A sybill attack on Tor is probably the least efficient attack. It'd be far easier to perform a correlation attack if you know the probable endpoints, or comprom

A sybill attack on Tor is probably the least efficient attack. It'd be far easier to perform a correlation attack if you know the probable endpoints, or compromise the target's computer (if you only know the source). I'm sure government agencies run Tor exits, which means they'll see the middleman node's IP addresses and whatever traffic the originator sent (usually HTTPS). They can't do much with that.