Paper conclusion says the cost of running Vuvuzela is pretty high per month, so you would need a benevolent millionaire to make it happen.

As for signal what every prosecutor wants is metadata to show the court that user A was in communication with user B. The actual contents of the messages aren't important especially in a conspiracy case and user B is an informant, their word against yours plus metadata showing you communicating is good enough.

Besides forcing Signal to keep this metadata in the future, I wonder if they can just obtain it themselves by watching all traffic on their federated servers and timing it to discover communication networks.

The cost of running Vuvuzela is dominated by bandwidth, and the paper used AWS prices to estimate the cost; purchasing IP transit directly would lead to about an order of magnitude reduction in costs (still non-trivial, of course).

Order of magnitude? 1Gbit on amazon costs 22k/month. Even an order of magnitude cheaper sounds pretty damn expensive, two orders of magnitude still isn't "cheap".

It's really easy to underestimate how big of a ripoff EC2 bandwidth pricing is.

A 10gbit unmetered server can be leased for under $3k a month. 1Gbit can be under $300 a month depending on the hardware.

1Gbit in Chattanooga, TN cost $350 a month. You gotta buy some servers and maybe a colocation fee. Way less than $22,000 a month. Actually, while I was looking that up, a recent press release says they're deploying 10Gbit to homes for $299 a month. Things may have improved on business side, too. :)

> 1Gbit on amazon costs 22k/month

Is this 1 gigabit of accumulated traffic, or sustained bandwidth guaranteed for an entire month?

1 TiB of accumulated bandwidth at DigitalOcean costs me $5/month. I am unaware of what sustained rates are given that tier of pricing, however.

1Gbit/s for a month, 328.5 terabytes.

On the expensive end you'd be looking at around $600 for such at $NOT_AMAZON, and on the cheap end you'd get it for "free" because a plenty of hosts have excess bandwidth.

DO doesn't separately charge for BW or enforce any limitations AFAIK.

There's also an updated, more distributed and thus (maybe) more scalable project by some of the same authors:

https://eprint.iacr.org/2016/943

Obfuscation is one approach, but it typically gets cracked pretty quickly or gets bogged down in trying to improve SNR.