7 ms·

Tor trip report to an FBI conference

156 points by onosendai 14y ago

mtgx 14y ago
So that settles it for recommending Hushmail for true private communications - don't use it.
- Nyr 14y ago
  That wasn't the first time they cooperated with law enforcement. One thing it's a "private communications" service and other a bulletproof one.
  - dhimes 14y ago
    Is there a better one?
    - HNLogInShit 14y ago
      HushHushMail
    - webreac 14y ago
      Yes, encrypt all your mails using PGP.
      - Xylakant 14y ago
        The problem with PGP is that while it keeps the content of your mail exchange secret, it does not protect the information that two persons exchanged emails. So if the investigators have a lead to person A that sells drugs and see that he's communicating with person B that accepts payments, the might just guess what relationship the two have.
        glomph 14y ago
        For that use tor to access your emails and/or use tormail.org which will not be able to disclose that information.
        dbrian 14y ago
        Right, that's why you use Tor. PGP provides privacy and accountability. Tor provides anonymity. Just remember you have to trust the security of the receiving party as well. Make sure not to reveal yourself with the contents of your emails since the other party might not be as disciplined with their tor and pgp use as you are.
        derrida 14y ago
        Tor doesn't anonomise email :-/ If you want that, look for mixminion or mixmaster. Tor is a low latency mixnet for TCP streams (aka web browsing).
        dbrian 14y ago
        SMTP uses TCP and works over tor just fine. But you can always just use a free web mail account somewhere.
        derrida 14y ago
        Yes, that's to fetch mail from a server. TorBirdy for instance is a plug in for Thunderbird. But! If you want to send a message alice@domain.com to bob@otherdomain.com that is not anonymous, unless you take other measures.
        DanBC 14y ago
        Yes. There is a difference between "private" and "anonymous". Encryption often removes anonymity by tying an identity to keys and to a web of trust.
      - 1337biz 14y ago
        @Xylakant then you have to pull an "Petraeus" and just keep the emails unsent in the draft folder. Not sure if this is still a viable option.
        derrida 14y ago
        People are forgetting that if you use PGP you can post it anywhere The Petreus incident is sort of crazy for this reason. Here is the head of the CIA, doesn't even use PGP. There are other mixnets such as Mixmaster and Mixminion that do what Tor does for TCP but with email. They unfortunately need many more people to run nodes.
        antidoh 14y ago
        "The Petreus incident is sort of crazy for this reason. Here is the head of the CIA, doesn't even use PGP." He's just a bureaucrat, hired after retiring as an Army general. I seriously doubt if he had any personal spy craft training beyond "use this secure computer and this secure phone when you're working on company business, sir. And don't talk about Fight Club."
        DanBC 14y ago
        <tinfoil hat> The head of the CIA is aware of the methods used to extract information from suspects, and thus wants his information to be easily found if he's discovered, rather than requiring him to be extra-ordinarily renditioned and water-boarded. </tinfoil hat> I guess it just shows that anonymous and private communication is still really hard for most people, even though we had the work of cypherpunks trying to help.
        pyre 14y ago
        Why would they waterboard him if he was willing to give up the keys?
      - mahyarm 14y ago
        Actually now-a-days it's using an OTR client, since it adds deniability and forward secrecy. I don't know if it removes offline messaging. It's also a lot easier to use and easier to convince your friends and close ones to use it since they only need to flip a switch practically. http://www.cypherpunks.ca/otr/ http://www.cypherpunks.ca/otr/
    - kapnobatairza 14y ago
      TorMail
    - codesuela 14y ago
      https://countermail.com/ https://countermail.com/
- gtt 14y ago
  I do not understand why they are still in the business. It seems their reputation is destroyed, yet they are still here.
  - mahyarm 14y ago
    For people who only care about non-government espionage.
- xk_id 14y ago
  you have to be an idiot to use any email provider for something like this, without PGP encrypting your content.
- revelation 14y ago
  Apparently you have never been to their website. They clearly state that they will fully cooperate with law enforcement on signup. Its a mandatory checkbox on signup: I understand that Hushmail is not suitable for illegal activity and that the providers of Hushmail will cooperate fully with authorities pursuing evidence via valid legal channels. See our Security Page.
  - derrida 14y ago
    "Security" here is used in a weird way. Security is a design feature, not a policy.
  - marvin 14y ago
    The corollary is that Hushmail is a shitty service. A good service for private e-mail should make it impossible for the server administrators to see what is going on. Obviously that checkbox should make any user that needs real security turn around in the door. I've never used Hushmail, but I assumed "secure e-mail" == "none of my information touches the server in plaintext". So this comment is quite interesting.
    - SageRaven 14y ago
      Supposedly lavabit.com is (from the admin perspective) about as close to zero knowledge as it gets. Logs are kept for a minimum to diagnose abuse/performance issues, and crypto keys are strictly between the user and server. As I understand it, the only legal compromise would be a national security letter style gag order to alter the binary that interfaces the client (be it Outlook, your phone, or the web-mail host) to the back-end data store, which is stored encrypted on disk. Security flaws are another thing entirely. I have no idea if anyone, aside from internal developers, has vetted the system for flaws that typically result in server compromises. I was a satisfied free user some years ago, and the above was my understanding of the service after a few pointed queries to the support address.
      - noibl 14y ago
        > alter the binary that interfaces the client Which, in case it's not clear, is exactly what Hushmail did/does. http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator-bolts-to-hush.html?showComment=1309018784191#c7610754517237372617 http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator...
- chmars 14y ago
  Most providers happily cooperate with law enforcement and other government agencies, in particular if they don't have to (or are forbidden to) inform their customers. In many cases, informal contacts are used or a polite official request without a court order is already sufficient.
- FiloSottile 14y ago
  Please note that all the discussion that is done here about Hushmail being or not secure is only applicable to @hushmail to @hushmail communication. Securing mails to external addresses is impossible by design (without other types of key exchange/trust, e.g. PGP).
HNLogInShit 14y ago
Whatever "Tor" is.
piqufoh 14y ago
I like the idea that some agents are regularly using Tor, whilst others are asking the Tor guy if he can track Tor users...
- morsch 14y ago
  I'm not sure quite what they're using it for, though. I suppose some sites block .gov IP ranges, but you'd think they could easily proxy via some innocuous host provided by a commercial provider.
  - derrida 14y ago
    Law enforcement have for decades been anonymous, wearing plain clothes & hiding behind false identities in efforts to catch criminals. Tor just gives them digital plain clothes. If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Keep in mind there is a good mix of software, a whole variety of kernels etc. If you have one of the less common architectures around, consider running a Tor node on it :-) Then we get a mix against random machine-code backdoors too.
    - dmix 14y ago
      Another good reason might be because there are a ton of illegal onion sites on Tor that they are investigating.
      - derrida 14y ago
        Sure, but that is a newer feature, and Roger Dingledine has been giving these talks to law enforcement for some years (the earliest I am aware of is 2008).
    - ChrisWoodall 14y ago
      >If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Can you go into more detail about what you are saying? I'm sure you could drop a- ADOBE, Active-X, Java, ect- 0-day on a page and pwn said box. You can also send payloads to/from TOR; although there are limited transfer protocols you can use. The whole point of TOR is to try to anonymize you. It's not going to save you from getting owned.
TommyDANGerous 14y ago
Great read, I use to use Tor but did not know it was used in this way. Pretty epic.
Create 14y ago
"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." We now know, that entire nations' & worldwide traffic is being intercepted and logged. One would probably see I2P as an overkill without knowing the downfalls of its predecessor. Tor was once a wonderful multi-proxy used for hiding IP addresses and bouncing off servers all over the world. At one time, it was even trusted by most governments for strong anonymity. All of that seemed to change after an article was posted in 2600 Hacker Quarterly. One author exposed how becoming an exit node for Tor allowed all the traffic on the Tor network to pass right through your machine. Becoming an exit node was the same as performing a Man-In-The-Middle attack. All one had to do was open up a packet sniffer and see all the traffic going through encrypted. Tor is still used by people trying to protect their privacy. But at the same time it has become a playground for hackers and governments monitoring what they consider suspicious. I2P has secured this problem while adding more functionality. Proper German engineering: http://www.i2p2.de/index.html http://www.i2p2.de/index.html
- derrida 14y ago
  > One author exposed how becoming an exit node for Tor allowed all the traffic on the Tor network to pass right through your machine. Becoming an exit node was the same as performing a Man-In-The-Middle attack. This is de-contextualised scaremongering. What the poster is referring to is that when you leave the Tor network, the connection is as it would have been before. This is by design. So if you were not using TLS, then your traffic could be read, as is the case with ALL http etc. Simple. Use SSL/TLS/SSH/ etc Do a trace route to google. All those intermediate parties are capable of the same thing. But if you use TLS the attack is useless. Tor provides one property, Anonymity, and it does this incredibly well. Anonymity and Privacy are related by distinct properties. Obviously if you send traffic to a site and sign off with your name, Tor can't help you be anonymous there. Tor cannot prevent misuse & ignorance. As for this 'MITM' attack, Tor's design is such that you do not have to trust the exit nodes for it to work. As for the comparison with I2P, I don't know much about it, but I support any FOSS project that aims to provide new types of anonymity. As I understand it the problem with I2p at the moment is that there is 1 exit node facing the regular net. It's not entirely clear how I2P evades what you consider 'the problem with Tor' when connecting with the regular net. EDIT: Yep, did a bit of research and i2p is subject to the same sort of "attack" you describe "Like Tor, I2P does not magically encrypt the Internet. You are vulnerable to snooping by the outproxy operators." http://www.i2p2.de/faq.html#outproxy http://www.i2p2.de/faq.html#outproxy
voltagex_ 14y ago
Can someone paste the content of this article elsewhere? *.torproject.org is blocked as proxy avoidance where I work.
- 11001 14y ago
  The post: In October I attended an FBI conference, as part of my work to try to keep Tor on good relations with law enforcement. My first goal is to remind them of all the good uses of Tor, so if they ever find themselves lobbying to outlaw anonymity online, they'll understand what they're giving up. The second goal is to make sure they understand what Tor is and how it works, so if they encounter it in their investigations they'll hassle our exit relay operators less. (Here's a great way that one FBI person explained it to me: "I've got 10 leads, and 48 hours before this case doesn't matter anymore. If you can help me understand which leads not to follow, I can do my job better.") My third goal is to help them be able to use Tor correctly for their own jobs — remember that diversity of users is part of what makes Tor safe for everybody to use. Overall, we've been doing a pretty good job at teaching US-based law enforcement about Tor. At the end of the conference, one of the FBI agents took me aside and asked "surely you have some sort of way of tracking your users?" When I pointed at various of his FBI colleagues in the room who had told me they use Tor every day for their work, and asked if he'd be comfortable if we had a way of tracing them, I think he got it. I met a nice man from the DEA who worked on the "Farmer's Market" bust. This was in the news a lot back in April, where apparently some people were selling drugs online, and using a Tor hidden service for their website. At the time I thought the news stories could be summarized simply as "idiot drug sellers accept paypal payments, get busted." It turns out they were pretty smart about how to accept paypal payments — they just had random Americans receive the paypal payments, take a cut, and then turn them into a Panama-based digital currency, and the Panama company didn't want to help trace where the money went. The better summary for the news stories should actually have been "idiot drug sellers use hushmail, get busted." Way before they switched to a Tor hidden service, the two main people used Hushmail to communicate. After a subpoena (and apparently a lot of patience since Canada still isn't quite the same as the US), Hushmail rolled over and gave up copies of all the emails. Many more details here: http://www.scribd.com/doc/89690597/Willemsindictment-Filed-045 http://www.scribd.com/doc/89690597/Willemsindictment-Filed-0... I should still note that Tor doesn't introduce any magic new silver bullet that causes criminals to be uncatchable when before they weren't. The Farmer's Market people ran their webserver in some other foreign country before they switched to a Tor hidden service, and just the fact that the country didn't want to cooperate in busting them was enough to make that a dead end. Jurisdictional arbitrage is alive and well in the world.

156 points by onosendai 14y ago

mtgx 14y ago

So that settles it for recommending Hushmail for true private communications - don't use it.

Nyr 14y ago
That wasn't the first time they cooperated with law enforcement. One thing it's a "private communications" service and other a bulletproof one.
- dhimes 14y ago
  Is there a better one?
  - HNLogInShit 14y ago
    HushHushMail
  - webreac 14y ago
    Yes, encrypt all your mails using PGP.
    - Xylakant 14y ago
      The problem with PGP is that while it keeps the content of your mail exchange secret, it does not protect the information that two persons exchanged emails. So if the investigators have a lead to person A that sells drugs and see that he's communicating with person B that accepts payments, the might just guess what relationship the two have.
      - glomph 14y ago
        For that use tor to access your emails and/or use tormail.org which will not be able to disclose that information.
      - dbrian 14y ago
        Right, that's why you use Tor. PGP provides privacy and accountability. Tor provides anonymity. Just remember you have to trust the security of the receiving party as well. Make sure not to reveal yourself with the contents of your emails since the other party might not be as disciplined with their tor and pgp use as you are.
        derrida 14y ago
        Tor doesn't anonomise email :-/ If you want that, look for mixminion or mixmaster. Tor is a low latency mixnet for TCP streams (aka web browsing).
        dbrian 14y ago
        SMTP uses TCP and works over tor just fine. But you can always just use a free web mail account somewhere.
        derrida 14y ago
        Yes, that's to fetch mail from a server. TorBirdy for instance is a plug in for Thunderbird. But! If you want to send a message alice@domain.com to bob@otherdomain.com that is not anonymous, unless you take other measures.
      - DanBC 14y ago
        Yes. There is a difference between "private" and "anonymous". Encryption often removes anonymity by tying an identity to keys and to a web of trust.
    - 1337biz 14y ago
      @Xylakant then you have to pull an "Petraeus" and just keep the emails unsent in the draft folder. Not sure if this is still a viable option.
      - derrida 14y ago
        People are forgetting that if you use PGP you can post it anywhere The Petreus incident is sort of crazy for this reason. Here is the head of the CIA, doesn't even use PGP. There are other mixnets such as Mixmaster and Mixminion that do what Tor does for TCP but with email. They unfortunately need many more people to run nodes.
        antidoh 14y ago
        "The Petreus incident is sort of crazy for this reason. Here is the head of the CIA, doesn't even use PGP." He's just a bureaucrat, hired after retiring as an Army general. I seriously doubt if he had any personal spy craft training beyond "use this secure computer and this secure phone when you're working on company business, sir. And don't talk about Fight Club."
        DanBC 14y ago
        <tinfoil hat> The head of the CIA is aware of the methods used to extract information from suspects, and thus wants his information to be easily found if he's discovered, rather than requiring him to be extra-ordinarily renditioned and water-boarded. </tinfoil hat> I guess it just shows that anonymous and private communication is still really hard for most people, even though we had the work of cypherpunks trying to help.
        pyre 14y ago
        Why would they waterboard him if he was willing to give up the keys?
    - mahyarm 14y ago
      Actually now-a-days it's using an OTR client, since it adds deniability and forward secrecy. I don't know if it removes offline messaging. It's also a lot easier to use and easier to convince your friends and close ones to use it since they only need to flip a switch practically. http://www.cypherpunks.ca/otr/ http://www.cypherpunks.ca/otr/
  - kapnobatairza 14y ago
    TorMail
  - codesuela 14y ago
    https://countermail.com/ https://countermail.com/
gtt 14y ago
I do not understand why they are still in the business. It seems their reputation is destroyed, yet they are still here.
- mahyarm 14y ago
  For people who only care about non-government espionage.
xk_id 14y ago
you have to be an idiot to use any email provider for something like this, without PGP encrypting your content.
revelation 14y ago
Apparently you have never been to their website. They clearly state that they will fully cooperate with law enforcement on signup. Its a mandatory checkbox on signup: I understand that Hushmail is not suitable for illegal activity and that the providers of Hushmail will cooperate fully with authorities pursuing evidence via valid legal channels. See our Security Page.
- derrida 14y ago
  "Security" here is used in a weird way. Security is a design feature, not a policy.
- marvin 14y ago
  The corollary is that Hushmail is a shitty service. A good service for private e-mail should make it impossible for the server administrators to see what is going on. Obviously that checkbox should make any user that needs real security turn around in the door. I've never used Hushmail, but I assumed "secure e-mail" == "none of my information touches the server in plaintext". So this comment is quite interesting.
  - SageRaven 14y ago
    Supposedly lavabit.com is (from the admin perspective) about as close to zero knowledge as it gets. Logs are kept for a minimum to diagnose abuse/performance issues, and crypto keys are strictly between the user and server. As I understand it, the only legal compromise would be a national security letter style gag order to alter the binary that interfaces the client (be it Outlook, your phone, or the web-mail host) to the back-end data store, which is stored encrypted on disk. Security flaws are another thing entirely. I have no idea if anyone, aside from internal developers, has vetted the system for flaws that typically result in server compromises. I was a satisfied free user some years ago, and the above was my understanding of the service after a few pointed queries to the support address.
    - noibl 14y ago
      > alter the binary that interfaces the client Which, in case it's not clear, is exactly what Hushmail did/does. http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator-bolts-to-hush.html?showComment=1309018784191#c7610754517237372617 http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator...
chmars 14y ago
Most providers happily cooperate with law enforcement and other government agencies, in particular if they don't have to (or are forbidden to) inform their customers. In many cases, informal contacts are used or a polite official request without a court order is already sufficient.
FiloSottile 14y ago
Please note that all the discussion that is done here about Hushmail being or not secure is only applicable to @hushmail to @hushmail communication. Securing mails to external addresses is impossible by design (without other types of key exchange/trust, e.g. PGP).

HNLogInShit 14y ago

Whatever "Tor" is.

piqufoh 14y ago

I like the idea that some agents are regularly using Tor, whilst others are asking the Tor guy if he can track Tor users...

morsch 14y ago
I'm not sure quite what they're using it for, though. I suppose some sites block .gov IP ranges, but you'd think they could easily proxy via some innocuous host provided by a commercial provider.
- derrida 14y ago
  Law enforcement have for decades been anonymous, wearing plain clothes & hiding behind false identities in efforts to catch criminals. Tor just gives them digital plain clothes. If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Keep in mind there is a good mix of software, a whole variety of kernels etc. If you have one of the less common architectures around, consider running a Tor node on it :-) Then we get a mix against random machine-code backdoors too.
  - dmix 14y ago
    Another good reason might be because there are a ton of illegal onion sites on Tor that they are investigating.
    - derrida 14y ago
      Sure, but that is a newer feature, and Roger Dingledine has been giving these talks to law enforcement for some years (the earliest I am aware of is 2008).
  - ChrisWoodall 14y ago
    >If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Can you go into more detail about what you are saying? I'm sure you could drop a- ADOBE, Active-X, Java, ect- 0-day on a page and pwn said box. You can also send payloads to/from TOR; although there are limited transfer protocols you can use. The whole point of TOR is to try to anonymize you. It's not going to save you from getting owned.

TommyDANGerous 14y ago

Great read, I use to use Tor but did not know it was used in this way. Pretty epic.

Create 14y ago

"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." We now know, that entire nations' & worldwide traffic is being intercepted and logged. One would probably see I2P as an overkill without knowing the downfalls of its predecessor. Tor was once a wonderful multi-proxy used for hiding IP addresses and bouncing off servers all over the world. At one time, it was even trusted by most governments for strong anonymity. All of that seemed to change after an article was posted in 2600 Hacker Quarterly. One author exposed how becoming an exit node for Tor allowed all the traffic on the Tor network to pass right through your machine. Becoming an exit node was the same as performing a Man-In-The-Middle attack. All one had to do was open up a packet sniffer and see all the traffic going through encrypted. Tor is still used by people trying to protect their privacy. But at the same time it has become a playground for hackers and governments monitoring what they consider suspicious. I2P has secured this problem while adding more functionality. Proper German engineering: http://www.i2p2.de/index.html http://www.i2p2.de/index.html

derrida 14y ago
> One author exposed how becoming an exit node for Tor allowed all the traffic on the Tor network to pass right through your machine. Becoming an exit node was the same as performing a Man-In-The-Middle attack. This is de-contextualised scaremongering. What the poster is referring to is that when you leave the Tor network, the connection is as it would have been before. This is by design. So if you were not using TLS, then your traffic could be read, as is the case with ALL http etc. Simple. Use SSL/TLS/SSH/ etc Do a trace route to google. All those intermediate parties are capable of the same thing. But if you use TLS the attack is useless. Tor provides one property, Anonymity, and it does this incredibly well. Anonymity and Privacy are related by distinct properties. Obviously if you send traffic to a site and sign off with your name, Tor can't help you be anonymous there. Tor cannot prevent misuse & ignorance. As for this 'MITM' attack, Tor's design is such that you do not have to trust the exit nodes for it to work. As for the comparison with I2P, I don't know much about it, but I support any FOSS project that aims to provide new types of anonymity. As I understand it the problem with I2p at the moment is that there is 1 exit node facing the regular net. It's not entirely clear how I2P evades what you consider 'the problem with Tor' when connecting with the regular net. EDIT: Yep, did a bit of research and i2p is subject to the same sort of "attack" you describe "Like Tor, I2P does not magically encrypt the Internet. You are vulnerable to snooping by the outproxy operators." http://www.i2p2.de/faq.html#outproxy http://www.i2p2.de/faq.html#outproxy

voltagex_ 14y ago

Can someone paste the content of this article elsewhere? *.torproject.org is blocked as proxy avoidance where I work.

11001 14y ago
The post: In October I attended an FBI conference, as part of my work to try to keep Tor on good relations with law enforcement. My first goal is to remind them of all the good uses of Tor, so if they ever find themselves lobbying to outlaw anonymity online, they'll understand what they're giving up. The second goal is to make sure they understand what Tor is and how it works, so if they encounter it in their investigations they'll hassle our exit relay operators less. (Here's a great way that one FBI person explained it to me: "I've got 10 leads, and 48 hours before this case doesn't matter anymore. If you can help me understand which leads not to follow, I can do my job better.") My third goal is to help them be able to use Tor correctly for their own jobs — remember that diversity of users is part of what makes Tor safe for everybody to use. Overall, we've been doing a pretty good job at teaching US-based law enforcement about Tor. At the end of the conference, one of the FBI agents took me aside and asked "surely you have some sort of way of tracking your users?" When I pointed at various of his FBI colleagues in the room who had told me they use Tor every day for their work, and asked if he'd be comfortable if we had a way of tracing them, I think he got it. I met a nice man from the DEA who worked on the "Farmer's Market" bust. This was in the news a lot back in April, where apparently some people were selling drugs online, and using a Tor hidden service for their website. At the time I thought the news stories could be summarized simply as "idiot drug sellers accept paypal payments, get busted." It turns out they were pretty smart about how to accept paypal payments — they just had random Americans receive the paypal payments, take a cut, and then turn them into a Panama-based digital currency, and the Panama company didn't want to help trace where the money went. The better summary for the news stories should actually have been "idiot drug sellers use hushmail, get busted." Way before they switched to a Tor hidden service, the two main people used Hushmail to communicate. After a subpoena (and apparently a lot of patience since Canada still isn't quite the same as the US), Hushmail rolled over and gave up copies of all the emails. Many more details here: http://www.scribd.com/doc/89690597/Willemsindictment-Filed-045 http://www.scribd.com/doc/89690597/Willemsindictment-Filed-0... I should still note that Tor doesn't introduce any magic new silver bullet that causes criminals to be uncatchable when before they weren't. The Farmer's Market people ran their webserver in some other foreign country before they switched to a Tor hidden service, and just the fact that the country didn't want to cooperate in busting them was enough to make that a dead end. Jurisdictional arbitrage is alive and well in the world.