- Daten-Speicherung.de – minimum data, maximum privacy - https://www.daten-speicherung.de -

EU Commission gives up blocking TOR and VPN services [updated 18 January 2015]

In February I noticed that I could no longer access the EU Commission’s website [1] using a VPN service. Most TOR servers and VPN services turned out to have been blocked, preventing millions of users from accessing essential official information. The blocking affected even the European Court of Justice’s website [2] which provides access to the Court’s jurisprudence.

I filed the following complaint on 16 February:

Dear Sir,

I have come to notice that the Commission’s website ec.europa.eu [3] is no longer accessible using VPN services (error message: „Access Denied (policy_denied) Your system policy has denied access to the requested URL“).

This policy infringes on the citizens right to access EU public information anonymously. It is also for reasons of IT security, for example when using public wifi access points, that the Internet is used via VPN services. According to a representative poll, 12.8% of Germans
use a VPN service (http://www.vorratsdatenspeicherung.de/images/infas-umfrage.pdf [4]).

Probably in the course of some update an anonymity blocklist provided by an international manufacturer has been installed inadvertedly. Please make sure that this blocklist is disabled. If, however, you should decide not to restore VPN access, I should have to file a complaint with the European Data Protection Commissioner. I hope that this will not be necessary.

Yours sincerely,

An Information Security Officer replied on 1 March (excerpt):

We fully understand this citizen’s request and also agree that you have the right to stay anonymous when accessing the Commission europa websites. But the Commission is obliged to keep the Commission websites available for all citizens. You can only realise this objective by implementing security measures, in this case preventing cyber attacks that typically use the TOR network. So to satisfy the higher rights of the general public, you are forced to block the TOR network, which implicitly blocks the possibility of some individuals to use anonymous access.

Despite this rebuke, the blocking was ended a few days later without further explanation. EU websites can once again be accessed anonymously. Obviously, blocking anonymity is not necessary to keep the websites available. The German Federal Crime Agency confirmed [5] last year that „anonymization services are no longer an issue in the execution of DoS or DDoS attacks“.

If you come across websites that cannot be accessed anonymously, do complain about it. Together we will hopefully end the failed blocking or blacklisting policies that punish millions of users for the acts of a tiny fraction of them.

Just like other liberties, the freedom to remain anonymous is too beneficial to society to be given up in reaction to sporadic abuse. The benefits of anonymity have been explained in detail by Gary Marx („What’s in a name? [6]“), the detriments of total traceability by AK Vorrat („Background information and facts“ [7]). To find out how to protect yourself, read our Comparative test of Internet Anonymizers [8].

German version of this article: EU-Kommission gibt Sperrung von Anonymisierungsdiensten auf [9] (26.3.2012)

Correction of 27 March 2012:

Although the EU Commission has given up blocking the VPN service I use, tests show that it is still blocking the TOR network. TOR browser comes up with the following error message:

https://www.daten-speicherung.de/wp-content/uploads/tor-error-300×213.png [10] 300w“ sizes=“(max-width: 323px) 100vw, 323px“ />

I have now filed a complaint with the European Data Protection Supervisor:

Dear Sir,

I have come to notice that the Commission’s website ec.europa.eu is no longer accessible using the TOR network (error message: „Access Denied (policy_denied) Your system policy has denied access to the requested URL“).

This policy infringes on the citizens right to access EU public information anonymously. It prevents millions of users from accessing essential official information. The blocking affects even the European Court of Justice’s website which provides access to the Court’s jurisprudence. Apart from privacy and human rights reasons for using TOR it is also valuable for reasons of IT security, for example when using public wifi access points. According to a representative poll, 12.8% of Germans use a VPN service such as TOR (http://www.vorratsdatenspeicherung.de/images/infas-umfrage.pdf).

I have filed a complaint with the Commission. […] (Local Information Security Officer) defended the policy with the following arguments: „But the Commission is obliged to keep the Commission websites available for all citizens. You can only realise this objective by implementing security measures, in this case preventing cyber attacks that typically use the TOR network. So to satisfy the higher rights of the general public, you are forced to block the TOR network, which implicitly blocks the possibility of some individuals to use anonymous access.“

This is false. A myriad of websites not blocking TOR (e.g. European Parliament, EDPS) prove that such blocking is not necessary for ensuring availability. Besides the German Federal Crime Agency has confirmed that TOR no longer plays a role in DDoS attacks.

In the context of its blocking policy, the EU Commission is processing personal data (IP address of Internet users) illegally as there is no legitimate interest in banning anonymous surfers.

Please make sure that the Commission restores TOR access to all EU websites.

Yours sincerely,

Update of 18 Jan 2015:

According to the EDPS, the Commission has given up its policy of blocking TOR users. Tests confirm this. Read Mr. Butarellis letter of 7 January 2015:

Brussels, 7 January 2015

GB/FS/ktl D(2015)0005 C 2012-0325

Subject: Case (2012-0325) Tor blocking at the European Commission

Dear …,

I am writing to you regarding case 2012-0325 where you have informed the EDPS about the prohibition of the use of the Tor network while accessing the European Commission web site. We would like to inform you that the EDPS has been reassured that this prohibition has been lifted and that the European Commission policy regarding the blocking of the Tor network has changed so as to allow this kind of connections.

Therefore the EDPS is closing this case.

Yours sincerely,

Giovanni BUTTARELLI