
Statement from the Tor Project Re: The Court's Feb. 23 Order in U.S. v. Farrell - jakobdabo
https://blog.torproject.org/blog/statement-tor-project-re-courts-february-23-order-us-v-farrell
======
rayiner
> It is clear that the court does not understand how the Tor network works.
> The entire purpose of the network is to enable users to communicate
> privately and securely.

The order demonstrates a perfectly adequate understanding of the technology:
[https://motherboard.vice.com/read/carnegie-mellon-
university...](https://motherboard.vice.com/read/carnegie-mellon-university-
attacked-tor-was-subpoenaed-by-feds).

Tor does not actually hide your IP address from the public Internet. Someone
technically ignorant might believe that (in which case, his expectation of
privacy is based on a false assumption and is thus objectively unreasonable),
but that's not the guarantee Tor provides. What onion routing does is ensure
that someone sitting in the middle cannot identify _both the source and
destination of a packet_.

But the legally relevant technical question is not whether someone can track
the packet from the source to the destination. It's whether the user's IP
address has been revealed to the public. That's necessarily the case even when
communicating over Tor; that's just how the Internet _works_.

~~~
naner
What does implementation details have to do with expectations? You can't just
say the general public's expectations don't matter because they don't
understand the implications of network routing.

Do Tor users expect their communications to be private? I think the answer is
obviously yes.

~~~
chatmasta
Then why bother setting up any encryption at all? Why not just call the
Internet an "anonymous network" and be done with it?

It's clear there is some difference between "expectation" and " _informed_
expectation." If there were no distinction, then claiming you expected privacy
in any situation would be legally sufficient to eliminate evidence collected
while "violating" your expectation.

------
eykanal
This statement is pretty confusing to me. It seems that they're attempting to
use the _legal_ phrase "reasonable expectation of privacy" in a decidedly non-
legal sense. The term is in fact a legal one (see here [1] for a definition,
or just google the term), and after reading through the definition, I find it
hard for anyone to argue that they _should_ have a "reasonable expectation of
privacy" when using _any_ public network. Sure, Tor users are using the
network because it provides anonymity, but anonymity and "expectation of
privacy" are two very distinct concepts. Tor allows them to PUBLICLY
communicate ANONYMOUSLY. You can have an anonymous communication without any
expectation of privacy, the same way you can have privacy without anonymity.

Note that I am not a lawyer and am making assumptions and inferences about
legal matters based on internet searches. YMMV.

[1]: [http://injury.findlaw.com/torts-and-personal-
injuries/what-i...](http://injury.findlaw.com/torts-and-personal-
injuries/what-is-the--reasonable-expectation-of-privacy--.html)

~~~
ajross
> anonymity and "expectation of privacy" are two very distinct concepts

Can you elaborate on that? I don't think I understand the point you're trying
to make. One can construct a semantic distinction, but it doesn't seem
relevant here.

Clearly, Tor users are using Tor because they believe the copious online
content describing it as either or both of "private" and "anonymous". To argue
that their "expectation of {privacy|anonymity}" is "unreasonable" seems to
strain logic by any definition, be it "legal" or not.

~~~
eykanal
The distinction is that one has a clear legal definition in a court of law and
one does not. The judge in this case has examined the case and found that Tor
users do not have the legal right to having any expectation of privacy. The
fact that we use the term anonymous as a synonym for privacy in some cases has
no bearing on the judges ruling.

~~~
mattmanser
Your own link contains this:

 _It 's important to note that the expectation of privacy discussed here means
something different than when it's used in connection with searches by persons
acting on behalf of a city, state, or federal government._

So how is it relevant? They clearly say the definition discussed is between
private individuals, not the state and individuals.

------
lucb1e
A few years ago this kinda bugged me. Now I am beginning to seriously wonder
how judges can still get away with this. If you have no clue what you are
judging, how can you do your very important job at all? Your vital role in
society? When is some high ranking dude in the government going to recognize
it and think of something to get them the hell out of making incorrect
judgements?

"No reasonable expectation of privacy in the Tor network"? That's like saying
warrantless searches are legal because your house has windows, thus giving you
no privacy either.

~~~
droffel
While I agree with you on principle, legally, the boundaries of the 4th
amendment's "Reasonable expectation of privacy" end the moment you give your
data to a third party. In Tor's case, you give your data to the Tor nodes
(third parties). The 4th amendment unfortunately doesn't apply, the precedent
here is rock-solid.

~~~
codys
If one gives a locked safe to someone else for safekeeping, do they really
expect the keeper to break open the safe and search through the contents?

I don't think 3rd party doctrine is really a good idea if the above is OK.

~~~
URSpider94
If you put a safe in a storage locker, the police could gain access to the
safe and crack it by serving a search warrant on the storage facility, without
ever notifying you -- and in fact they could get a companion gag order to
prevent the storage facility from telling you or anyone else that they had
done so.

If the service were willing, the police could even gain access by just asking.
In that case, you might have a legal claim against the service, but not
against the cops.

That's probably the best analogy to data in cloud services.

