20

Thought experiment: You need to upload a file, and the threat model is the entire world trying to find out who you are after you do so.

I know this is absurd, but bear with me, it's a thought experiment, where the scenario is the following:

You are a normal citizen, and you have a file (assume that you just have it, and the file doesn't have metadata or information related to you) that is somehow so compromising/critical that, if uploaded on the internet, the entire world would actively try to find out who you are. Everyone, military, every country's agencies, civilians, the grandma going to the grocery store, yes, her too, to the best of her ability. People who run TOR relays too, everyone.

Your mission is to upload it on the internet without your identity being revealed. How would you go about it?

Update: File is in your pendrive, has a size of few MB, it's ok if it just shows up eventually. No-one should really guess what country you might live in. We can think of the uploader as average-citizen, with average knowledge of technology, and can follow instructions (for example, setting up Tails). Assume that no-one had access to this data before. The thought experiment is not realistic, because one could argue that no upload could be so critical as to motivate the entirety of humanity to find the identity of the uploader, and I would agree with that argument, but the thought experiment is aimed at exploring fairly reasonable routes of action if that was the case.

  • 1
    Especially that last line really makes it sound like this question was taken from /r/askreddit – Luc Nov 19 at 11:06
  • 4
    I don't think this question is not realistic enough to actually care about this constructed problem. Assuming that you have the file or information from somewhere the whole world would not concentrate on who did the actual upload but who had access to this information and might have leaked it. This will quickly narrow down the field. And if the file would not contain some secret information but instead some made up stuff most would simply not care. – Steffen Ullrich Nov 19 at 11:17
  • 1
    If no one had access to this data before then this means that these data are made up by the one who did the upload. I find it very unlikely that somebody has created absolutely critical information all by its own without anybody else being involved which means I still find your question not realistic enough. – Steffen Ullrich Nov 19 at 11:28
  • 3
    @SteffenUllrich the scenario was not meant to be realistic, but a thought experiment, in order to explore possible routes of action in such scenario. Thought experiments (even containing elements of absurdity) are not uncommon in scientific fields. – Tom Nov 19 at 12:00
  • 1
    @Tom: In a world where such a scenario is possible, what else is possible or different? I don't find it useful to make unrealistic assumption on one side but then require realistic assumption everywhere else. – Steffen Ullrich Nov 19 at 12:05
8

Tl;DR

Time is on your side.


Note: leave your own phone at home and preferably own a car without GPS.

  1. Drive 100 miles from home and buy a cheap used laptop/Android device with functioning Wi-Fi in cash from any source with bad/non-existent record-keeping
    • If laptop then make sure it has the most common OS such as Windows 10
    • Make sure to park your car about 1-2 miles away from the transaction
    • If you can grow out your hair and a large beard then do so before this transaction; when the seller gets interrogated then they won't have a clear idea of your facial features. Just try not to make yourself look disheveled or sketchy
    • Re-format the device to factory settings if possible. Do not install your own copy of the OS
    • Don't try to install Linux thinking that it's more secure or anonymous because that would narrow down the search criteria to finding people with the knowledge to do such a thing unless of course you are not a person that knows how to do such a thing but were given explicit instruction for achieving such a task. In the latter case you should install Linux to further distance yourself from the main suspect.
  2. Put a piece of tape over the webcam if laptop
  3. Shave your face and cut your hair if applicable
  4. Wait at least one year
  5. Grow out your hair and a large beard again if applicable
  6. Go find some free public Wi-Fi at least 100 miles from both you and the transaction location of the laptop/Android device and connect while outside the actual building; preferably with no surveillance cameras nearby. Park 1-2 miles away.
    • Alternatively, you could hide in plain sight in a heavily populated mall; in which case an android device would be less conspicuous than a laptop.
  7. Upload the file
    • You may wish to pass through one or more VPNs
  8. Shut down the laptop/Android device
  9. Get back to your car and drive another 50 miles, remove the hard drive if laptop, and destroy it physically and dispose of it.
    • Destroy and dispose the laptop/Android device in a different location and drench it in bleach to remove fingerprints
  10. Return home using a different route
  • 2
    This is a decent answer, but #3 is hard and is the weak link. License plate readers, unanticipated surveillance cameras, etc. will all link you to the location. Stashing the laptop and scripting it to perform the upload might work better there, but requires an unconspicuous way to dispose of it later or having it dispose of any record that it was involved in the upload and just leaving it as trash. A cheap used Android phone is probably better for that than a laptop. – R.. Nov 19 at 20:24
  • 1
    I'd go for a burner phone and prepaid SIM instead. You should easily find them in some 2nd/3rd world country. Also, plenty of places with GSM signal, but without any surveillance. The phone can even be a 10yo model literally from trash if only it supports (at least) GPRS and tethering. – Marandil Nov 19 at 20:55
  • @Marandil I've never acquired a burner phone. Don't you need to provide your personal details to obtain one? If this requires meeting a shady dealer in the ghetto then I don't know if the average person is willing to do that. – MonkeyZeus Nov 19 at 20:59
  • @MonkeyZeus usually no. At least it depends on country. I have never provided any info to anyone when I bought any of my phones. Similar with SIM cards, although many "civilized" (if we can call them that) countries now require registration of SIM before use as a mean of "preventing terrorism" ;) (and massive surveillance of course) – Marandil Nov 19 at 21:04
  • 1
    @Marandil: Using mobile internet is a pretty bad idea. It introduces TWO components (phone and SIM card) that are potentially trackable to you. – Michael Borgwardt Nov 19 at 21:40
4

You can get away with it at least once. The keyword here is plausible deniability.

If it is plausible that you can deny that you are the source of the information, and that there's no way the adversaries can prove that, then you're successful.

What you can do is that you should run a large, busy Tor node, without any logging. As a relay, users of the network and other nodes will be sending traffic through your node, and you can send out your critical packet by hiding your packets among that crowd of traffics. Even if the adversary can trace the packet back to you, they would have no way to prove that you're not just relaying traffic from another node. You can just say that you don't keep logs, so you don't know where the packet came from. This excuse is plausible, and they cannot prove that you've lied.

Even if the adversary figured out who you were connected to during the time the sensitive packet got published, and they interviewed all of the Tor users and the node operators who connected to your relay, they'd never be able to prove it specifically at you. They'll have suspects numbering in at least the hundreds or thousands of people and they'll have no way to tell who is lying and who is telling the truth.

After you've done this once though, it's likely the adversary will increase their surveillance on you (and all the nodes that are directly or indirectly connected to you at the time) and they might require that you must log traffic, so it'll become much harder to plausibly deny sending another packet because if the sensitive packets always comes via nodes that you operate and you are the only node that keeps failing to keep logs after being ordered to do so, it'll become more and more harder to plausibly deny that you haven't actually been sending out the packet.

  • 1
    I think these are the two keys: plausible deniability and the fact that you can probably get away with it once. If you are being specifically targeted/tracked then it becomes much, much, much more difficult (probably impossible) – Conor Mancone Nov 19 at 13:17
  • If the "whole world" is against you, this wouldn't work. You don't have log your traffic, but your ISP does. And it can correlate that the packet you send does not correspond to any packet that you receive as a relay. – Marandil Nov 19 at 20:43
  • Now, you could technically drop other packets to make up for it, but the senders of those packets could also provide proofs that their packets were not properly relayed by your Tor node and so directly disclose your involvement. – Marandil Nov 19 at 20:44
  • @Marandil I am certain ISPs do not log traffic on a packet-by-packet basis and keep records of same. It's hard enough to provide decent bandwidth, and infeasible to write every packet to a log. The size of such a log would be astronomical within seconds – ig-dev Nov 19 at 22:22
0

I would send an Ethereum(*) transaction including the file encoded in hexadecimal in the "input" field of the transaction (which is kind of a "free text" field).

Ethereum nodes (servers running the ethereum blockchain) are all over the world, the information on the network is available publicly, and a particular node receiving the transaction will forward it to each nodes it knows, without any flagging if it is the original sending node or a forwarding node.

Thus, as long as there are more than 2 "sane" nodes of the network( ** ), a particular node can not be aware of who is the sender of a particular transaction, and as long as the transaction is correct, it will be forwarded to the rest of the network, before being included in the next "block" of the blockchain, becoming public.

The data would now be accessible from any web blockchain explorer, and it would be trivial to recover the original file from the hexadecimal "input" field.

Now, someone mentioning this specific transaction in the flood of transaction that occur each seconds would be very suspicious, but nothing could technically tie this person to the transaction.


(*) or any public blockchain ran by individual all over the world with thousands of nodes

(**) An evil company possessing all nodes on the network could create custom rogue nodes associating ip to each transaction, and could hence reverse the route taken by the transaction, recovering the original sender (and its ip)

  • 1
    Does this still protect you if you assume that all nodes are logging everything, and the operators of the nodes are collaborating to catch you? – Anders Nov 19 at 11:31
  • Of course not, as we can expect that the operators are keeping full trace of the whole network at each event, thus isolating the moment when the transaction has been emitted without any node having seen it before. But in a realistic scenario based on our current technology, it is your best bet. – Betcheg Nov 19 at 11:42
  • 1
    The question is a realistic scenario which is not handled by this. – ximaera supports Monica Nov 19 at 18:16
  • 1
    Blockchain is the exact opposite of an answer to this question. You want ingredients with no recordkeeping whatsoever, not permanent append-only ledgers. – R.. Nov 19 at 20:21
0

Yes if you manage to steal someone else digital identity.

The most hard piece of everything to get is someone else digital identity. Then use it to send the file.

If you do not wish to be tracked to your country go to another and use a public hotspot, if you do not wish to be tracked after destroy and dispose the computer and the wifi usb pen.

Speaking of computer buy a second hand one in cash converter.

If you have afraid of getting recognized organize the deliver outside the store in an non existing address and wait for the deliver person... normally you can choose a number between 2 existing numbers in a street anywhere if it is paid you just need social eng. to convince the delivery person to give you the package to you in the middle of the street. break the complexity in small problems that you can action...

0

The computer geek's answer is Tor, which is made exactly for this problem.

You say that even Tor operators would like to know your identity, but there is still a significant logistical problem because everyone has to share their information.

Suppose you upload your file to a public file-sharing site (e.g. Github) over HTTPS over Tor. To find your identity, Github would have to identify the Tor exit node, the Tor exit node would have to identify the Tor middle node, the Tor middle node would have to identify the Tor entrance node, the Tor entrance node would have to identify you.

You could further decrease the availability of access logs by uploading an encrypted file, setup a Github Action to wait a month, then trigger Travis CI to decrypt it using a stored secret and re-upload it.

You could even edit and recompile Tor for much higher numbers of hops and escalate this even further; but this is already enormously private. A real world example is Satoshi Nakamoto, the unidentified inventor of Bitcoin, who used Tor for years without detection. (And damn if he would not be an attractive ransom target...)


The traveler's answer is to go to another location, use a public computer (e.g. at a library), wear gloves/disguise, and upload your file.

  • 1
    Actually, all you have to do is to correlate Github traffic w/ your ISP traffic. This is a common attack on Tor, that doesn't involve compromising any nodes. All you have to do is to compromise recipient (or recipient's ISP) and sender's ISP. Given in question "the whole world is looking for you", Tor is definitely not an answer. – Marandil Nov 19 at 20:51
  • But tor is originally a government project, surely they slide a backdoor somewhere in there – DatsunZ1 Nov 19 at 22:54
  • 1
    @DatsunZ1 they didn't have to backdoor it. The structure of the Tor itself makes it vulnerable to sufficiently strong adversaries ;) – Marandil Nov 20 at 0:02
  • @Marandil are you suggesting going through Github traffic (which is large) and matching it to records from every ISP on the planet? This seems extremely infeasible. – Paul Draper Nov 20 at 6:41
0

It doesn't have to be too complicated.

  1. Make a cup of tea
  2. Connect and chain a few reputable privacy VPNs. Use highly frequented servers. As a bonus, pay the providers anonymously with crypto-currency.
  3. From your cozy home, upload your file using a protocol that doesn't carry identifying metadata about your OS / software.

You can keep your beard.

The key is that the reputation of those privacy VPNs depends on the fact that they don't keep logs. VPN servers have been successfully hacked in the past, and if logs would exist, privacy would have been compromised, and the reputation of the VPN provider killed - bad for business. So the privacy VPN providers have to make sure that not even themselves can reconstruct who did what. Use more than one provider in case, by chance, one of the providers is currently compromised.

Step 3) is the hardest. You could use a protocol such as HTTPS for a file upload to a public service, as long as you use a tool that gives you full control over what meta-data (headers) are submitted. Either spoof the information, or set the meta-data to blank/default values. It might reveal that the uploaded is someone with enough technical skills to do this, but it is by no means identifying.

So the evidence could then be traced back up to the point of the VPN provider. From there, even the VPN provider doesn't know more than "it was one of our many customers of any country of the world".

  • Typical timing-based attacks on Tor hold for VPNs as well. No matter how many VPNs you tunnel through, if sender ISP and recipient (or recipient's ISP) are compromised, you can deanonymize the traffic via timing patterns. I can guarantee you that state-level adversaries can do that. – Marandil Nov 20 at 0:00
  • @Marandil But you would have to be subject to such an attack prior to the upload, so it doesn't apply, correct? Since ISPs can keep logs for later analysis of every individual packet of the astronomical amount of data that they relay. – ig-dev Nov 20 at 0:48
  • @igdev I'd assume they cannot log every single packet, however they can (and should) log every initiated (and closed) connection, with a precise timestamp. That in itself should be enough to at least put you in a suspect circle. – Marandil Nov 20 at 1:06
  • @Marandil I'd be happy to hear your counter-argument, but I think this does not help at all, because VPN connections stay open. There is no correlation between the time the VPN connection is established, and the time the file is uploaded. You'd come no closer than "anyone worldwide who was connected to the VPN server at that time" – ig-dev Nov 20 at 1:19
0

No need to use complicated techniques:

To upload it without your identity being revealed to the internet, give that file to someone else and tell them to upload it once you've left the room. Their identity will be shown on the internet, and from there, it's their words against yours that you're the original source (in short: human proxy).

If you consider that the entire world trusts each other, your proxy's words are considered truth against yours, then the problem is biased: the only person in the world that the rest of the world does not trust is the information uploader, so you could never hide yourself. So there will always be this side-channel attack to identify you, no matter what you do. Hence I have excluded this option.

And you said the world is looking for you after the upload, so your human proxy cannot catch you when you give them the file nor when you leave the room, because the file wasn't uploaded yet.

  • I had almost the same idea: you submit the document to some random person via physical mailbox. it can lead the world to know where you probably live but they won't know who you are. – MrHeliose Nov 19 at 13:52
  • 1
    You are fully identified from the start and the whole world is trying to catch you. Great – ig-dev Nov 19 at 22:19
  • You can make this idea even better if you somehow managed to hand it to a person known to release stuff on Wikileaks without that person knowing you gave it to them. Something like hiding it in one of the balloons during a balloon release event and them accidentally stumbling across it. – Nzall Nov 19 at 22:25
  • @ig-dev No, because the world is against you after the upload: when giving the file to someone, it's not already on the internet so the world is not chasing you. After the upload, the world is not chasing you, but the one you gave your file to. They will get them, but they won't trust them when they'll say you gave them the file in first place. If they do, claim the same and say someone else give you the file and must now be chased. – Xenos Nov 20 at 19:54
  • @Xenos I think your imagination is far removed from reality. Imagine somebody ("you") committed a murder, and you are an immediate suspect (second in line). There were witnesses that saw you at the time, fingerprints, cameras, wifi and server logs from your phone activity (including GPS), all types of evidences. All you say is "No, I didn't do it! This other guy did." Pointing at someone who actually did nothing. Well, good luck. You wouldn't even need the whole world to chase you down, it would still be a clear case – ig-dev Nov 20 at 22:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.