that provide any confidentiality of content or of routing data. We assume a world in which there is sufficient encrypted traffic (SSL, SSH, DRM, …) that encrypted traffic is not of itself suspicious so long as it is wrapped in a common ciphertext type. The attacker’s input consists of traffic data collected from the backbone or from ISPs, and her output consists of decisions to send police officers to raid the premises associated with particular IP addresses. Her problem is this: given an observed pattern of communications, whom should she investigate first?

The precise mechanism of ring formation in our simulation is as follows. A vulnerable node decides to create a ring and recruits for the purpose a further $n-1$ nodes from the new nodes introduced in the most recent replenishment round, or, if they are inadequate, from among its immediate neighbours. Existing ring members cannot be recruited, so rings may not overlap. Finally, recruits to a ring relinquish any existing links with the rest of the network, and the ring-forming node shares its external links uniformly among all the members of the ring.

Defense strategy 3 – revolutionary cells
----------------------------------------

Our third defensive strategy is inspired by cells of 