4 ms·

I suppose my issue stems from my perception of the seemingly lack of serious investigation on their law enforcement side. If you had visited any of my exit nod

by edm0nd 2y ago

I suppose my issue stems from my perception of the seemingly lack of serious investigation on their law enforcement side. If you had visited any of my exit nodes via port 80 or 443, I had a lander on them stating that it was a Tor exit node and to please contact me if you wanted your IP to be blacklisted from it. I also stated that there was no useful information contained on this server (by design) that would be helpful for any evidence gathering or investigations. Seriously, all they had to do was plug my IP into a browser or do a simple scan of it but I suppose that's asking too much from LE lol. Additionally, Tor exit nodes are public and all they had to do was look into my IP more than 5 seconds after finding it in logs somewhere and firing off a warrant or subpoena for it. The first two were straight up vague templated fishing expeditions. The 3rd subpoena actually came straight from the DOJ and was a lot more detailed and serious. They should know what Tor is and know that any Tor server contains ZERO info that would be able to assist them in whatever they are attempting to investigate. Sure, I do think such situations require follow-up but as soon as they are informed it's a Tor ip, they should know to drop any pursuit of getting evidence from it. They do not, they continue to go after you via legal means. Even though I had the EFFs help, this entire process still took months. It's pretty stressful to be in a situation where its lil ole me VS the entire United States government who has unlimited resources, time, and money to go after you. I am extremely blessed to have had the EFF lawyers at my defense and will forever be a life long supporter and donor to them. They really do fight for our digital rights and can help defend you in a digital equivalent of a David versus Goliath situation.

shadowgovt 2y ago
> Seriously, all they had to do was plug my IP into a browser or do a simple scan of it but I suppose that's asking too much from LE lol. I mean, yes, I'm pretty sure "just take my word for it" is asking too much of LE. We can always say "Come back with a warrant" but then sometimes they'll come back with a warrant. > They should know what Tor is and know that any Tor server contains ZERO info Unless, of course, one has misconfigured it... Which could be the case. Definitely the kind of thing LEO can figure out on the other side of a seize-and-strip of the hardware. Unfortunately, I think the only way to not be a part of the story here is to not be a part of the story here... Don't proxy anonymous traffic if you don't want law enforcement asking after the anonymous traffic you proxied. Otherwise, expect the responsibility imposed upon a service provider (since you're providing a service). Other ISPs avoid this scrutiny by going out of their way to be helpful to law enforcement.
- edm0nd 2y ago
  Yup that's the same conclusion that I've come to for now. I got a family and stuffs now so don't want to bring any stress to them. One day I will resume but in the future :)
- zadokshi 2y ago
  There is no way for police to know if the traffic came through tor, or was initiated by the owner of computer/server. It seems reasonable that the police have the right to investigate. If not, anyone could run a tor node to cover up their own criminal activities. Even if you did have logs suggesting it was tor activity, should we trust someone’s claim that the logs are proof that it was someone else? It would in fact be negligent if the police did not properly investigate the server/computer/house of the device.
madars 2y ago
Maybe they did not expect any useful info? One gets jaded but https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...
- fn-mote 2y ago
  That isn't the reading I would make of the situation. Like the OP says, it's harrassment to discourage continued operation.
  - jacobgkau 2y ago
    I think that's what the person you replied to was saying. The purpose of the "system" of law enforcement is not what they say it is (to try and gather evidence from the server), but rather is what the system does (get people to shut down exit nodes because of the hassle).
cortesoft 2y ago
The end goal is probably to get you to do what you did, which is shut down the exit node. If they make it painful to run a Tor exit node, they make Tor harder to use.
- lolinder 2y ago
  Exactly. Which is not as obviously an unethical approach as some here would think—if you are standing between law enforcement and a bomb threat, "I'm intentionally ignorant of the activities of the people that I'm shielding" is a morally dubious place to stand. The law allows law enforcement to subpoena records related to an investigation like this, and I honestly think it's fair to force Tor exit node operators to handle those subpoenas every time, even if the answer is always the same. To have some sort of automated process in place to deflect blame allows an exit node operator to ignore the real damage their work can do. They may still decide that the good that they're doing outweighs the bad, but forcing them to see the negative consequences of shielding anyone who wants a shield has value.
  - courseofaction 2y ago
    Is that the horseman we're giving up our rights for today?
    - lolinder 2y ago
      Your right to knowingly run a service that is used by people to kill other people while never having to interact with the consequences of that decision? I'm not suggesting people shouldn't be able to run a Tor exit node. I'm suggesting that people who run Tor exit nodes should occasionally have to a deal with a subpoena that says "your exit node was used by a criminal to hurt people in ${these ways} and we require any information you have to help apprehend the attacker." I don't want to deprive anyone of the right to make a moral decision, but I do want them to feel the weight of the full import of that decision.
      - aspenmayer 2y ago
luckylion 2y ago
There's a very productive spammer that sends out spam for their shops and, on their home page, they have a big info about how they didn't send that spam, and it's just somebody else trying to ruin their reputation. If all you'd need to deter law enforcement is to put a website up on your server and say that you don't have anything to do with anything happening on that server and that they shouldn't bother because there's nothing to see anyhow, a lot more criminals would do that. I'm sure they'd even put an actual exit node on their machines if that protected them from law enforcement.
- edm0nd 2y ago
  Fair enough!
- thecrash 2y ago
  Maybe rather than a big info explaining that there's nothing to see, it could be a big info explaining that "source IP address" is useless as evidence of a crime, because, as this server and many, many other proxy services demonstrate, the IP listed as the origin is in no way guaranteed (or even likely) to be the actual origin of the traffic. It's like raiding the home of the mail carrier because someone got drugs in the mail. Sure, it could technically be that the mail carrier is also a drug dealer. But when it comes to the USPS, the identity of who delivered the contraband package is not a useful data point for investigating the crime, and acting otherwise is willful ignorance.
  - lolinder 2y ago
    > "source IP address" is useless as evidence of a crime, because, as this server and many, many other proxy services demonstrate, the IP listed as the origin is in no way guaranteed (or even likely) to be the actual origin of the traffic. It doesn't have to be the actual origin for it to be useful—unless the software is specifically designed to avoid traces (i.e., Tor), there are often logs that will lead you to another IP address, which might lead you to another, which might eventually lead you to the source. It would be foolhardy for police investigating a bomb threat to not at least ask, given how many people they do in fact catch this way. > It's like raiding the home of the mail carrier because someone got drugs in the mail. No, in the case of OP it's like subpoenaing the local post office and asking for everything they know about where that package came from. Which is, incidentally, quite common, except that in the US the post office is a government entity that doesn't need to be subpoenaed because it has its own law enforcement agency that should have jurisdiction over the case.
admax88qqq 2y ago
I don’t know. Could you imagine if you were in charge of investigating something like this and you _didnt_ check one of the computers involved just because the guy who owned the computer claimed it doesn’t have anything useful on it? There could be logging bugs in Tor that you were unaware of, or the owner could be using Tor as a cover. It would be negligent _not_ to at least check the device logs for anything useful.
- thecrash 2y ago
  By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? After all, the ISP could be secretly in on the criminal plot, and how could you know without imaging every hard-drive in the data center? It would be negligent not to. The truth is that police investigations normally are restrained based on the disruption that they cause the public. Police deviate from standard operating procedure when it comes to TOR exit node operators because they want to punish and intimidate them. They want to punish operators because the authorities are frustrated by the effectiveness of these technologies in countering the pervasive surveillance environment which the authorities take for granted.
  - aspenmayer 2y ago
    > By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? After all, the ISP could be secretly in on the criminal plot, and how could you know without imaging every hard-drive in the data center? It would be negligent not to. Implying that they don’t have the capability to do this already and/or alternative means to accomplish the same thing. https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A > Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency, as part of its warrantless surveillance program as authorized by the Patriot Act. The facility commenced operations in 2003 and its purpose was publicly revealed by AT&T technician Mark Klein in 2006.
  - bongodongobob 2y ago
    < By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? You think they don't!?
BLKNSLVR 2y ago
> I suppose my issue stems from my perception of the seemingly lack of serious investigation on their law enforcement side. That's my experience too from actually having my house raided. I had two kids in bed at the time, and the police didn't even know to expect kids in the house (both kids were over 11 years old, had birth certificates, had lived in that house all their lives and attend local schools and are darn fine students). They didn't know. It's mind boggling to me that they could get a raid warrant without having done even the most basic (below even basic) investigation. My opinion of police investigative competence took a 99% hit as a result. It's a lesson my kids won't forget either.
- hcfman 2y ago
  The raid no doubt was carried out by the police. They just what they are told to do by an organisation that is higher up. No one will get reasons. Maybe the chief of police. But only a limited amount so he can claim plausible deniability. The dirty people behind all this are in the way they run the investigations. And what way is that ? Well it’s the “organised crime investigations”. The Netherlands pushed the RIEC way of working here to Germany and Belgium. Look it up. Euriec. The whole way of working is to do dirty tricks in an unaccountable way.

by edm0nd 2y ago

shadowgovt 2y ago

> Seriously, all they had to do was plug my IP into a browser or do a simple scan of it but I suppose that's asking too much from LE lol. I mean, yes, I'm pretty sure "just take my word for it" is asking too much of LE. We can always say "Come back with a warrant" but then sometimes they'll come back with a warrant. > They should know what Tor is and know that any Tor server contains ZERO info Unless, of course, one has misconfigured it... Which could be the case. Definitely the kind of thing LEO can figure out on the other side of a seize-and-strip of the hardware. Unfortunately, I think the only way to not be a part of the story here is to not be a part of the story here... Don't proxy anonymous traffic if you don't want law enforcement asking after the anonymous traffic you proxied. Otherwise, expect the responsibility imposed upon a service provider (since you're providing a service). Other ISPs avoid this scrutiny by going out of their way to be helpful to law enforcement.

edm0nd 2y ago
Yup that's the same conclusion that I've come to for now. I got a family and stuffs now so don't want to bring any stress to them. One day I will resume but in the future :)
zadokshi 2y ago
There is no way for police to know if the traffic came through tor, or was initiated by the owner of computer/server. It seems reasonable that the police have the right to investigate. If not, anyone could run a tor node to cover up their own criminal activities. Even if you did have logs suggesting it was tor activity, should we trust someone’s claim that the logs are proof that it was someone else? It would in fact be negligent if the police did not properly investigate the server/computer/house of the device.

madars 2y ago

Maybe they did not expect any useful info? One gets jaded but https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

fn-mote 2y ago
That isn't the reading I would make of the situation. Like the OP says, it's harrassment to discourage continued operation.
- jacobgkau 2y ago
  I think that's what the person you replied to was saying. The purpose of the "system" of law enforcement is not what they say it is (to try and gather evidence from the server), but rather is what the system does (get people to shut down exit nodes because of the hassle).

cortesoft 2y ago

The end goal is probably to get you to do what you did, which is shut down the exit node. If they make it painful to run a Tor exit node, they make Tor harder to use.

lolinder 2y ago
Exactly. Which is not as obviously an unethical approach as some here would think—if you are standing between law enforcement and a bomb threat, "I'm intentionally ignorant of the activities of the people that I'm shielding" is a morally dubious place to stand. The law allows law enforcement to subpoena records related to an investigation like this, and I honestly think it's fair to force Tor exit node operators to handle those subpoenas every time, even if the answer is always the same. To have some sort of automated process in place to deflect blame allows an exit node operator to ignore the real damage their work can do. They may still decide that the good that they're doing outweighs the bad, but forcing them to see the negative consequences of shielding anyone who wants a shield has value.
- courseofaction 2y ago
  Is that the horseman we're giving up our rights for today?
  - lolinder 2y ago
    Your right to knowingly run a service that is used by people to kill other people while never having to interact with the consequences of that decision? I'm not suggesting people shouldn't be able to run a Tor exit node. I'm suggesting that people who run Tor exit nodes should occasionally have to a deal with a subpoena that says "your exit node was used by a criminal to hurt people in ${these ways} and we require any information you have to help apprehend the attacker." I don't want to deprive anyone of the right to make a moral decision, but I do want them to feel the weight of the full import of that decision.
    - aspenmayer 2y ago

luckylion 2y ago

There's a very productive spammer that sends out spam for their shops and, on their home page, they have a big info about how they didn't send that spam, and it's just somebody else trying to ruin their reputation. If all you'd need to deter law enforcement is to put a website up on your server and say that you don't have anything to do with anything happening on that server and that they shouldn't bother because there's nothing to see anyhow, a lot more criminals would do that. I'm sure they'd even put an actual exit node on their machines if that protected them from law enforcement.

edm0nd 2y ago
Fair enough!
thecrash 2y ago
Maybe rather than a big info explaining that there's nothing to see, it could be a big info explaining that "source IP address" is useless as evidence of a crime, because, as this server and many, many other proxy services demonstrate, the IP listed as the origin is in no way guaranteed (or even likely) to be the actual origin of the traffic. It's like raiding the home of the mail carrier because someone got drugs in the mail. Sure, it could technically be that the mail carrier is also a drug dealer. But when it comes to the USPS, the identity of who delivered the contraband package is not a useful data point for investigating the crime, and acting otherwise is willful ignorance.
- lolinder 2y ago
  > "source IP address" is useless as evidence of a crime, because, as this server and many, many other proxy services demonstrate, the IP listed as the origin is in no way guaranteed (or even likely) to be the actual origin of the traffic. It doesn't have to be the actual origin for it to be useful—unless the software is specifically designed to avoid traces (i.e., Tor), there are often logs that will lead you to another IP address, which might lead you to another, which might eventually lead you to the source. It would be foolhardy for police investigating a bomb threat to not at least ask, given how many people they do in fact catch this way. > It's like raiding the home of the mail carrier because someone got drugs in the mail. No, in the case of OP it's like subpoenaing the local post office and asking for everything they know about where that package came from. Which is, incidentally, quite common, except that in the US the post office is a government entity that doesn't need to be subpoenaed because it has its own law enforcement agency that should have jurisdiction over the case.

admax88qqq 2y ago

I don’t know. Could you imagine if you were in charge of investigating something like this and you _didnt_ check one of the computers involved just because the guy who owned the computer claimed it doesn’t have anything useful on it? There could be logging bugs in Tor that you were unaware of, or the owner could be using Tor as a cover. It would be negligent _not_ to at least check the device logs for anything useful.

thecrash 2y ago
By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? After all, the ISP could be secretly in on the criminal plot, and how could you know without imaging every hard-drive in the data center? It would be negligent not to. The truth is that police investigations normally are restrained based on the disruption that they cause the public. Police deviate from standard operating procedure when it comes to TOR exit node operators because they want to punish and intimidate them. They want to punish operators because the authorities are frustrated by the effectiveness of these technologies in countering the pervasive surveillance environment which the authorities take for granted.
- aspenmayer 2y ago
  > By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? After all, the ISP could be secretly in on the criminal plot, and how could you know without imaging every hard-drive in the data center? It would be negligent not to. Implying that they don’t have the capability to do this already and/or alternative means to accomplish the same thing. https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A > Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency, as part of its warrantless surveillance program as authorized by the Patriot Act. The facility commenced operations in 2003 and its purpose was publicly revealed by AT&T technician Mark Klein in 2006.
- bongodongobob 2y ago
  < By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? You think they don't!?

BLKNSLVR 2y ago

> I suppose my issue stems from my perception of the seemingly lack of serious investigation on their law enforcement side. That's my experience too from actually having my house raided. I had two kids in bed at the time, and the police didn't even know to expect kids in the house (both kids were over 11 years old, had birth certificates, had lived in that house all their lives and attend local schools and are darn fine students). They didn't know. It's mind boggling to me that they could get a raid warrant without having done even the most basic (below even basic) investigation. My opinion of police investigative competence took a 99% hit as a result. It's a lesson my kids won't forget either.

hcfman 2y ago
The raid no doubt was carried out by the police. They just what they are told to do by an organisation that is higher up. No one will get reasons. Maybe the chief of police. But only a limited amount so he can claim plausible deniability. The dirty people behind all this are in the way they run the investigations. And what way is that ? Well it’s the “organised crime investigations”. The Netherlands pushed the RIEC way of working here to Germany and Belgium. Look it up. Euriec. The whole way of working is to do dirty tricks in an unaccountable way.