Carnegie Mellon University Responds to Allegations it Took $1m to Take Down Tor

Last week, The Onion Router team claimed that Carnegie Mellon University had taken $1 million from the FBI to compromise its Tor browser. The University has now spoken out about the allegations, with a statement denying that it receives any money for information it provides police and intelligence organisations.

In a world of increasing online surveillance, Tor aims to provide its users with anonymous internet browsing, and as such it has been the bane of law enforcement agencies across the globe. The FBI specifically has been lobbying for more powers to see through Tor’s layers for some time, and it is known to have a relationship with Carnegie Mellon University.

While Carnegie Mellon dismisses any notion that it has taken money from any agency, it does not deny that it works with law enforcement organisations, nor does it specifically address its dealings FBI or its involvement in compromising Tor.

The statement reads:

“There have been a number of inaccurate media reports in recent days regarding Carnegie Mellon University’s Software Engineering Institute work in cybersecurity.

Carnegie Mellon University includes the Software Engineering Institute, which is a federally funded research and development center (FFRDC) established specifically to focus on software-related security and engineering issues. One of the missions of the SEI’s CERT division is to research and identify vulnerabilities in software and computing networks so that they may be corrected.

In the course of its work, the university from time to time is served with subpoenas requesting information about research it has performed. The university abides by the rule of law, complies with lawfully issued subpoenas and receives no funding for its compliance.”

While it doesn’t say outright that the University gave the FBI information regarding Tor due to a subpoena it received, it is heavily implied. In denying taking money and affirming that any dealings were law enforcement were legally obliged, Carnegie Mellon appears to be indirectly absolving itself of blame by assigning all responsibility to the FBI.