commit 00053b5515a1364b0741a510afaaf675b0b37b5d
Author: Roger Dingledine <a...@torproject.org>
Date: Wed Aug 9 00:21:34 2017 -0400
add files for 2016-03 trsb case
---
htdocs/trsb/2016-03-request.txt | 67 +++++++++++++
htdocs/trsb/2016-03-response.txt | 201 +++++++++++++++++++++++++++++++++++++++
2 files changed, 268 insertions(+)
diff --git a/htdocs/trsb/2016-03-request.txt b/htdocs/trsb/2016-03-request.txt
new file mode 100644
index 0000000..3c8b1f7
--- /dev/null
+++ b/htdocs/trsb/2016-03-request.txt
@@ -0,0 +1,67 @@
+Date: Wed, 26 Oct 2016 19:10:45 -0400
+From: Kymberlee McMaster <kymberlee.mcmas...@gmail.com>
+Subject: Re: Tor Research Safety Board
+
+Please see below for our answers to the questions on the website.
+
+ - What are you trying to learn, and why is that useful for the world?
+ That is, what are the hoped-for benefits of your experiment?
+ - Team DIRE plans to analyze major events relating to the Dark Internet
+ and the substituent community response, the culture of the Dark Internet
+ community, and bitcoin's use as a form of currency in Dark Internet
+ marketplaces. The communication of a community during and after events
can
+ provide insight into the culture of the people immersed in that
community.
+ In order to understand the culture found on Dark Internet marketplaces,
+ Team DIRE plans to study the communication among individuals within the
+ Dark Internet community during events, such as the shutdown of a popular
+ marketplace.
+ - Our goal is to answer the following question: How does the
+ communities response to major events reflect the underlying culture? We
+ hypothesize that, although members of the Dark Internet are anonymous,
+ these events will bring the community together and give a representation
of
+ the Dark Internet's culture that is different from the day to day. It is
+ useful for the world to understand the culture of the Dark Internet as it
+ expands its reach and is used by more and more people.
+ - What exactly is your plan? That is, what are the steps of your
+ experiment, what will you collect, how will you keep it safe, and so on.
+ - Our plan is twofold. We plan to collect texts form sources such as
+ blogs, Reddit, and news websites that all discuss the Dark Internet so we
+ can analyze their view of the Dark Internet. We then plan to take this
+ analysis and compare it to some events that have occurred involving the
+ Dark net to see if their view or user reactions change during those times
+ of crisis. All texts being used are public information available to
anyone
+ with access to the Internet. Each text is coded so that we only use the
+ coded values in our analysis of those texts. We also plan to purchase
items
+ from both Dark net and traditional Internet marketplaces and compare the
+ experiences involved with both and the quality of the products received
in
+ relation to the price of the product.
+ - What attacks or risks might be introduced or assisted because of your
+ actions or your data sets, and how well do you resolve each of them? Use
+ the "safety guidelines" above to help in the brainstorming and analysis.
+ - Our data sets will be limited to the coding of the articles that we
+ read that have been published for public view on the Internet and Dark
+ Internet as well as the products that we receive from the purchasing we
are
+ going through. Due to the nature of our project and the fact that we are
+ only looking to compare the views and products of the marketplaces on the
+ Dark and traditional Internet, there will be no attacks or risks to Tor
due
+ to our actions and data sets.
+ - Walk us through why the benefits from item 1 outweigh the remaining
+ risks from item 3: why is this plan worthwhile despite the remaining risks
+ - Since we believe there are no risks associated with the conduction of
+ this study, the benefits of learning about the differences in the way
Dark
+ and traditional Internet marketplaces behave and are viewed can only
+ provide valuable insight into their cultures.
+
+Please let me know if you have any questions or need further information on
+the above information. We tried to keep it short but also descriptive
+enough that you would understand what we were trying to do without bogging
+you down with the exact things we are coding in our textual analysis.
+
+Additionally, my team will need to present our thesis next semester to a
+panel of experts, and we were wondering if you would be interested in
+serving as a member of the panel.
+
+Thank you for all of your help with our team!
+
+-Kym
+
diff --git a/htdocs/trsb/2016-03-response.txt b/htdocs/trsb/2016-03-response.txt
new file mode 100644
index 0000000..8dbf64d
--- /dev/null
+++ b/htdocs/trsb/2016-03-response.txt
@@ -0,0 +1,201 @@
+Date: Thu, 22 Dec 2016 01:07:53 -0500
+From: Paul Syverson <paul.syver...@nrl.navy.mil>
+Subject: Re: Tor Research Safety Board
+
+Hi Kymberlee,
+
+Here is the TRSB response to your proposal.
+Please share with your team.
+
+May the season make sense to you and yours,
+Paul
+
+----------------------------------------
+
+Dear UMD Gemstone Team DIRE,
+
+Thank you for your submission of proposed research to the Tor Research
+Safety Board. Your proposal was reviewed by three members of the
+Board. I have assembled this response from the reviews each has
+given. There was no significant discussion since reviews were largely
+in agreement.
+
+Aside from safety considerations, all reviewers noted that they found
+the research to be potentially quite interesting. That is not always
+so, even for seasoned researchers much less undergraduates. Thus
+congratulations already in that respect.
+
+All reviewers agreed that there are no Tor-specific safety concerns
+for your research project. Nonetheless, all noted similar concerns
+for such research on the Internet, whether concerning Tor or not.
+
+Details can be found in the comments of each reviewer, included below.
+But in summary the concerns are
+
+1. Make sure that you take adequate security precautions for yourselves
+not just those you research.
+
+2. Be aware that when coding input from multiple sources, potential
+exists for privacy or safety risks to emerge out of the synthesis,
+even if the individual items being coded are safe in isolation.
+
+3. What constitutes "public" information may not be black-and-white and
+can have lots of context to it.
+
+Any or all of these may require the input or analysis of your IRB. In
+any case you should look over our comments and make sure that you are
+both taking them into consideration yourselves and making appropriate
+decisions with respect to your IRB.
+
+Please let me know if you have any further questions or comments.
+I look forward to seeing how your work progresses.
+
+Sincerely,
+Paul Syverson
+
+---------------------------------------------------------------
+Comments from Reviewer A
+---------------------------------------------------------------
+Based on the answers to the questionnaire, I would flag up the
+following issues that may be helpful to the research team:
+
+- The data collected is referred to as "public", and as I understand
+ it consists of discussion forum posts etc associated with specific
+ "darkweb" topics. While, the "public" nature of those posts does to
+ some extent mitigate the risks introduced by the research per se,
+ that data has the potential to be personally identifiable,
+ particularly when it is subject to coding on the basis of the
+ content. Thus I would advise the researchers to seek advice at their
+ institution on whether specific protocols and approvals are needed
+ when handling such PII. I know for a fact that institutions in the
+ EU -- where horizontal data protection provisions are in place --
+ would have to go through a (lightweight) approval process to collect
+ and handle such personal information. Probably procedures to ensure
+ the "anonymity" of the coded transcripts would also have to be
+ described as part of the approval process.
+
+- There is a little ambiguity in the description in relation to the
+ phrase "compare the views and products of the marketplaces". This
+ may mean simply browsing the pages of underground marketplaces,
+ which I think is fine (subject to the above). However, if products
+ are to be bought a certain amount of care should be taken. (1) the
+ safety of researchers should be thought of when it comes to payment
+ options, as well as shipping addresses -- ensuring that the
+ researchers personal information does not end up in the hands of
+ criminal organizations; (2) there are delicacies associated with
+ purchasing controlled substances, or other restricted items or
+ material from specific jurisdictions -- and probably some sound
+ legal advice will be needed in case this is the plan; (3) there are
+ ethical issues about providing payment for, or to anyone involved,
+ in criminal activity, since this may be seen as financially
+ supporting crime. Note that doing the above for research purposes
+ per se, is probably not a sufficient moral or legal defence, and
+ some sound legal & ethical reasoning may be required -- as well as
+ clear protocols to minimize risks to researchers or society at
+ large.
+
+- Besides the above, the research seems to be using Tor as a browser;
+ it does not involve any access that all other Tor users would not
+ have (eg. it does not involve observing traffic, running
+ infrastructure or even hidden services); and no other streams of
+ data, besides what is made available by hidden services, is likely
+ to be affected. Thus, I would think that the usual protocols for
+ collecting PII, and safely interacting with potentially criminal
+ activity while conducting research, should cover most concerns.
+
+- Beyond the strict remit of the board: this does sound like an
+ interesting project!
+
+---------------------------------------------------------------
+Comments from Reviewer B
+---------------------------------------------------------------
+[Note these are written in the context of Reviewer A's comments. -PFS]
+
+Interesting, I agree!
+
+I want to underscore two of Reviewer A's points:
+
+1) If you're giving money to bad people, you need to think through the
+ethics of that.
+
+2) It's important to consider your own safety when you're buying arbitrary
+things from arbitrary people on the Internet.
+
+Both of those are standard IRB topics, and not particularly Tor related,
+so we are right to send them to their IRB for more thoughts on those.
+
+And then here's a third one:
+
+3) Some marketplaces (both in onionspace and on the insecure web)
+require logins before you can browse the wares -- and some of them put
+up barriers to creating the account. At what point do the pages behind
+such login requirements stop counting as 'public'? "Anybody could have
+done these eighteen steps, so the stuff I found after that isn't private"
+is a slippery argument.
+
+But overall, sounds great, thumbs up!
+
+
+---------------------------------------------------------------
+Comments from Reviewer C
+---------------------------------------------------------------
+This looks like very interesting and potentially quite useful work. I
+look forward to seeing its results. I see no show-stoppers, but I do
+have a few safety recommendations and considerations.
+
+The proposed research is "limited to the coding of the articles that
+ we read that have been published for public view on the Internet
+ and Dark Internet as well as the products that we receive from
+ the purchasing we are going through."
+
+The researchers therefore conclude that there is no risk expected in
+conducting this work. Construed strictly in terms of expected Tor
+protocol use or gathering of Tor usage network data, that is
+true. However there are a few concerns.
+
+1. Safety of the researchers is as important as safety of those
+researched. While obviously you can give yourselves informed consent,
+you should take the same precautions as when purchasing or downloading
+anything from the Internet, perhaps with a slight increase in caution
+if purchasing items or visiting forums that seem potentially to have
+higher than normal likelihood of malicious activity, e.g., if focused
+on sensitive or controversial issues or goods. That will of course
+depend on the forums in which you participate. To the extent
+practicable, you should at least protect your own identities and
+network location. It would make sense to conduct all your research
+via Tor running on a suitably up-to-date and protected system except
+where something specific precludes that, e.g. visiting a forum/site
+that restricts access from the Tor network). Discussing the context of
+and extent to which such blockage is encountered could be a useful
+research output of this work.
+
+2. "[P]ublished for public view" is not as straightforward as that
+expression might seem.
+
+First of all, as Vitaly Shmatikov is fond of saying, there is no
+PII... it's all PII. Cf. his work w/ Arvind Narayanan on deanonymizing
+highly dimensional public data using, e.g., publicly posted IMDb
+reviews. Coding information from multiple sources potentially runs
+that risk, and the research should be conducted cognizant of the sorts
+of concerns that research in this space has identified.
+
+Second, you have not said whether sites you will visit/purchase-from
+require registration to participate. That is one indicator of privacy
+assumptions. But whether the sites require registration or not,
+certainly some forums assume information is to be shared only among
+participants or otherwise expect discretion and respect for privacy,
+e.g., forums for discussion amongst crime or disease abuse
+victims. Similarly, for participants in a purchase or other financial
+transaction.
+
+Third, even if information is publicly available, it may be that
+original sources of that information intended it to remain private in
+a way that is violated by public posting. Public posting may have
+occurred when others violated those assumptions.
+
+None of these are Tor-specific safety considerations, but the
+researchers should be cautious and cognizant of these themselves and
+should make sure that their intended research is acceptable given the
+guidelines or evaluation of UMD's IRB or its other institutional bodies
+for research involving (even public) data about individuals.
+
_______________________________________________
tor-commits mailing list
tor-commits@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits
