The Ethical Considerations of the Tor Browser.
At NYU, I took a class on online privacy. My final project? Making the ethical case for the Tor Browser.
During the fall semester, when I was still figuring out what I wanted to study, I took a class called “Privacy in Information Technology,” which dealt with topics like surveillance, big data, online anonymity, and the like.
30% of the grade was a final group project in December on some aspect of the course material, which consisted of a 10–15 minute spoken presentation and some form of media. An activist friend of mine and I decided to look at the ethical considerations of the Tor Browser, an online anonymity network. Here’s a bit of background about that project, and some of the text of the talk we gave.
We were interested in the topic not only because of work we’d previously done about campus surveillance, but because of the rhetoric of the current debate for online anonymity. Yesterday, Bloomberg ran a story about Manhattan District Attorney Cyrus Vance, who said that Apple and Google should be legally compelled to hand over customer data necessary to investigate crimes. Police, he claimed, might not be able to stop crimes against children or solve murders without this data.
His comments echo those of FBI director James Comey, who said he could not understand why Apple would “allow people to place themselves beyond the law.” Other police officials have been unequivocal in their condemnation. “Apple [iPhones] will become the phone of choice for the pedophile,” said John Escalante, head of the Chicago Police Department’s Bureau of Detectives.
Given that this is the current debate, we decided to lay out the ethical considerations of using a web browser which enables online anonymity and resists censorship.
Tor —and online anonymity in general— has a pretty bad reputation in some quarters. The only people who want it are criminals, it’s inherently bad because you can use it to access child pornography or stalk people. The rhetoric is usually that only “bad people” want online anonymity, using whatever definition of bad people you care to use on a given day. After all, who gets called a terrorist in the US is different to who gets called a terrorist in Syria, which is different to who gets called a terrorist in China.
So we’ve talked a little bit about Tor and how it works already, and we’re going to look at what that means for different actors in any given browsing session — you, the server you access, the third-party cookies on the webpages you visit, your Internet Service Provider (ISP), and whatever government agents happen to be monitoring your connection. In short, what’s the difference between using Tor and using, say, Google Chrome?
The first thing you might notice about Tor is that it’s a little slower than other web browsers. Using it means you have to fundamentally change your browsing habits: everyday webpages are full of browser extensions and third-party cookies that reveal information about you, and Tor blocks almost all of them by default.
So we have a bunch of people who are involved in a given browsing session. When I visited Prezi.com, Ghostery told me that there were trackers from AdRoll, AppNexus, Bizo, Google Adwords, Google Analytics, Google Dynamic Remarketing, Google Tag Manager, Optimizely, and Quantcast. The takeaway here is that a lot of people knew I visited Prezi who weren’t Prezi. Also, NYU, my ISP at college, knew I did, because I didn’t use Tor. If I had, NYU would have seen that I pinged a server in Japan or something, but they wouldn’t know where that connection went from there. Also, because my connection with Tor looks different every time, third-party cookies are virtually useless.
A core tenet of the privacy class we took is that privacy is not synonymous with secrecy but rather that the flow of personal information about oneself should flow appropriately, subject to constraints depending on the context.
By this, we acknowledge that people assume different roles depending on the situation. In class, I am a student; at home, I am a son, or a brother, and at my place of work, I am a staff columnist. In the eyes of the US government, I am a visa-holding citizen of a foreign country. Contextual integrity divides social interactions into actors, activities, norms, and values, which allows us to debate the legitimacy of privacy in a given situation. Contextual integrity means that it’s considered strange or inappropriate to tell your barista about your marriage problems, but perfectly normal to tell someone who’s acting as a marriage counsellor. Similarly, in the doctor/patient context, it’s unusual for a counsellor to start telling you about their own problems.
So we’ve come to the conclusion that using Tor restores contextual integrity, because if I access NYU’s health center to get test results, I don’t want third party cookies knowing I did that. If you know someone called a suicide hotline from the Golden Gate Bridge, you could guess at their mental state at the time. Essentially, Tor restores the integrity of your communications and web-browsing because it reduces the interaction back to you and the server: no governments, no data brokers, nobody eavesdropping on your network.
So then the next question is whether Tor is ethically “worth it,” because for every person who’s researching HIV treatments and whistleblowing on repressive regimes, there is, the argument goes, someone looking up child porn or stalking someone or buying heroin.
If you imagine an activist who’s reporting on the ground from China, or someone trying to organize safe passage out of Syria for their children, they don’t have that many tools at their disposal. Now, let’s imagine a women in New York who’s being harassed online by someone using Tor. How do you begin to weigh up that world — online sexual harassment is abhorrent, but you can’t really put it on a weighing scales against whistleblowing, it’s comparing apples to oranges.
It’s not a question of absolutes, whether you can do X or Y. It’s a question of relativity and also of perception. Being stalked sucks, but a creep stalking a woman in the US has a plethora of tools: if Tor gets shut down, he picks from a dozen alternatives and the harassment continues. But that woman in Syria doesn’t have a whole lot of alternatives. It’s people like that Syrian women that lead us to believe that, yes, a world with Tor is better than a world without it.
Tommy Collison is a privacy advocate and journalism student at New York University who runs events where other journalists and activists can learn how to use online privacy tools. He’s @tommycollison on Twitter.
Originally published at www.tommycollison.com on January 7, 2015.
