4 ms·

Your mixing up general Tor use vs Tor hidden services. With hidden services there’s not really an exit node because the traffic never exits the Tor network. C

by varenc 2y ago

Your mixing up general Tor use vs Tor hidden services. With hidden services there’s not really an exit node because the traffic never exits the Tor network. Charlie could only see the machine in the final step of requesting the illegal content it Charlie was hosting the hidden service themselves. These requests can come from many different Tor operators not just exit nodes.

Manuel_D 2y ago
To be clear, Bob is not the host of the illegal content. Bob is just the second-to-last hop before the content reaches the end destination (Charlie). My understanding of the tor network is that it obfuscates traffic across many hops. The path content takes from the host to Charlie: Host -> Node 1 -> Node 2 -> ... Bob -> Charlie this obfuscates the Host from Charlie. But Charlie knows that Bob sent him illegal content. Yes, Bob didn't host the content. The host is obfuscated. But Bob is still delivering illegal content and Charlie knows it.
- aniviacat 2y ago
  Exit nodes are not the nodes that are directly facing tor users. Those nodes are called "Guard Relays". Guard Relays usually don't have these issues, since you have to be somewhat technical to actively probe relays by requesting content through tor. And technical people know there isn't any point to rading an operator's home.
- fn-mote 2y ago
  > Bob is still delivering illegal content and Charlie knows it Does BOB know they are delivering illegal content? No... is it even possible to send unencrypted traffic by Tor? If it's even possible, Charlie must be the only person in the world doing it.
  - Manuel_D 2y ago
    > Does BOB know they are delivering illegal content? He does when Charlie knocks on his door and informs him that he delivered CSE to him. Ignorance of the fact that one is breaking the law is rarely accepted as a defense. Carriers usually get this protection when when meet some standards of safeguards and cooperation with law enforcement.
    - Zak 2y ago
      Ignorance of the law is not generally accepted as a legal defense, but ignorance of facts is. Most crimes involve a mental state of knowledge or intent with respect to the wrongdoing, and an exit node operator does not know what users are accessing. Taking the wrong jacket by mistake is not theft, and operating the exit node through which someone downloads CSAM is not criminal possession of CSAM or knowing facilitation thereof.
      - Manuel_D 2y ago
        Do you think drug mules get off scot-free when they say "I didn't know what was in that package"?
        Zak 2y ago
        If the prosecutor can't convince the jury that they did know, yes. That rarely happens in practice because prosecutors are usually pretty good at their jobs, and tend not to bring cases they can't prove.
        Manuel_D 2y ago
        The prosecutor doesn't need to definitively prove that the mule knew he was transporting drugs. Only that a reasonable person should have known. Back to our Tor example: if you've been repeatedly told by the government that your node is being used for illegal activity, it's hard to plead ignorance.
        Zak 2y ago
        You've described the legal mental state of negligence, and it's true that some crimes use it. Some jurisdictions have "criminally negligent homicide" as a crime with a lower penalty than manslaughter (reckless homicide) for example. A look at federal drug distribution statutes in the USA[0] shows the mental state used for most of the forbidden acts is "intentionally" or "knowingly". Other jurisdictions could have different laws, but in the USA, it does appear the prosecutor has to prove that a drug mule knew what they were doing. Similarly, the federal statute in the USA criminalizing distribution and transmission of child pornography[1] says "knowingly". Someone operating an ISP, an internet router, a VPN, or an exit node has no obligation (and often no ability) to inspect the data they're transmitting to find out if it contains child pornography, and knowing that there's a certain probability a given amount of random traffic contains some does not trigger criminal liability because the operator does not know that any particular data is child pornography. In another comment you mentioned that ISPs can aid law enforcement because they know details about their customers. They usually do for billing purposes, but in many jurisdictions they're not required to. There is not, to my knowledge a KYC law in the USA for providing internet service. [0] https://www.law.cornell.edu/uscode/text/21/841 https://www.law.cornell.edu/uscode/text/21/841 [1] https://www.law.cornell.edu/uscode/text/18/2252A https://www.law.cornell.edu/uscode/text/18/2252A

by varenc 2y ago

Manuel_D 2y ago

To be clear, Bob is not the host of the illegal content. Bob is just the second-to-last hop before the content reaches the end destination (Charlie). My understanding of the tor network is that it obfuscates traffic across many hops. The path content takes from the host to Charlie: Host -> Node 1 -> Node 2 -> ... Bob -> Charlie this obfuscates the Host from Charlie. But Charlie knows that Bob sent him illegal content. Yes, Bob didn't host the content. The host is obfuscated. But Bob is still delivering illegal content and Charlie knows it.

aniviacat 2y ago
Exit nodes are not the nodes that are directly facing tor users. Those nodes are called "Guard Relays". Guard Relays usually don't have these issues, since you have to be somewhat technical to actively probe relays by requesting content through tor. And technical people know there isn't any point to rading an operator's home.
fn-mote 2y ago
> Bob is still delivering illegal content and Charlie knows it Does BOB know they are delivering illegal content? No... is it even possible to send unencrypted traffic by Tor? If it's even possible, Charlie must be the only person in the world doing it.
- Manuel_D 2y ago
  > Does BOB know they are delivering illegal content? He does when Charlie knocks on his door and informs him that he delivered CSE to him. Ignorance of the fact that one is breaking the law is rarely accepted as a defense. Carriers usually get this protection when when meet some standards of safeguards and cooperation with law enforcement.
  - Zak 2y ago
    Ignorance of the law is not generally accepted as a legal defense, but ignorance of facts is. Most crimes involve a mental state of knowledge or intent with respect to the wrongdoing, and an exit node operator does not know what users are accessing. Taking the wrong jacket by mistake is not theft, and operating the exit node through which someone downloads CSAM is not criminal possession of CSAM or knowing facilitation thereof.
    - Manuel_D 2y ago
      Do you think drug mules get off scot-free when they say "I didn't know what was in that package"?
      - Zak 2y ago
        If the prosecutor can't convince the jury that they did know, yes. That rarely happens in practice because prosecutors are usually pretty good at their jobs, and tend not to bring cases they can't prove.
        Manuel_D 2y ago
        The prosecutor doesn't need to definitively prove that the mule knew he was transporting drugs. Only that a reasonable person should have known. Back to our Tor example: if you've been repeatedly told by the government that your node is being used for illegal activity, it's hard to plead ignorance.
        Zak 2y ago
        You've described the legal mental state of negligence, and it's true that some crimes use it. Some jurisdictions have "criminally negligent homicide" as a crime with a lower penalty than manslaughter (reckless homicide) for example. A look at federal drug distribution statutes in the USA[0] shows the mental state used for most of the forbidden acts is "intentionally" or "knowingly". Other jurisdictions could have different laws, but in the USA, it does appear the prosecutor has to prove that a drug mule knew what they were doing. Similarly, the federal statute in the USA criminalizing distribution and transmission of child pornography[1] says "knowingly". Someone operating an ISP, an internet router, a VPN, or an exit node has no obligation (and often no ability) to inspect the data they're transmitting to find out if it contains child pornography, and knowing that there's a certain probability a given amount of random traffic contains some does not trigger criminal liability because the operator does not know that any particular data is child pornography. In another comment you mentioned that ISPs can aid law enforcement because they know details about their customers. They usually do for billing purposes, but in many jurisdictions they're not required to. There is not, to my knowledge a KYC law in the USA for providing internet service. [0] https://www.law.cornell.edu/uscode/text/21/841 https://www.law.cornell.edu/uscode/text/21/841 [1] https://www.law.cornell.edu/uscode/text/18/2252A https://www.law.cornell.edu/uscode/text/18/2252A