3 ms·

What is the risk of hosting an exit node? I have heard that you can be liable for facilitating illegal actions if yours gets used for it

somebodythere 7y ago
Hosting an exit node is not illegal (in the United States), and generally you cannot be held liable if the network was used for illegal actions as a consequence of being an exit node and not committed by you (this is not legal advice); however, you have to be able to prove that and it does not necessarily mean you are protected from being investigated, having your door kicked in, and/or your equipment seized.
- lucb1e 7y ago
  > being investigated, having your door kicked in, and/or your equipment seized. True and good to be aware of (upvoted), but I think it is fair to note that this is a very small number of cases. It's not small odds like "win the lottery" odds, but it's also not likely that it'll happen to you. Definitely something to be aware of and plan for (e.g. don't also use that server for important stuff, say, your email and website).
rocky1138 7y ago
It's best left to universities and other large organizations.
stordoff 7y ago
As I understand it, part of the risk is proving that you didn't perform the illegal act, and that an investigation itself can be damaging (loss of equipment/public reporting that you are being investigated for being involved in illegal behaviour). If you maintain a strict separation between your traffic/equipment and the exit node, this may be less of a risk, but is subject to the laws of your jurisdiction. > In the USA, there have been no equipment seizures due to Tor exits, but there have been phone calls and visits. In other countries, people have had all their home computing equipment seized for running an exit from their home internet connection. https://blog.torproject.org/tips-running-exit-node https://blog.torproject.org/tips-running-exit-node > Jan Bultmann and David Robinson, a married couple from Seattle and well-known privacy activists in that city, were awakened early one morning last month by police with a search warrant for their home. The detectives from the Seattle Police Department demanded passwords to access the couple's computers, saying they were investigating child abuse imagery [...] The couple consented to the search and gave their passwords to police, who found no child abuse imagery, didn't seize any equipment, and made no arrests. https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-tor-exit-node-raided-by-cops-investigating-child-abuse/ https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-t... > The operator of a Tor [exit node] used by someone to download a pornographic image of a minor has been given a three-month suspended prison sentence by an Austrian court for abetting access to pornographic images of minors [but chats show that he was aware of this use and did not disapprove, so this is not necessarily a general ruling] https://www.pcworld.com/article/2452320/tor-exit-node-operator-convicted-of-abetting-spread-of-child-porn.html https://www.pcworld.com/article/2452320/tor-exit-node-operat...
- burtonator 7y ago
  > that an investigation itself can be damaging This is the main part. It's extrajudicial punishment. TONS of governments engage in this behavior. This is why MJ as illegal for so long. It allowed the US to imprison 1M more minorities since the 80s.
  - notafraudster 7y ago
    I agree with the principle of your point re: marijuana in specific -- it was often used as a way to stack charges, and especially in a racialized way. But I'm not sure it applies here. Clearly if the US is investigating a serious computer crime that came from your server, they can't take it on your say-so that it actually came from somewhere else. They need to be able to investigate. And typically for forensic reasons that's going to involve an infrastructure seizure. Now, the failure to return infrastructure over a long period of time is more extrajudicial punishment, and they do that too sometimes. Lots of people haven't gotten laptops back for years via this.
    - tgsovlerkhgsel 7y ago
      Publicizing unproven charges, and allowing "mugshot extortion"-style web sites to operate, is a large part of this. In many other countries, crime reporting has to happen in an anonymized way until conviction.
tgsovlerkhgsel 7y ago
The best/safest way to do so is to found a company/club/... that operates the node. The goal here isn't to hide who runs it, it's to make sure that the police find someone who understands what Tor is before they find whose _home_ to raid. When there's bomb threats, child porn, or other illegal activity coming from your home IP, you're going to get raided before you get to explain what a Tor node is. When that stuff is coming from a server that you personally have rented, you're probably going to get raided before you get to explain what a Tor node is. When that stuff is coming from a server that a company, student club, or similar has rented, suddenly brains are required to be switched on since there isn't an "obvious culprit", and it's unlikely that they'll start raiding the private homes of random members or organizers. Not impossible, but significantly less likely. The office address of the company/club is at the highest risk, but if that's "digital freedom club, computer science department building, university road 17, biguniversity" that's not necessarily a big problem. A raid at the office address would already be the exception, not the rule, but if you can make sure that a raid happening wouldn't be more than a minor annoyance, do it. For non-exit nodes, just run them wherever you feel like, as long as you're OK with the traffic and the risk that some people will treat the IP as "not reputable". Anyone who finds the IP of the node will by necessity have an idea how Tor works and understand that the node is not the origin of the traffic.

somebodythere 7y ago

Hosting an exit node is not illegal (in the United States), and generally you cannot be held liable if the network was used for illegal actions as a consequence of being an exit node and not committed by you (this is not legal advice); however, you have to be able to prove that and it does not necessarily mean you are protected from being investigated, having your door kicked in, and/or your equipment seized.

lucb1e 7y ago
> being investigated, having your door kicked in, and/or your equipment seized. True and good to be aware of (upvoted), but I think it is fair to note that this is a very small number of cases. It's not small odds like "win the lottery" odds, but it's also not likely that it'll happen to you. Definitely something to be aware of and plan for (e.g. don't also use that server for important stuff, say, your email and website).

rocky1138 7y ago

It's best left to universities and other large organizations.

stordoff 7y ago

As I understand it, part of the risk is proving that you didn't perform the illegal act, and that an investigation itself can be damaging (loss of equipment/public reporting that you are being investigated for being involved in illegal behaviour). If you maintain a strict separation between your traffic/equipment and the exit node, this may be less of a risk, but is subject to the laws of your jurisdiction. > In the USA, there have been no equipment seizures due to Tor exits, but there have been phone calls and visits. In other countries, people have had all their home computing equipment seized for running an exit from their home internet connection. https://blog.torproject.org/tips-running-exit-node https://blog.torproject.org/tips-running-exit-node > Jan Bultmann and David Robinson, a married couple from Seattle and well-known privacy activists in that city, were awakened early one morning last month by police with a search warrant for their home. The detectives from the Seattle Police Department demanded passwords to access the couple's computers, saying they were investigating child abuse imagery [...] The couple consented to the search and gave their passwords to police, who found no child abuse imagery, didn't seize any equipment, and made no arrests. https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-tor-exit-node-raided-by-cops-investigating-child-abuse/ https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-t... > The operator of a Tor [exit node] used by someone to download a pornographic image of a minor has been given a three-month suspended prison sentence by an Austrian court for abetting access to pornographic images of minors [but chats show that he was aware of this use and did not disapprove, so this is not necessarily a general ruling] https://www.pcworld.com/article/2452320/tor-exit-node-operator-convicted-of-abetting-spread-of-child-porn.html https://www.pcworld.com/article/2452320/tor-exit-node-operat...

burtonator 7y ago
> that an investigation itself can be damaging This is the main part. It's extrajudicial punishment. TONS of governments engage in this behavior. This is why MJ as illegal for so long. It allowed the US to imprison 1M more minorities since the 80s.
- notafraudster 7y ago
  I agree with the principle of your point re: marijuana in specific -- it was often used as a way to stack charges, and especially in a racialized way. But I'm not sure it applies here. Clearly if the US is investigating a serious computer crime that came from your server, they can't take it on your say-so that it actually came from somewhere else. They need to be able to investigate. And typically for forensic reasons that's going to involve an infrastructure seizure. Now, the failure to return infrastructure over a long period of time is more extrajudicial punishment, and they do that too sometimes. Lots of people haven't gotten laptops back for years via this.
  - tgsovlerkhgsel 7y ago
    Publicizing unproven charges, and allowing "mugshot extortion"-style web sites to operate, is a large part of this. In many other countries, crime reporting has to happen in an anonymized way until conviction.

tgsovlerkhgsel 7y ago

The best/safest way to do so is to found a company/club/... that operates the node. The goal here isn't to hide who runs it, it's to make sure that the police find someone who understands what Tor is before they find whose _home_ to raid. When there's bomb threats, child porn, or other illegal activity coming from your home IP, you're going to get raided before you get to explain what a Tor node is. When that stuff is coming from a server that you personally have rented, you're probably going to get raided before you get to explain what a Tor node is. When that stuff is coming from a server that a company, student club, or similar has rented, suddenly brains are required to be switched on since there isn't an "obvious culprit", and it's unlikely that they'll start raiding the private homes of random members or organizers. Not impossible, but significantly less likely. The office address of the company/club is at the highest risk, but if that's "digital freedom club, computer science department building, university road 17, biguniversity" that's not necessarily a big problem. A raid at the office address would already be the exception, not the rule, but if you can make sure that a raid happening wouldn't be more than a minor annoyance, do it. For non-exit nodes, just run them wherever you feel like, as long as you're OK with the traffic and the risk that some people will treat the IP as "not reputable". Anyone who finds the IP of the node will by necessity have an idea how Tor works and understand that the node is not the origin of the traffic.