Hacker News Reader

Comment by vilhelm_s | Hacker News Reader

I wonder how exactly they tracked that he was using Tor at the time---does Harvard specifically log connections to the Tor network? Or do they log every outbound TCP connection?

View on HN

The Harvard (non-guest) network is secure - you must connect to it using your Harvard web ID login information. Harvard can then uniquely identify all of your traffic. (http://www.fas-it.fas.harvard.edu/node/189)

I guess I should have written a paragraph's worth of inane blog spam to get my submission title used? I was trying to make this exact point in my original title. The title my submission was assigned is not the real title of the PDF either... seems very arbitrary.

Many institutions & providers gather Netflow data (source, dest IP+Port, number of bits, flow duration) and store for a period of time to use in detecting DDoS, performance monitoring, and planning transit/peering. Correlating that with access to known tor nodes and you're done.

My guess is they have logs of every outbound TCP connection—it's not like Tor is the only protocol that can be used for evil.

By and large, if he tethered his cellphone and used Tor that way (or sit outside a coffee shop, etc), he wouldn't have been caught?

Tethered cellphone probably will be identified, though that would be slower as it needs to go through the ISP.

Coffeeshop will make it even harder, but may still have issues like identifying the computer, etc. etc.

Identifying from a cellphone connection would require the FBI to get a log of all Tor connections from all cellphone users in the area. And it still doesn't prove anything. Compared to just asking the campus for their records, it's a totally different league. It's not even clear if cell ISPs track every TCP connection.

They would have only needed a log of all connections within a very short time window (a timing attack, which ofc is not tor specific, after all someone might chain a proxy and tor). If the terrorism card is on the table I wouldn't be surprised if they had done that first and only after that constructed a legal case. Remember that there was a good period of time during which they had the bomb threat but they didn't necessarily know it was fake.

Reply on news.ycombinator.com