Amusingly, the original FBI affidavit was posted yesterday with a similar title, but it was changed to "FBI Affidavit in Harvard Bomb Hoax [pdf]".<p>The submitter of yesterday's post joked,<p>> I guess I should have written a paragraph's worth of inane blog spam to get my submission title used? I was trying to make this exact point in my original title. The title my submission was assigned is not the real title of the PDF either... seems very arbitrary.[0]<p>I completely understand the desire not to editorialize discussions. That said, this is an interesting case study of how the title of the submission very strongly affects the actual discussion that unfolds. After the title was changed, more of the comments revolved around the actual bomb threat itself, rather than the security benefits (and caveats) of Tor.<p>[0] <a href="https://news.ycombinator.com/item?id=6925289" rel="nofollow">https://news.ycombinator.com/item?id=6925289</a>
It's worth remembering that security (here including the information security involved in hiding identity) is not boolean. The value of the prize matters. A penny (or a diary) hidden under a mattress can be considered "secure" - three million dollars can't, especially when people know you have those three million somewhere.<p>The first mistake this guy made was doing something that made the authorities want to know who he was, and have a good excuse for expending enormous resources (if necessary) to do that. Had he used TOR correctly, it would have been harder for them, but it's very likely they would still have succeeded.<p>Plenty of people here are making comments that sound suspiciously like advice for breaking the law. I realize that that's not actually the case -- lessons taken from somebody who did something illegal and got caught can be perfectly applicable to someone trying to do something legal, privately. We all should be aware, though, that TOR and other privacy tools (and other non-privacy tools, like bittorrent) have a reputation for being designed for criminals, and it's not a good idea to seem to sympathize too strongly with people who use TOR to send in bomb threats.
The very BEST slideshow about using Tor to stay anonymous. You'll see his mistake in it.<p><a href="http://www.slideshare.net/grugq/opsec-for-hackers" rel="nofollow">http://www.slideshare.net/grugq/opsec-for-hackers</a>
Fail a test, no big deal. Send a bomb hoax, ruin your life. Interesting choice. I thought Harvard students were supposed to be smart not just arrogant.
Also keep in mind that, from my understanding, he was confronted with this information and then admitted that it was him. This just reinforces the rule... never talk to the police.
To be sure about <i>who knows what</i> when you use TOR, there is this excellent EFF article [1].<p>[1] <a href="https://www.eff.org/pages/tor-and-https" rel="nofollow">https://www.eff.org/pages/tor-and-https</a>
It sounds like they merely looked for who had accessed a Tor network, not that they could tell anything about the communication. Kind of like, "We know the perpetrator entered the grounds through the east gate prior to 9:00am. Security footage shows only 1 person doing that so go talk to him".
So basically idiotic "pranks" that would have been done in high school have now moved to colleges costing tens of thousands a year?<p>You really have to have a shallow life experience to think a bomb threat to get out of an exam is even remotely an okay idea.
They caught him because he was signed into the wifi network using his personal credentials. Had he went to a Starbucks or McDonalds we'd be having a different discussion.
Back when the whole Snowden/NSA thing blew up, people talked about switch to TOR all the time to keep safe. The problem is, you kind of have to be disciplined and commit to it...and <i>even if that's the case</i>, you might be exposed by uncontrollable environmental variables. The apparent problem in this case was that the student was using Tor at the time of the incident...and I'm assuming he was one of the very few to have been using Tor at that time, and he didn't use it <i>all</i> the time...which makes his Tor usage at the time of the email stick out.<p>Obviously, he should've just not done it from Harvard's network (and obviously, he shouldn't have done it at all)...but I think it's a good lesson when teaching others about security...know the conceptual limits of the black box you choose to use.
It's been a while since I was in the network security and monitoring world so I'm wondering what this monitoring software looks like. It sounds like it has the capability to keep a historical log of the type of traffic associated with each wifi-authenticated user. How detailed is the traffic analysis? How is the data recorded and for how long?
He would have had better luck cutting letters out of a newspaper, sticking them to a page and popping it in the post.<p>However that is not without its hazards. He would need to evade CCTV and make sure he did not take his cell phone with him to the post box. The stationary he used would also have to be untraceable, so a stack of identical envelopes at home would not be ideal. He would also need an alibi lest any neighbours end up why he was posting letters at 4 a.m.
There's always an official good reason why some Tor user gets busted by the Feds, and it's never that Tor itself is pwned. It reminds me of Brits trying not to show that they pwned Enigma during WWII.<p>If I needed to be shielded from the Feds, and I depended on Tor for this, I'd feel increasingly nervous.