170 million credit and debit card numbers stolen In 2010, a hacker was sentenced to twenty years in prison for stealing more than 170 million credit and debit card numbers, making it the largest single-identity theft case that the US Department of Justice (DoJ) has ever prosecuted.14 Case 1.1: FBI Hacks “Playpen” Child Pornography Site on Tor Network (USA)15 In a massive sting operation, FBI agents infiltrated “Playpen”, one of the largest ever child pornography networks, by infecting websites with malware that bypassed user’s security systems.16 The FBI continued to operate the site for thirteen days after it had secured control of it, subsequently identifying hundreds of users. Tor—an abbreviation for “The Onion Router”—is a free software that allows anonymous internet communication, preventing localization of users or monitoring of browsing habits, by bouncing users’ internet traffic from one computer to another to make it largely untraceable.17 Operating through the special-use, top level domain suffix “.onion”,18 Tor addresses are not actual names in the domain name system (DNS)—the hierarchical, decentralized naming system for computers, services or any resource connected to the internet or a private network. Initially developed with the US Navy, today it is a nonprofit organization; the, Tor network is a group of volunteer-operated servers. Tor’s popularity recently increased with its launch of a hidden chat tool that not only hides message contents from everyone except participants, as well as hiding the location of those participants, but which also operates with platforms such as Facebook Chat, Google Talk, Twitter and Yahoo!, even in countries where those platforms are banned.19 Rather than rely on the “dark web”, a collection of hidden websites and services of which Tor forms a prominent part, the Tor Messenger operates by sending messages across a series of internet relays (or routers), known as “bridges”, thereby masking the messages’ origins.20 Because the services operate through a collection of relays that are not publicly listed, blocking access to the Tor network would not affect the Tor Messenger.21 Furthermore, just as with services such as WhatsApp (see section 1 B, case 1.3, below), end-to-end message encryption may be offered. Although concern exists that the services might be used for more nefarious purposes, there is public interest in having such a tool—for instance, for whistleblowers and others needing anonymity. While banning Tor might well be both infeasible and unwise,22 this case indicates that Tor is not a perfect blanket of anonymity. Page 17 | Chapter 1 | § B. Phenomenon & Dimensions of Cybercrime Table of Contents