Throughout the second half of this year, there has been much heated debate about proposed changes to the Wassenaar Arrangement, which seeks to expand export controls on dual-use technologies, including those that pertain to intrusion software. While the intention was good, the first iteration of these changes released this past spring was more likely to hurt those who adhere to the arrangement, while empowering non-participants (e.g. China, Iran, North Korea) with an uneven playing field in their favor.
This week’s proposal by the French government to impose a ban on Tor – the most popular anonymous dark net – is just the latest in a series of myopic policy solutions (e.g. encryption debate) that similarly seems to entail undesirable externalities. In the wake of the Paris terrorist attacks, the government likely feels obliged to expedite policy changes to demonstrate a tough stance against terrorist activity. Unfortunately, banning Tor not only will fail to meet those objectives, but will also disrupt the democratic ideals of a free and open Internet. Below are four of the key problematic issues that arise from this initial policy proposal.
- Failure to deter terrorist activity. Malicious actors – including terrorists, criminal networks, and lone wolves –will simply adapt and find another venue for their activity. Tor is just one aspect of a multi-pronged OPSEC strategy pursued by ISIS and other groups. In fact, roadblocks are more likely to force adversaries toward more innovative strategies and activity outside of the law enforcement radar.
- Difficult to enforce. At a technical level, it is not difficult to identify whether a specific computer is communicating directly with the Tor network. However, the difficulty arrives in specifically attributing the actual person behind the keyboard, especially given the ability to bounce connections, obfuscate connections via proxy or VPN, and the presence of multiple users at a computer. In fact, banning Tor eliminates a known source of activity and data, thereby making it arguably much harder to monitor and attribute criminal and terrorist behavior. Identifying whether a particular individual is using Tor inherently involves monitoring Internet usage, which may require additional legal provisioning. Finally, the simple technical logistics of implementing the ban is much more difficult, which even if enacted, returns to the difficulty of who to charge if a given computer is discovered to be using Tor.
- Decreases civil liberties. While the French proposal is in response to terrorist activities, it is more likely to harm those human rights and civil liberties groups who use Tor to express their perspective, collaborate, and coordinate with journalists. The only people that will stop using Tor in France as a result of the ban are people who were using it for legal purposes. Anyone using Tor for an illicit criminal or terrorist agenda will continue to use Tor. The ban therefore decreases an important outlet for these civil liberties groups while enabling illicit activity to persist.
- A global Splinternet. Despite the widespread perception that state boundaries are obsolete, they do in fact still matter. The ban on Tor in France would accelerate the trend toward a Balkanized Internet, again undermining the spread of a free and open Internet. Moreover, just because Tor is blocked in France, does not mean that malicious actors can’t access it elsewhere. This is especially pertinent and returns to our first point. Because the attacks in Paris were largely planned in Belgium, if this legislation had been in place in France prior to the terrorist attacks, it is extremely unlikely that they would have been prevented based on what we know now.
The policy debates around Wassenaar, encryption, and now the ban on Tor all reflect the naïve belief that a policy can simply make these capabilities disappear. The genie is out of the bottle and instead of placing bans on these technologies, which will only hinder licit while enabling illicit activity, the policy world needs to dig deep and provide innovative solutions that better align with the realities of the modern world system.