Hacker News Reader

There's a very productive spammer that sends out spam for their shops and, on their home page, they have a big info about how they didn't send that spam, and it's just somebody else trying to ruin their reputation.

If all you'd need to deter law enforcement is to put a website up on your server and say that you don't have anything to do with anything happening on that server and that they shouldn't bother because there's nothing to see anyhow, a lot more criminals would do that. I'm sure they'd even put an actual exit node on their machines if that protected them from law enforcement.

Fair enough!

Maybe rather than a big info explaining that there's nothing to see, it could be a big info explaining that "source IP address" is useless as evidence of a crime, because, as this server and many, many other proxy services demonstrate, the IP listed as the origin is in no way guaranteed (or even likely) to be the actual origin of the traffic.

It's like raiding the home of the mail carrier because someone got drugs in the mail. Sure, it could technically be that the mail carrier is also a drug dealer. But when it comes to the USPS, the identity of who delivered the contraband package is not a useful data point for investigating the crime, and acting otherwise is willful ignorance.

> "source IP address" is useless as evidence of a crime, because, as this server and many, many other proxy services demonstrate, the IP listed as the origin is in no way guaranteed (or even likely) to be the actual origin of the traffic.

It doesn't have to be the actual origin for it to be useful—unless the software is specifically designed to avoid traces (i.e., Tor), there are often logs that will lead you to another IP address, which might lead you to another, which might eventually lead you to the source. It would be foolhardy for police investigating a bomb threat to not at least ask, given how many people they do in fact catch this way.

> It's like raiding the home of the mail carrier because someone got drugs in the mail.

No, in the case of OP it's like subpoenaing the local post office and asking for everything they know about where that package came from. Which is, incidentally, quite common, except that in the US the post office is a government entity that doesn't need to be subpoenaed because it has its own law enforcement agency that should have jurisdiction over the case.

The end goal is probably to get you to do what you did, which is shut down the exit node. If they make it painful to run a Tor exit node, they make Tor harder to use.

Exactly. Which is not as obviously an unethical approach as some here would think—if you are standing between law enforcement and a bomb threat, "I'm intentionally ignorant of the activities of the people that I'm shielding" is a morally dubious place to stand. The law allows law enforcement to subpoena records related to an investigation like this, and I honestly think it's fair to force Tor exit node operators to handle those subpoenas every time, even if the answer is always the same.

To have some sort of automated process in place to deflect blame allows an exit node operator to ignore the real damage their work can do. They may still decide that the good that they're doing outweighs the bad, but forcing them to see the negative consequences of shielding anyone who wants a shield has value.

Is that the horseman we're giving up our rights for today?

Your right to knowingly run a service that is used by people to kill other people while never having to interact with the consequences of that decision?

I'm not suggesting people shouldn't be able to run a Tor exit node. I'm suggesting that people who run Tor exit nodes should occasionally have to a deal with a subpoena that says "your exit node was used by a criminal to hurt people in ${these ways} and we require any information you have to help apprehend the attacker."

I don't want to deprive anyone of the right to make a moral decision, but I do want them to feel the weight of the full import of that decision.

If it is moral for the US government to create Tor, it is moral to use it. Sure, it may be it’s a tragedy of the commons, but there’s no individual moral accountability or responsibility for those running Tor because of things other people do or don’t do on it. That’s outside anyone’s ability to control anyway.

> there’s no individual moral accountability or responsibility

Of course there is. If I am deciding whether to dedicate resources, money and time to running a service which -

a) Helps dissidents in authoritarian regimes communicate freely

and

b) Enables bad actors to send threats and/or move CSAM around

Then that is absolutely a moral choice I need to make. It's not outside your control, you get to decide whether or not to provide the service.

> Your right to knowingly run a service that is used by people to kill other people while never having to interact with the consequences of that decision?

Can you name a product or service for which this is not the case? Militaries use general purpose software to design weapons. Murderers use vehicles and transit systems. We don't expect the government to harass the makers of cutlery because they provided a product used in a mugging.

I think that any creator of any tool should be faced on a regular basis with the harm that that tool causes and have to make the call on a regular basis if it's still worth it.

So steel workers should get a subpoena they have no effective means to respond to on a regular basis because steel is used to make all manner of weapons and machinery that gets used by bad actors?

This is a bad faith comparison and I'm not going to engage with it.

I'm honestly not sure what distinction you're trying to draw between them. Clearly any ordinary product can be used for nefarious purposes.

The distinction some people try to draw is when a higher proportion of a product's users are nefarious, but that doesn't really work either because who uses something can change over time.

If you have a society where nobody has window blinds or locks on their doors because it's a rural area and there is no one around to invade your privacy then locks will be disproportionately used by neerdowells "with something to hide", and then busybodies will claim that anyone with nothing to hide shouldn't be concealing their private spaces and anyone selling or using any privacy technology should be pressured to stop. Which sustains the status quo through external pressure even if someone does start invading everyone's privacy.

And that's what's been happening on the internet. Surveillance is the default, Cloudflare et al block Tor users as a matter of course and that drives normal people from Tor and similar technologies even though they would otherwise benefit from its use. People are told that it's the dark web where there are criminals and they shouldn't use it -- it being Tor Browser, the thing that keeps ad networks from tracking them across the internet.

Then after dispersing the normal users who would otherwise benefit from using it, people say that it has a lot of nefarious users to justify the continued harassment of anyone who does. But that's just path dependence, and there are parties interested in leading us down the garden path to mass surveillance.

> Clearly any ordinary product can be used for nefarious purposes.

Right, I could kill a person with a spoon. Still we regulate guns and not spoons, why is that?

> not sure what distinction you're trying to draw between them

Cost versus benefit. Steel has massive, obvious benefits. That makes its costs worth it. On the other hand, several toxic compounds have no known benefits and are tighty regulated.

You're trying to argue Tor's costs are worth its benefits. But that requires being clear-eyed about both. You can't build buildings and spaceships out of Tor. But neither can you fashion it into a gun. Unless you're arguing for solely action-based regulation, never access-based, which is its own idiotic can of worms.

I believe you are right. I have heard OP's argument many times before, it is almost akin to the "you only need privacy if you have something to hide" and whatnot; same kind of mentality.

Everything could be used for nefarious purposes, and I do not think that is why we should "stop having nice things".

By their logic, we should get rid of encryption, too, completely.

You apparently read what you thought I was going to say and not what I actually wrote. This does not even begin to approach an accurate assessment of what I said or meant.

I'm saying that too many people in this forum are too comfortable completely ignoring the harm that Tor causes, and in order to make a good judgement call about whether to run an exit node the harms need to be surfaced. Full stop.

Everything else that you and others in this thread read into my comment is on you, not me.

Tor does not inherently cause harm, though. Similarly to how E2EE does not cause harm, nor do platforms (or programs) where you are allowed to exchange messages. Do you agree with the first statement or not? If not, what are the differences between Tor and IM software with E2EE?

> Tor does not inherently cause harm, though.

Case in point.

> If not, what are the differences between Tor and IM software with E2EE?

I would never run an IM software with e2e encryption either, for the same reason. I don't want to be paying to move data that is being used to hurt people, no matter how many people I'd be benefiting in the process.

If other people come to a different decision that's entirely reasonable as long as they're cognizant of the harms caused and not in denial.

Where do you draw the line?

You are talking into a void following this line of reasoning. There is no logical consistency in the context of a state and all the myriad of terms and concepts in its wake. That's by design and everyone that's brought up under it from a young age is taught to embrace that, as a feature. Your words are foreign invaders and every core of these smart people's beings will fight you with their ridiculously smart and well trained antibodies.

Not trying to single out the person you're responding to, but I've seen this play out many times and engaged in it previously to no effect.

Aside from this being a bad faith comparison - no way you actually believe that steel rods and bars can't be subject to EAR

You can't justify a bad policy with a different bad policy. Trying to control access to a fungible global commodity is pointless.

You've questioned existence of such "bad policy". I pointed out that there are such policies. I neither supported nor opposed them.

I won't be surprised if there were something in US criminal code with supreme court precedents that specifically dictate the government harass in timely manners the makers of cutlery used in a mugging. There _are_ always laws. _Everything_ is regulated. Most of those regulations are reasonable.

We, uh, absolutely expect the government to "harass" people operating transit systems for any and all information about a criminal using that system.

Camera feeds, ticket records... All of that is accessible via warrant. That's probably the most salient example in this context.

Tor exit nodes don't have any information to identify the end user. They don't know who it is, so there is nothing to subpoena or turn over. Subjecting low-resource entities to a known-futile legal process is a form of harassment.

It's not known-futile. A misconfigured Tor node could be storing all sorts of useful traffic data. Besides, there's also the possibility that the exit node operator themselves could be the actor; since the trail stops at them, they're under suspicion.

Exactly: They intentionally built their transit system without cameras. Who benefits from that, except criminals? Oh yeah, sure: North Korean dissidents, Saudi LGBTQ people, etc, etc.

Yes, quite noble. But: How many of those are there using it, and how many criminals? It's mind-boggling how people so adamantly insist on seeing this only as black-and-white, and refuse to admit that there even exists something to weigh against each other.

> I suppose my issue stems from my perception of the seemingly lack of serious investigation on their law enforcement side.

That's my experience too from actually having my house raided. I had two kids in bed at the time, and the police didn't even know to expect kids in the house (both kids were over 11 years old, had birth certificates, had lived in that house all their lives and attend local schools and are darn fine students).

They didn't know. It's mind boggling to me that they could get a raid warrant without having done even the most basic (below even basic) investigation.

My opinion of police investigative competence took a 99% hit as a result.

It's a lesson my kids won't forget either.

The raid no doubt was carried out by the police. They just what they are told to do by an organisation that is higher up. No one will get reasons. Maybe the chief of police. But only a limited amount so he can claim plausible deniability.

The dirty people behind all this are in the way they run the investigations. And what way is that ? Well it’s the “organised crime investigations”. The Netherlands pushed the RIEC way of working here to Germany and Belgium. Look it up. Euriec.

The whole way of working is to do dirty tricks in an unaccountable way.

I don’t know. Could you imagine if you were in charge of investigating something like this and you _didnt_ check one of the computers involved just because the guy who owned the computer claimed it doesn’t have anything useful on it?

There could be logging bugs in Tor that you were unaware of, or the owner could be using Tor as a cover. It would be negligent _not_ to at least check the device logs for anything useful.

By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? After all, the ISP could be secretly in on the criminal plot, and how could you know without imaging every hard-drive in the data center? It would be negligent not to.

The truth is that police investigations normally are restrained based on the disruption that they cause the public. Police deviate from standard operating procedure when it comes to TOR exit node operators because they want to punish and intimidate them.

They want to punish operators because the authorities are frustrated by the effectiveness of these technologies in countering the pervasive surveillance environment which the authorities take for granted.

> By that logic why not also seize and do forensics on all the ISP's routers too then, just in case? After all, the ISP could be secretly in on the criminal plot, and how could you know without imaging every hard-drive in the data center? It would be negligent not to.

Implying that they don’t have the capability to do this already and/or alternative means to accomplish the same thing.

https://en.wikipedia.org/wiki/Room_641A

> Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency, as part of its warrantless surveillance program as authorized by the Patriot Act. The facility commenced operations in 2003 and its purpose was publicly revealed by AT&T technician Mark Klein in 2006.

< By that logic why not also seize and do forensics on all the ISP's routers too then, just in case?

You think they don't!?

ISPs cooperate with law enforcement. Most even have dedicated staff for that.

So there's no need to seize their equipment.

They could be lying though, especially if they are in on it. Why not seize the equipment instead?

/s

> Police deviate from standard operating procedure when it comes to TOR exit node operators because they want to punish and intimidate them.

Citation needed. ISPs have entire departments dedicated to cooperating with law enforcement. Comcast has a whole portal with its own subdomain specifically for handling requests from law enforcement [0]. Cox has a page detailing exactly how to send them a subpoena [1]. These guys are clearly dealing with subpoenas just like the ones OP is describing all the time.

It only seems out of the ordinary this time because it's a random person who decided to play middle-man instead of an enormous corporation with a massive legal department.

[0] https://lrc.comcast.com/lea

[1] https://www.cox.com/aboutus/policies/law-enforcement-and-sub...

Maybe they did not expect any useful info? One gets jaded but https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

That isn't the reading I would make of the situation.

Like the OP says, it's harrassment to discourage continued operation.

I think that's what the person you replied to was saying. The purpose of the "system" of law enforcement is not what they say it is (to try and gather evidence from the server), but rather is what the system does (get people to shut down exit nodes because of the hassle).

> Seriously, all they had to do was plug my IP into a browser or do a simple scan of it but I suppose that's asking too much from LE lol.

I mean, yes, I'm pretty sure "just take my word for it" is asking too much of LE.

We can always say "Come back with a warrant" but then sometimes they'll come back with a warrant.

> They should know what Tor is and know that any Tor server contains ZERO info

Unless, of course, one has misconfigured it... Which could be the case. Definitely the kind of thing LEO can figure out on the other side of a seize-and-strip of the hardware. Unfortunately, I think the only way to not be a part of the story here is to not be a part of the story here... Don't proxy anonymous traffic if you don't want law enforcement asking after the anonymous traffic you proxied. Otherwise, expect the responsibility imposed upon a service provider (since you're providing a service).

Other ISPs avoid this scrutiny by going out of their way to be helpful to law enforcement.

Yup that's the same conclusion that I've come to for now. I got a family and stuffs now so don't want to bring any stress to them.

One day I will resume but in the future :)

There is no way for police to know if the traffic came through tor, or was initiated by the owner of computer/server. It seems reasonable that the police have the right to investigate. If not, anyone could run a tor node to cover up their own criminal activities. Even if you did have logs suggesting it was tor activity, should we trust someone’s claim that the logs are proof that it was someone else?

It would in fact be negligent if the police did not properly investigate the server/computer/house of the device.