Russia’s Interior Ministry is offering $111k for a technological solution that would allow police officers to identify internet surfers who are using the TOR anonymizer network, which has been rapidly growing in popularity inside the country.
The 3.9 million ruble (US$111,290) tender – whose winner will be announced on August 20 – was put on the official government procurement website and went unnoticed by the wider public for two weeks, until it was flagged by several human rights activists on Thursday.
TOR – which anonymizes the identity of an online user by encrypting their data and sending their information through thousands of random pathways, making it harder to trace – can be used to conceal potentially illegal activity. But it can also be essential for avoiding monitoring or censorship from security services, in countries with restrictive legislation.
“Law enforcers are worried about the ability of internet users to anonymously visit the internet, and particularly blocked sites. Also, thenew blogging lawthat comes into force in August says that all bloggers with a daily audience of over 3,000 must register their identity. But someone blogging through TOR can do so anonymously,” Sarkis Darbinyan, a lawyer for Russia’s Pirate Party, told BBC.
While only a fraction of Russia’s 30 million households with internet access use an anonymizer, the number of TOR users has spiked from just 80,000 in May to nearly 200,000 this month, according to Apparat.cc online magazine – though it is unclear whether those results are muddied by automated accounts.
Nonetheless, Russia’s security service mooted a plan to ban all anonymizers last year, though the idea was later shelved.
Various technological solutions for unmasking TOR users have been applied by the NSA and other leading agencies, though most involve considerable time and expense, or rely on cracking less secure software used in conjunction with the anonymizer.
A talk titled 'You don’t have to be the NSA to Break Tor: De-Anonymizing Users on a Budget,' which was to be presented at the reputable Black Hat hacker conference in August, was pulled without explanation earlier this week.