I recently came across a paper called "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" (Aaron Johnson et al) ... which seems to be saying that adversaries (like the NSA) that can see large segments of the Internet can relatively easily de-anonymize most Tor traffic:
"... previous work has thus far only considered adversaries that control either a subset of the members of the Tor network, a single autonomous system (AS), or a single Internet exchange point (IXP). These analyses have missed important characteristics of the network, such as that a single organization often controls several geographically diverse ASes or IXPs. That organization may have malicious intent or undergo coercion, threatening users of all network components under its control. Our analysis shows that 80% of all types of users may be de-anonymized by a relatively moderate Tor-relay adversary within six months. Our results also show that against a single AS adversary roughly 100% of users in some common locations are de-anonymized within three months (95% in three months for a single IXP). Further, we find that an adversary controlling two ASes instead of one reduces the median time to the first client de-anonymization by an order of magnitude: from over three months to only 1 day for a typical web user; and from over three months to roughly one month for a BitTorrent user. This clearly shows the dramatic effect an adversary that controls multiple ASes can have on security."
Does this mean that Tor is essentially useless for defending against US government surveillance? I feel like I might be misinterpreting the paper, because I would think the Tor Project would go out of their way to make that clear if it was the case (and there is nothing on their website about this) ... Is it really the case that in less than a day the NSA can de-anonymize 80-100% of Tor users?
Can someone explain to me what the practical implications are of this for Tor users who are worried about NSA/FBI surveillance? What kinds of additional steps could be taken to mitigate some of these threats described here?