Tor browser, Tails OS merge to offer users improved security and privacy

 CISOs of organizations with staff (including cybersecurity threat researchers) who have to meet high privacy standards when connecting to the internet have a new option with the merger of the Tor Project and the Tails portable operating system (OS).

The two providers said Thursday that Tails will be merged into the Tor Project’s structure. That will allow easier collaboration, reduced overhead, and expanded training opportunities to protect users from surveillance.

“By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.” they said in the announcement. “The merger will lead to more robust treatment of these overlapping threat models and offer a comprehensive solution for those who need both network and system-level security in high-risk environments.”

Tor has been a financial backer of Tails for some time, and developers of the two platforms have been collaborating since 2015. Both rely on donations from organizations and users (The Tor Project is a 501(c)(3) nonprofit, so donations are tax-deductible for anyone paying US taxes). But late last year, Tails approached the Tor Project with the idea of merging operations, since, the announcement noted, Tails had outgrown its existing structure. Among other things, the merger will help spread the reach of Tails, and let the Tails team concentrate on their core mission, it said.

Tor, short for The Onion Router, is well known among security researchers – and threat actors – for its ability to anonymize a user’s browsing activity by routing encrypted web traffic through a series of nodes. This lowers the odds a user’s browsing can be traced back to them. Its reputation has been mixed over the years, as it is often used to hide illegal activities, not just to protect the privacy and safety of its stated target users.

Tails, short for The Amnesic Incognito Live System, is a Linux distribution running in RAM that uses the Tor network. The OS is meant to be downloaded and installed on a USB stick, then plugged into a computer. That way, a user can boot into Tails from the USB instead of into Windows, Linux, or macOS.

By default, everything a user does under Tails — devices and Wi-Fi networks used, files opened, websites visited — disappears when the computer is shut down. A user has the option of saving some of their files and configuration, including documents, browser bookmarks, emails, and even some additional software, in encrypted persistent storage on the USB stick, but nothing is left on the machine itself.

Tor and Tails offer complementary protections, the providers say. “While Tor Browser anonymizes online activity, Tails secures the entire operating system, from files to browsing sessions. For journalists working in repressive regions or covering sensitive topics, Tor and Tails are often used as a set to protect their communications and safeguard their sources. The merger will lead to more robust treatment of these overlapping threat models and offer a comprehensive solution for those who need both network and system-level security in high-risk environments.”

David Shipley, head of Canadian-based cybersecurity training provider Beauceron Security, said that the merger will also help Tor and Tails lower their administrative costs.

“The tricky part is when it gets to feature prioritization. Does each team continue to work on each project or is it one team, and they advance things in whatever order makes the most sense? The other interesting thing is where the donation dollars will go. They’re still allowing folks to earmark donations to Tails separately for now, but if that changes, how will funding in the future drive investment in each area?”

The answer to some of these questions should emerge next year. According to the FAQ, the donation infrastructures will be merged sometime in 2025, at which point donations will support all of the Tor Project’s tools, including Tails, the Tor Browser, and the Tor network.