3

A university course has tasked my wife with researching websites that would, I imagine, get her placed on an FBI watchlist. Their advice is to not provide any PII, do not interact with anyone, and do not download anything.

Aside from going incognito, are there other steps that she can take to be a little safer? Perhaps use a proxy of some sort?

Anthony
  • 133
  • 4

3 Answers3

3

Carrying out this task I would either use a commercial proxy, or the Tor network. The easiest way to safely use the Tor network is to use Tails Live.

If you choose a commercial proxy think about which ones are going to be the easiest for your government to get hold of the logs for. Maybe choose one that is based in a foreign jurisdiction.

forest
  • 66,706
  • 20
  • 212
  • 270
David Waters
  • 2,801
  • 2
  • 15
  • 14
  • 1
    Most commercial proxies would give out your info on a heartbeat if they're served warrants, even by foreign law enforcements. The fact that you paid them also means tracing the money is fairly straightforward unless they're paid by some form of cryptocurrency and/or money mixer. – Lie Ryan Mar 29 '19 at 01:53
  • I agree in principle @LieRyan, there have been some that have stated they do not keep logs linking outbound IP's to user. As such they have no information to release looking backwards. However you comment still stands that they may make an exception in your case if asked nicely by law enforcement. – David Waters Mar 29 '19 at 02:44
  • @DavidWaters Yes, and quite a few of said services actually were keeping logs. Even if they were not however, their ISP would still be keeping logs, and they have no control over that. – forest Mar 30 '19 at 03:14
1

If I was forced to do that I would preemptively contact the FBI (or relevant authority) to

  • let them know about the assignment
  • ask for advice

If you are wondering how to hide, then you will not be able to hide if a state-sponsored organisation is after you.

They may tell her that she must not do that, something that must then be addressed with the university.

WoJ
  • 9,038
  • 3
  • 34
  • 55
  • -1 This is factually incorrect, which is obvious given the fact that many people are able to evade organizations like the FBI all the time with the proper tools and mindset. If it were really the case that you couldn't hide, then there would be no operators of illegal websites or visitors of said websites as they would all have been arrested. – forest Mar 30 '19 at 03:11
  • 1
    @forest. Many people are not caught because someone is not actively looking for them at a given time. Should you get into the radar, you would have zero chance to hide if you are not an expert. Read about the Silk Road owner for instance. If you state that a random person can hide from competent organization then you are simply putting in danger OP's wife. For someone who apparently is competent in security as you are this is a disappointing comment. – WoJ Mar 30 '19 at 17:26
  • The Silk Road owner made serious OPSEC mistakes, including posting to Stack Overflow under a pseudonym linked to his website with a non-anonymous identity. He couldn't hide because he was an idiot. You also seem to be creating a threat model for OP that was not stated. There's a difference between doing something illegal and being "on the radar" and having an entire TLA focus all their efforts on finding you and only you. The fact that thousands of drug dealers, child pornographers, hackers, carders, etc. are able to hide with only a small fraction ever being found proves this. – forest Mar 30 '19 at 22:46
  • It's reasonable to assume that OP's wife is researching one of those topics. Concluding that OP was tasked by their university to do something so incredibly high-profile (treason, espionage, etc.) that a massive government organization is going to allocate significant resources to finding her is beyond unreasonable. This is why threat modeling is so important. It allows you to decide whether or not a random non-expert can hide from a government organization. The answer turns out to be, depending on threat model, yes. – forest Mar 30 '19 at 22:57
  • @forest: a research on child pornography for instance will get you in real trouble should the authorities stumble upon the areas you are investigating and they happen to see your connections over there. You will then be arrested and it will take an awful amount of time to be cleared. If your advice is to use whatever technology to hide - fine. Mine is to anticipate the issues and not wake up one day realizing you were not that good afterwards. Since you call Ross Ulbricht for being an idiot because he did not hide well enough - will you call that OP's wife when there are problems? – WoJ Mar 31 '19 at 08:12
  • And yet there are a huge number of actual child pornographers who are never caught because they use proper opsec. Also, OP's wife will be doing research, not hosting a multi-million dollar drug peddling website. The former opens you up to significant attacks and requires the kind of expertise that Ross Ulbricht and, most likely, OP's wife don't have. The latter requires nothing more than Tor Browser and common sense. – forest Apr 01 '19 at 22:16
-2

For this kind of research I would care to use:

  • a robust operating system: rather use any kind of Unix (Linux, MacOS X) and avoid any kind of Windows (8, 10),

  • a robust browser: prefer Firefox or Opera to Internet Explorer or Edge, so as to limit risk of being infected on a booby trapped web server,

  • a not too leaking search engine: prefer DuckDuckGo to Google,

  • a “kind of" anonymous and unpriviledged account newly created to run all this research so as to limit private information leak through registered data within your browser (cookies, E-mail, history, passwords…).

dan
  • 3,058
  • 16
  • 35