Does the Tor browser counter wiretapping?

Question

I have learned about Tor quite recently. Where I live, new laws are made for digital surveillance. It looks like the law will gain new tools with the motivation to prevent terrorism. There is a lot of concern about this. The law will gain abilities such as wiretapping certain areas where they think terrorism may link towards. This concerns lots of people, because this wiretapping counts for a certain area in range around a single possible threat, instead of focusing directly on a target, large amounts of personal data around that target may be intercepted from citizens and kept for years. My question is or Tor can protect one's personal traffic from these attacks.

Thanks.

Answer 1

Tor works by encrypting your traffic with three layers of encryption, and relaying it through a set of three nodes, an entry node, a relay node, and an exit node. Each one of these nodes peels off a layer of encryption, making sure that the only unencrypted traffic is between the exit node and the internet. The use of three separate nodes makes the tracing of where it comes from difficult. This encryption prevents tampering and stops ISPs for example from snooping on your traffic. Your law enforcement will only be able to know that you are using Tor, but won’t be able to see which pages you visit, or their content. (You can add an extra layer of security by only visiting HTTPS websites).

Before making a decision on whether to use Tor or not, please head to this website to learn more about it: https://www.torproject.org/about/overview.html.en

Answer 2

"Wire tapping" is targeted surveillance. They intercept your internet communications, normally with assistance from your ISP (through systems like CALEA) and log them. It is necessarily one-sided.

In this case, they would be able to see you were using Tor, what times you were using Tor and how much traffic you were sending over the Tor network. They would not know what you were sending over the Tor network or where it was being sent to. The wire tapper would be able to see less than the Guard node already sees. Since the Guard node alone cannot link a users input to their output, similarly the wire tapper would be unable to, infact they'd be less able to.

There have been cases (e.g. Jeremy Hammond) where they already have an expected output from the network in relation to the users input. In those cases knowing when you use Tor can be sufficient to correlate it with when the output they expect is linked to you happens. This only worked when they had already identified a suspect and then performed targeted surveillance on them.

What you seem to be refering to is mass surveillance, where ISPs keep logs. However mostly these logs are only information like what IP address a user connected to and when and for how long. For example, the recent Ivestigatory Powers Act in the UK madates the retention of "Internet Connection Records":

required communication service providers (CSPs) to retain UK internet users' "Internet connection records" – which websites were visited but not the particular pages and not the full browsing history – for one year;

This kind of information might let them know that you used Tor but it wouldn't be sufficient to break Tor. It is only problematic if they can see both the entry and exit to the network.

There is no magic bullet to unbreakable anonymity, every user must consider who their adversary is and what their capabilities are but a traditional wire tap or ISP ICR isn't sufficient on it's own.