Freedom Hosting

~ the obit ~

Freedom Hosting was a free web host for Tor onion sites, started in July 2008 and run single-handed by Eric Eoin Marques from Dublin. You uploaded, you got an address, nobody asked who you were. Because hosting an onion site otherwise meant running your own server and getting the operational details right every single day, a free host that did it for you absorbed an enormous share of the network. By 2013 researchers put its share at around half of all reachable hidden services.

That share was made of very different things. Ordinary forums and political mirrors sat on the same machines as more than two hundred sites trading in child sexual abuse imagery, and it was those that brought the investigation. The Justice Department later put the material recovered from the servers in the millions of files. The host's defense, such as it was, amounted to not looking, and the court did not accept it.

This is not a corner of the internet I had any contact with, and the reason to write it down is not the operator. It is what law enforcement did with the infrastructure once it had it, because that part rewrote how everyone thinks about anonymity networks.

~ the rap sheet ~

~ the takedown ~

Marques was arrested in Dublin in late July 2013. The servers did not go dark. Around 4 August, pages served by Freedom Hosting started carrying a small piece of JavaScript that exploited a memory bug in older versions of Firefox, the browser that Tor Browser is built on. The payload did not steal files or install anything persistent. It read the machine's hostname and MAC address and shipped them to a server in Reston, Virginia, which meant that server also logged the visitor's real IP.

The FBI acknowledged responsibility in a court filing on 12 September 2013. Documents released by Edward Snowden later showed the NSA had its own program aimed at the same browser, under the codename EgotisticalGiraffe.

The bug had already been fixed upstream. The exploit only reached people running a version of Tor Browser they had not updated, which in practice was a large number of them, because updating meant noticing a prompt inside a tool most users treated as a black box they were not supposed to touch.

~ what went with it ~

TorMail was the loss almost nobody planned for. It was an anonymous email service that happened to sit on Freedom Hosting's infrastructure, used by people who had nothing to do with the sites under investigation, and it disappeared on the same day. Its stored message database was later reported to have been imaged and used as an evidence source in unrelated cases, which meant that for years afterward the practical advice about anonymous email was to assume that the archive of anything you had sent through it was in a filing cabinet in Maryland.

The other casualty was an assumption. Before August 2013 the working mental model for a lot of people was that Tor protected you at the network layer and that was the layer that mattered. The operation demonstrated the obvious thing nobody had wanted to test: take the destination, keep it serving, and the browser will hand you everything the network was hiding. Every serious conversation about anonymity tooling since 2013 has had to account for the endpoint as well as the route, and the standard nagging about keeping Tor Browser patched dates from that August rather than from any theory.

~ the court ~

Marques fought extradition in the Irish courts for five and a half years, lost, and was flown to Maryland in March 2019. He pleaded guilty in February 2020 and was sentenced on 15 September 2021 to twenty-seven years in federal prison with lifetime supervised release, plus forfeiture of more than $154,000. An FBI agent had called him the largest facilitator of this material on the planet at his bail hearing eight years earlier.

A successor calling itself Freedom Hosting II appeared and by 2017 was reported to be carrying about a fifth of the onion sites in existence, which tells you the demand never went anywhere. That one lasted until a hacker acting under the Anonymous banner broke into it in February 2017, defaced everything on it, and took it offline permanently. The same shape twice in four years, killed by different hands.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »