Tor Project Moves Away from Infrastructure Ran by Internet Monitoring Firm

The Tor Project, the organization which maintains the Tor anonymity network and related browser, is continuing to move its infrastructure away from that previously provided by Team Cymru, an internet monitoring firm that donated hardware and other resources. The Tor Project now expects the migration to be completed in the spring, the organization told Motherboard in a statement.

The Tor Project announced the move in October after Motherboard reported that Team Cymru sold an internet monitoring tool called “Augury” to multiple branches of the U.S. military. Augury is based in part on data provided by internet service providers, and claims to cover 90 percent of the world’s internet traffic. A whistleblower also alleged that NCIS, a civilian law enforcement agency that is part of the Navy, engaged in the warrantless use and purchase of this data.

Pavel Zoneff, director of communications at the Tor Project, told Motherboard the organization has “made great progress, including making significant investments to scale our own server infrastructure. We have migrated the most critical functions and are currently tracking completion before the end of spring this year. We will share an update as soon as the transition is completed.”

In the Tor Project’s October announcement, Tor Project executive director Isabela Fernandes mentioned that Team Cymru has donated “hardware, and significant amounts of bandwidth to Tor over the years. These were mostly web mirrors and for internal projects like build and simulation machines.” The Tor community, Fernandes wrote, raised concerns about the Tor Project using infrastructure from Team Cymru.

Given conflicts between the Tor Project’s and Team Cymru’s missions, “it’s not tenable to continue to accept Team Cymru’s donations of infrastructure,” Fernandes wrote. Fernandes added the Tor Project had been planning to move out things since early 2022. After Motherboard’s reporting, those efforts appeared to have moved more earnestly.

Team Cymru’s CEO Rob Thomas was also on the board of the Tor Project, something which Motherboard pointed to in its reporting. He left on August 4, 2022. In the October blog post, Fernandes explained that Tor Project staff and volunteers raised concerns about Thomas’ position on the board at the end of 2021. This led to internal discussions. “During these conversations, it became clear that although Team Cymru may offer services that run counter to the mission of Tor, there was no indication that Rob Thomas's role in the provision of those services created any direct risk to Tor users, which was our primary concern,” Fernandes wrote.

“But of course, not actively endangering our users is a low bar,” Fernandes continued. “It is reasonable to raise questions about the inherent disconnection between the business model of Team Cymru and the mission of Tor which consists of private and anonymous internet access for all. Rob Thomas's reasons for choosing to resign from the board are his own, but it has become more clear over the months since our initial conversation how Team Cymru's work is at odds with the Tor Project's mission.”

Team Cymru did not respond to a request for comment.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.