NSA - How to Insure Your Are On the Watch List

"Here’s One Way to Land on the NSA’s Watch List" by Julia Angwin and Mike Tigas, ProPublica 7/9/2014

Last week, German journalists revealed that the National Security Agency has a program to collect information about people who use privacy-protecting services, including popular anonymizing software called Tor.  But it's not clear how many users have been affected.

So we did a little sleuthing, and found that the NSA's targeting list corresponds with the list of directory servers used by Tor between December 2010 and February 2012 – including two servers at the Massachusetts Institute of Technology.  Tor users connect to the directory servers when they first launch the Tor service.

That means that if you downloaded Tor during 2011, the NSA may have scooped up your computer's IP address and flagged you for further monitoring.  The Tor Project is a nonprofit that receives significant funding from the U.S. government.

The revelations were among the first evidence of specific spy targets inside the United States.  And they have been followed by yet more evidence.  The Intercept revealed this week that the government monitored email of five prominent Muslim-Americans, including a former Bush Administration official.

It's not clear if, or how extensively, the NSA spied on the users of Tor and other privacy services.

After the news, one of Tor's original developers, Roger Dingledine, reassured users that they most likely remained anonymous while using the service:  "Tor is designed to be robust to somebody watching traffic at one point in the network – even a directory authority."  It is more likely that users could have been spied on when they were not using Tor.

For its part, the NSA says it only collects information for valid foreign intelligence purposes and that it "minimizes" information it collects about U.S. residents.  In other words, NSA may have discarded any information it obtained about U.S. residents who downloaded Tor.

However, according to a recent report by the Privacy and Civil Liberties Oversight Board, the NSA's minimization procedures vary by program.  Under Prism, for example, the NSA shares unminimized data with the FBI and CIA.

In addition, the NSA can also later search the communications of those it has inadvertently caught in its Prism dragnet, a tactic some have called a " backdoor" search.  It's not clear if similar backdoors exist for other types of data such as IP addresses.

In response to the Tor news, the NSA said it is following President Obama's January directive to not conduct surveillance for the purpose of "suppressing or burdening criticism or dissent, or for disadvantaging persons based on their ethnicity, race, gender, sexual orientation, or religion."

[Disclosure:  Mike Tigas is the developer of an app that uses Tor, called the Onion Browser.]