Mathematics tied into a Tor node

The court arrested the mathematician Dmitry Bogatov, who was detained for calls for an uncoordinated action, adding to him the charge of “calls for terrorism.” We are looking into the question: what does the Tor network have to do with it?

The very strange situation with anonymous calls for mass riots on April 2, which were disowned by all known opposition organizations and leaders, is becoming more and more strange. Let us remember that at the end of March it became known that some unknown people were calling on Russians to go to protests that were not coordinated with the authorities on April 2 of this year. Nobody really knew anything about these actions, but the Prosecutor General’s Office has already rushed to give orders to Roskomnadzor to block public sites that disseminated relevant information. One of the suspects for calling for mass riots was detained on April 6 - he turned out to be a man born in 1992, and employees of the Investigative Committee of the Russian Federation (ICR) did not disclose any more information about him. Later it became known that this was Dmitry Bogatov, a mathematics teacher at the Moscow University of Finance and Law (MFYuA).

Today, the Presnensky Court of Moscow authorized the arrest for two months of a 24-year-old mathematician, whom the Investigative Committee charges with calls on the Internet for an unauthorized mass action on April 2, as well as for terrorist activities (according to journalists, this was done so that the court would still leave the mathematician in custody). This decision was made by judge Evgeniy Naydenov. Moreover, a few days ago the same judge refused to authorize his arrest.

The ICR website reports that

“During the preliminary investigation, it was established that the accused, using special software designed to hide traces of his presence on the Internet, namely using servers located on the territory of foreign states, posted materials inciting the organization of mass riots in the center of Moscow. In addition, the accused, in order to destabilize the activities of the authorities, using the Internet, posted on a website accessible for public viewing a text message in which he addressed an unlimited number of people in order to induce them to commit actions that frighten the population and create the danger of human death, as well as other grave consequences.
Investigators conducted searches at the defendant’s place of residence, during which numerous computer equipment and electronic devices used for transmitting and distributing information, as well as other items relevant to the investigation of the criminal case were seized.
“Currently, comprehensive computer-technical forensic examinations have been ordered for all seized items, and a set of investigative and other procedural actions are being carried out aimed at establishing all the circumstances of the crime.”

At the trial, a representative of the Investigative Committee asked to attach to the case materials a letter from the Federal Security Service, which stated that linguists from the Institute of Linguistics of the Russian Academy of Sciences found in posts signed “Ayrat Bashirov,” under which the above-mentioned provocative posts were written, “linguistic and psychological signs aimed at public calls for terrorist activities.” It was these posts that became the reason for initiating a case on calls for mass riots. Operational search activities confirmed that it was Bogatov who published these materials on the Internet, the investigator emphasized.

He confirmed that the Investigative Committee has already opened a case against the teacher for calls for terrorism. It was combined into one proceeding with the case of calls for mass riots, in which Bogatov was detained on April 6. Thus, the teacher has become accused of a serious crime, and this allows him to be placed in custody during the investigation, the department official indicated.

And this is where the fun begins. Bogatov’s lawyer, Alexander Mordvinov, explained to the court that during the publication of the posts, which the investigation considers terrorist, Bogatov was first in a fitness club, and then in a grocery store with his wife. This is evidenced by video recordings made in the gym and supermarket. Another lawyer’s argument was that the alleged author of the terrorist posts used VPN technology (when the signal is transmitted through a chain of proxy servers around the world), which means that it is technically impossible to accurately establish his authorship. In addition, a person under the nickname Airat Bashirov, after Bogatov’s arrest, continued to publish similar posts on the same Internet resource, the defense lawyer pointed out. When the judge began to announce the arrest order, Bogatov’s mother fainted.

The fact is that the arrested mathematician is a supporter of the distribution of free software and the administrator of the Tor browser exit node. According to GeekTimes user Leonid Evdokimov, who refers to data from the Atlas service that monitors the state of Tor nodes, a few hours before the expected time of the search on the evening of April 5, the exit node registered to the user Dmitry Bogatov stopped working. The information about the node administrator included the email address [email protected] , which is also mentioned on Bogatov’s personal page.

“I do not know,” writes Evdokimov, “whether Dmitry himself posted the materials while away from home, or whether it was one of the users of the Tor network who used Dmitry’s node, one of thousands of others. But it seems that now, from a practical point of view, the question “Were there any cases of conviction for Tor Exit-node in Russia?” you can answer in the affirmative with some degree of confidence - Dmitry was arrested for two months. This is the first case known to me of the arrest of an operator of an exit node of the Tor network in Russia. If the prosecution’s position is based on the coincidence of the IP address, then now the risk zone also includes operators of open wi-fi points in public places, users of the Hola VPN service, which works on a somewhat similar principle, not to mention infected personal computers and botnets from routers.”

Thus, it may turn out that Dmitry Bogatov may not have written any provocative posts, but merely provided the opportunity for other users to anonymously post publications on the Internet, and he does not necessarily have anything to do with them.

The user of the Tor network is given a different IP from among those registered to the holder of the exit node (there are several hundred of them in Russia, they are distributed randomly by the network). Thus, the author of calls for an action on April 2 could use the Tor network for publication, in which he received Bogatov’s IP address. Bogatov himself stated that he was not guilty and was ready to assist in solving this crime in any way possible in order to “completely clear his name.”

Several years ago, on the Toster website for IT specialists, it was reported that FSB officers came to the owner of one of the Tor nodes in Russia and found out that a letter had been sent from his IP address to Vnukovo airport, in which there was talk of a planted explosive device. As a result, FSB officers checked the laptop and returned it to the owner after checking.

Meanwhile, there have already been cases when Russian security forces were interested in Tor users. In October 2016, a Novosibirsk provider received a letter from the FSB in which it was allegedly “asked to count and transmit all information on users who access tor/i2p. No motivation, no court decision, no case number.” How this story ended is still unknown.

It becomes obvious that the verdict passed by the court against the mathematician is unlawful. There may be a lot of discussion about whether he was detained on suspicion of inciting mass riots via the Internet or because he was a Tor-node operator; the restrictive measure taken against him clearly exceeds all permissible limits. We are not talking about a serious crime, but only about a post on the Internet, which he may not even have written. Therefore, it is no wonder that the sympathies of Internet users here are not on the side of the security forces, whose accusations look more like forgery and tailoring of the legislative framework to a specific specific case.

It also becomes obvious that those who provide other users with anonymous access to the Internet are now at risk. According to the head of RosKomSvoboda, they will now be closely monitored, which is confirmed by other users of social networks:

Web developer and Internet activist Shara gave his comment to RosKomSvoboda about the danger of the precedent with Dmitry Bogatov:

“In fact, due to insufficient information, we cannot know exactly how the request (to post materials on any website) was sent from his IP address.
Most likely, this happened due to the fact that Dmitry contained the so-called “exit node” of the anonymous Tor network. The output node is the last address in the chain of servers through which direct interaction with the requested resource is carried out.
But the very idea of accepting a specific network address as evidence of guilt is vicious and dangerous, because From an investigator's point of view, posting a comment via open or hacked Wi-Fi will be no different from this situation, just as posting a comment via malware from an unsuspecting person's computer will be no different. Unless Dmitry has an excuse - his name and contact details are on the public list of Tor-node weekends, and an ordinary user will have no excuses.”

We have before us a case of yet another legal outrage. The man was deprived of his freedom during the investigation under far-fetched pretexts, accused of serious crimes only for words and, apparently, not even said by him.

110 Potentially Dangerous Tracking Hosts Found on Tor

MIT introduced a new anonymous network, Riffle, more secure than Tor

These people don’t exist: news aggregators ignore coverage of the nationwide protest