Editing Penet remailer

{{Short description|Internet software to protect user identity}}
{{Use mdy dates|date=January 2021}}
The '''Penet remailer''' ({{mono|'''anon.penet.fi'''}}) was a [[pseudonymous remailer]] operated by [[Johan Helsingius|Johan "Julf" Helsingius]] of Finland from 1993 to 1996. Its initial creation stemmed from an argument in a Finnish [[Usenet newsgroup|newsgroup]] over whether people should be required to tie their real name to their online communications. Julf believed that people should not&mdash;indeed, could not&mdash;be required to do so. In his own words:
:"Some people from a university network really argued about if everybody should put their proper name on the messages and everybody should be accountable, so you could actually verify that it is the person who is sending the messages. And I kept arguing that the Internet just doesn't work that way, and if somebody actually tries to enforce that, the Internet will always find a solution around it. And just to prove my point, I spent two days or something cooking up the first version of the server, just to prove a point."<ref name="Grassmuck">{{Cite journal |last=Grassmuck |first=Volker |date=December 1994 |title="Don't Try to Control the Network Because it's Impossible Anyway" Interview with Johan Helsingius on Anonymous Remailers |url=http://waste.informatik.hu-berlin.de/Grassmuck/Texts/remailer.html |url-status=dead |journal=IC Magazine |archive-url=https://web.archive.org/web/20060827210638/http://waste.informatik.hu-berlin.de/Grassmuck/Texts/remailer.html |archive-date=2006-08-27}}</ref>

==Implementation==
{{Unreferenced section|date=October 2018}}
Julf's remailer worked by receiving an e-mail from a person, stripping away all the technical information that could be used to identify the original source of the e-mail, and then remailing the message to its final destination. The result provided Internet users with the ability to send e-mail messages and post to Usenet newsgroups without revealing their identities.

In addition, the Penet remailer used a type of “post office box” system in which users could claim their own anonymous e-mail addresses of the form ''an''xxxxx''@anon.penet.fi'', allowing them to assign pseudonymous identities to their anonymous messages, and to receive messages sent to their (anonymous) e-mail addresses.

While the basic concept was effective, the Penet remailer had several vulnerabilities which threatened the anonymity of its users. Chief among them was the need to store a list of real e-mail addresses mapped to the corresponding anonymous e-mail addresses on the server. A potential attacker needed only to access that list to compromise the identities of all of Penet's users. The Penet remailer was on two occasions required by the legal system in [[Finland]] (the country where the Penet server hardware resided) to turn over the real e-mail address that was mapped to an anonymous e-mail address. Another potential vulnerability was that messages sent to and from the remailer were all sent in [[cleartext]], making it vulnerable to electronic eavesdropping.

Later anonymous remailer designs, such as the [[Cypherpunk anonymous remailer|Cypherpunk]] and [[Mixmaster anonymous remailer|Mixmaster]] designs, adopted more sophisticated techniques to try to overcome these vulnerabilities, including the use of encryption to prevent eavesdropping, and also the technique known as [[onion routing]] to allow the existence of pseudonymous remailers in which no record of a user's real e-mail address is stored by the remailer.

Despite its relatively weak security, the Penet remailer was a hugely popular remailer owing to its ease of anonymous account set-up and use compared to more secure but less user-friendly remailers, and had over 700,000 registered users at the time of its shutdown in September 1996.

==First compromise==
In the summer of 1994, word spread online of the Penet remailer being compromised, with the announcement being made at the hacker convention [[DEF CON]] II. ''[[Wired (magazine)|Wired]]'' magazine reported at the time:

{{blockquote|An official announcement was made at this year's [[DEF CON#Venues, dates, and attendance|DefCon II]] that anon.penet.fi has been seriously compromised. We strongly suggest that you not trust this anonymous remailer. (Word has it that some folks are working on a [[Pretty Good Privacy|PGP]]-based service.) We'll keep  you posted.<ref>{{Cite magazine |date= 1994-11-01 |title=Net Surf |url= http://www.wired.com:80/wired/archive/2.11/net_surf.html |magazine=WIRED|archive-url=https://web.archive.org/web/19991117164252/http://www.wired.com:80/wired/archive/2.11/net_surf.html |archive-date=November 17, 1999 }}</ref>}}

This was followed a year later by a mention in the announcement for DEF CON III:

<blockquote>
SPEAKERS
[[Sarah Gordon (computer scientist)|Sarah Gordon]], AKA [[Theora Jones|Theora]], a veteran of DC II will be presenting another speech this year. Last year she organized a round table discussion with [[Phil Zimmermann]] and Presence, and revealed that the Anonymous remailer anon.penet.fi was compromised. TOPIC: Not Announced Yet.<ref name="CUD">{{Cite web |date=1995-02-07 |title=Computer underground Digest |url=http://venus.soci.niu.edu/~cudigest/CUDS7/cud710 |url-status=dead |archive-url=https://web.archive.org/web/20060901123001/http://venus.soci.niu.edu/~cudigest/CUDS7/cud710 |archive-date=2006-09-01 |access-date=2007-04-26}}</ref>
</blockquote>

==Second compromise==
The second reported compromise of the Penet remailer occurred in February 1995 at the behest of the [[Church of Scientology]]. Claiming that a file had been stolen from one of the Church's internal computer servers and posted to the newsgroup [[alt.religion.scientology]] by a Penet user, representatives of the Church contacted [[Interpol]], who in turn contacted the Finnish police, who issued a search warrant demanding that Julf hand over data on the users of the Penet remailer. Initially Julf was asked to turn over the identities of all users of his remailer (which numbered 200,000 at the time), but he managed a compromise and revealed only the single user being sought by the Church of Scientology.<ref>{{cite web | url=https://www.wired.com/1995/12/alt-scientology-war/ | title=alt.scientology.war | last=Grossman | first=Wendy M. | author-link=Wendy M. Grossman | date=Dec 1, 1995 | publisher=Wired}}</ref>

The anonymous user in question used the handle "-AB-" when posting anonymously, and their real e-mail address indicated that they were an alumnus or alumna of the [[California Institute of Technology]]. The document he posted was an internal report by a Scientology private investigator, Eugene Ingram, about an incident that had occurred involving a man named Tom Klemesrud, a BBS operator involved in a [[Scientology and the Internet#Raids and lawsuits|controversy]]. The confusing story became known on the Internet as the "Miss Blood Incident".{{r|scnvinternet}}

Eventually the Church learned the real identity of "-AB-" to be Tom Rummelhart, a Scientologist and computer operator responsible for some of the maintenance of the Church of Scientology's [[INCOMM]] computer system. The fate of "-AB-" after the Church of Scientology learned his true identity is unknown. Years later in 2003, a two-part story entitled "What Really Happened in INCOMM - Part 1"<ref name="GG1">{{Cite web |title=What Really Happened in INCOMM - Part 1 |url=http://groups.google.com/group/alt.religion.scientology/msg/3d23b12d4264e8fc? |access-date=18 October 2018 |website=[[alt.religion.scientology]] |via=[[Google Groups]] |url-status=deviated |archive-url=https://web.archive.org/web/20070401144515/http://groups.google.com/group/alt.religion.scientology/msg/3d23b12d4264e8fc |archive-date=April 1, 2007 |date=November 16, 2003 |first=Dan |last=Garvin}}</ref> and "What Really Happened in INCOMM – Part 2"<ref name="GG2">{{Cite web |title=What Really Happened in INCOMM – Part 2 |url=http://groups.google.com/group/alt.religion.scientology/msg/b0949c0e7484657f? |access-date= 2018-10-18 |website=[[alt.religion.scientology]] |via=[[Google Groups]] |url-status=deviated |archive-url=https://web.archive.org/web/20070212040453/http://groups.google.com/group/alt.religion.scientology/msg/b0949c0e7484657f |archive-date=February 12, 2007 |date=November 23, 2003 |first=Dan |last=Garvin}}</ref> was posted to [[alt.religion.scientology]] by a former Scientologist named Dan Garvin, which described events within the Church leading up to and stemming from the Penet posting by "-AB-".{{r|GG1|GG2}}

==Other attacks==
Julf was also contacted by the government of [[Singapore]] as part of an effort to discover who was posting messages critical of the nation's government in the newsgroup soc.culture.singapore, but as Finnish law did not recognise any crime being committed, Julf was not required to reveal the user's identity.

In August 1996, a British newspaper, ''[[The Observer]]'', published an article describing the Penet remailer as a major hub of [[child pornography]], quoting a United States [[Federal Bureau of Investigation|FBI]] investigator named Toby Tyler as saying that Penet was responsible for between 75% and 90% of the child pornography being distributed on the Internet.<ref>{{cite news |title=The pedlars of child abuse: We know who they are. Yet no one is stopping them. |url=http://www.scallywag.com/obtext.htm |url-status=dead |archive-url=https://web.archive.org/web/19970524015719/http://www.scallywag.com/obtext.htm |archive-date=May 24, 1997 |via=scallywag.com |publisher=The Observer |date=1996-08-25}}</ref> Investigations by online journalist [[Declan McCullagh]] demonstrated many errors and omissions in the ''Observer'' article. In an article penned by McCullagh, the alleged FBI investigator described himself as a sergeant in [[California]]'s [[San Bernardino, California|San Bernardino]] sheriff's office who only consulted with the FBI from time to time, a relationship which the ''Observer'' article had in his opinion purposefully misrepresented as some kind of employment relationship. Tyler also claimed that the ''Observer'' purposely misquoted him, and he had actually said that most child pornography posted to newsgroups does '''not''' go through remailers.<ref name="spaink">{{cite web |last1=Sherilyn |title=The Observer Observed |url=https://www.spaink.net/cos/rnewman/anon/sherilyn.html |website=[[Karin Spaink|spaink.net]] | date=1996-09-11 |url-status=deviated |archive-url=https://web.archive.org/web/20020927041854/https://www.spaink.net/cos/rnewman/anon/sherilyn.html |archive-date=September 27, 2002}}</ref>

In addition, Julf claimed that he explained to the ''Observer'' the steps he took to prevent child pornography from being posted by forbidding posting to the alt.binaries [[newsgroups]] and limiting the size of messages to 16 kilobytes, too small to allow [[uuencode]]d binaries such as pictures to be posted. He also informed the ''Observer'' of an investigation already performed by the Finnish police which had found no evidence that child pornography was being remailed through Penet. Julf claims that all this information was ignored, stating that the ''Observer'' "wanted to make a story so they made things up."{{Citation needed|date=October 2018}}

Despite voluminous reader mail pointing to the numerous errors in the news story, the ''Observer'' never issued a full retraction of its claims, only going so far as to clarify that Johan Helsingius had "consistently denied" the claims of child pornography distribution.{{Citation needed|date=October 2018}}

In September 1996, the [[Church of Scientology]] again sought information from Julf as part of its court case against a critic of the Church named [[Grady Ward]]. The Church wanted to know if Ward had posted any information through the Penet remailer. Ward gave Julf explicit permission to reveal the extent of his alleged use of the Penet remailer, and Julf told the Church that he could find no evidence that Ward had ever used the Penet remailer at all.{{Citation needed|date=October 2018}}

==Third compromise and shutdown==
In September 1996, an anonymous user posted the [[Operating Thetan#Confidential materials|confidential writings]] of the [[Church of Scientology]] through the Penet remailer. The Church once again demanded that Julf turn over the identity of one of its users, claiming that the poster had infringed the [[Scientology and the legal system|Church's copyright]] on the [[Timeline_of_Scientology#1994 |confidential material]]. The Church was successful in finding the originating e-mail address of the posting before Penet remailed it, but it turned out to be another anonymous remailer: the alpha.c2.org [[Nym server|nymserver]], a more advanced and more secure remailer which didn't keep a mapping of e-mail addresses that could be [[subpoena]]ed.<ref name="Mendels">{{cite news |last1=Mendels |first1=Pamela |title=Scientology Case and Finnish Law Blamed for Demise of Remail Service |url=https://archive.nytimes.com/www.nytimes.com/library/cyber/week/0905remail.html |work=New York Times |date=1996-09-05}}</ref>

Facing much criticism and many attacks, and unable to guarantee the anonymity of Penet users, Julf shut down the remailer in September 1996.<ref name="eff">{{Cite press release |title=Johan Helsingius closes his Internet remailer |date=1996-08-30 |url=https://w2.eff.org/Privacy/Anonymity/960830_penet_closure.announce |access-date=2014-10-09 |archive-url=https://web.archive.org/web/20160303221336/https://w2.eff.org/Privacy/Anonymity/960830_penet_closure.announce |archive-date=2016-03-03 |url-status=dead}}</ref>

==See also==
{{Portal|Internet}}
* [[Anonymous remailer]]
* [[Crypto-anarchism]]
* [[Cypherpunk]]
* [[Pseudonymous remailer]]
* [[Sintercom]]
* [[Scientology and law]]
* [[Scientology and the Internet]]

==References==
{{reflist|2|refs=

<ref name="scnvinternet">{{cite magazine |title=Scientology v. the Internet : Free Speech & Copyright Infringement on the Information Super-Highway |first1=Jim |last1=Lippard |author1-link=Jim Lippard |first2=Jeff |last2=Jacobsen |magazine=[[Skeptic (American magazine)|Skeptic]] |volume=3 |issue=3 |year=1995 |url=https://www.skeptic.com/magazine/archives/3.3/ |pages=35–41 |url-access=subscription}} {{cite web |url=https://www.discord.org/lippard/skeptic/03.3.jl-jj-scientology.html#blood |title=Authorized copy <!--link is to an authorized copy by author of article on his own website--> |website=[[Jim Lippard|discord.org]]}}</ref>

}}

==Further reading==
* {{Cite journal |last=McCullagh |first=Declan |date=September 1996 |title=Finnish Line |url=https://www.eff.org/Misc/Publications/Declan_McCullagh/hw.finnish.line.090696.article |url-status=dead |journal=Hotwired, the Netizen |archive-url=https://web.archive.org/web/20060621113254/http://www.eff.org/Misc/Publications/Declan_McCullagh/hw.finnish.line.090696.article |archive-date=2006-06-21}}
* {{Cite journal |last=Helmers |first=Sabine |date=September 1997 |title=A Brief History of anon.penet.fi - The Legendary Anonymous Remailer |url=http://www.december.com/cmc/mag/1997/sep/helmers.html |journal=CMC Magazine}}
* {{Cite journal |last=Post |first=David G. |date=April 1996 |title=The First Internet War |journal=Reason Magazine}} ([https://web.archive.org/web/20080420061007/http://www.cli.org/DPost/X0003_ARTICLE4.html Transcription] hosted by Cyberspace Law Institute)
* {{Cite press release |title=Johan Helsingius gets injunction in Scientology case — privacy protection of anonymous messages still unclear |date=1996-09-23 |publisher=EFF |url=https://www.eff.org/Privacy/Anonymity/960923_penet_injunction.announce |archive-url=https://web.archive.org/web/20050921022510/http://www.eff.org/Privacy/Anonymity/960923_penet_injunction.announce |archive-date=2005-09-21 |url-status=dead}}

==External links==
* {{Cite web |title=The Church of Scientology vs anon.penet.fi |url=http://www.spaink.net/cos/rnewman/anon/penet.html | work = spaink.net |first=Ron |last=Newman}}
* {{Cite web |title=Archive of an144108's Usenet postings |url=http://groups.google.com/groups?q=author:an144108@anon.penet.fi&start=0&scoring=d |via=Google |access-date=December 4, 2021 |archive-date=January 24, 2013 |archive-url=https://archive.today/20130124163543/http://groups.google.com/groups?q=author:an144108@anon.penet.fi&start=0&scoring=d |url-status=live }}
* {{Cite web |date=1995-02-07 |editor-last=Thomas |editor-first=Jim |title=Computer underground Digest |url=http://computer-underground-digest.org/CUDS7/cud710 |volume=7 |number=10 |editor-first2=Gordon |editor-last2=Meyer |url-status=dead |archive-url=https://web.archive.org/web/20220412002911/http://computer-underground-digest.org/CUDS7/cud710 |archive-date=April 12, 2022}}

{{Scientology and the Internet|state=expanded}}

{{DEFAULTSORT:Penet Remailer}}
[[Category:Cryptography law]]
[[Category:Anonymity networks]]
[[Category:Internet properties established in 1993]]
[[Category:Internet properties disestablished in 1996]]
[[Category:Scientology and the Internet]]
[[Category:Internet services shut down by a legal challenge]]
[[Category:Routing]]
[[Category:Network architecture]]
[[Category:Internet in Finland]]