43 ms·

Tor exit node operator raided in Austria

495 points by Nyr 14y ago

venomsnake 14y ago
Well ... go on authorities. These pirate parties need votes. They are only at 5-6% now. Let's ensure that they can get at least 20% on the next elections.
shocks 14y ago
I feel like I should post this here too: https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutCriminals https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutC...
hcarvalhoalves 14y ago
I can't empathize. With great power comes great responsibility. If you're protecting someone else's privacy by publicly running an exit node for Tor under your name, that's expected. The open Wi-Fi analogy doesn't fly here. It's more than pure unawareness, you need to purposefully install Tor and route anonymous traffic to the internet. That entails being held accountable for what this traffic is used for. If an analogy is needed, the right one is giving the key for your P.O. box to anyone with a mask, then complaining you're being charged because they've found child pornography there.
- Retric 14y ago
  I think a more reasonable analogy would be someone selling drugs in your stores parking lot. Your opening a private resource up for public use and someone is using that resource to break the law. However, I have no idea what the case law is and while I suspect the owners are left alone in the vast majority of cases, there may be some culpability.
  - deleted 14y ago
    [deleted]
- morsch 14y ago
  You're begging the question. Why does routing someone's traffic make you accountable for the traffic? Because someone needs to be accountable? I'm not sure analogies are very helpful.
  - hcarvalhoalves 14y ago
    > Why does routing someone's traffic make you accountable for the traffic? Because someone needs to be accountable? The evidence is on him now, so he has to prove it wasn't. Given Tor's anonymity, that's rather difficult, but it's his problem. Which is stupid in the first place, because he dug himself on this hole, and that's why I can't empathize.
  - khill 14y ago
    If this guy isn't held responsible for the content, you would be creating a loophole in the law. If I wanted to distribute illegal content safely, I could just run a Tor exit node and claim that the illegal content originated from somewhere within Tor instead of from my machines.
- flyinRyan 14y ago
  >you need to purposefully install Tor and route anonymous traffic to the internet. That entails being held accountable for what this traffic is used for. This is utterly ridiculous. An ISP has to go to a hell of a lot more effort than that. Does that also entail being held accountable for what the traffic is used for? The guy most likely installed Tor imagining helping groups like wikileaks, not Jimmy Savile.
jeremysmyth 14y ago
Tor can be used for good and for bad. It's the very same problem that Cory Doctorow talks about in his lectures about the War on General Purpose Computing, and it's not an easy problem to solve. I'm an admin on a social/gaming site (a MUD with appendant forum, blogs, and other community elements), and we have had to make a few decisions about Tor in the last couple of years. Some background: the site is quite old, and we have historically encouraged users to sign up without needing to provide a unique ID such as email address. They _can_ provide one, but don't have to. In the last few years we have had the problem of occasional griefers log on and cause whatever social havoc they can. Now, my personal feelings about Tor are generally quite positive, and I like the freedoms it provides people who are otherwise restricted by their ISPs or governments from accessing legitimate resources. Like many others have said, Tor is a tool that, while it can be used to do illegal things, is also used to provide a very useful service to people who need it to get on with things you and I take for granted. Now, back to our griefers: We have a number of banning mechanisms based on IP or domain, and they tend to be successful because griefers usually get bored when they can't access the site for a couple of hours. However, because a tiny minority of griefers are more persistent, more technically adept, and figured they could use Tor to damage our community, we did a little bit of analysis and found that few if any legitimate users of our site came from Tor exit points, and we chose to block them. The alternative was to require a unique identity during the sign-up process, and frankly we wanted as few hurdles as possible to new users (anyone who knows the MUD community knows that it's in decline, and low-friction signups are pretty desirable). So we blacklist Tor exit points from our signup process. The unfortunate fact is that some Tor users do bad things with the fantastic tool at their disposal, and end up spoiling it for the legitimate (and extremely valuable) use cases that make it such an amazing tool. Yet its very anonymity means that there is no easy way to allow one set of uses while disallowing others. This is a hard problem, and one I'm not smart enough to solve.
- jamoes 14y ago
  This problem may very well grow as IPv6 gains adoption. IP address won't be a viable indicator of identity. What we need is a distributed, pseudonymous reputation system. In this way, honest users would have no problem signing up for services such as yours, but griefers would have much more trouble, because there would be a very real cost each time they destroyed one of their pseudonymous identities.
systematical 14y ago
So can an ISP be raided because child porn went over its network at some point? I didn't think so...so I don't see the difference here.
cwkoss 14y ago
Wow. William has received more than $1300 in Bitcoin donations in the past 3 hours. http://blockchain.info/address/1CPKAMtD4bcLrh8SRHfSxBBMmQQ5cqahPZ http://blockchain.info/address/1CPKAMtD4bcLrh8SRHfSxBBMmQQ5c...
- WilliamAT 14y ago
  Yea, um, trust me i didn't expect that - In fact i didn't even look until i read this now and it's true: balance 124BTC (I had around 7 before)... Now i need to think how i can pay Bitcoins back when this is done (as i don't know if the source addresses are valid then still (if they ever were and not just a proxy source) and who sent what amount at mass sends...) Tricky, probably can't pay bitcoin back :(
  - cwkoss 14y ago
    Yeah, if they paid you directly from an online wallet, sending funds back to the address you received them won't necessarily get deposited in their account. And if they don't hold the private key, they can't sign a message to you with it... You probably can't pay them back.
hntldr_com 14y ago
summary: A man was recently raided after someone shared child pornography through one of his Tor exits, and all his computers have been confiscated. If convicted, the man faces 6 to 10 years in prison. He will be accepting donations to cover his legal expenses for the incident.
rsync 14y ago
You should not be running a ToR exit node from your home. Dumb. Dumb. Dumb.
- WilliamAT 14y ago
  The exit in question was located in Poland - Not in my home, i never had any exit running at home. The server used in Poland was however (naturally) registered on my name.
- haarts 14y ago
  Why?
lazyjones 14y ago
I'd honestly like to know how he paid for all this stuff: up to 30TB/day traffic according to arstechnica (costs surely more than 1-2k euro/month), loads of servers - all with the salary of a 20 years old ISP employee?
- qwertyoruiop 14y ago
  I'm a 15 year old 'kid` that has been pushing 30TB/day traffic thru a few Tor exits for months just fine, because I truly believe in freedom of speech. You know, money isn't that hard to get. For me, a few weeks of coding got me a few thousands of euros. He was running an ISP apparently, and selling VPSs. I've been sysadmining a few boxes for a few VPS hosting companies and got enough money to run a few Tor exits pushing over 2Gbps for months. (Also, I think that it's hilarious that me having my 15-year-old girlfriend pics is considered illegal, thanks to CP laws. ) I truly believe in this: http://datalove.me/ http://datalove.me/
  - lazyjones 14y ago
    A TB of traffic will cost at least around €2-3 from most european (and other) ISPs with VPS so you basically claim to have enough spare change lying around at the age of 15 to pay €2000-3000/month just for Tor traffic because you're an idealist and after buying all the stuff a 15 year old normally buys first? ;-) I call BS, or rich parents. (and btw., WW was not running the ISP, he wrote somewhere in this thread that he is just a normal employee)
    - qwertyoruiop 14y ago
      > A TB of traffic will cost at least around €2-3 from most european (and other) ISPs with VPS The average bandwidth price I got from all the ISPs I used in the past was ~1 dollar/megabit. The ISPs I used for my Tor relays were ISPs I was using already for bandwidth-intensive HTTP hosting, so I already had quite a few deals for dirt cheap bandwidth. I've been paying ~600€ per box (1Gbit, of which I was using at least 60% 24/7, getting to 100% during day hours). > you basically claim to have enough spare change lying around at the age of 15 to pay €2000-3000/month just for Tor traffic because you're an idealist Yep. I got it mostly by selling iOS Tweaks on Cydia Store, private consulting with a few companies, freelancing, and sysadmining. > and after buying all the stuff a 15 year old normally buys first? ;-) The only thing apart from my tech equipment and servers that I'm interesting in buying is weed anyway. > (and btw., WW was not running the ISP, he wrote somewhere in this thread that he is just a normal employee) Thanks for clarifying that he was not running the ISP. I misread it, probably.
AlexMuir 14y ago
We need a community fund that can be used for things like this. The equivalent of a hardship fund with an aim of protecting our internet freedoms. It's good for the world, it's good for us individually, and it's good for business. Everyone throws a few €£$ in a pot and a few volunteers administer it and do a bit of due diligence to ensure cases are valid. I guess in the US this is the EFF, but there are plenty of cases outside their remit. It'd be like social security but for legal battles - but I don't think contributing/not should entitle or exempt anyone from funds.
- lambda 14y ago
  > Everyone throws a few €£$ in a pot and a few volunteers administer it and do a bit of due diligence to ensure cases are valid. You are fairly optimistic about the ease of administering a charity which gives out free money.
- hornbaker 14y ago
  How about a Kickstarter for legal defense funds? Is there one out there?
- cynoclast 14y ago
  I think we need to rethink our society because if the average person can expect to have their lives nearly ruined by a legal battle in which they did nothing wrong, we have a very defective legal system. Not saying we shouldn't do this, but that we shouldn't have to.
  - dwj 14y ago
    So you think it's fine to allow someone to use your computer to transfer child porn and other illegal stuff with no consequences? While tor might have some legitimate uses, I think 99% of the time it's used for trolling or illegal stuff. It's a pain in the ass for me because I have to keep reblocking it when the ips change.
    - droithomme 14y ago
      It's past time for a contrarian viewpoint. How about we legalize child porn? The vast majority of the time when it gets brought up is in the context of using it as a pretext to attack civil liberties of law abiding citizens. When there is a child porn arrest it almost always ends up being a honey trap run by the FBI using decades old photos, so it's not like there are many children being protected by these laws.
dbaupp 14y ago
I know little about the Tor community, but is there any verification of these sort of claims?
- loopdoend 14y ago
  All tor node addresses are public. (Except for secret entry nodes.) I imagine this information could be used to verify claims.
- throwaway125 14y ago
  I briefly looked for other information about this and I found this thread on the tor-talk mailing list. The thread mentions he contacted the torservers.net team for a recommendation about a lawyer. The thread also mentions someone is going to provide better proof soon. https://lists.torproject.org/pipermail/tor-talk/2012-November/026616.html https://lists.torproject.org/pipermail/tor-talk/2012-Novembe...
haarts 14y ago
What if the guy had an open Wifi router? And the neighbors downloaded a movie? This goes to show law enforcement does not know what they are doing. I run a node as well and noticed other (far less severe) downsides of doing so. Registering on certain forums won't work and purchasing games on Steam doesn't work. These parties just blacklist the entire list of IPs published running exit nodes.
- Tichy 14y ago
  Where I live you can get punished for stuff people do with your open Wifi network. I think the authorities know exactly what they doing: they don't want people to anonymously surf the internet, so the prevent it by making it impossible to run Tor nodes or Wifi networks. I don't like it...
  - error54 14y ago
    Same here. If you don't secure your wifi then you are legally responsible for what people do on your internet which I kind of understand but where does the line get drawn? If my computer gets hijacked and is used in a DDOS attack against some website, am I responsible for that too? At best this is all a legal gray area.
    - pi18n 14y ago
      A greyhat should write a virus that hijacks computers and makes them Tor exit nodes. Anyone can run it voluntarily and claim ignorance. And people that get hijacked would have been hijacked by something anyway, so they will at least be supporting free speech with this one.
      - finnw 14y ago
        Way to make politicians even less sympathetic towards Tor. It's now a "hackers' tool" as well as a "kiddy fiddlers' tool" BTW plenty of IRC-based botnets already do something similar, though usually without proper encryption.
    - 14y ago
drzaiusapelord 14y ago
>Yesterday i got raided for someone sharing child pornography over one of my Tor exits. Reason #1 why I will never run a tor exit node. I don't want to make it easier for child predators to get off nor do I want the legal issues they bring.
- shocks 14y ago
  There are plenty of legitimate uses for Tor.
  - jcromartie 14y ago
    I wonder what proportion of Tor is used for legal purposes? I personally hold an extremely low estimate for that figure.
    - geoka9 14y ago
      What about email encryption? Should it be banned, too?
    - flyinRyan 14y ago
      Really, you can't imagine anything? You can't imagine a good thing someone might want to do over a network that is (well, is meant to be anyway) completely anonymous? Seriously, right now with Arab Spring going on, Syria shutting off the internet, China having the biggest firewall, other countries fiddling around with censorship, people going to jail for tweets or clicking "like" on facebook and you can't think of a valid reason one might want to be able to hide their online activities from prying eyes?
  - shocks 14y ago
    Here is a good link, with more information. https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutCriminals https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutC...
  - kevindication 14y ago
    You don't find yourself in litigation for the legitimate uses of Tor.
error54 14y ago
I fully support TOR and I think that overall it's a good thing for the internet but legally I don't know if he has a leg to stand on. Being an exit node operator carries these risks which he knew about so the court system has him there. The danger if he is tried and convicted is that all it sets a dangerous precedent for the rest of the TOR network. Who's to say where the blame stops? Can the relay operators passing the packets along be convicted too? I hope for the sake of the TOR network that he gets off on the charges because if he does not, less and less people will be willing to be exit nodes which essentially means the end of the TOR network.
- ef4 14y ago
  The legal theory here is that he should have common carrier status, like an ISP. ISPs aren't generally liable for the things that their customers do over their network.
- driverdan 14y ago
  Without knowing and understanding Austrian law you can't make such speculations. In the USA he wouldn't be breaking any laws.
  - jonpaul 14y ago
    Really? This surprises me. Do you have any research, evidence, articles to support this?
    - ef4 14y ago
      https://www.torproject.org/eff/tor-legal-faq.html.en https://www.torproject.org/eff/tor-legal-faq.html.en
      - jonpaul 14y ago
        Unless I missed something, they don't touch legality of Tor, other than: "Further, we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is lawful under U.S. law." This doesn't say anything. I can "believe" anything that I want, but it doesn't make it so. I'm looking for articles with sound legal rationale and previous case outcomes that argue on the legality of a defendant's culpability as it pertains to a crime being committed on said defendant's Tor exit node.
Irregardless 14y ago
What's next? If someone walks across my lawn with a backpack full of child porn DVDs I'll be liable for aiding a felon? I'm sure the authorities would agree that's absurd, yet it's fundamentally identical to this case.
- pavel_lishin 14y ago
  Wouldn't a closer analogy be someone suing FedEx because you used them to ship a DVD of child pornography?
  - finnw 14y ago
    I think a combination of the two would be a better analogy: A complete stranger knocks on your door and asks you if it's ok for FedEx to deliver an unmarked parcel of DVDs to your house, and he will collect them from you later. You do not know his name or address. The package arrives. You open it and examine the DVDs, but find that they are encrypted. You pass them on as agreed. Next day the feds knock on your door, saying they have a tip-off that some child porn, bomb-making manuals and stolen bank account details were delivered to your address. You tell them exactly what happened. They seize your laptop and search it for said materials, but find nothing incriminating. Have you committed a crime? I hope not (in both cases) but at the same time I think if the tor exit node operator is protected from prosecution for illegal material passing through the node, then the person passing on the mysterious package should have exactly the same protection.
    - joepie91 14y ago
      The validity of that analogy strongly depends on whether local activists make a habit of passing packages with encrypted contents through your place, to avoid prosecution of a tyrannical government.
dewey 14y ago
his twitter account with some further information http://twitter.com/str0AT http://twitter.com/str0AT [german]
film42 14y ago
I will need to wait for his local news to confirm the story before I will donate. I trust him, but you can't just say I need all of your money without proof, that's like a certain Nigerian prince. I really hope this is fake because its really sad to see people like William get caught in the middle of a situation like this. However, with my gut feeling this is real, I will be waiting for confirmation to submit my donation.
- JohnTheRipper 14y ago
  William has a long history on LET, he runs a hosting company and is among the most well-known users on the site.
iamtherockstar 14y ago
If you go to a bank, rob it, and then walk outside to a waiting taxi, and have the taxi drive you home, is the taxi driver an accessory? I think that in the US you'd really have to make a case that the taxi drive had knowledge of what had transpired.
- baak 14y ago
  If you go to a bank, rob it, and then hand the money to your friend for hiding, then your friend is an accessory. (Possession of Stolen Goods at the least) Did he rob the bank? No. He may have just been at home, not involved in planning at all, you show up with $50,000, ask him to hide it and tell him it's stolen. He was just used to transfer the goods, but he's still breaking the law. Likewise laundering the stolen money is illegal, even though you didn't steal it.
  - anonymous 14y ago
    Your scenarios are about knowingly transferring illegal goods. The Tor operator didn't know that illegal data was being transferred over his equipment. In the same way a webhoster isn't liable for the data his clients are hosting.
- swalsh 14y ago
  The thing is, if you're operating a TOR node you should have full knowledge that people are going to use it as much for illegitimate uses as much as legitimate uses.
  - groby_b 14y ago
    And if you're operating a cab, you should have full knowledge that people are going to use it as much for illegitimate uses as much as legitimate uses. Your point being?
    - georgeorwell 14y ago
      For Tor, the ratio of legitimate to illegitimate is perhaps 1:1, whereas for taxis it's like 1000:1, or higher. At least that's how I read "as much as".
tomku 14y ago
It seems like a lot of people are objecting to the raid/seizure itself in addition to the possibility of conviction, so I have a question. Is it reasonable for the police to investigate an exit node operator for traffic coming from his node, even if they know he's an exit node operator? The way I see it, it's their job* to determine whether the traffic in question was relayed, or whether it was the exit node operator himself generating that traffic. In an ideal world, they could just call him up and ask nicely - but if he was actually guilty, he'd say "No, no way it was me!" and immediately start destroying any evidence. On the other hand, raiding someone's home or server rack and confiscating all of their computers isn't a great solution if most exit node operators are not guilty themselves. I'm not aware of a good solution that avoids inconveniencing exit node operators without giving them some kind of blanket immunity to investigation that goes beyond just relayed traffic. * - I'm aware that this might be impossible, but you can't know whether it will be ahead of time. It's possible that they could raid him and find no proof, even if he's guilty. It's also possible that they could raid him and find exactly what they were looking for. Like many investigation tactics, there's no guaranteed payoff.
- ChuckMcM 14y ago
  In the strict public policy sense you could argue the raid/seizure either way; The pro-raid argument would go "This activity harms society by allowing criminal activity which is part of the economics of exploiting children, thus it is right for the state to step in and make these raids to identify and contain those threats." Then you could make the anti-raid argument, "The economic disruption of taking a legitimate business off-line and possibly causing irreparable harm to innocent citizens does not warrant such a drastic measure without solid evidence of complicity in the commission of a crime." In the United States there is an analogous situation which is that of the 'high speed pursuit.' In the pursuit situation the officers have strong reason to believe the driver of a vehicle was involved in a crime and seek to arrest them. The driver of the vehicle doesn't want to be arrested and so they drive away quickly. If the officers give chase, they greatly increase the chance that harm will come to innocent bystanders. If they don't give chase they risk losing their suspect. Generally those debates come down to things like "what crime might they have committed?" and if it was failure to stop for a right turn, that is seen as not being as 'reasonable to chase' as hit and run vehicular manslaughter. I tend to fall into the "Do the police work to figure out who the crooks are and if you need the co-operation of an end-node provider then get a warrant to compel that co-operation." But I also have spoken to officers who feel that such restrictions are 'red tape' and keep them from doing the job they were paid to do. In this particular case we don't have the police version of the story. Perhaps they think this guy is complicit? Did they raid/seize any other end nodes? Did they have a warrant and what did it say? Had this person been involved in other questionable activities? "Presumption of innocence" is not a principle that extends outside of US borders so its always difficult to contextualize police action in other countries to Americans who take their constitution for granted.
jborden13 14y ago
People are working to verify that this isn't a scam.
- WilliamAT 14y ago
  http://raided4tor.cryto.net/ http://raided4tor.cryto.net/ and http://arstechnica.com/tech-policy/2012/11/tor-operator-charged-for-child-porn-transmitted-over-his-servers/ http://arstechnica.com/tech-policy/2012/11/tor-operator-char... (has scan of the search warrant) should be good enough for now :)
synthos 14y ago
Personally, I have 2Tb, and it's not legal (but not immoral). I can't imagine what legal uses an individual could have for 100Tb of storage.
- acuozzo 14y ago
  > I can't imagine what legal uses an individual could have for 100Tb of storage. An example: Raw captures (e.g., digitized home movies) can take up a lot of space, even if they're losslessly-compressed with a codec like Huffyuv or Lagarith. I have five raw captures of the same 2-hour VHS movie sitting on my HDD, as I plan to average them to reduce the appearance of artifacts due to tracking differences. Each capture is losslessly-compressed with Huffyuv and approximately __50GB__. That's ~250GB right there.
- seanc722 14y ago
  If you do anything with video/photo's and many other types of things the space adds up quickly. I had 2TB filled with just games that I had purchased. Just my steam folder alone is pretty massive. Files are getting a lot larger with the amount of storage we have access to. Just compare a floppy disk to a CD to a DVD. You've only used floppy's and someone comes up to you and shows you a CD... "WOW! what legal use could you POSSIBLY have for that!"
- csense 14y ago
  This line of reasoning is very troublesome. Your argument seems to be: "Don't make waves. Don't do anything out of the ordinary." To many people, having Linux installed on a computer is something that people have no legitimate reason for. No innovation or individuality. Everyone has to be exactly the same. Also, your line of reasoning goes against presumption of innocence. The suspect doesn't have to explain why he has that much storage. The police/prosecutor have to explain what criminal acts he's doing with that storage.
- WilliamAT 14y ago
  It's mainly server backups (encrypted by PGP even) (50% of storage), Movies, Music, Documentaries, Apps (legal and/or free/opensource) (30%), and empty space i had added a few weeks ago for more backups (switching from daily to 3hourly)
hosay123 14y ago
This is William of Edis.at, the company offering the free Raspberry Pi hosting deal posted here a few weeks ago.

495 points by Nyr 14y ago

Well ... go on authorities. These pirate parties need votes. They are only at 5-6% now. Let's ensure that they can get at least 20% on the next elections.

shocks 14y ago

I feel like I should post this here too: https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutCriminals https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutC...

hcarvalhoalves 14y ago

I can't empathize. With great power comes great responsibility. If you're protecting someone else's privacy by publicly running an exit node for Tor under your name, that's expected. The open Wi-Fi analogy doesn't fly here. It's more than pure unawareness, you need to purposefully install Tor and route anonymous traffic to the internet. That entails being held accountable for what this traffic is used for. If an analogy is needed, the right one is giving the key for your P.O. box to anyone with a mask, then complaining you're being charged because they've found child pornography there.

Retric 14y ago
I think a more reasonable analogy would be someone selling drugs in your stores parking lot. Your opening a private resource up for public use and someone is using that resource to break the law. However, I have no idea what the case law is and while I suspect the owners are left alone in the vast majority of cases, there may be some culpability.
- deleted 14y ago
  [deleted]
morsch 14y ago
You're begging the question. Why does routing someone's traffic make you accountable for the traffic? Because someone needs to be accountable? I'm not sure analogies are very helpful.
- hcarvalhoalves 14y ago
  > Why does routing someone's traffic make you accountable for the traffic? Because someone needs to be accountable? The evidence is on him now, so he has to prove it wasn't. Given Tor's anonymity, that's rather difficult, but it's his problem. Which is stupid in the first place, because he dug himself on this hole, and that's why I can't empathize.
- khill 14y ago
  If this guy isn't held responsible for the content, you would be creating a loophole in the law. If I wanted to distribute illegal content safely, I could just run a Tor exit node and claim that the illegal content originated from somewhere within Tor instead of from my machines.
flyinRyan 14y ago
>you need to purposefully install Tor and route anonymous traffic to the internet. That entails being held accountable for what this traffic is used for. This is utterly ridiculous. An ISP has to go to a hell of a lot more effort than that. Does that also entail being held accountable for what the traffic is used for? The guy most likely installed Tor imagining helping groups like wikileaks, not Jimmy Savile.

jeremysmyth 14y ago

Tor can be used for good and for bad. It's the very same problem that Cory Doctorow talks about in his lectures about the War on General Purpose Computing, and it's not an easy problem to solve. I'm an admin on a social/gaming site (a MUD with appendant forum, blogs, and other community elements), and we have had to make a few decisions about Tor in the last couple of years. Some background: the site is quite old, and we have historically encouraged users to sign up without needing to provide a unique ID such as email address. They _can_ provide one, but don't have to. In the last few years we have had the problem of occasional griefers log on and cause whatever social havoc they can. Now, my personal feelings about Tor are generally quite positive, and I like the freedoms it provides people who are otherwise restricted by their ISPs or governments from accessing legitimate resources. Like many others have said, Tor is a tool that, while it can be used to do illegal things, is also used to provide a very useful service to people who need it to get on with things you and I take for granted. Now, back to our griefers: We have a number of banning mechanisms based on IP or domain, and they tend to be successful because griefers usually get bored when they can't access the site for a couple of hours. However, because a tiny minority of griefers are more persistent, more technically adept, and figured they could use Tor to damage our community, we did a little bit of analysis and found that few if any legitimate users of our site came from Tor exit points, and we chose to block them. The alternative was to require a unique identity during the sign-up process, and frankly we wanted as few hurdles as possible to new users (anyone who knows the MUD community knows that it's in decline, and low-friction signups are pretty desirable). So we blacklist Tor exit points from our signup process. The unfortunate fact is that some Tor users do bad things with the fantastic tool at their disposal, and end up spoiling it for the legitimate (and extremely valuable) use cases that make it such an amazing tool. Yet its very anonymity means that there is no easy way to allow one set of uses while disallowing others. This is a hard problem, and one I'm not smart enough to solve.

jamoes 14y ago
This problem may very well grow as IPv6 gains adoption. IP address won't be a viable indicator of identity. What we need is a distributed, pseudonymous reputation system. In this way, honest users would have no problem signing up for services such as yours, but griefers would have much more trouble, because there would be a very real cost each time they destroyed one of their pseudonymous identities.

systematical 14y ago

So can an ISP be raided because child porn went over its network at some point? I didn't think so...so I don't see the difference here.

cwkoss 14y ago

Wow. William has received more than $1300 in Bitcoin donations in the past 3 hours. http://blockchain.info/address/1CPKAMtD4bcLrh8SRHfSxBBMmQQ5cqahPZ http://blockchain.info/address/1CPKAMtD4bcLrh8SRHfSxBBMmQQ5c...

WilliamAT 14y ago
Yea, um, trust me i didn't expect that - In fact i didn't even look until i read this now and it's true: balance 124BTC (I had around 7 before)... Now i need to think how i can pay Bitcoins back when this is done (as i don't know if the source addresses are valid then still (if they ever were and not just a proxy source) and who sent what amount at mass sends...) Tricky, probably can't pay bitcoin back :(
- cwkoss 14y ago
  Yeah, if they paid you directly from an online wallet, sending funds back to the address you received them won't necessarily get deposited in their account. And if they don't hold the private key, they can't sign a message to you with it... You probably can't pay them back.

hntldr_com 14y ago

summary: A man was recently raided after someone shared child pornography through one of his Tor exits, and all his computers have been confiscated. If convicted, the man faces 6 to 10 years in prison. He will be accepting donations to cover his legal expenses for the incident.

rsync 14y ago

You should not be running a ToR exit node from your home. Dumb. Dumb. Dumb.

WilliamAT 14y ago
The exit in question was located in Poland - Not in my home, i never had any exit running at home. The server used in Poland was however (naturally) registered on my name.
haarts 14y ago
Why?

lazyjones 14y ago

I'd honestly like to know how he paid for all this stuff: up to 30TB/day traffic according to arstechnica (costs surely more than 1-2k euro/month), loads of servers - all with the salary of a 20 years old ISP employee?

qwertyoruiop 14y ago
I'm a 15 year old 'kid` that has been pushing 30TB/day traffic thru a few Tor exits for months just fine, because I truly believe in freedom of speech. You know, money isn't that hard to get. For me, a few weeks of coding got me a few thousands of euros. He was running an ISP apparently, and selling VPSs. I've been sysadmining a few boxes for a few VPS hosting companies and got enough money to run a few Tor exits pushing over 2Gbps for months. (Also, I think that it's hilarious that me having my 15-year-old girlfriend pics is considered illegal, thanks to CP laws. ) I truly believe in this: http://datalove.me/ http://datalove.me/
- lazyjones 14y ago
  A TB of traffic will cost at least around €2-3 from most european (and other) ISPs with VPS so you basically claim to have enough spare change lying around at the age of 15 to pay €2000-3000/month just for Tor traffic because you're an idealist and after buying all the stuff a 15 year old normally buys first? ;-) I call BS, or rich parents. (and btw., WW was not running the ISP, he wrote somewhere in this thread that he is just a normal employee)
  - qwertyoruiop 14y ago
    > A TB of traffic will cost at least around €2-3 from most european (and other) ISPs with VPS The average bandwidth price I got from all the ISPs I used in the past was ~1 dollar/megabit. The ISPs I used for my Tor relays were ISPs I was using already for bandwidth-intensive HTTP hosting, so I already had quite a few deals for dirt cheap bandwidth. I've been paying ~600€ per box (1Gbit, of which I was using at least 60% 24/7, getting to 100% during day hours). > you basically claim to have enough spare change lying around at the age of 15 to pay €2000-3000/month just for Tor traffic because you're an idealist Yep. I got it mostly by selling iOS Tweaks on Cydia Store, private consulting with a few companies, freelancing, and sysadmining. > and after buying all the stuff a 15 year old normally buys first? ;-) The only thing apart from my tech equipment and servers that I'm interesting in buying is weed anyway. > (and btw., WW was not running the ISP, he wrote somewhere in this thread that he is just a normal employee) Thanks for clarifying that he was not running the ISP. I misread it, probably.

AlexMuir 14y ago

We need a community fund that can be used for things like this. The equivalent of a hardship fund with an aim of protecting our internet freedoms. It's good for the world, it's good for us individually, and it's good for business. Everyone throws a few €£$ in a pot and a few volunteers administer it and do a bit of due diligence to ensure cases are valid. I guess in the US this is the EFF, but there are plenty of cases outside their remit. It'd be like social security but for legal battles - but I don't think contributing/not should entitle or exempt anyone from funds.

lambda 14y ago
> Everyone throws a few €£$ in a pot and a few volunteers administer it and do a bit of due diligence to ensure cases are valid. You are fairly optimistic about the ease of administering a charity which gives out free money.
hornbaker 14y ago
How about a Kickstarter for legal defense funds? Is there one out there?
cynoclast 14y ago
I think we need to rethink our society because if the average person can expect to have their lives nearly ruined by a legal battle in which they did nothing wrong, we have a very defective legal system. Not saying we shouldn't do this, but that we shouldn't have to.
- dwj 14y ago
  So you think it's fine to allow someone to use your computer to transfer child porn and other illegal stuff with no consequences? While tor might have some legitimate uses, I think 99% of the time it's used for trolling or illegal stuff. It's a pain in the ass for me because I have to keep reblocking it when the ips change.
  - droithomme 14y ago
    It's past time for a contrarian viewpoint. How about we legalize child porn? The vast majority of the time when it gets brought up is in the context of using it as a pretext to attack civil liberties of law abiding citizens. When there is a child porn arrest it almost always ends up being a honey trap run by the FBI using decades old photos, so it's not like there are many children being protected by these laws.

dbaupp 14y ago

I know little about the Tor community, but is there any verification of these sort of claims?

loopdoend 14y ago
All tor node addresses are public. (Except for secret entry nodes.) I imagine this information could be used to verify claims.
throwaway125 14y ago
I briefly looked for other information about this and I found this thread on the tor-talk mailing list. The thread mentions he contacted the torservers.net team for a recommendation about a lawyer. The thread also mentions someone is going to provide better proof soon. https://lists.torproject.org/pipermail/tor-talk/2012-November/026616.html https://lists.torproject.org/pipermail/tor-talk/2012-Novembe...

haarts 14y ago

What if the guy had an open Wifi router? And the neighbors downloaded a movie? This goes to show law enforcement does not know what they are doing. I run a node as well and noticed other (far less severe) downsides of doing so. Registering on certain forums won't work and purchasing games on Steam doesn't work. These parties just blacklist the entire list of IPs published running exit nodes.

Tichy 14y ago
Where I live you can get punished for stuff people do with your open Wifi network. I think the authorities know exactly what they doing: they don't want people to anonymously surf the internet, so the prevent it by making it impossible to run Tor nodes or Wifi networks. I don't like it...
- error54 14y ago
  Same here. If you don't secure your wifi then you are legally responsible for what people do on your internet which I kind of understand but where does the line get drawn? If my computer gets hijacked and is used in a DDOS attack against some website, am I responsible for that too? At best this is all a legal gray area.
  - pi18n 14y ago
    A greyhat should write a virus that hijacks computers and makes them Tor exit nodes. Anyone can run it voluntarily and claim ignorance. And people that get hijacked would have been hijacked by something anyway, so they will at least be supporting free speech with this one.
    - finnw 14y ago
      Way to make politicians even less sympathetic towards Tor. It's now a "hackers' tool" as well as a "kiddy fiddlers' tool" BTW plenty of IRC-based botnets already do something similar, though usually without proper encryption.
  - 14y ago

drzaiusapelord 14y ago

>Yesterday i got raided for someone sharing child pornography over one of my Tor exits. Reason #1 why I will never run a tor exit node. I don't want to make it easier for child predators to get off nor do I want the legal issues they bring.

shocks 14y ago
There are plenty of legitimate uses for Tor.
- jcromartie 14y ago
  I wonder what proportion of Tor is used for legal purposes? I personally hold an extremely low estimate for that figure.
  - geoka9 14y ago
    What about email encryption? Should it be banned, too?
  - flyinRyan 14y ago
    Really, you can't imagine anything? You can't imagine a good thing someone might want to do over a network that is (well, is meant to be anyway) completely anonymous? Seriously, right now with Arab Spring going on, Syria shutting off the internet, China having the biggest firewall, other countries fiddling around with censorship, people going to jail for tweets or clicking "like" on facebook and you can't think of a valid reason one might want to be able to hide their online activities from prying eyes?
- shocks 14y ago
  Here is a good link, with more information. https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutCriminals https://www.torproject.org/docs/faq-abuse.html.en#WhatAboutC...
- kevindication 14y ago
  You don't find yourself in litigation for the legitimate uses of Tor.

error54 14y ago

I fully support TOR and I think that overall it's a good thing for the internet but legally I don't know if he has a leg to stand on. Being an exit node operator carries these risks which he knew about so the court system has him there. The danger if he is tried and convicted is that all it sets a dangerous precedent for the rest of the TOR network. Who's to say where the blame stops? Can the relay operators passing the packets along be convicted too? I hope for the sake of the TOR network that he gets off on the charges because if he does not, less and less people will be willing to be exit nodes which essentially means the end of the TOR network.

ef4 14y ago
The legal theory here is that he should have common carrier status, like an ISP. ISPs aren't generally liable for the things that their customers do over their network.
driverdan 14y ago
Without knowing and understanding Austrian law you can't make such speculations. In the USA he wouldn't be breaking any laws.
- jonpaul 14y ago
  Really? This surprises me. Do you have any research, evidence, articles to support this?
  - ef4 14y ago
    https://www.torproject.org/eff/tor-legal-faq.html.en https://www.torproject.org/eff/tor-legal-faq.html.en
    - jonpaul 14y ago
      Unless I missed something, they don't touch legality of Tor, other than: "Further, we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is lawful under U.S. law." This doesn't say anything. I can "believe" anything that I want, but it doesn't make it so. I'm looking for articles with sound legal rationale and previous case outcomes that argue on the legality of a defendant's culpability as it pertains to a crime being committed on said defendant's Tor exit node.

Irregardless 14y ago

What's next? If someone walks across my lawn with a backpack full of child porn DVDs I'll be liable for aiding a felon? I'm sure the authorities would agree that's absurd, yet it's fundamentally identical to this case.

pavel_lishin 14y ago
Wouldn't a closer analogy be someone suing FedEx because you used them to ship a DVD of child pornography?
- finnw 14y ago
  I think a combination of the two would be a better analogy: A complete stranger knocks on your door and asks you if it's ok for FedEx to deliver an unmarked parcel of DVDs to your house, and he will collect them from you later. You do not know his name or address. The package arrives. You open it and examine the DVDs, but find that they are encrypted. You pass them on as agreed. Next day the feds knock on your door, saying they have a tip-off that some child porn, bomb-making manuals and stolen bank account details were delivered to your address. You tell them exactly what happened. They seize your laptop and search it for said materials, but find nothing incriminating. Have you committed a crime? I hope not (in both cases) but at the same time I think if the tor exit node operator is protected from prosecution for illegal material passing through the node, then the person passing on the mysterious package should have exactly the same protection.
  - joepie91 14y ago
    The validity of that analogy strongly depends on whether local activists make a habit of passing packages with encrypted contents through your place, to avoid prosecution of a tyrannical government.

dewey 14y ago

his twitter account with some further information http://twitter.com/str0AT http://twitter.com/str0AT [german]

film42 14y ago

I will need to wait for his local news to confirm the story before I will donate. I trust him, but you can't just say I need all of your money without proof, that's like a certain Nigerian prince. I really hope this is fake because its really sad to see people like William get caught in the middle of a situation like this. However, with my gut feeling this is real, I will be waiting for confirmation to submit my donation.

JohnTheRipper 14y ago
William has a long history on LET, he runs a hosting company and is among the most well-known users on the site.

iamtherockstar 14y ago

If you go to a bank, rob it, and then walk outside to a waiting taxi, and have the taxi drive you home, is the taxi driver an accessory? I think that in the US you'd really have to make a case that the taxi drive had knowledge of what had transpired.

baak 14y ago
If you go to a bank, rob it, and then hand the money to your friend for hiding, then your friend is an accessory. (Possession of Stolen Goods at the least) Did he rob the bank? No. He may have just been at home, not involved in planning at all, you show up with $50,000, ask him to hide it and tell him it's stolen. He was just used to transfer the goods, but he's still breaking the law. Likewise laundering the stolen money is illegal, even though you didn't steal it.
- anonymous 14y ago
  Your scenarios are about knowingly transferring illegal goods. The Tor operator didn't know that illegal data was being transferred over his equipment. In the same way a webhoster isn't liable for the data his clients are hosting.
swalsh 14y ago
The thing is, if you're operating a TOR node you should have full knowledge that people are going to use it as much for illegitimate uses as much as legitimate uses.
- groby_b 14y ago
  And if you're operating a cab, you should have full knowledge that people are going to use it as much for illegitimate uses as much as legitimate uses. Your point being?
  - georgeorwell 14y ago
    For Tor, the ratio of legitimate to illegitimate is perhaps 1:1, whereas for taxis it's like 1000:1, or higher. At least that's how I read "as much as".

tomku 14y ago

It seems like a lot of people are objecting to the raid/seizure itself in addition to the possibility of conviction, so I have a question. Is it reasonable for the police to investigate an exit node operator for traffic coming from his node, even if they know he's an exit node operator? The way I see it, it's their job* to determine whether the traffic in question was relayed, or whether it was the exit node operator himself generating that traffic. In an ideal world, they could just call him up and ask nicely - but if he was actually guilty, he'd say "No, no way it was me!" and immediately start destroying any evidence. On the other hand, raiding someone's home or server rack and confiscating all of their computers isn't a great solution if most exit node operators are not guilty themselves. I'm not aware of a good solution that avoids inconveniencing exit node operators without giving them some kind of blanket immunity to investigation that goes beyond just relayed traffic. * - I'm aware that this might be impossible, but you can't know whether it will be ahead of time. It's possible that they could raid him and find no proof, even if he's guilty. It's also possible that they could raid him and find exactly what they were looking for. Like many investigation tactics, there's no guaranteed payoff.

ChuckMcM 14y ago
In the strict public policy sense you could argue the raid/seizure either way; The pro-raid argument would go "This activity harms society by allowing criminal activity which is part of the economics of exploiting children, thus it is right for the state to step in and make these raids to identify and contain those threats." Then you could make the anti-raid argument, "The economic disruption of taking a legitimate business off-line and possibly causing irreparable harm to innocent citizens does not warrant such a drastic measure without solid evidence of complicity in the commission of a crime." In the United States there is an analogous situation which is that of the 'high speed pursuit.' In the pursuit situation the officers have strong reason to believe the driver of a vehicle was involved in a crime and seek to arrest them. The driver of the vehicle doesn't want to be arrested and so they drive away quickly. If the officers give chase, they greatly increase the chance that harm will come to innocent bystanders. If they don't give chase they risk losing their suspect. Generally those debates come down to things like "what crime might they have committed?" and if it was failure to stop for a right turn, that is seen as not being as 'reasonable to chase' as hit and run vehicular manslaughter. I tend to fall into the "Do the police work to figure out who the crooks are and if you need the co-operation of an end-node provider then get a warrant to compel that co-operation." But I also have spoken to officers who feel that such restrictions are 'red tape' and keep them from doing the job they were paid to do. In this particular case we don't have the police version of the story. Perhaps they think this guy is complicit? Did they raid/seize any other end nodes? Did they have a warrant and what did it say? Had this person been involved in other questionable activities? "Presumption of innocence" is not a principle that extends outside of US borders so its always difficult to contextualize police action in other countries to Americans who take their constitution for granted.

jborden13 14y ago

People are working to verify that this isn't a scam.

WilliamAT 14y ago
http://raided4tor.cryto.net/ http://raided4tor.cryto.net/ and http://arstechnica.com/tech-policy/2012/11/tor-operator-charged-for-child-porn-transmitted-over-his-servers/ http://arstechnica.com/tech-policy/2012/11/tor-operator-char... (has scan of the search warrant) should be good enough for now :)

synthos 14y ago

Personally, I have 2Tb, and it's not legal (but not immoral). I can't imagine what legal uses an individual could have for 100Tb of storage.

acuozzo 14y ago
> I can't imagine what legal uses an individual could have for 100Tb of storage. An example: Raw captures (e.g., digitized home movies) can take up a lot of space, even if they're losslessly-compressed with a codec like Huffyuv or Lagarith. I have five raw captures of the same 2-hour VHS movie sitting on my HDD, as I plan to average them to reduce the appearance of artifacts due to tracking differences. Each capture is losslessly-compressed with Huffyuv and approximately __50GB__. That's ~250GB right there.
seanc722 14y ago
If you do anything with video/photo's and many other types of things the space adds up quickly. I had 2TB filled with just games that I had purchased. Just my steam folder alone is pretty massive. Files are getting a lot larger with the amount of storage we have access to. Just compare a floppy disk to a CD to a DVD. You've only used floppy's and someone comes up to you and shows you a CD... "WOW! what legal use could you POSSIBLY have for that!"
csense 14y ago
This line of reasoning is very troublesome. Your argument seems to be: "Don't make waves. Don't do anything out of the ordinary." To many people, having Linux installed on a computer is something that people have no legitimate reason for. No innovation or individuality. Everyone has to be exactly the same. Also, your line of reasoning goes against presumption of innocence. The suspect doesn't have to explain why he has that much storage. The police/prosecutor have to explain what criminal acts he's doing with that storage.
WilliamAT 14y ago
It's mainly server backups (encrypted by PGP even) (50% of storage), Movies, Music, Documentaries, Apps (legal and/or free/opensource) (30%), and empty space i had added a few weeks ago for more backups (switching from daily to 3hourly)

hosay123 14y ago

This is William of Edis.at, the company offering the free Raspberry Pi hosting deal posted here a few weeks ago.