Ask who pays for Tor and most engineers reach for the same half-joke — “the CIA,” delivered with a smirk, as if that settles the matter. The real answer is stranger, better documented, and more useful to a systems architect than the meme. Tor was conceived inside a U.S. Naval research laboratory, spent its adolescence on Navy and DARPA funding, and today runs as an independent nonprofit whose most recent audited financials still show more than a third of its revenue arriving from the U.S. government — the same government whose surveillance programs its users routinely evade. That is not a scandal buried in a filing; it is a disclosed, engineered fact, and understanding why a state funds the network that hides people from it is a better lesson in security architecture than any protocol diagram.
This piece works the paradox in order: verified origin, the actual audited numbers, why the arrangement doesn’t collapse under its own weight, who governs the nonprofit that spends the money, where the network’s real centralization lives, and what happens when the government class that funds Tor decides to block it instead.
🏛️ The Verified Lineage: From a Naval Research Lab to a 501(c)(3)
Onion routing began in 1995 at the U.S. Naval Research Laboratory (NRL), where Paul Syverson, Michael Reed, and David Goldschlag asked a mission-driven question: could a Navy analyst exchange information over the open internet without an observer learning who was talking to whom? That’s a traffic-analysis problem, not a content-secrecy one — TLS already hid what was said; nothing hid who was talking. Get the sponsor right: Navy and DARPA history, not Army. The Office of Naval Research funded the earliest work from 1995, and DARPA funded further development from 1997, per The Tor Project’s history page.
MIT graduate Roger Dingledine began extending the NRL codebase with Syverson in the early 2000s; classmate Nick Mathewson joined shortly after. Dingledine renamed the implementation “Tor” and the alpha code was released in September 2002 under a free license — shorthand for a process, not a single day: the network grew from roughly a dozen volunteer nodes into today’s global relay fleet. In August 2004, the trio formalized the design in “Tor: The Second-Generation Onion Router” at USENIX Security, adding forward secrecy, directory servers, and rendezvous-based hidden services — a paper that won USENIX’s “Test of Time” award in 2014. That same year, the Electronic Frontier Foundation announced on December 21, 2004 it would sponsor Dingledine’s and Mathewson’s work through roughly 2005 (press release). Two years later, on December 22, 2006, The Tor Project, Inc. incorporated as an independent 501(c)(3) nonprofit — a structure barred from being controlled by, or paying profit to, any single donor(3)_organization), government agency included. That legal separation is the structural fact that makes the rest of this paradox resolvable.
| Milestone | Date | What happened |
|---|---|---|
| Onion routing conceived | 1995 | Goldschlag, Reed, Syverson design it at the Naval Research Laboratory, ONR-funded |
| DARPA funding begins | 1997 | Continued development funded by DARPA |
| Tor alpha released | September 2002 | Dingledine, Mathewson, and Syverson release free-licensed alpha code as “Tor” |
| Design paper published | August 2004 | “Tor: The Second-Generation Onion Router,” USENIX Security 2004 |
| EFF sponsorship announced | December 21, 2004 | EFF funds Dingledine’s and Mathewson’s work through ~2005 |
| Nonprofit incorporation | December 22, 2006 | The Tor Project, Inc. becomes an independent 501(c)(3) |
💵 The Numbers: What “Government-Funded” Actually Means
“Tor is government-funded” is technically true and routinely used to imply something it doesn’t support: that the funder controls the network. The honest version needs the audited numbers, which Tor publishes every fiscal year and breaks out below.
In FY2023–2024, the most recent audited period, total cash revenue was $7,287,566 ($8,005,661 including in-kind), per Tor’s financials post and its audited statements. Corporate and nonprofit partners in that mix — OpenSats, Omidyar Network, Mullvad, DuckDuckGo, and Proton — are worth naming individually, since they’re doing real work to diversify the base. FY2021–2022, the comparison year Tor itself uses for “diversification,” is the most recent fiscal year where DARPA appears as a live, current-era funder of Tor, not just a 1990s historical one (see the FY21–22 post).
| Revenue source | FY2021–2022 | FY2023–2024 |
|---|---|---|
| U.S. government (total) | 53.5% — $3,209,631 | 35.08% — $2,556,472 |
| — State Dept. DRL | $2,246,302 | $2,121,049 |
| — DARPA (via Georgetown) | $610,530 | not a listed line item |
| — Open Technology Fund | $152,906 | $340,681 |
| — NSF (via Georgetown) | $120,271 | $14,715 |
| Non-U.S. government (Sweden’s Sida, etc.) | not broken out in this report | 7.58% — $552,387 |
| Individual donations | see note below | 15.61% — $1,102,619 |
| Corporate & nonprofit partners | see note below | 21.59% — $1,573,300 |
| Total cash revenue | $5,999,891 | $7,287,566 |
The government-share figures are corroborated across both audited fiscal-year posts and are safe to compare directly. The individual-donation figures are not: the two disclosures appear to categorize “individual” giving differently, so this piece cites each year’s non-government figures to their own report rather than asserting a multi-year donation trend.
What is safe to say: U.S. government funding fell from a majority of Tor’s budget to roughly a third in two fiscal years, while non-U.S. government, individual, and corporate/nonprofit sources grew to fill the remainder — real, audited diversification, without a clean year-by-year donation curve to draw. Historically, before the current State Department/OTF structure, the U.S. Broadcasting Board of Governors (renamed USAGM in 2018) funded Tor roughly $6.1 million across 2007–2015, largely via the Open Technology Fund. That figure comes from journalist Yasha Levine’s reporting, not a Tor-audited statement, and should carry that attribution rather than be treated as an audited number.
🧩 Why the Paradox Resolves: Anonymity Loves Company
Here is the engineering argument most “the government funds Tor” commentary skips: a network used only by government agents anonymizes nobody. If the only traffic entering an anonymity network belonged to intelligence officers, the mere fact of a connection originating from that network would itself be the identifying signal, regardless of what the encryption inside protected. Dingledine made this point directly in 2004, at the Wizards of OS conference: “The United States government can’t simply run an anonymity system for everybody and then use it themselves only. Because then every time a connection came from it people would say, ‘Oh, it’s another CIA agent.'” The system’s usefulness to its own funder depends on a large, diverse, non-governmental user base. Public release was not a donation to civil society bolted onto a classified tool — it was a requirement of the tool working at all.
That intuition was formalized two years later, at a venue most engineers never read: Dingledine and Mathewson’s “Anonymity Loves Company: Usability and the Network Effect,” presented at the Workshop on the Economics of Information Security (WEIS) in 2006 — not 2004, despite a legacy URL path that misleads casual citation. The paper’s claim is an economics argument in security-paper clothing: anonymity is a network good. Its strength is a function of the size and diversity of the crowd a user blends into, not just the cryptographic strength of the protocol underneath. A protocol can be mathematically flawless and still fail at anonymity if only ten people, all with the same profile, ever use it.
That generalizes past Tor. If you design any system whose value depends on blending into a crowd — a corporate VPN, an end-to-end encrypted messenger, a mix network — the size and diversity of that crowd is a security parameter, not a growth metric optimized separately from security. This is why the U.S. government funding Tor isn’t a contradiction to hand-wave away: State Department circumvention-diplomacy programs and NRL-originated traffic-analysis research share an identical technical requirement — a strong, widely used anonymity network. A narrow one serves neither goal.
🗳️ Who Actually Runs The Tor Project
Funding is one axis of accountability; governance is the other, and the two are legally separate at Tor by design. The Tor Project, Inc. is governed by an independent, all-volunteer Board of Directors that sets strategy and oversees a paid staff led by an executive director — the mechanism that keeps any single funder, government or corporate, from directing the organization’s decisions. As of this writing, the board’s seven members are Alissa Cooper, Christian Kaufmann, Desigan “Dees” Chinniah, Esra’a Al Shafei, Kendra Albert, Maria Xynou, and Sarah Gran, with Isabela Fernandes as executive director — a roster that should be re-checked against torproject.org/about/people rather than treated as permanent.
The board’s most consequential turnover is a governance case study, not a footnote. In 2016, high-profile developer Jacob Appelbaum resigned on May 25 amid allegations of sexual misconduct. An independent investigation The Tor Project commissioned substantiated a pattern of misconduct, and the organization replaced its board of directors — having found several existing members had known of informal complaints beforehand — and adopted new conduct policies (see Washington Post coverage). Read this correctly: it’s a board’s accountability failure and remediation, not a protocol vulnerability. The engineering-relevant question isn’t “was Tor compromised” — it’s “does the governance structure correct itself.” Here, the answer was yes: full board replacement, published findings, new policy.
🔑 The Nine People Your Browser Trusts by Default
Governance covers the organization; trust architecture covers the network — and here the honest answer is that Tor isn’t decentralized at every layer.
Every Tor client needs a trustworthy answer to one question: which relays exist right now, and are they safe? Peer-discovered, gossip-based relay membership is trivially Sybil-able. Tor’s answer is a deliberate, small, high-trust human set: nine directory authorities — as of 2025, named moria1, longclaw, dizum, faravahar, tor26, maatuska, gabelmoo, bastet, and dannenberg — that vote on network state, publishing their signed majority hourly as the consensus every client trusts by default. A valid consensus requires 5 of 9 authorities to agree; that bootstrap list is hardcoded into the Tor client at build time. Operators are individually named, long-tenured community members — Dingledine has historically run moria1 — a deliberate trade-off: some problems (Sybil resistance, bootstrapping trust from zero) are better solved by accountable humans than pure cryptographic consensus at Tor’s scale, per grounded community analysis of the directory-authority design.
| Layer | What’s genuinely decentralized | Where centralization actually lives |
|---|---|---|
| Traffic relays | Volunteer-operated guard/middle/exit relays worldwide; anyone can run one | A relay isn’t “real” to clients until a majority of the 9 authorities vote it into the hourly consensus |
| Network view (bootstrap) | — | The 9 directory-authority addresses are hardcoded into every client release |
| Consensus validity | Nine independent voters, no single point of failure among them | Only 9 named operators can vote; 5-of-9 signatures make a consensus valid |
| Source code | Open, publicly reviewable by anyone | A small core team merges to the canonical repository |
| Funding | Diversifying across government, individual, and corporate sources | A short, named list of institutional funders is still the first pressure target |
That pattern recurs everywhere at internet scale: DNS ultimately roots trust in a small set of root servers, exposed to the same category of targeted infrastructure attack that a small, named directory-authority set invites, and HTTPS root trust reduces to a comparably short list of certificate authorities. A small trusted set bootstrapping a much larger trust-minimized system shows up from DNS to CAs to blockchain validator sets; Tor is simply an unusually well-documented instance of the trade-off.
📰 SecureDrop, Snowden, and “Tor Stinks”
The network-effect argument is easier to believe with concrete evidence that the funder’s own security interest is served by a strong, public Tor. SecureDrop, the Tor-based whistleblower platform launched in 2013, is deployed at more than 80 newsrooms — including The New York Times, The Washington Post (live since June 2014), and ProPublica — using air-gapped systems and onion addresses so neither the operator nor an observer can identify a source, per SecureDrop’s overview. Reporters Without Borders, Human Rights Watch, and Amnesty International have all recommended Tor for source protection.
The sharpest evidence comes from the Snowden disclosures. Edward Snowden used Tor while transferring NSA documents to journalists Glenn Greenwald, Laura Poitras, Barton Gellman, and Ewen MacAskill in 2013; The Tor Project has publicly credited him as “a Tor supporter.” The same leak trove included an internal NSA presentation nicknamed “Tor Stinks,” conceding the agency would “never be able to de-anonymize all Tor users all the time” — the NSA, at full analytical capability, stating a documented limitation, not a backdoor. It’s the resistance-without-defeat outcome the 2004 design paper’s stated non-goal (a global passive adversary) predicts.
Weigh this against the honest counterpoint. Tor’s own 2015 measurement put onion-service traffic at roughly 3.4% of client-side traffic and 6.1% of relay-observed traffic; a 2018 academic follow-up by Mani et al. is the only rigorous successor, and an open, unresolved Tor network-health ticket confirms nobody has re-derived a current figure since. The last rigorous traffic-share measurement is simply years old, and measuring it at all is architecturally hard precisely because the network resists that kind of observation. Content-sampling studies tell a harsher, separate story about what exists within onion services: Owen and Savage’s 2016 study (IET Information Security), sampling roughly 45,000 live onion services over six months, found child-sexual-abuse material dominated the slice its methodology could categorize. A separate 2020 PNAS study found Tor’s dark-web harms cluster disproportionately in free countries relative to authoritarian ones. Traffic volume, service-count sampling, and harm-by-regime are three different instruments answering three different questions — never average them into one “X% of Tor is criminal” headline.
🚧 When the Adversary Is a State
The funding relationship gets its sharpest test in the states that treat Tor as a threat to information control. China’s Great Firewall began blocking unpublished Tor bridges at the end of 2011; from October that year it added active probing — deep packet inspection flags a suspected Tor handshake, then Chinese probes connect back within minutes to confirm and blacklist it, documented in Winter and Lindskog’s USENIX FOCI 2012 paper. Tor’s first countermeasure, obfs2 (2012), obfuscated the TLS stream but was itself fingerprintable; later transports — obfs3, obfs4, meek — hardened against the same active-probing technique.
Russia began blocking Tor on December 1, 2021, independently confirmed by OONI. Iran saw a large Tor-usage spike during the October 2022 protests, followed by crackdowns on the most effective bridge techniques. Tor’s 2025 retrospective calls it the project’s most challenging year yet for anti-censorship engineering: WebTunnel, introduced in late 2024 to disguise Tor as ordinary HTTPS, became critical for Russian users until most WebTunnel bridges were identified and blocked by mid-2025, pushing distribution toward Telegram and newer transports like Conjure.
The current flagship transport, Snowflake, illustrates the design principle cleanly: disguise Tor traffic as something too expensive for a censor to block wholesale. It makes connections look like ordinary WebRTC video-call traffic — the protocol underlying Zoom and Meet — using volunteer browser-extension proxies and standard NAT-traversal, so blocking Snowflake means blocking WebRTC broadly. Prototyped by pseudonymous developer “Serene” in January 2016, it gained browser-extension proxy support in 2019 and a Rust rewrite reached beta in February 2023.
Legality here is jurisdiction- and conduct-dependent, not binary. States most consistently named as banning or heavily blocking Tor include China, Russia, Iran, Belarus (anonymizers outlawed by statute in 2015), and Turkmenistan, with others named less consistently. Treat any specific blocking list, including this one, as a snapshot requiring re-verification at read time.
⚖️ The Dual-Use Question
The same rendezvous-point design that lets SecureDrop protect a New York Times source from a nation-state adversary is, mechanically, identical to the design that protects a criminal marketplace’s infrastructure from law enforcement. Strong anonymity is a single property with no “good guys only” mode. Tor’s history — a defense-funded traffic-analysis tool released publicly on purpose, now serving journalists, dissidents, ordinary users, and criminals alike — is one of the cleanest case studies available for the argument that you cannot build strong anonymity for the powerless without it also working for the powerful-and-malicious.
The clearest instance where “the government funds Tor” and “the government attacks Tor” briefly became the same sentence is the 2014 CMU relay-early incident, reported here exactly as contested as it is. From roughly January to July 2014, a set of relays ran what researchers later identified as a traffic-confirmation attack against onion-service users, exploiting a “relay early” cell-header bug; Tor’s security team discovered and patched it in July 2014. Later reporting connected the relays to Carnegie Mellon University’s Software Engineering Institute and, per Tor’s own statements citing sources it considered credible, an alleged FBI payment of roughly $1 million — a claim the FBI and CMU have never confirmed, per contemporaneous Forbes reporting. Operation Onymous, a joint FBI-Europol action that November, took down Silk Road 2.0 and dozens of other onion sites; a causal link to the relay-early attack was widely suspected but never conclusively confirmed in the public record. It’s a documented, patched, six-month-scoped incident layered with a genuinely unresolved payment dispute — not evidence Tor is broken, and not a settled dispute.
That tension is why the funding structure matters as more than an accounting curiosity. A nonprofit legally separate from any funding agency, whose code is fully open and auditable, whose governance replaced itself after a real accountability failure, and whose primary funder’s stated interest — circumvention diplomacy, not intelligence collection — is structurally aligned with a strong network rather than a compromised one, is about as good an institutional answer as this problem gets. It doesn’t make the dual-use question disappear; it makes it answerable with evidence instead of implication. The same instinct that makes end-to-end encryption a poor opt-in feature restricted to “people with something to hide” should make you suspicious of any security architecture claiming strong protection while quietly excluding the population that would make that protection real.
🧭 What This Means for You
If you take one transferable lesson from Tor’s institutional history, make it this: “who funds this, and does their incentive point toward strength or toward compromise” is a more useful diligence question than “is this government-funded,” full stop. Tor’s own numbers answer that structurally rather than rhetorically — open code any funder-inserted backdoor would have to survive, a legally independent board, and a funder whose stated goal requires the network to work well, not just for them. The next time you evaluate or design security infrastructure, ask what the U.S. government’s history with Tor answers by example: does this system’s value depend on a crowd, and is that crowd actually large and diverse enough to make the protection real?
❓ Frequently Asked Questions
Who actually pays for Tor? A diversifying mix. In FY2023–2024, U.S. government sources supplied 35.08% of The Tor Project’s $7.29M cash revenue; non-U.S. government sources (led by Sweden’s Sida) added 7.58%; individual donations were 15.61%; and corporate/nonprofit partners like Mullvad, Proton, and DuckDuckGo contributed 21.59%. In FY2021–2022, U.S. government funding was a larger 53.5% of a smaller $6.0M total.
Does U.S. government funding mean the U.S. government controls Tor? No, structurally. The Tor Project, Inc. is a legally independent 501(c)(3) nonprofit incorporated in December 2006, governed by its own volunteer board — not by any funding agency. Its source code is fully open and publicly reviewable, and no funder-inserted backdoor has ever been substantiated.
Why would the government fund something that helps people hide from government surveillance? Because a network used only by government agents doesn’t anonymize anyone — the traffic itself becomes the identifying signal. Dingledine and Mathewson formalized this in their 2006 paper “Anonymity Loves Company”: an anonymity system’s strength depends on the size and diversity of its user base, not just its protocol. A strong, public, civilian-heavy network serves the same traffic-analysis-resistance goal that motivated the original Naval Research Laboratory work — it isn’t a contradiction of it.
What are Tor’s directory authorities, and why do they matter? Nine named, independently operated servers that vote on the state of the Tor network and publish a signed hourly “consensus” every client trusts by default as its bootstrap source of truth. A valid consensus needs 5-of-9 signatures. It’s the most centralized element inside an otherwise decentralized relay network — a deliberate trade-off against Sybil attacks on network discovery, not an oversight.
Is most Tor traffic used for illegal activity? No credible current measurement supports that claim, and no rigorous one exists past 2015–2018. Tor’s own 2015 measurement put onion-service traffic (a small fraction of total Tor use) at roughly 3.4–6.1% of overall traffic; separate content-sampling studies of what exists within onion services found troubling proportions of harmful material in the slice they could categorize. These measure different things and should never be averaged into one “X% of Tor is criminal” figure.
Which countries block Tor? Most consistently cited: China (active probing since late 2011), Russia (blocked December 1, 2021), Iran (crackdowns intensified after October 2022), Belarus (anonymizers outlawed by statute in 2015), and Turkmenistan. Treat any specific list, including this one, as a snapshot — enforcement posture changes faster than most reporting on it.
📚 Further Reading
- Better Email Privacy and Security with ProtonMail — Proton, one of Tor’s corporate/nonprofit funding partners, applying the same “strong crowd, not a narrow one” logic to consumer privacy tooling.
- The Age of Surveillance Capitalism by Shoshana Zuboff — the broader argument for why diplomatic and commercial incentives around surveillance and circumvention pull in opposite directions at once.
- Data and Goliath by Bruce Schneier — Schneier’s case for why broad, default privacy protection beats narrow, opt-in protection, the same network-effect logic this piece traces through Tor’s funding history.
- What Is the Domain Name System? and DNS Security Issues, Vulnerabilities, and Exploits — the closest infrastructure analogue to Tor’s directory-authority trust root: a small, named set of servers everyone else’s trust ultimately traces back to.
- Primary sources: The Tor Project’s history page, FY2023–2024 financials, and the 2004 USENIX design paper.
📚 Recommended Resources
Disclosure: some links below are Amazon affiliate links. If you buy through them, I earn a small commission — at no extra cost to you — which helps keep this site running.
Crypto: How the Code Rebels Beat the Government — Saving Privacy in the Digital Age
Steven Levy · Book
The essential backstory to this article’s paradox: how encryption moved from a government monopoly to public infrastructure, and why the state’s relationship with privacy technology has always been more complicated than “they want it banned.”
No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State
Glenn Greenwald · Book
The first-hand account of the 2013 disclosures, including the operational role secure channels played in them. Read alongside the NSA’s own “Tor Stinks” assessment discussed above.
Security Engineering: A Guide to Building Dependable Distributed Systems
Ross Anderson · Book · 3rd edition
Anderson is unusually good on the economics and politics of security infrastructure — who funds it, who benefits, and how incentives shape design. The right lens for the dual-use question this article closes on.
Free and primary: The Tor Project publishes its audited financials and history at torproject.org — the source for every funding figure cited above.