Hacker News Reader

Comment by bergie | Hacker News Reader

Interesting, all the Berlin exit nodes are in a place that is a huge construction area on the Museum Island. Based on this I suppose they were only able to do city-level positioning (GeoIP or something similar).

View on HN

It's worth noting that the statistics may be skewed because e.g. of US-based operators run their nodes at foreign ISPs due to fear of US law enforcement. Countries with more "liberal" policies probably have more nodes because of this, but it doesn't necessarily mean there are more operators based in those countries.

Ah, I see the distinction you're making: this is a map of exit nodes, not exit node operators. The operators can of course be anywhere in the world. For all we know based on just this map, all the tor exit node operators live in Antarctica.

I'm curious: what are the specific laws that we should be concerned about?

(Obviously the US has many draconian laws regarding cyber-anything, but I'm curious what specific lines we cross with Tor Exit Node operation. Does it include something like ownership and responsibility of the data that passes through a node that we operate?)

Yes, exactly. There's never been any case law on the issue, but in the ideal theoretical world, exit node operators would get the same protections from what their users do that ISPs do.

Unfortunately, since we're often a single guy with no legal entity, we are not afforded such protections by default. I've been running an exit node since 2005, and I've had to switch ISPs numerous times because of abuse coming out of the node. I've even had my hardware physically confiscated when network administrators couldn't figure out what kind of traffic was coming out of it.

While I believe in the goals of the Tor project, I am not really interested in being the guy who has to set the precedent here, so I don't run my exit node in the US any more. If history is any indication it would be a long legal battle to set such a precedent.

See https://www.torproject.org/eff/tor-legal-faq.html.en for more discussion on the topic.

I would think that in any decent courtroom, then eventually would, since those same protections apply to forum operators, chat rooms, picture sharing sites, etc. But I don't blame you at all for not wanting to be the test case, since that would probably be rather expensive and likely to disrupt your personal life.

Your ISP is obviously an ISP, and most law enforcement agencies understand that and that it means that if something dirty comes through there, then an employee of the ISP most likely didn't do it. But if you're using your home PC as an exit node... most agencies probably have no idea what Tor is, and would assume that you personally were doing whatever came through it, and would commence with the whole search, seizure, and media circus before they figured it out.

The article clearly states that they're using GeoIP:

"Geolocation was performed against the IP addresses using the Free GeoIP API"

That quote even contained a hyperlink to Free GeoIP's website.

He notes just above the map, that they used freegeoip.net. So it is indeed city level.

I agree. Majority of Central London ones are right in the middle of the financial district.

And Edinburgh's are smack-bang in the middle of Princes Street Gardens, which is staggeringly unlikely unless they're subterranean...

Yes, obviously city-level GeoIP lookups.

Reply on news.ycombinator.com