Anyone paying attention has been aware of this since last fall. It's common knowledge that CMU/SEI works for the US military. And the timing was a total giveaway. They pulled the Black Hat talk, and SR2 etc went down not long thereafter. But it's not surprising that CMU/SEI would do this. Legal niceties aside, it's arguably part of their mission.

The focus here, in my opinion, ought to be on the Tor Project's role in this. Although they did speak up last summer, and have blogged this update, I'm not impressed. They ignored the CMU attack for five months last spring. Maybe they did get blindsided by a new kind of attack. Maybe they just weren't paying enough attention. Or maybe, as they've noted, there aren't many devs who focus on onion services.

But so far there's been no mea culpa from the Tor Project. It's disingenuous to whinge about unethical researchers and investigators. It's stuff like this that fuels conspiracy theories about Tor and the US military. The Tor Project needs to take a stand.