To understand how a traffic analysis attach works, you first need to understand how hidden services work. The way Tor hidden services work is that the hidden s

To understand how a traffic analysis attach works, you first need to understand how hidden services work. The way Tor hidden services work is that the hidden service builds a route (called a circuit) through the network of Tor nodes through to a node which it calls a 'rendezvous point' (RP). It then repeats this process to establish multiple circuits, one to each RP. The IPs of the RPs are public information, but no node (not even the RP) except the hidden service knows the route the circuit takes to the RP - only how to get to the next hop. End-users build their own circuit with Tor to the RP, so the RP or the hidden service also don't know the identity of the end-user. An attacker wants to find out the route a circuit takes from an RP to the private node, to find the private node. Tor does not send masking traffic - it only sends data when someone is actually asking something. So when someone sends data through the RP, the RP receives that data, unwraps one layer of the 'onion' packet and sends the rest along the circuit. The next node does the same. Therefore, this creates a pattern that is observable to someone who is sniffing the networks. An attacker with access to all the networks between the nodes cannot see the contents of the packets, since it is encrypted, but they can look for the pattern in the traffic to see where the traffic is flowing. If no one was using Tor at all except for one packet being sent along one circuit, it would be trivial to see the path a packet follows, since you would see the RP sending the packet, then a slightly smaller packet going to the next node, and so on to the destination. In practice, lots of people are using Tor, so you need to do statistical analysis and build up confidence over time about a circuit. If there is an unusual amount of data traveling over the circuit you care about (e.g. due to a DDOS), this again makes it easier - just look for all the most active nodes. If you can send a pulse of exceptionally high traffic, you can watch the time evolution of the pulse through the system and see where it ends up. Even without a high traffic pulse, you can compute probabilities that observed traffic outputs from a node were caused by a given input (based on the timing, size, etc...) and over time, combine a lot of individual points of weak evidence to get strong evidence about a circuit. The complaint says that the 23rd was when they asked a foreign government to assist them by imaging the server - so they know where it is physically, and who owns the datacentre.