$date

Federal Bureau of Investigation

ATTN : $agent

$address

BY FAX : $fax_number

RE : Grand Jury Subpoena in matter $case_number

Mr. $agent,

In response to your $date subpoena for subscriber records regarding IP address 1.2.3.4 at $time :

a.b.c.d (hereafter referred to as “server”) is owned and operated by $university.

Server is a router which is part of the TOR privacy network. Information about the TOR privacy network is available at http://tor.eff.org. $university elected to operate a TOR router as part of our beliefs in the universal availability of information, as TOR assists individuals restricted by oppressive firewalls – both organizational and political.

Application software run on the server as part of the TOR privacy network is specifically designed to make identification of an end user impossible by any individual server operator. This is particularly important in cases such as China, where anonymity offers protection from government censors.

The TOR network transports Transmission Control Protocol (TCP) Internet streams, and requires each stream traverse 3 separate routers in different locations. The transmission from end-user client to the “entry node” is encrypted using 256-bit AES, as is the hop between “entry node”, “middleman node”, and “exit node”. Only at the “exit node” does traffic emerge unencrypted. An overview of this architecture can be found at http://tor.eff.org/overview and an excellent graphic representation can be found at http://tor.eff.org/images/htw2.png

The TOR network was specifically designed to prevent “timing attacks”, or the analysis of source and destination IP addresses, packet sizes, and times.

The TOR application software by default creates no logfiles containing any information regarding sessions transported.

Various other network devices present between the TOR router and the Internet (notably the Cisco PIX firewalls) do create logfiles, however logging of these devices was configured based on guides from the TOR developers and the Electronic Frontiers Foundation (EFF) to explicitly NOT log any traffic from the TOR router address, as this would defeat its purpose as a privacy router. This guide can be found at : http://www.eff.org/osp/20040819_OSPBestPractices.pdf

The Cisco PIX Firewall logs are collected using “syslog-ng” (http://www.balabit.com/products/syslog_ng/). The relevent bits of the configuration file are as follows :

filter f_firewall { facility(local7) and not match("a\\.b\\.c\\.d\\ Accessed\\ URL") \

and not match("a\\.b\\.c\\.d\\/") and \

not match("Accessed\\ URL\\ a\\.b\\.c\\.d"); };

(continued on page 2)

RE : Grand Jury Subpoena in matter $case_number

Page 2 of 2

Logfiles on other devices and applications which may have captured any traffic in question include Argus (http://www.qoisent.com/argus) and Snort (http://www.snort.org). Both are retained for a maximum of $n (where $n < $request_date) days, and as such, neither are available for analysis. Furthermore, due to the design of the TOR Privacy Network, any attempt to “track back” a user from a particular “exit node” would at best refer to another router in the TOR network, but it would not be possible to identify which of the approximately 500 other routers a particular session passed through.

As of 18 May 2006, $university no longer operates a TOR router, for reasons unrelated to this request (specifically, a contractual issue with various online journal providers about operation of a proxy).

If you need any additional information or clarification of the above points, please feel free to contact me.

Please copy $lawyer, University Legal Counsel, at $address on any future requests or correspondence.

Regards,

$my_info

$my_address

$my_phone_number

Michael Holstein

2006-12-18T09:52:27