7

For clarification, I am looking for the best way to release this program anonymously, not how to remain anonymous and such in general life (that is a different -already answered- question).


I've created a program myself not pirated/cracked and would like to release it to the world but do not want anyone to know I created it...

What is the best way to realistically assume that the author will not be determined?

Do I simply walk around the tube station and drop a usb with it and hope someone picks it up and uploads it to a torrent site (a big stretch). I would also like to limit all potential exposure -physical and digital.

My program is not malware and is something people would use but like I said, I do not want to be tracked at all.


Additional Details From Comments (I delete my comments so there is not so much clutter)

  • This is a standard compiled program with source code files as well. I've created binaries for linux and compiled a .dmg for mac as well as an .msi for windows (for the non-technical users). I actually do not have an IOS app (or any mobile app).

  • We can assume that it is ok to know the creator posthumously, thus in ~100 years.

  • I anticipate this program to become widespread. As such many people will want to determine the origins. I cannot give details about the program or it's functionality.

  • I am looking for a form of realistic statistical security (seen in cryptology theory; IE mathematically guessing RSA will take X amount of cpu hours). I would think that there are ways to be statistically anonymous (IE having more possibilities of where/who a person is than possible cpu hours)

  • Assume an adversary with considerable resources. I cannot give details on the anticipated adversary.

  • The level of protection is simply avoiding 'substantial' evidence. I do not care so much if the identity is suspected (even heavily) based on supposition, but I am look for a way to avoid the vast amounts of hard evidence left behind that could be tied to the author.

  • I have taken some precautions and I hope to be as ambiguous as possible (without having this question closed). Also, the whole branch of this question is completely isolated in every meaningful way from the program and its author. Likewise, the distro of the program will be isolated from me etc... My goal with this post is to garner feedback and peer review some ideas of my own...

  • I do not care if someone(s) else take credit for my app, in fact that may be better for its survival (and mine;)

  • This program does not need to be hosted by myself nor do any of its components. For release, I am looking for a solution like a bit-torrent where it is decentralised.

  • The initial release will be fire-and-forget. I have made every effort to make my code available and understandable in hopes that many other developers will be able to tweak it should future changes be needed. I have taken so many steps to make this software future compatible but only time will tell. To that note, I may release additional 'patches' but that depends on many factors...

  • if you're making an iOS app, I think it requires a certificate, so you must be talking about Android and possibly Windows Phone (or Blackberry) – Christopher Dec 12 '14 at 19:35
  • 2
    Is this roughly what Satoshi did with Bitcoin? In which case you could pretty much do that. – cpast Dec 12 '14 at 21:24
  • 2
    How likely is this account to be tied back to you? If you take any suggestions from any possible answers, how likely is such software to be linked back to this answer? Any truly powerful adversary isn't going to ignore this question. – Lawtonfogle Dec 12 '14 at 21:33
  • 3
    Also, who would be interested in identifying the author? If it's a three letter agency it's a lot different from if you just expect it to be journalists – atk Dec 13 '14 at 4:58
  • 1
    ok, so you're looking to evade the NSA, FBI, GRU, Mossad, etx, for 99 years, starting on day 1. And you posted your request for how on a public forum, probably from a device you have used in the past, thereby tying the request to yourself, thereby starting behind the 8 ball. And if anyone knew how to avoid all of them successfully and anonymously without mocving to a country that they do not monitor (ha!) or crawling down a deep dark hole, you think that that person would post it here. And once posted, that the technique would work for 100 years. Good luck with that. – atk Dec 16 '14 at 19:49
6

This is an interesting question because it is almost entirely nontechnical. One presumes from your question that you are releasing something that would offend more than one national government.

Digital Opsec

  • Compartmentation: Only work on it using resources that are not associated to you. One cross-contamination will burn you (that is how DPR was sent up -- he once used his Silk Road laptop from home and once posted with a reference only DPR would know about Silk Road under his own name). This means a laptop only for this program that has the battery removed when you are within 200 meters of your home
  • When you compile it, run the compiled binary through "strings". If you see anything that is a word you use, determine if it can be removed
  • Use variable names, subroutine names, object class names that are consistent with another lexicon. Careto was attributed to the Spanish because the analyzed binary had names in Spanish, one of which was the word careto, meaning an ugly mask
  • Strip the executable and any libraries before packaging it

Offline Opsec

  • Compartmentation: As The Offspring said, http://youtu.be/G2gTFBhQ7Ko. That means EVERYTHING: cell phones, cell phone service (personal is Sprint, program is Ma Bell), laptops, usernames, passwords, email addresses, email hosting providers (personal is gmail, then program is hotmail), EVERYTHING
    • If it is used for the program, it is never used for your purposes
    • If it is used for your purposes, it is never used for the program
    • If you check your Facebook once from your laptop for the program, you have been made
      • BTW, members of APT1 used a hijacked machine to Twitter, to get around the Great Firewall of China, and that is how they were made
      • cf DPR above
  • Resources used for the development and maintenance of the program, the support of the program and the communication about the program should be owned by the non-natural person (see below) and should never be used for anything else (see compartmentation, above)
  • Plausible deniability: when something is going on with your program, be doing something else, have an alibi every time
  • Be blase and naive about the existence and function of your program. "Oh, did someone make that? Not sure why they would. It sounds interesting. Tell me about".
  • Create a legal fiction (read "corporation") to own your program, and do not have any ties to it. Some jurisdictions are friendlier to anonymous non-natural persons (a legal term for a corporation or trust). http://www.npr.org/blogs/money/2012/07/27/157421340/how-to-set-up-an-offshore-company.
  • Understand the difference between anonymity and pseudonymity
  • Keep the development of the program, the person who owns the intellectual property of the program, the assets of that entity (bank account, tax-filings, patents), and the servers that are used to sell / distribute it in different jurisdictions. This would mean that to discover the full extent of the involvement, your adversary would have to get cooperation and collaboration with authorities in more countries
    • Corporation in Belize, taxes filed as a Belizian corporation operating internationally
    • Software development in Canada
    • Bank account in Dominican Republic
    • Assignment of intellectual property to an Irish subsidiary of the corporation
    • Web servers in multiple countries
  • Have a plan in-place for when you are made. There is no such thing as a fool-proof plan
  • To add on, any physical resources (like the dedicated laptop) should be purchased with cash, preferably with serial numbers that aren't easily traced back to you, from a store far away from where you live. – Justin Lardinois Dec 13 '14 at 19:14
  • 1
    Even further, (some) cars, phones, watches and other devices use gps and other technologies to track your location or leave a footprint. Depending upon the adversary, it may be necessary to leave these completely at home. But that makes travel very difficult, because busses in western nations often have cameras, so something must be done to avoid those cameras filming you and recognizing you, or filming you and tracking the unknown person back to a particular region. This problem is extremely hard... – atk Dec 13 '14 at 19:17
  • @JustinLardinois, that is necessary if you work in a virtual global network... Also, the risk assessment of physically being tagged is far greater than digitally being tagged. ATK, that is what I was referring to. – user63407 Dec 13 '14 at 19:19
  • Oh, and fingerprints, hair and other dna samples, etc might matter depending upon the adversary. – atk Dec 13 '14 at 19:24
  • 1
    @DTK, Thank you for the first meaningful response. The biggest takeaway is compartmentalisation. You are however, leaving out a very important one -misinformation. Also, my program does not need to be hosted by myself. The idea is to release it to enough people that it cannot be centralised and thus 'banned'. (also I do not have the amount of money needed to setup all these legal entities) – user63407 Dec 13 '14 at 19:24
-2

Go to some public wifi access point (e.g. some coffee shop, internet cafe, etc.), plug in your USB stick and upload it somewhere publicly available (e.g. github/sourceforge if you also want to make the source code available).

  • 2
    This creates too much of a trail (registration, logs, geographics, video, etc) and I can simply do that at home via VPNs, Proxies, and Tor. The point is, I myself do not want to be tracked at all. I want to nearly eliminate all possible indexing between myself and the distro – user63407 Dec 12 '14 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.