, and John Jay to promote the ratification of the U.S. Constitution. Hamilton, Madison, and Jay did not use their real names; rather, they published the essays under the name "Publius". The core of McIntyre is best captured by the following quote from the Court's decision in the case authored by Justice Stevens:
Under our Constitution, anonymous pamphleteering is not a pernicious, fraudulent practice, but an honorable tradition of advocacy and of dissent. Anonymity is a shield from the tyranny of the majority. See generally J. Mill, On Liberty and Considerations on Representative Government 1, 3–4 (R. McCallum ed. 1947). It thus exemplifies the purpose behind the Bill of Rights, and of the First Amendment in particular: to protect unpopular individuals from retaliation—and their ideas from suppression—at the hand of an intolerant society.
The Supreme Court's decision in McIntyre came at a time when the Internet was still budding. I concluded my blog post on McIntyre with the thought that the proliferation of misinformation on the Internet poses new challenges to the thought that anonymous political messaging is "an honorable tradition of advocacy and of dissent". However, I ultimately agreed that the core finding of McIntyre remains true and relevant today: the right to express oneself anonymously is a part of the broader right to express oneself freely.

So how do we become anonymous on the Internet? There are different options here, depending on your "threat model". The simplest solution I can think of is to create a new account on whatever Internet platform you wish to speak on and choose a pseudonymous username and account credentials that have no relation whatsoever to your real life identity. This will hide your identity from other users on the website, but there is a problem. As I stated at the start of this blog post, when you connect to the website, not only can the website see that you were the one who posted the message, but also anyone in the middle whose network helped pass along the message that you sent, such as your employer, school, government, or Internet service provider. This is troubling if you distrust one of these entities.

The next idea is to use a "proxy". Instead of sending a message directly to the website, we will now send a message to a friend, asking them to send a message to website. To the website, now it looks like your friend is the one sending the message, and to the people in the middle, it looks like you are just sending a message to your friend (remember, if you use HTTPS, no one can read the contents of the message you are sending, so they cannot decipher what you are asking your friend to do). There is an obvious problem: you need to be able to trust your friend, since they have full knowledge that you are the one sending the message to the website, and they would now be the ones who appear responsible for the message you are sending. We call your friend in this case a "proxy", and there are a variety of Internet companies out there that provide this kind of anonymizing proxy as a service. Some good examples are Mullvad and Private Internet Access. You might've heard of the term "VPN" before—a VPN acts like a proxy, though the terms are not strictly interchangeable. If you are choosing to use a proxy service to anonymize your Internet activity, you need to be able to trust that the service will sufficiently defend your identity against exposure (e.g. perhaps they will promise not to keep any logs of your activity on their proxy, so that if people with power do ask them what you were doing on their service, they will have no records to give them). Sometimes, you just can't justify this kind of trust, especially if your real-life reputation is at stake.

The idea I am most excited about is called onion routing. It works like proxies, but instead of sending a message to just one friend, what if we asked that friend to pass the message onto another friend? What if we had three friends? Here's the rough plan:
  • Suppose Alice wants to anonymously send a message M to Bob.
  • Alice has three friends—Eve, Mallory, and Trent—who are all willing to pass along messages.
  • Alice tells Eve to tell Mallory to tell Trent to tell Bob the contents of the message M.
More specifically, to ensure confidentiality:
  • Alice first encrypts the message M in a way that only Bob can read.
    • We'll denote encryption with brackets: [M].
      • Text in purple can only be read by Bob.
      • Text in green can only be read by Trent.
      • Text in orange can only be read by Mallory.
      • Text in red can only be read by Eve.
    • Technical note: this first encryption is done by HTTPS, not necessarily by onion routing. If you use unencrypted HTTP, then Trent will also be able to read M in this scheme (but not Mallory or Eve).
  • Alice then encrypts the following message in a way that only Trent can read:
    • [Send [M] to Bob]
  • Alice then encrypts the following message in a way that only Mallory can read:
    • [Send [Send [M] to Bob] to Trent]
  • Alice then encrypts the following message in a way that only Eve can read:
    • [Send [Send [Send [M] to Bob] to Trent] to Mallory]
  • Alice then sends the above message directly to Eve.
Notice how the message that Alice sends Eve is like the shell of an onion, hence why the scheme is called "onion routing". When Eve peels back the first shell of the onion by decrypting the message, she finds a new shell, which Mallory will peel back to find yet another shell, which Trent will peel back to find a final shell, which Bob will peel back to find Alice's message. The scheme is so brilliant because no single friend of Alice knows what the message is or where it's going to.
  • Eve only knows that there is a message from Alice being passed to Mallory.
    • All Eve sees is: Send [gibberish] to Mallory
  • Mallory only knows there is a message from Eve being passed to Trent.
    • All Mallory sees is: Send [gibberish] to Trent
  • Trent only knows there is a message from Mallory being passed to Bob.
    • All Trent sees is: Send [gibberish] to Bob
  • Bob only knows there is an incoming message from Trent.
This means that even if Eve and Mallory are both untrustworthy and are secretly spying on and recording all of the messages being sent, they will still be unable to decipher what the message is or whom it's going to (Mallory doesn't even know who originally sent it!). In order to de-anonymize Alice, an attacker needs to compromise all three friends: Eve, Mallory, and Trent. (There is a slight caveat: if an attacker were to compromise Eve and Trent, they could theoretically observe the timing of the messages being passed to and from Mallory and deduce that Alice is communicating with Bob.)

What if Bob wants to send a reply message? How can he do so without knowing who sent the message? Although no one except Alice knows the complete picture, Trent knows that Mallory sent him a message to pass to Bob, so if Bob responds to that message, then Trent can pass the response back to Mallory, who knows to pass it back to Eve, who can pass it back to Alice.

The most exciting thing about this scheme is that it doesn't exist just on paper; it has actually been implemented! The Tor Project is a non-profit organization responsible for deploying and maintaining the Tor network. The name "Tor" is an acronym for "The Onion Router". Within the Tor network, thousands of volunteers have set up "relays" (also known as "nodes"), which are computers that pass along web requests just like Eve, Mallory, and Trent passed along messages in the scheme above. The Tor Project has produced a special web browser called the Tor Browser, which automatically routes your Internet browsing through the Tor network. These Tor relays are located all over the world, meaning Tor can and will bounce your Internet requests all over the world before it reaches your intended recipient. This makes it considerably more difficult for oppressive governments and other nosy people to spy on your Internet activity, since in order to compromise all three relays that make up your "circuit", an attacker would need to have influence in up to three different jurisdictions, possibly all on different continents. As long as one of the relays in your circuit is legitimate, your anonymity remains protected.

There are a few important caveats. Firstly, Tor does not hide the fact that you are using Tor. Almost all Tor relays are publicly listed, so although Tor hides your identity from the website you are visiting, the website can easily determine that you are using Tor to accomplish that hiding—they can just cross-reference the IP address you appear to be connecting from with the list of the IP addresses of Tor exit nodes. (The "exit node" is the third and final relay in your Tor circuit, i.e. Trent in the example above.) There are some Tor relays that are not publicly listed—these are called "bridges", and they exist because some governments simply block all connections to the publicly listed Tor relays. If you decide to use a bridge, it will only replace the first relay in your circuit (i.e. Eve in my example above), so the website you are visiting will still know you are using Tor, since the exit node is still publicly listed. Using a bridge relay may allow you to get around these government censors, but if the bridge is ever discovered, then the fact that you were using Tor will also become known. In some cases, just using Tor is suspicious in itself, as a student at Harvard University found out when he sent bomb threats to his university through Tor while on his university's Wi-Fi network. After determining that the bomb threats came from Tor, the investigating FBI agents needed only to cross-reference the time the bomb threats were received with the time the student was using Tor on the university network, and as a result, the student's anonymity was compromised.

As the Harvard student discovered, just using Tor alone is insufficient for ensuring anonymity. Good behavioral practices are also necessary. For example, it is not a good idea to mix your regular Internet browsing with the browsing that you want to anonymize: signing into your personal Twitter account linked to your identity, logging out, and then immediately logging into an anonymous Twitter account—all on Tor—will almost certainly allow Twitter to identify you as the owner of the anonymous account. The Tor Project's FAQ has a list of behavioral tips for staying anonymous with Tor.

I have a friend who works for the government as a forensic fingerprint analyst. (Every time I see her, I remind her that I think she has the coolest job ever.) She once told me the story of a criminal who wanted to avoid detection so badly that he burned off his fingerprints. There was a problem, however. In a world where everyone has fingerprints, if you are the only person who doesn't have fingerprints, you actually stand out more than if you had kept them. A similar problem exists with Tor. In a world where everyone has a digital fingerprint, if you are the only one without one, then you stick out like a sore thumb. For this reason, your success with Tor depends also on how many people are also using Tor at the same time. Fortunately, as awareness of Tor has risen over the past decade, so too have the number of users and the number of relays. Today, there are approximately two million Tor users worldwide who are connecting at any given time; when your digital fingerprint is the exact same as up to two million users, that definitely increases the chance that you will remain anonymous.

As interesting as Tor is from a technological standpoint, it is important for us to take a step back and realize the gravity of what we are doing. When we dissociate the identity of an Internet user from their activity on the Internet, we immediately open the door to abuse. Although the aforementioned Harvard student was caught, there are certainly entities out there who are at large. These are people who do practice good operations security, who use Tor for nefarious purposes, and who haven't been caught because of how powerful the system is.

Indeed, in our zeal to protect legitimate people from harassment and persecution, the system that we have created for their protection also enables users to engage in harassment and criminal activity with near impunity. As an example, for multiple years, a man from California named Buster Hernandez used Tor to extort underage girls on Facebook for sexually explicit photographs, threatening to bomb their schools if they did not comply. This man was described by a Facebook employee as "the worst criminal to ever use the platform", and because of the protections afforded by Tor, tracking him down was an immense effort. Not only did Hernandez use the Tor Browser, he also used an operating system called Tails (an acronym for The Amnesic Incognito Live System), which routes all Internet activity performed on the operating system through Tor and blocks any network activity that attempts to bypass Tor. Just last week, it was revealed that Facebook had collaborated with the FBI and a third-party consulting group, spending hundreds of thousands of dollars to develop a maliciously crafted video file, which they sent to Hernandez, posing as an underage girl. When Hernandez attempted to open the video file, it exploited a security vulnerability in Tails's video software that was unknown to the developers of Tails at the time—a kind of security issue known as a "zero-day vulnerability". This exploit allowed Facebook and the FBI to compromise Hernandez's computer and consequently also his anonymity.

McIntyre v. Ohio Elections Commission revolved around an old woman who was passing out anonymous leaflets opposing a school district tax levy. The Supreme Court took that case and handed down a decision that appears to travel farther than just leafletting: it appears that any law that enacts a sweeping prohibition on anonymous political speech would violate the First Amendment. In the Court's decision, Justice Stevens acknowledged that anonymity can be misused:
The right to remain anonymous may be abused when it shields fraudulent conduct. But political speech by its nature will sometimes have unpalatable consequences, and, in general, our society accords greater weight to the value of free speech than to the dangers of its misuse. See Abrams v. United States, 250 U. S. 616, 630–631 (1919) (Holmes, J., dissenting). Ohio has not shown that its interest in preventing the misuse of anonymous election-related speech justifies a prohibition of all uses of that speech. The State may, and does, punish fraud directly. But it cannot seek to punish fraud indirectly by indiscriminately outlawing a category of speech, based on its content, with no necessary relationship to the danger sought to be prevented.
The Court's decision was not unanimous. Justice Scalia wrote a dissenting opinion that was joined by Chief Justice Rehnquist, in which Scalia rejected the Court's claim that "anonymous pamphleteering is not a pernicious, fraudulent practice, but an honorable tradition of advocacy and of dissent", adding:
I can imagine no reason why an anonymous leaflet is any more honorable, as a general matter, than an anonymous phone call or an anonymous letter. It facilitates wrong by eliminating accountability, which is ordinarily the very purpose of the anonymity.
In Scalia's view, the Court's decision in McIntyre was sweeping: the Court had struck down not just Ohio's law, but similar laws in 49 other U.S. states. Justice Ginsburg was not as convinced. In a separate concurring opinion, Ginsburg sought to limit the scope of the decision, writing:
In for a calf is not always in for a cow. The Court’s decision finds unnecessary, overintrusive, and inconsistent with American ideals the State’s imposition of a fine on an individual leafleteer who, within her local community, spoke her mind, but sometimes not her name. We do not thereby hold that the State may not in other, larger circumstances require the speaker to disclose its interest by disclosing its identity. Appropriately leaving open matters not presented by McIntyre’s handbills, the Court recognizes that a State’s interest in protecting an election process “might justify a more limited identification requirement.” But the Court has convincingly explained why Ohio lacks “cause for inhibiting the leafletting at issue here.”
A tech-savvy Tor user is clearly different from an old woman in front of a school passing out leaflets that don't have her name on it. I wonder how the Court today would evaluate the importance of anonymous speech against the backdrop of technology like onion routing, indisputably the most remarkable way for any individual to remain anonymous on the Internet. Cracking the anonymity of just one abusive Tor user took Facebook and the FBI years of effort, a tremendous degree of technical skill, a bit of luck, and access to substantial financial resources.

The issue is complicated because of the underlying technology. As I mentioned before, the security of Tor increases as more people use its technology. "In a world where everyone has fingerprints, if you are the only person who doesn't have fingerprints, you actually stand out more than if you had kept them." Thus, if a state enacts a sweeping prohibition against the use of Tor and thereby cuts off a significant chunk of Tor activity, it would make it more difficult for legitimate Tor users in other countries to avoid persecution and harassment. From a technical standpoint, it is actually incredibly difficult for a state to enact such a Tor prohibition effectively: one of the features of Tor is censorship circumvention, especially via bridge relays, so even if a state bans its citizens from using Tor, it is unlikely that it will actually be able to prevent its citizens from using Tor on a technical level. In other words, banning Tor on a political level would not prevent illegitimate users from using the network, and it may even harm users who have a legitimate need to use it.

At the end of the day, I find myself on the side of Tor. The Internet today is an extension of the free speech platforms we have used in the past: from leaflets to newspapers to The Federalist Papers. This is not a novel idea. In a case called Packingham v. North Carolina (2017), the Supreme Court stated:
A fundamental principle of the First Amendment is that all persons have access to places where they can speak and listen, and then, after reflection, speak and listen once more. The Court has sought to protect the right to speak in this spatial context. [...] While in the past there may have been difficulty in identifying the most important places (in a spatial sense) for the exchange of views, today the answer is clear. It is cyberspace—the “vast democratic forums of the Internet” in general, Reno v. American Civil Liberties Union, 521 U. S. 844, 868 (1997), and social media in particular.
Just as Margaret McIntyre had a First Amendment right to stand outside of Blendon Middle School in Westerville, Ohio, to pass out her anonymous leaflets, Internet users have a First Amendment right to access the Internet and social media platforms anonymously. (Note that the First Amendment only restricts what governments may do under the law; the First Amendment does not prohibit the Internet and social media companies themselves from restricting anonymous speech on their platforms as part of their internal rules.) If Alexander Hamilton, James Madison, and John Jay had access to the Internet, I have no doubt that they would have used the Internet as their primary means for anonymously distributing The Federalist Papers in support of the ratification of the Constitution. And if they wished to remain truly anonymous—in a way that not even the website, the government, or their Internet service provider could identify them—they would have needed to look no further than onion routing.
Posted by