NSA, GSHQ agents secretly helping Tor patch bugs: report

While it was known that US and British spy agencies were trying to crack the Tor network, new information suggested that the agencies' efforts might be undermined from within, endgadget reported.

Tor is a web browser anonymises the identity of a person and their location and browsing activity.

It deploys several technologies and is also a known gateway to the so-called "dark-web" that hosts sites like the Silk Road.

Spy organisations see it as a threat, though, according to Tor Project's Andrew Lewman, a number of employees were undermining their own hacking efforts.

"There are plenty of people in both organizations who can anonymously leak data to us and say, maybe you should look here, maybe you should fix this," he told the BBC in a recent interview. "And they have."

Tor's anonymous bug reporting system made it impossible to tell where the reports came from, though, the issues that were being reported were exceedingly subtle and could be expected only from users who had spent hundreds of hours scrutinising Tor's source code.

NSA whistleblower William Binney had reportedly told Lewman that NSA employees were upset by the organisation, and might be leaking data to Tor as a subtle retaliation.

Newman told BBC News in an interview that he had received bug reports from security agencies on a monthly basis. However, he acknowledged that Tor's security controls made it impossible for him to know exactly who sent the data - or if the NSA and GCHQ were actually behind it. He told the BBC that it was a hunch.

"You have to think about the type of people who would be able to do this and have the expertise and time to read Tor source code from scratch for hours, for weeks, for months and find and elucidate these super-subtle bugs or other things that they probably don't get to see in most commercial software," he said. "And the fact that we take a completely anonymous bug report allows them to report to us safely."

"I think that at some point there will always be attacks, there will always be software bugs - we are human, we will always make mistakes, but with many eyes trying to help us we seem to be getting better," Lewman told the BBC.