Anonymity as a crime?

08/04/2017
G DATA Blog

Legislation regarding the use of technologies such as VPN and TOR are a hot topic at the moment. One of the main arguments fielded against those technologies is the fight against terrorism and the "removal of terrorist content" from the web. Some experts, however, openly question the usefulness and effectiveness of those measures.

Cui bono? Why you may want to remain anonymous on the web

The argument that "if you have nothing to hide, you have nothing to fear" has been disproven over and over again. Therefore I will not discuss this any further. It is a fact that some individuals have a legitimate interest to cover their tracks when they use the web. This includes people who are in danger of political persecution and have no other means of accessing information about the outside world. Anonymization is also employed by investigative journalists who want to glean information and protect  their sources. It cannot be in the interest of the public that journalists put their own lives as well as the lives of their contacts at risk by forcing them to act and communicate more or less openly. Especially in countries where even accessing foreign news websites or social media platforms is punishable by law, the use of such technologies can become essential for one's own survival. 

Overshoot and Overkill

The statement is out there: "TOR and VPN are used by terrorists to plan and coordinate crimes and to spread illegal content. Therefore those tools must be outlawed."

There is no doubt that there are websites and content that belong in this category.
However, I think that effectively banning and criminalizing a technology which has saved lives of people or at the very least made it easier, based on the potential for abuse would be to throw out the baby with the bath water. 

Arguing that you don't care about privacy because you have nothing to hide is no different than saying you don't care about freedom of speech, because you have nothing to say.

Edward Snowden

The often quoted "Dark Web" and its dangers also play a role in the minds of politicians in many countries. On the other hand, co-founder of the TOR network Roger Dingledine disagrees with this notion and states that "There is no Dark Web. It doesn't exist." According to Dingledine, traffic to so-called "Hidden Services" (for which the term "Dark Web" is often used) only accounts for three per cent of all traffic in the TOR network. By the way, the most popular and most often used hidden service is the one offered by Facebook. It is used by a million users on a monthly basis who would not be able to access the site otherwise. 

Those in favor of the ban face accusations of attempting to introduce "censorship through the back door" and to silence or eliminate political opposition. Those who oppose the legislation are trapped between a rock and a hard place: they are in danger of being accused of either implicitly supporting terrorism or of wanting to boost "unpopular" political activities and crime. Both only face a relatively small number of cases where those measures are beneficial. One analogy would be to ban the sale and use of trucks or cars based on the fact that both have been used for criminal purposes in the past. Nobody would think of doing this. Besides: the fact that something is illegal is usually of little concern to a determined criminal. 

Asymmetry and Development

"Asymmetric warfare", as terrorism is also referred to by defense experts, is an argument that is used very often these days as justification for political measures. Also, the term "terrorism" is used in an increasingly broad sense. Some countries have also stretched the definition of terrorism to a point where it is not much different from "having a different political inclination". I am very concerned about this development and hope that technology is not widely criminalized and outlawed. In Russia, a big step in this direction has now been made: from November 1st, 2017 the use of proxy services (which VPN is) will be considered illegal in Russia. In China, no foreign VPN providers exist anymore. The solutions which are available there are licensed and controlled by the state. Recently, Apple had to give in to pressure from Chinese authorities and pull VPN apps from the Chinese App Store.

So far there are no indications which suggest that criminal and terrorist actors are deterred from performing their activities because of communication platforms being under increased pressure from surveillance. Persuasive evidence about the efficacy of outlawing anonymization techniques in crime prevention has yet to emerge. The data that is currently available does not support a conclusion about this as yet.

Germany is also discussing and testing measures to track terrorist suspects using video surveillance and biometric data (facial recognition). The objective is to create profiles of movements and to apprehend suspects. An article by Deutschlandfunk (source in German) on the other hand shows that biometry is not without its flaws. An expert demonstrates that even at a presumed false positive rate of only 0.1 per cent, there would still be 300 false alarms on a daily basis when applied to a location such as Berlin's main railway station. That's 300 people who may be wrongly identified by the system as terrorists. The fact that nobody would be able to move anonymously anymore if the technology finds widespread application is criticized by privacy advocates. 

For the Future

We live in interesting times when it comes to privacy. The concept is gradually being hollowed out.
Especially in Germany, people are highly sensitive about this, given the country's history.

One facet of this manifests in what is called "German Angst". The term describes the tentativeness with which some developments are driven forward as well as the way in which new technical possibilities are viewed. The tentativeness that is part of the German Angst is a result of several factors: for one, people are concerned about mistakes they might make when moving on unploughed ground. This approach can certainly be a hindrance on the way to progress and cause the country to 'miss the boat' in many ways, but can also be seen as a way of avoiding bad decisions. It is a delicate balance between a fear- and fretful "but what, if..."  and a determined "We are definitely not going to make the same mistake twice".

Germany has a reputation for have some of the strictest pricavy laws in the world. This reputation is a direct result from the past roughly 80 years. On the other hand, political efforts are made to undermine the possibility to remain anonymous or, as is happening in Russia right now - outright ban it. In this case, the justification is - again - the fight against terrorism. The critical question to which the discussion boils down to appears to be whether or not anonymity and privacy should be undermined to provide some abstract level of "security". The countries which make an active effort to push legislation that criminalizes anonymity are on a fast track towards a society that is under constant surveillance and a model of society where a form of  "Listen and Watch, LTD" is never far away. Especially the eastern part of Germany has extensive first-hand experience in living in that type of society from the days of the German Democratic Republic (GDR), where political dissidents often faced imprisonment.

In any case, the political tug-of-war over the subject is likely going to last for a while. It is a very attricious process already in which the public is rapidly losing interest. But is is now that people should really be on their guard: in Germany, for instance, crucial changes to criminal procedure legislation were greenlighted which grant authorities permission to perform extensive surveillance "at the source" to gather evidence - including the authorization to use a "federal Trojan". So far, those permissions were only granted to cases related to organized crime and terrorism, but given these changes, the law applies to other crimes as well. This change has gone largely unnoticed as most media attention was still dealing with the aftermath of the G20 summit in Hamburg. As early as 1775, Benjamin Franklin famously wrote that "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety". And while the quote was used in a different context back then, it applies to the current situation very well. The way things stand now, the political pendulum tends to swing more in favor of "safety".