To distill 'gwern's comment even further:

He's saying that warrants and filings show that FBI had an insider positioned to subvert SR2's servers. If you have that vantage point, a worldwide traffic confirmation attack on Tor is a oddly elaborate way to scoop up SR2 vendors. Why not just use the SR2 servers to trick the vendors?

Observe that the relay-early traffic confirmation attack would be a technical effort unprecedented for the DoJ, whereas implanting a backdoor into a web app is already par for their course.

The Reddit threads 'gwern links to talk more about the implications of the timing. At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.

> Why not just use the SR2 servers to trick the vendors?

Thank you.

We must assume that the FBI is a rational and intelligent adversary (even if we have a difference of opinion on specific public decisions or press releases that impact our perception of their intelligence).

They're not going to expend the resources (or, as The Grugq might say, burn a valuable capability) to compromise a server when they already had a man on the inside (Cirrus).

I would be willing to accept that it's possible they were on a dragnet fishing expedition around the same time to see what they could sweep up, and they just happened to use this information to confirm the efficacy of their Tor attack. This would also explain Doxbin going down, but so would Doxbin and another target of theirs being on the same bare metal server.

> At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.

Agreed. Given what is already public knowledge, it's far from the most likely explanation.

But they did burn that valuable capability. Did they do it for no gain?

How do you know who "they" is? The Tor project said it seemed like it could have been a research project.

Academics would have no such motivational constraints unless working for the feds. They burn capabilities with wild abandon and still serve their own self-interest.

Given a global deanon attack against Tor, the DoJ absolutely would have rounded up the members of the dozens of child abuse related hidden services. The fact that only a single site was compromised indicates it was most likely an insider attack against the SR2 servers.

I think a multi prong attack from independent teams is reasonable for such a high profile target.