5 ms·

I'm not sure how a Tor exit node could operate legally. Tor is widely used for illegal activities. Like drug sales and CSE media. If a government goes on Tor, d

I'm not sure how a Tor exit node could operate legally. Tor is widely used for illegal activities. Like drug sales and CSE media. If a government goes on Tor, downloads such material they'll easily see the exit node as the last hop in the chain. It's a clear-cut case that the exit node operator facilitated illegal activity. My assumption is that Germany has some sort of common-carrier privileges for Tor node operators. In America, telecoms can't be sued for facilitating illegal activity. But they do have to assist law enforcement with finding criminals when requested. Would be happy to hear from someone who is more knowledgeable in this area.

Hizonner 2y ago
> I'm not sure how a Tor exit node could operate legally. Tor is widely used for illegal activities. How do ISPs operate legally? Every single thing that's ever been done over a Tor relay has crossed multiple ISPs.
- Manuel_D 2y ago
  > How do ISPs operate legally? I described exactly that in my second paragraph.
  - Hizonner 2y ago
    Tor relay operators are, as a rule, entirely willing to give law enforcement all the information they have about connections that have gone through their relays. They simply don't have any. And there's no legal requirement for them to have any. ... or at least there never was in the past. The new wave of stupid and extremely broad "duty of care" laws that try to apply to the design of any and every communication service may change that. But it hasn't been litigated anywhere.
    - bawolff 2y ago
      The original post mentioned facilitation, which from what i understand is when you assist comitting a crime but have no secific knowledge of the crime. I imagine for tor, the reason is that there are also good uses for tor. However i dont think "i intentionally know nothing" works as a defence in general. Ianal
      - Hizonner 2y ago
        I was answering something about assistance to law enforcement, which isn't the same issue as facilitation of crime. "Facilitation" as an offense in itself is one of those things that tends to be a real thing, but varies a lot depending on the jurisdiction. In most places, most of the time, you're only going to get in trouble for facilitating crime if your service is especially set up to be unusually useful for crime. You're especially vulnerable if you specifically designed it for crime. If those things apply, then knowing it's being used for crime (but not necessarily on which specific occasions) can make it worse for you. Give or take, depending on where you live. In the past, Tor nodes, even exit nodes, have mostly gotten a pass, at least in countries where most of them are located. They get raided all the time, but largely as cases of mistaken identity. That's probably because most Tor traffic has historically probably been people trying to hide from ad tracking or people worried about their perfectly legal activities being spied on. So it's hard to say the service is really aimed at illegal activity. Things are tightening up worldwide, in statute and probably in case law, mostly because of Tor and other services possibly being swept in by standards primarily aimed at social media. We may start seeing Tor nodes targeted because Tor is now considered "too adapted to legal activity", or even because node operators are "not doing enough to prevent" illegal activity (including redesigning the system if necessary). But until fairly recently that's been more what you'd expect to see in North Korea than what you'd expect to see in Germany (or the US).
    - Manuel_D 2y ago
      Whether or not the exit node operators retained logs is besides the point. These exit nodes are facilitating illegal activities, and it's trivial to prove. How do they not get arrested? It sounds like Germany extends some sort of carrier protection to Tor exit node operators. E.g. if someone organizes a drug deal over the phone, Verizon is not liable. But Verizon does have to meet some minimum standards of records keeping and law enforcement assistance (wire tapping).
      - lokar 2y ago
        Lots of people and organizations facilitate crime. That’s not generally the legal standard. They typically must be proved to done so intentionally (or with reckless disregard)
        numpad0 2y ago
        No, it is. There are more often specific laws that exempt platformers of liabilities on condition that they keep logs and cooperate with LE. Perhaps the most famous example is DMCA: [Google] is exempt from liabilities for hosting pirated movies on [YouTube] by US laws, on condition that it's not actively involved with it and fully robotic with takedowns.
        golergka 2y ago
        If a criminal rode on a bus to place of the crime, is the bus driver automatically liable? Bus company? Is his phone company liable because he talked about his crimes on the phone?
        betaby 2y ago
        No. But legal system treats 'on the Internet' in a more harshly way.
        numpad0 2y ago
        IANAL, but "legally"? Bus companies has code of conduct posted on the wall at their depot for its users to read and agree, or state law regulating public transportation, and it always says using it for crimes is against the law. Those clauses let drivers and companies frame themselves as victims to escape prosecutions, unless there's going to be gross negligence or sorts that override them. It's not like courts treat popular businesses like buses and ISPs as sceneries just by gut feeling. There are always laws.
  - RobRivera 2y ago
    What law mandates forced compliance outside subpoenas?
    - Manuel_D 2y ago
      Communications act of 1934, among others: https://en.wikipedia.org/wiki/Communications_Act_of_1934#Wiretapping https://en.wikipedia.org/wiki/Communications_Act_of_1934#Wir...
      - RobRivera 2y ago
        Both the communication acts of 34 and 96(?) Do not require software operators to legally do what LEO tells them to do without subpoena.
        Manuel_D 2y ago
        The question was about ISPs.
        RobRivera 2y ago
        You are quite literally telling me what question I asked. How do you expect further fruitful dialogue?
- tensor 2y ago
  ISPs cooperate with law enforcement and often happily give out the information for people doing illegal things on their networks. I realize that operators of Tor exit nodes likely can't help track people on the Tor exit nodes, but I doubt law enforcement cares, they just see it as "not helping" while they see ISPs as "helping."
  - Hizonner 2y ago
    Courts, and even law enforcement, are actually smart enough to know that they have to enforce the laws as written and that they can't just act on their feels. At least most of the time. In many places.
    - beaglesss 2y ago
      They can't say they're breaking the law but as long as they don't admit to wrongdoing they can accomplish the goal of picking up pretty much anyone for something.. It's best to assume the government is a hostile, rabid actor who will seize any reachable assets and your freedom at any point they wish and proceed accordingly.
    - hnbad 2y ago
      FWIW this is more of a concern if you expect the case to go to court. In the US most "criminals" accept plea bargains without a court ever seeing the case. So statistically you can likely "act on your feels" as long as the suspect does not think they can prove you wrong in a court of law (whether it's because they're guilty, because they don't fully understand the law or because they can't afford the time and money involved in a court process).
  - deleted 2y ago
    [deleted]
  - varenc 2y ago
    The core question here is w whether law enforcement actually believes, incorrectly, that the exit node operators are being intentionally unhelpful, or if they understand that due to Tor’s design the exit node operators have no valuable information but the police continue to raid them anyway as a scare tactic.
ponorin 2y ago
Exit node applies only to traffic that goes into a clearnet. You could to illegal stuff, but only tor users have protection and website owners are liable to raids should they allow illegal stuff to happen on their platforms. With Tor Hidden Service there's no exit node as such since traffic terminates inside the Tor network. The networking route is doubly anonymized so both the server and the client can't track each other down.
- Manuel_D 2y ago
  Perhaps I'm not understanding something. I'm imagining this scenario: 1. Bob is running a Tor exit node. 2. Charlie is a government official investigating illegal content (use your imagination) 3. Charlie downloads illegal content via Tor 4. This content is sent to Charlie from Bob's exit node. 5. Charlie observes that Bob's exit node sent him illegal content. I understand that even if Bob is raided and his computer searched, they cannot find the website hosting the illegal content. But Charlie would know that Bob helped deliver the illegal content. Tor Hidden Service does not anonymize the exit node from the client.
  - varenc 2y ago
    Your mixing up general Tor use vs Tor hidden services. With hidden services there’s not really an exit node because the traffic never exits the Tor network. Charlie could only see the machine in the final step of requesting the illegal content it Charlie was hosting the hidden service themselves. These requests can come from many different Tor operators not just exit nodes.
    - Manuel_D 2y ago
      To be clear, Bob is not the host of the illegal content. Bob is just the second-to-last hop before the content reaches the end destination (Charlie). My understanding of the tor network is that it obfuscates traffic across many hops. The path content takes from the host to Charlie: Host -> Node 1 -> Node 2 -> ... Bob -> Charlie this obfuscates the Host from Charlie. But Charlie knows that Bob sent him illegal content. Yes, Bob didn't host the content. The host is obfuscated. But Bob is still delivering illegal content and Charlie knows it.
RobRivera 2y ago
>it's a clear-cut case that the exit node operator facilitated illegal activity. If someone leveraged your employment services to commit crime, would you consider yourself having facilitated illegal activity?
- Manuel_D 2y ago
  My past employers have had to scramble to prevent things like hackers using their service for C&C, malware distribution, etc. Companies usually have to meet some minimum standard to enjoy immunity from liability for abuse of their services. Telecoms need to retain logs, know the identity of their customers, and assist with government wiretapping for example.
bawolff 2y ago
IANAL, but i imagine it comes down to how many legit purposes tor has vs the illegal ones. I have no idea where the line is, but like we dont charge art supply stores with facilitating forgery, so some amount of bad usage is clearly acceptable.
- RobRivera 2y ago
  Well the great thing about U.S.C is that you don't have to imagine, you can read the docs. Measure of purposes, 'legit or otherwise', is not a law for anything ever.
  - bawolff 2y ago
    Fun fact, usc does not apply to germany where the article is about. But regardless, in both systems i am very certain your purpose ("intent") matters a lot. (Details depend on the specific crime in question)
    - beaglesss 2y ago
      All sorts of foreigners have been extradited for supposedly violating USC despite never stepping foot in America. They could argue the node operator facilitated money laundering that touched a US bank, that they conspired with a US person, a US CSAM victims likeness went through the node, etc etc. USC has extraterritorial power about everywhere but NK, Russia, and Iran either formally or through influence.
      - bawolff 2y ago
        Normally extradition requires the activity to be a crime in both juridsictions.
        ruthmarx 2y ago
        Not when the US asks.
    - 2y ago
codexb 2y ago
You can make the same argument for developers of encryption. There are legitimate reasons for privacy. The fact that criminals want privacy, too, doesn't mean privacy should be illegal.
- mminer237 2y ago
  The difference is that with Tor you are physically downloading CSAM and forwarding it on to the offender. With encryption you're just providing tools for them to hide material.
- deleted 2y ago
  [deleted]
Zak 2y ago
It operates legally because there isn't a law against it in the jurisdiction in which it operates. What part are you surprised isn't forbidden? The part where it accepts connections anonymously? The part where data is encrypted in transit? Exit node operators, like telecoms can be required to tell law enforcement everything they know about a user. The difference is they don't know anything of value.

Hizonner 2y ago

> I'm not sure how a Tor exit node could operate legally. Tor is widely used for illegal activities. How do ISPs operate legally? Every single thing that's ever been done over a Tor relay has crossed multiple ISPs.

Manuel_D 2y ago
> How do ISPs operate legally? I described exactly that in my second paragraph.
- Hizonner 2y ago
  Tor relay operators are, as a rule, entirely willing to give law enforcement all the information they have about connections that have gone through their relays. They simply don't have any. And there's no legal requirement for them to have any. ... or at least there never was in the past. The new wave of stupid and extremely broad "duty of care" laws that try to apply to the design of any and every communication service may change that. But it hasn't been litigated anywhere.
  - bawolff 2y ago
    The original post mentioned facilitation, which from what i understand is when you assist comitting a crime but have no secific knowledge of the crime. I imagine for tor, the reason is that there are also good uses for tor. However i dont think "i intentionally know nothing" works as a defence in general. Ianal
    - Hizonner 2y ago
      I was answering something about assistance to law enforcement, which isn't the same issue as facilitation of crime. "Facilitation" as an offense in itself is one of those things that tends to be a real thing, but varies a lot depending on the jurisdiction. In most places, most of the time, you're only going to get in trouble for facilitating crime if your service is especially set up to be unusually useful for crime. You're especially vulnerable if you specifically designed it for crime. If those things apply, then knowing it's being used for crime (but not necessarily on which specific occasions) can make it worse for you. Give or take, depending on where you live. In the past, Tor nodes, even exit nodes, have mostly gotten a pass, at least in countries where most of them are located. They get raided all the time, but largely as cases of mistaken identity. That's probably because most Tor traffic has historically probably been people trying to hide from ad tracking or people worried about their perfectly legal activities being spied on. So it's hard to say the service is really aimed at illegal activity. Things are tightening up worldwide, in statute and probably in case law, mostly because of Tor and other services possibly being swept in by standards primarily aimed at social media. We may start seeing Tor nodes targeted because Tor is now considered "too adapted to legal activity", or even because node operators are "not doing enough to prevent" illegal activity (including redesigning the system if necessary). But until fairly recently that's been more what you'd expect to see in North Korea than what you'd expect to see in Germany (or the US).
  - Manuel_D 2y ago
    Whether or not the exit node operators retained logs is besides the point. These exit nodes are facilitating illegal activities, and it's trivial to prove. How do they not get arrested? It sounds like Germany extends some sort of carrier protection to Tor exit node operators. E.g. if someone organizes a drug deal over the phone, Verizon is not liable. But Verizon does have to meet some minimum standards of records keeping and law enforcement assistance (wire tapping).
    - lokar 2y ago
      Lots of people and organizations facilitate crime. That’s not generally the legal standard. They typically must be proved to done so intentionally (or with reckless disregard)
      - numpad0 2y ago
        No, it is. There are more often specific laws that exempt platformers of liabilities on condition that they keep logs and cooperate with LE. Perhaps the most famous example is DMCA: [Google] is exempt from liabilities for hosting pirated movies on [YouTube] by US laws, on condition that it's not actively involved with it and fully robotic with takedowns.
        golergka 2y ago
        If a criminal rode on a bus to place of the crime, is the bus driver automatically liable? Bus company? Is his phone company liable because he talked about his crimes on the phone?
        betaby 2y ago
        No. But legal system treats 'on the Internet' in a more harshly way.
        numpad0 2y ago
        IANAL, but "legally"? Bus companies has code of conduct posted on the wall at their depot for its users to read and agree, or state law regulating public transportation, and it always says using it for crimes is against the law. Those clauses let drivers and companies frame themselves as victims to escape prosecutions, unless there's going to be gross negligence or sorts that override them. It's not like courts treat popular businesses like buses and ISPs as sceneries just by gut feeling. There are always laws.
- RobRivera 2y ago
  What law mandates forced compliance outside subpoenas?
  - Manuel_D 2y ago
    Communications act of 1934, among others: https://en.wikipedia.org/wiki/Communications_Act_of_1934#Wiretapping https://en.wikipedia.org/wiki/Communications_Act_of_1934#Wir...
    - RobRivera 2y ago
      Both the communication acts of 34 and 96(?) Do not require software operators to legally do what LEO tells them to do without subpoena.
      - Manuel_D 2y ago
        The question was about ISPs.
        RobRivera 2y ago
        You are quite literally telling me what question I asked. How do you expect further fruitful dialogue?
tensor 2y ago
ISPs cooperate with law enforcement and often happily give out the information for people doing illegal things on their networks. I realize that operators of Tor exit nodes likely can't help track people on the Tor exit nodes, but I doubt law enforcement cares, they just see it as "not helping" while they see ISPs as "helping."
- Hizonner 2y ago
  Courts, and even law enforcement, are actually smart enough to know that they have to enforce the laws as written and that they can't just act on their feels. At least most of the time. In many places.
  - beaglesss 2y ago
    They can't say they're breaking the law but as long as they don't admit to wrongdoing they can accomplish the goal of picking up pretty much anyone for something.. It's best to assume the government is a hostile, rabid actor who will seize any reachable assets and your freedom at any point they wish and proceed accordingly.
  - hnbad 2y ago
    FWIW this is more of a concern if you expect the case to go to court. In the US most "criminals" accept plea bargains without a court ever seeing the case. So statistically you can likely "act on your feels" as long as the suspect does not think they can prove you wrong in a court of law (whether it's because they're guilty, because they don't fully understand the law or because they can't afford the time and money involved in a court process).
- deleted 2y ago
  [deleted]
- varenc 2y ago
  The core question here is w whether law enforcement actually believes, incorrectly, that the exit node operators are being intentionally unhelpful, or if they understand that due to Tor’s design the exit node operators have no valuable information but the police continue to raid them anyway as a scare tactic.

ponorin 2y ago

Exit node applies only to traffic that goes into a clearnet. You could to illegal stuff, but only tor users have protection and website owners are liable to raids should they allow illegal stuff to happen on their platforms. With Tor Hidden Service there's no exit node as such since traffic terminates inside the Tor network. The networking route is doubly anonymized so both the server and the client can't track each other down.

Manuel_D 2y ago
Perhaps I'm not understanding something. I'm imagining this scenario: 1. Bob is running a Tor exit node. 2. Charlie is a government official investigating illegal content (use your imagination) 3. Charlie downloads illegal content via Tor 4. This content is sent to Charlie from Bob's exit node. 5. Charlie observes that Bob's exit node sent him illegal content. I understand that even if Bob is raided and his computer searched, they cannot find the website hosting the illegal content. But Charlie would know that Bob helped deliver the illegal content. Tor Hidden Service does not anonymize the exit node from the client.
- varenc 2y ago
  Your mixing up general Tor use vs Tor hidden services. With hidden services there’s not really an exit node because the traffic never exits the Tor network. Charlie could only see the machine in the final step of requesting the illegal content it Charlie was hosting the hidden service themselves. These requests can come from many different Tor operators not just exit nodes.
  - Manuel_D 2y ago
    To be clear, Bob is not the host of the illegal content. Bob is just the second-to-last hop before the content reaches the end destination (Charlie). My understanding of the tor network is that it obfuscates traffic across many hops. The path content takes from the host to Charlie: Host -> Node 1 -> Node 2 -> ... Bob -> Charlie this obfuscates the Host from Charlie. But Charlie knows that Bob sent him illegal content. Yes, Bob didn't host the content. The host is obfuscated. But Bob is still delivering illegal content and Charlie knows it.

RobRivera 2y ago

>it's a clear-cut case that the exit node operator facilitated illegal activity. If someone leveraged your employment services to commit crime, would you consider yourself having facilitated illegal activity?

Manuel_D 2y ago
My past employers have had to scramble to prevent things like hackers using their service for C&C, malware distribution, etc. Companies usually have to meet some minimum standard to enjoy immunity from liability for abuse of their services. Telecoms need to retain logs, know the identity of their customers, and assist with government wiretapping for example.

bawolff 2y ago

IANAL, but i imagine it comes down to how many legit purposes tor has vs the illegal ones. I have no idea where the line is, but like we dont charge art supply stores with facilitating forgery, so some amount of bad usage is clearly acceptable.

RobRivera 2y ago
Well the great thing about U.S.C is that you don't have to imagine, you can read the docs. Measure of purposes, 'legit or otherwise', is not a law for anything ever.
- bawolff 2y ago
  Fun fact, usc does not apply to germany where the article is about. But regardless, in both systems i am very certain your purpose ("intent") matters a lot. (Details depend on the specific crime in question)
  - beaglesss 2y ago
    All sorts of foreigners have been extradited for supposedly violating USC despite never stepping foot in America. They could argue the node operator facilitated money laundering that touched a US bank, that they conspired with a US person, a US CSAM victims likeness went through the node, etc etc. USC has extraterritorial power about everywhere but NK, Russia, and Iran either formally or through influence.
    - bawolff 2y ago
      Normally extradition requires the activity to be a crime in both juridsictions.
      - ruthmarx 2y ago
        Not when the US asks.
  - 2y ago

codexb 2y ago

You can make the same argument for developers of encryption. There are legitimate reasons for privacy. The fact that criminals want privacy, too, doesn't mean privacy should be illegal.

mminer237 2y ago
The difference is that with Tor you are physically downloading CSAM and forwarding it on to the offender. With encryption you're just providing tools for them to hide material.
deleted 2y ago
[deleted]

Zak 2y ago

It operates legally because there isn't a law against it in the jurisdiction in which it operates. What part are you surprised isn't forbidden? The part where it accepts connections anonymously? The part where data is encrypted in transit? Exit node operators, like telecoms can be required to tell law enforcement everything they know about a user. The difference is they don't know anything of value.