Jurisdictional Arbitrage: Quantifying and Counteracting the Threat of Government Intelligence Agencies against To

Recent events continue to expose the ability and commitment of Government Intelligence Agencies (GIAs) to conduct cross-border surveillance of the Internet. These revelations have significant consequences for anonymous communication systems like Tor. Current adversarial models do not incorporate international surveillance, meaning that realistic adversaries are much more powerful than what is assumed by prior work. In this work, we take the first steps towards quantifying the risk of surveillance posed by GIAs. We use legal and technical data to assess the hostility of each country to Internet traffic, and build a graph of the intelligence treaties between countries to identify cross-border surveillance capabilities. Based on this data, we develop metrics that quantify the ability of an adversarial GIA to conduct surveillance in any other country. We apply our risk metrics to the current state of the Tor anonymity network and discover that the majority of Tor users are at significant risk to passive deanonymization attacks by GIAs. We incorporate our metrics into alternative Tor relay selection algorithms, and show that the resulting circuits have significantly reduced surveillance risk, compared to Tor's standard relay selection algorithm.