8 ms·

This is probably what I find most worrying about the TOR concept. By running an exit node, you open yourself up to all sorts of legal actions. But if you can't

This is probably what I find most worrying about the TOR concept. By running an exit node, you open yourself up to all sorts of legal actions. But if you can't run a TOR exit node as an average citizen, won't all exit nodes end up being run by NSA, GCHQ, and their ilk?

Synaesthesia 11y ago
It really shouldn't be illegal, it should be protected, like free speech, as noted in the article, "It's like raiding the mailman's house for delivering an illegal letter with no return address" In fact I think that's why they withheld the fact that he runs a TOR node from the judge.
- deleted 11y ago
  [deleted]
- EdHominem 11y ago
  Especially since the agencies in question can easily "plant" the network evidence they want.
  - ethanbond 11y ago
    Can they? Does the client have any control over the route that their traffic takes through the network? Not a rhetorical question^
    - dsmithatx 11y ago
      Yes the user can choose the exit node in the client very easily. Even a dirty cop could figure it out.
    - htns 11y ago
      The client has full control. Tor works by having the client chain proxies ("nodes"). Tor hidden services add some complications but in that case too the client creates its own half of the proxy chain.
- noonespecial 11y ago
  Its more like getting a warrant to search his house because they found drugs in his car, but not bothering to mention to the judge that "his" car was a rental car he took out from the airport Hertz a month ago.
  - mulmen 11y ago
    Except in this case Bultmann and Robinson are Hertz, not the customer. They also knowingly rented to a drug dealer. Another analogy may be running a Hertz in Saudi Arabia and renting to women without male guardians present. The computer is not rented, they were in control of a device that may have been used to distribute child pornography. They themselves claim to know and understand this but feel that the risk of enabling criminal behavior is outweighed by the benefits to society of the "good" crime. Such as expression of dissent against regimes they disagree with. I'm not convinced this search was unreasonable from a legal perspective. I do not know enough about the legal precedent around running a Tor node but I could understand if they are on the hook for what happens with their node. I respect what they are doing and I don't think what they are doing is wrong morally but they are taking on a risk which they believe is outweighed by the benefit.
    - belorn 11y ago
      > They also knowingly rented to a drug dealer. How did you establish intent there? I know as a fact that by depositing money in the bank, some of that money will be lent out by the bank. I also know that some people who lend money from banks will be criminals. I thus know that by depositing money in the bank, criminal behavior will be enabled. I do not know however if my money specifically will be use for criminal behavior, nor do I know whom the criminals are or what the crime will be. In order to "knowingly" participate in a crime, the will, whom, and what is kind of important.
      - mulmen 11y ago
        You don't own the bank, they owned the computer. You aren't responsible for what happens to money the bank loans out since that money isn't yours. From the article: "Bultmann and Robinson had publicly advertised that they operated a Tor exit relay node—a node in the global Tor network, whose purpose is to give users the ability to browse the web anonymously. They said they operated the node as a service to dissidents in repressive countries, knowing full well that criminals might use it as well, much like any other communication tool." So yes, they didn't know which drug dealer they were renting to or which packets were from drug dealers (or child pornographers) but they did know it was possible. And with Tor I think it would even be considered likely. There seems to be a difference between say running a Tor exit node and running a commercial VoIP service. With VoIP the operator is required by law to record and make available certain information to LEO. Tor by design prevents the operators from having that information. I'm not sure what the legal consequences are but it seems to me that in any other "communication tool" situation the operator is expected to at least make an attempt to prevent illegal use. With Tor that isn't possible so I don't think it's really "like any other communication tool" Bultmann and Robinson knew they might be enabling criminal behavior with their own personal equipment in their home. I think it's easy to at least see the perspective of law enforcement in this case or how the legal system could find them at least partially responsible. I'm not saying this is what should happen but I don't think we have a clearly defined right to run an open proxy as a get out of jail free card.
- rayiner 11y ago
  Given that most of the content on Tor is illegal,[1] I'm not sure the mail is really the appropriate analogy. [1] https://www.schneier.com/blog/archives/2016/02/survey_of_the_d.html https://www.schneier.com/blog/archives/2016/02/survey_of_the...
  - lallysingh 11y ago
    Most of Tor usage is as a proxy back to the regular internet. I don't think you meant to, but the term "content on Tor" can be misleading in that respect, restricting the discussion to hidden services when the context is often Tor use in general.
  - deleted 11y ago
    [deleted]
  - woodman 11y ago
    I don't know why you wouldn't link directly to the paper, unless you're hoping that Schneier acknowledging its existence lends it some credibility. > most of the content Easily refuted: the authors had a spider crawl hidden services, which is laughably stupid. They claimed that there where 5,205 hidden services, of which 1,547 hosted illegal content. Another study [1], one which actually took advantage of network statistics, found the number of hidden services closer to 30,000. Also, well over 90% of Tor traffic is unrelated to any hidden services. So not most. As far as the analogy is concerned, hidden services would be more like the personal thoughts of the mailman - not the mail he is routing. [0] http://www.tandfonline.com/doi/abs/10.1080/00396338.2016.1142085 http://www.tandfonline.com/doi/abs/10.1080/00396338.2016.114... [1] https://research.torproject.org/techreports/extrapolating-hidserv-stats-2015-01-31.pdf https://research.torproject.org/techreports/extrapolating-hi...
    - deleted 11y ago
      [deleted]
  - AnthonyMouse 11y ago
    Most email is spam. Most cash contains traces of drugs. Most BitTorrent content infringes copyright. Is that supposed to justify a raid of anyone who runs a mail server or pays in cash or torrents a Debian ISO? For that matter, given the whole Three Felonies a Day thing, most postal mail is in fact sent by criminals too. There is a reason we have a law against theft and not a law against crowbars.
spudfkc 11y ago
Isn't that exactly what those agencies want?
cortesoft 11y ago
Really, the only way for it to work is if everyone is an exit node.
AdmiralAsshat 11y ago
I seem to recall Mozilla talking about running some exit nodes. I wonder if that fizzled out under government or law-enforcement pressure.
- cmrx64 11y ago
  Relays, not exit nodes, and they still run them: https://globe.torproject.org/#/search/query=mozilla https://globe.torproject.org/#/search/query=mozilla
ianleeclark 11y ago
It's actually really sad because I was wanting to see if I could implement an exit node all by myself as a side proejct, but then I realized the potential danger I'd be putting myself in. Naturally, I'd have to host it to test it, so I had to throw this one to the way-side
- dsmithatx 11y ago
  You still can but, make sure you don't do it in your house. Even one of the operators said, I guess I should have rented a server for this. Not that I agree with the warrant however, I'm not putting my dog's and children's lives in danger.
  - dsp1234 11y ago
    This is the advice given by a few people, but I'm not sure how valid it is. If the police have probable cause to search a server at a datacenter, then they would likely also have probable cause to search the computers of the owner's of those servers. In which case, we're back to 6am raids (probably done at the same time as the datacenter raid to prevent evidence tampering)
    - mirimir 11y ago
      Check out https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP... Find one that accepts Bitcoin. Use a pseudonym, and a throwaway email address. Find a plausible meatspace address and telephone number online. Maybe a hostel, business hotel, restaurant that just closed, etc.
  - ianleeclark 11y ago
    Realistically the only way that I could test it is by whitelisting my home box, but this isn't entirely reasonable given that I wouldn't truly be testing it, as I wouldn't know for certain the kind of throughput it offers.
  - noonespecial 11y ago
dublinben 11y ago
Best practices for running an exit node cover most of these concerns.[0] The most important one the individuals here didn't follow is 'don't run your relay from home.' A properly registered tor exit relay running in a datacenter somewhere will attract a courteous inquiry, rather than a 6am raid. [0]https://blog.torproject.org/running-exit-node https://blog.torproject.org/running-exit-node
- guelo 11y ago
  Yea but that means you have to spend extra money to run a Tor node, again limiting the amount of nodes that people are willing to run. The solution is for more people to run Tor, not fewer. Same with open Wifi nodes, the more the safer.
  - dublinben 11y ago
    If you want to contribute with your home broadband connection, a bridge relay is more appropriate. You can run an exit relay for as little as $5/mo with a VPS.
    - walrus01 11y ago
      99% of all VPS providers (in the $5/mo category, not $75/mo) will kill your account for running an exit node. They do not want their blocks of ARIN, RIPE or APNIC ipv4 space listed in every abuse and spam swamp realtime black hole list in existence.
- CaptSpify 11y ago
  If you run it in a DC, don't you risk exposure to someone cloning it and getting the data you have stored on it? No, you shouldn't keep sensitive data on it, I know, but still could be cloned/compromised without you knowing, right?
djsumdog 11y ago
They thing is, they knew he was running a TOR node. They knew they wouldn't find anything. In a _real_ raid for suspected child porn, they confiscate all the equipment. If it's encrypted, you don't get it back (without the money to spend on good lawyers, and then it will be 6 months minimum. Without good lawyers, even if you're never charged, it will probably get wiped and auctioned off, because US police can confiscate anything they damn well please). There was another article, either here or slahdot or somewhere, talking about how there have been several of these TOR node raids. I doubt they even had any evidence of illegal material being downloaded. I think the FBI got all these local police departments to do this intentionally to scare people. The guy should have never turned over his passwords either. He would have lost his machine, but IIRC, the Seattle privacy group he's with decided to scrap those machines anyway since they couldn't be sure the PD didn't tamper with the tor server.
pjc50 11y ago
By running an exit node, you open yourself up to all sorts of legal actions This is not going to be popular here, but IMO this is actually reasonable: you ought to be aware that running an exit node is enabling all kinds of terrible behaviour. You can't just handwash your responsibility away from this. (No, this is not the same thing as providing encryption software, or general public chat forums etc)

Synaesthesia 11y ago

It really shouldn't be illegal, it should be protected, like free speech, as noted in the article, "It's like raiding the mailman's house for delivering an illegal letter with no return address" In fact I think that's why they withheld the fact that he runs a TOR node from the judge.

deleted 11y ago
[deleted]
EdHominem 11y ago
Especially since the agencies in question can easily "plant" the network evidence they want.
- ethanbond 11y ago
  Can they? Does the client have any control over the route that their traffic takes through the network? Not a rhetorical question^
  - dsmithatx 11y ago
    Yes the user can choose the exit node in the client very easily. Even a dirty cop could figure it out.
  - htns 11y ago
    The client has full control. Tor works by having the client chain proxies ("nodes"). Tor hidden services add some complications but in that case too the client creates its own half of the proxy chain.
noonespecial 11y ago
Its more like getting a warrant to search his house because they found drugs in his car, but not bothering to mention to the judge that "his" car was a rental car he took out from the airport Hertz a month ago.
- mulmen 11y ago
  Except in this case Bultmann and Robinson are Hertz, not the customer. They also knowingly rented to a drug dealer. Another analogy may be running a Hertz in Saudi Arabia and renting to women without male guardians present. The computer is not rented, they were in control of a device that may have been used to distribute child pornography. They themselves claim to know and understand this but feel that the risk of enabling criminal behavior is outweighed by the benefits to society of the "good" crime. Such as expression of dissent against regimes they disagree with. I'm not convinced this search was unreasonable from a legal perspective. I do not know enough about the legal precedent around running a Tor node but I could understand if they are on the hook for what happens with their node. I respect what they are doing and I don't think what they are doing is wrong morally but they are taking on a risk which they believe is outweighed by the benefit.
  - belorn 11y ago
    > They also knowingly rented to a drug dealer. How did you establish intent there? I know as a fact that by depositing money in the bank, some of that money will be lent out by the bank. I also know that some people who lend money from banks will be criminals. I thus know that by depositing money in the bank, criminal behavior will be enabled. I do not know however if my money specifically will be use for criminal behavior, nor do I know whom the criminals are or what the crime will be. In order to "knowingly" participate in a crime, the will, whom, and what is kind of important.
    - mulmen 11y ago
      You don't own the bank, they owned the computer. You aren't responsible for what happens to money the bank loans out since that money isn't yours. From the article: "Bultmann and Robinson had publicly advertised that they operated a Tor exit relay node—a node in the global Tor network, whose purpose is to give users the ability to browse the web anonymously. They said they operated the node as a service to dissidents in repressive countries, knowing full well that criminals might use it as well, much like any other communication tool." So yes, they didn't know which drug dealer they were renting to or which packets were from drug dealers (or child pornographers) but they did know it was possible. And with Tor I think it would even be considered likely. There seems to be a difference between say running a Tor exit node and running a commercial VoIP service. With VoIP the operator is required by law to record and make available certain information to LEO. Tor by design prevents the operators from having that information. I'm not sure what the legal consequences are but it seems to me that in any other "communication tool" situation the operator is expected to at least make an attempt to prevent illegal use. With Tor that isn't possible so I don't think it's really "like any other communication tool" Bultmann and Robinson knew they might be enabling criminal behavior with their own personal equipment in their home. I think it's easy to at least see the perspective of law enforcement in this case or how the legal system could find them at least partially responsible. I'm not saying this is what should happen but I don't think we have a clearly defined right to run an open proxy as a get out of jail free card.
rayiner 11y ago
Given that most of the content on Tor is illegal,[1] I'm not sure the mail is really the appropriate analogy. [1] https://www.schneier.com/blog/archives/2016/02/survey_of_the_d.html https://www.schneier.com/blog/archives/2016/02/survey_of_the...
- lallysingh 11y ago
  Most of Tor usage is as a proxy back to the regular internet. I don't think you meant to, but the term "content on Tor" can be misleading in that respect, restricting the discussion to hidden services when the context is often Tor use in general.
- deleted 11y ago
  [deleted]
- woodman 11y ago
  I don't know why you wouldn't link directly to the paper, unless you're hoping that Schneier acknowledging its existence lends it some credibility. > most of the content Easily refuted: the authors had a spider crawl hidden services, which is laughably stupid. They claimed that there where 5,205 hidden services, of which 1,547 hosted illegal content. Another study [1], one which actually took advantage of network statistics, found the number of hidden services closer to 30,000. Also, well over 90% of Tor traffic is unrelated to any hidden services. So not most. As far as the analogy is concerned, hidden services would be more like the personal thoughts of the mailman - not the mail he is routing. [0] http://www.tandfonline.com/doi/abs/10.1080/00396338.2016.1142085 http://www.tandfonline.com/doi/abs/10.1080/00396338.2016.114... [1] https://research.torproject.org/techreports/extrapolating-hidserv-stats-2015-01-31.pdf https://research.torproject.org/techreports/extrapolating-hi...
  - deleted 11y ago
    [deleted]
- AnthonyMouse 11y ago
  Most email is spam. Most cash contains traces of drugs. Most BitTorrent content infringes copyright. Is that supposed to justify a raid of anyone who runs a mail server or pays in cash or torrents a Debian ISO? For that matter, given the whole Three Felonies a Day thing, most postal mail is in fact sent by criminals too. There is a reason we have a law against theft and not a law against crowbars.

spudfkc 11y ago

Isn't that exactly what those agencies want?

cortesoft 11y ago

Really, the only way for it to work is if everyone is an exit node.

AdmiralAsshat 11y ago

I seem to recall Mozilla talking about running some exit nodes. I wonder if that fizzled out under government or law-enforcement pressure.

cmrx64 11y ago
Relays, not exit nodes, and they still run them: https://globe.torproject.org/#/search/query=mozilla https://globe.torproject.org/#/search/query=mozilla

ianleeclark 11y ago

It's actually really sad because I was wanting to see if I could implement an exit node all by myself as a side proejct, but then I realized the potential danger I'd be putting myself in. Naturally, I'd have to host it to test it, so I had to throw this one to the way-side

dsmithatx 11y ago
You still can but, make sure you don't do it in your house. Even one of the operators said, I guess I should have rented a server for this. Not that I agree with the warrant however, I'm not putting my dog's and children's lives in danger.
- dsp1234 11y ago
  This is the advice given by a few people, but I'm not sure how valid it is. If the police have probable cause to search a server at a datacenter, then they would likely also have probable cause to search the computers of the owner's of those servers. In which case, we're back to 6am raids (probably done at the same time as the datacenter raid to prevent evidence tampering)
  - mirimir 11y ago
    Check out https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP... Find one that accepts Bitcoin. Use a pseudonym, and a throwaway email address. Find a plausible meatspace address and telephone number online. Maybe a hostel, business hotel, restaurant that just closed, etc.
- ianleeclark 11y ago
  Realistically the only way that I could test it is by whitelisting my home box, but this isn't entirely reasonable given that I wouldn't truly be testing it, as I wouldn't know for certain the kind of throughput it offers.
- noonespecial 11y ago

dublinben 11y ago

Best practices for running an exit node cover most of these concerns.[0] The most important one the individuals here didn't follow is 'don't run your relay from home.' A properly registered tor exit relay running in a datacenter somewhere will attract a courteous inquiry, rather than a 6am raid. [0]https://blog.torproject.org/running-exit-node https://blog.torproject.org/running-exit-node

guelo 11y ago
Yea but that means you have to spend extra money to run a Tor node, again limiting the amount of nodes that people are willing to run. The solution is for more people to run Tor, not fewer. Same with open Wifi nodes, the more the safer.
- dublinben 11y ago
  If you want to contribute with your home broadband connection, a bridge relay is more appropriate. You can run an exit relay for as little as $5/mo with a VPS.
  - walrus01 11y ago
    99% of all VPS providers (in the $5/mo category, not $75/mo) will kill your account for running an exit node. They do not want their blocks of ARIN, RIPE or APNIC ipv4 space listed in every abuse and spam swamp realtime black hole list in existence.
CaptSpify 11y ago
If you run it in a DC, don't you risk exposure to someone cloning it and getting the data you have stored on it? No, you shouldn't keep sensitive data on it, I know, but still could be cloned/compromised without you knowing, right?

djsumdog 11y ago

They thing is, they knew he was running a TOR node. They knew they wouldn't find anything. In a _real_ raid for suspected child porn, they confiscate all the equipment. If it's encrypted, you don't get it back (without the money to spend on good lawyers, and then it will be 6 months minimum. Without good lawyers, even if you're never charged, it will probably get wiped and auctioned off, because US police can confiscate anything they damn well please). There was another article, either here or slahdot or somewhere, talking about how there have been several of these TOR node raids. I doubt they even had any evidence of illegal material being downloaded. I think the FBI got all these local police departments to do this intentionally to scare people. The guy should have never turned over his passwords either. He would have lost his machine, but IIRC, the Seattle privacy group he's with decided to scrap those machines anyway since they couldn't be sure the PD didn't tamper with the tor server.

pjc50 11y ago

By running an exit node, you open yourself up to all sorts of legal actions This is not going to be popular here, but IMO this is actually reasonable: you ought to be aware that running an exit node is enabling all kinds of terrible behaviour. You can't just handwash your responsibility away from this. (No, this is not the same thing as providing encryption software, or general public chat forums etc)