> The high number of high-speed relays and exits in Germany mean that it is not too uncommon to get both a German guard and exit. This gives the state an easier

> The high number of high-speed relays and exits in Germany mean that it is not too uncommon to get both a German guard and exit. This gives the state an easier time if they want to target someone using traffic correlation attacks. No, it doesn't. They'd need to control those computers, and they don't, do they? Because if they do, then "move your exit node somewhere else" won't help, because "you" are the state. And if they don't, no, I don't believe it's feasible for them to look at raw traffic (e.g. on the datacenter level) for two nodes in Germany and correlate individual data streams that may or may not be from one TOR connection. > That also does not take in account the planned German law that will allow authorities to redirect traffic to state-owned servers, to infect users with viruses/Trojans. They'd have to control the server though. They can't just decree that all TOR traffic must now be routed through their malicious endpoint. The laws are targeting ISPs and service providers and are for individual cases (i.e. "we know who's on the line") not for mass-infection, and will require a court order. They could do the individual surveillance with court order previously, what's new is that the provider can be forced to cooperate and proxy the traffic. It's still not applicable to TOR because it's not one large provider, and you can generally not say who's on the line.