You may know or probably are using TOR client which provides anonymity to the users but how can one be sure they are secure when browsing using this client and its network since its funded by feds?

I have read this article by the Washington Post about TOR and it mentions that the Tor Executive Director Andrew Lewman's Email to Tor Users about the collaboration between both FBI and Tor Project. but how would one trust such a statement ?

" Just because the project accepts federal funding does not mean it collaborated with the NSA to unmask people's online identities".

What has even shocked me more is that FBI has helped the local police in Turkey to find the identity of a man that's pedophile and that helped detaining him which is good! but FBI funding Tor's project and In the mean time spying on peoples activity online?

what do you think?



3 Answers 3


There are several points to consider:

  1. There is no indication that the guy in Turkey was using TOR or even how the FBI contributed. So, this news story is not related to your question.
  2. US government IS actively putting backdoors in all kinds of things: For example, recent revelations that RSA accepted money from the federal government to use a weak default encryption algorithm should make us suspect everything is compromised and not just projects that are federally funded.
  3. You said "FBI is funding TOR". FBI does not fund TOR. I think you are using "FBI" as a catch-all for federal government and maybe you don't care about the distinction. 80% of TOR funding is from US government, mostly Department of Defense. It is in the model of a research grant and was originally funded by DARPA and the Naval Research Laboratory.
  4. TOR is open source and so it can be verified whether it was deliberately or otherwise made insecure.
  5. The speculation is that instead of compromising the program itself, the government has simply created enough TOR exit nodes to be able to correlate TOR traffic with the users they are interested in. If you use TOR and expect it to protect you, understand the limitations just like any other tool.
  6. Edward Snowden trusted it enough to use it to communicate with Glenn Greenwald.
  7. See two big stories about people getting busted even though they used TOR. In one, Eric Eoin Marques was arrested for child porn due to an insecurity in Firefox and not TOR itself. In the other, Silk Road, Ross William Ulbricht was protecting himself with TOR, but I understand it was a non-anonymized forum posting about how to use TOR that led the FBI to him.

You're right, he's probably not using TOR or any other Proxy server but what really got me interested is the reach of the FBI of this particular person's activity online. I mean if they are getting as far as to get what a random person out of 3 billion internet users surf and do then they could certainly know every other little/big information about everyone else.

They provided the identity of this person through his online activity online to the Local police without any search warrant and the worse is that people were thankful for that! of course they should for catching a pedophile but that would have a catastrophic results if the pedophile in place of the FBI themselves ?

  • Free speech, freedom from censorship, freedom of association, and freedom to publish anonymously all depend on terrorists, pedophiles, hackers, pirates, and elephant tusk dealers being able to do the same. I don't see any way around it. BTW, I don't understand your last sentence: "...results if the pedophile in place of the FBI themselves."
    – mcgyver5
    Commented Mar 19, 2014 at 13:55
  • 1
    I mean what if the pedophile was in the FBI office and one among those who were checking the activity of this guy? we know that FBI are watching peoples activity online! but who is watching over their activities?
    – Moh
    Commented Mar 19, 2014 at 14:01

Security is always about creating a compromise between security and functionality. Which means that to make the best security for you, you need to consider what are your essential functions, what are your assets, and what are your threats.

The government doesn't give a crap about getting into your bank or finding out about your affair. If those are your concerns, then government funded tools are great. While they may be more likely to have government back doors in them (I'll address that in a bit) they are much, much less likely to have accidental vulnerabilities or to be compromised by a third party. The government cares a lot about security, and has no shareholders to answer to about why they are spending so much money securing trivial software.

On the other hand, random commercial or open source software may not have back doors built in to them, but may instead have a laundry list of vulnerabilities that leave you at least as exposed. Open source is only as secure as volunteers care to make it, and commercial software is only as secure as the development team can justify to the board.

If the activity you are trying to secure is illegal, then you need to take a closer look at things. In particular, you should look at which agency. TOR, for instance, is not supported by the FBI as you claim. In fact, the FBI hates it and actively works to undermine it by targeting end nodes. It's supported by the State Department. Why does that matter? Because the State Department's mission is to maintain international relations and to prevent the outbreak of (unintended) war. They don't give a crap about your little drug ring or even your child pornography distribution ring. Their concern is that if someone eavesdrops on their communications, it might lead to a war in which thousands of people are killed. They are not willing to compromise the security of nations in order to help the FBI prosecute some small potatoes crook. So while the security of TOR has some concerns, it's not because of the State Department's involvement.

You need to evaluate your options against your own needs. And you need to do so dispassionately. The way you lump together "government" and the FBI suggests to me you are approaching this from a predetermined conclusion. Ultimately, one of the principal tenets of security is that you can't entirely trust anything. If you are relying on one specific tool or technology to keep you safe, you aren't.

Not the answer you're looking for? Browse other questions tagged .