Irreal

Over at Digital Era there’s a nice post on Tor best practices. While the Tor protocol and software are reasonably secure, you can’t use them blindly. The most recent example of what happens when you do is demonstrated by Eldo Kim who used Tor and Guerrilla Mail to send a bomb threat to Harvard University. Kim sought to use the bomb scare to avoid taking a final. Unfortunately for him he used the Harvard WiFi network and his identity was discovered simply by checking who on the network was using Tor at the time the email was sent.

It wasn’t a weakness in Tor but Kim’s lack of operational security that caused his discovery. The post at Digital Era helps you avoid errors like Kim’s by explaining how best to use Tor and what practices are dangerous and should be avoided. One of those practices is to never use Tor from or near home. It’s too bad for Kim that he didn’t read that before sending his email.

Most of us aren’t using Tor to send bomb threats, of course, but it is used by many—journalists and activists come to mind—in conditions that could be life threatening if their identities were discovered. If you’re using Tor under conditions that could result in dire consequences should your identity be discovered, you should definitely take a look at the best practices post.

Matt Blaze over at Exhaustive Search has an interesting post on how law enforcement agencies track phone calls. Blaze is discussing law enforcement targeting individuals in support of criminal investigations not the wholesale dragnet surveillance of the type that the NSA specializes in.

If you’re the type that likes cop shows you’re already familiar with some of these techniques. There’s what Blaze calls the retrospective methods that subpoena call detail records from the phone company. There’s also real time methods where the authorities capture call information as the calls happen. Again, many of these—such as pen registers—are part of popular culture and well known to devotees of police procedurals.

What’s more interesting are the lessor know methods such as tower dumps, 911 pings, and IMSI catchers. Blaze explains what these are and how they work.

While there is some controversy over a couple of these methods—especially the IMSI catchers—most people see these techniques as legitimate investigative tools unlike the highly controversial wholesale surveillance used by the NSA. Still, if you’re concerned about privacy and how the government might, legitimately or illegitimately, track your communications, you will find this post helpful.