The EFF Reflects On ICE Seizing a Tor Exit Node

An anonymous reader writes "Marcia Hofmann, senior staff attorney at the EFF, gives more information on the first known seizure of equipment in the U.S. due to a warrant executed against a private individual running a Tor exit node. 'This spring, agents from Immigration and Customs Enforcement (ICE) executed a search warrant at the home of Nolan King and seized six computer hard drives in connection with a criminal investigation. The warrant was issued on the basis of an Internet Protocol (IP) address that traced back to an account connected to Mr. King's home, where he was operating a Tor exit relay.' The EFF was able to get Mr King's equipment returned, and Marcia points out that 'While we think it's important to let the public know about this unfortunate event, it doesn't change our belief that running a Tor exit relay is legal.' She also links to the EFF's Tor Legal FAQ. This brings up an interesting dichotomy in my mind, concerning protecting yourself from the Big digital Brother: Running an open Wi-Fi hotspot, or Tor exit node, would make you both more likely to be investigated, and less likely to be convicted, of any cyber crimes."

Re:Intimidation

[betterunixthanunix]

An employee at an ISP could download child pornography and disguise it as traffic from a customer. Why, then, does ICE not seize the ISP's equipment as part of their investigation, just to see whether or not that is the case?

The way you know that this has nothing to do with legitimate investigatory techniques is that ICE threatened the guy when they returned his equipment, telling him that he have to deal with more law enforcement harassment in future should he continue operating a Tor exit. This is a straightforward case of harassing the exit node operator because ICE was unable to defeat Tor. Aside from the minority of law enforcement officers who understand that law enforcement agencies benefit from Tor, law enforcement officers in general disdain Tor and think that it is a tool for criminals.

Re:Intimidation

[betterunixthanunix]

So why not treat corporate ISPs the same way -- after all, one of the ISP's employees might be using the ISP's equipment to download child pornography, and attempting to disguise that as if it were one of the ISP's customers. Why is ICE not seizing routers and other equipment from ISPs as part of its investigation?

Right, because individual citizens are not supposed to be providing communication services, only registered corporations are supposed to be doing that sort of thing.

What about in Europe?

[ChumpusRex2003]

Does anyone know what the legal issues about TOR are in Europe?

European law makes the last 'named' user of an internet connection responsible for any transmissions via it. So, if running a TOR exit node from your home, your name would be the last name on the list (after your ISP, etc.). As a result, if a offence is committed via your connection, then you as the last named party are the person responsible for it.

The only defences are:
1. That you can provide proof of identity of the person who did commit the offence, or other strong evidence that you were not responsible.
2. You can prove that the use of your connection was unauthorized (and that you were not negligent in securing access to your equipment).

Re:ICE is doing what now?

[betterunixthanunix]

every criminal could simply operate a Tor exit node and be out of reach of investigation.

Or they could just use Tor, and avoid being investigated in the first place. Which is what happened in this case.

The "every criminal will use this excuse" theory is baseless. If an IP address is the only evidence that someone committed a crime, then that person should not be convicted -- and we should be examining what sort of laws led to a situation where IP addresses are the only evidence needed for a search or arrest warrant. I share an Internet connection with several other people; should we all be arrested if the IP address happened to be an endpoint of illegal data? There are dozens of people who have SSH access to my research group's server, and it is possible that any of them could use that server as a proxy -- should the server and all of our computers be confiscated, and all of us arrested, if the IP address shows up during an investigation?

IP addresses are not a form of identification, and even less so when a Tor exit node has that IP address. Anyone could be a criminal, but we should have higher standards for evidence when it comes to issuing warrants and confiscating equipment.

Comment removed

[account_deleted]

Comment removed based on user account deletion

I've gotten a call from the police about TOR

[hawkeyeMI]

I run an exit node on a VPS. Apparently it'd been used by some guy to try to get a teenaged girl to send him naked pics. They subpoenaed everything back to my business cable connection at home and then called up my company (i.e. me) about it citing a scary amount of information about me. I explained to the detective what TOR was (I already have the standard exit node info page up as recommended on the web server), and he'd already heard it from someone else (a civil lib organization running TOR exits used by the same guy). They dropped it there. Scared me a little and I contacted the EFF, who did not hesitate to offer support should something worse happen in the future. EFF is one of the only organizations I donate to, ever, and I donate a decent chunk of change every month. I'm a proud supporter and it's good to know they're there to support me too.