Tor operator charged for child porn transmitted over his servers

http://arstechnica.com/tech-policy/2012/11/tor-operator-charged-for-child-porn-transmitted-over-his-servers/

by roadnottaken • 14 years ago

51 54 14 years ago

arstechnica.com

dragonbonheur• 14 years ago

Then the phone company should be charged for the same content that went through their wires.

goostavos• 14 years ago

Heck, by the logic the police are using, the state should be charged with drug trafficking since surely their roads are using to transport illicit drugs by individuals. So long as we're charging people who have nothing to do with the actual crime.

The terrifying part is I wonder if the judge will have any idea what Tor is, or even be capable of understanding once it's explained to him. I don't see how anyone with even the slightest technical knowledge could do anything but throw this case out.

halvsjur• 14 years ago

It's not difficult to understand what Tor is.

Given the job description and circumstances, what is a judge supposed to do in this situation? There are deeper issues here.

For the record, I've considered running an exit node in the past when I had the bandwidth available.

gizmo6863• 14 years ago

>The terrifying part is I wonder if the judge will have any idea what Tor is, or even be capable of understanding once it's explained to him. I don't see how anyone with even the slightest technical knowledge could do anything but throw this case out.

This is why we have trials. Even ignoring the fact that the judges often need to learn new things (and therefore doing so is part of their job), Tor is not very difficult to understand. An user sends an encrypted message to a Tor 'exit node' (which can be run from any internet connected computer). This exit node then decrypts the message to get another encrypted message, which it sends to a 'relay node'. This process is repeated several times until it becomes fully decrypted at another 'exit node'. At this point, the exit node sends the message through normal channels to the intended recipient. The recipient may sends a response back to the exit node, in which case the response is encrypted and sent back up the chain of relays until it reaches the user.

If a judge cannot be bothered to invest the time needed to understand that system, then the legal system already has serious problems.

baddox• 14 years ago

Don't forget the camera companies. Oh, and all the companies that sold food to the creators of the child pornography. Bunch of enablers.

gizmo6863• 14 years ago

Also the children.

I'm only half joking, there have been cases where children (teens) have been charged with child pornography for images of themselves. Forget about illegal data, this is what happens when you try to stop one action by criminalizing another. In this case, stopping the exploitation of children by criminazing child porn.

SeanDav• 14 years ago

He must be making money from running the tor exit node servers, otherwise how does he afford the terrabytes of bandwidth?

Retric• 14 years ago

Some places have cheap residential Gigabit broadband. Using 1/3 of that on TOR is 150 Gigabytes per hour and 108 Terabytes per month of bandwidth in theory without a user noticing.

ChuckMcM2• 14 years ago

Oh man, Kansas City doesn't know what they are getting into!

More seriously though, the price of bandwidth is dropping. I see these kinds of actions really as a way to prep the record with "stories" which link TOR and "Child Pornography" so that at some future proposal to outlaw such things a legislator will Google it and see a bunch of hits and go "wow this really is a problem, we should do something" having never read a single story.

If you're aware of this technique you can see examples of it all over the place. Another (perhaps local) version of this is MDMA which isn't technically illegal (its just a chemical that oh by the way if you ingest it affects you kind of like meth) and so first they label it "bath salts" then there are a lot of stories with "bath salts" + "bad outcome" (regardless if there is a proven or even plausible connection) which I expect to be followed by some sort of legislative action where all of a sudden I need to ask the pharmacist to buy Tums or something which can be used as a precursor to making it [1] from behind the counter and only in small amounts.

[1] The exemplar being sudafed which is controlled like crack cocaine in some jurisdictions.

gtt2• 14 years ago

I wonder, is it possible to mine that data for something valuable?

tjoff2• 14 years ago

Mining for passwords isn't uncommon. And while most valuable targets use encryption most users use the same password for most services.

You could go one step further and play with MITM as well.

cjbprime2• 14 years ago

> I wonder, is it possible to mine that data for something valuable?

Yes, people have published papers doing this:

http://homes.cs.washington.edu/~yoshi/papers/Tor/PETS2008_37...

My understanding is that looking at exit node traffic individually rather than statistically is likely to be illegal in many jurisdictions.

cjbprime2• 14 years ago

> He must be making money from running the tor exit node servers, otherwise how does he afford the terrabytes of bandwidth?

He's running an individual exit node. You can run an exit node with as much bandwidth as you can spare. You can set bandwidth limits per month so that you don't go over your quota. Once your bandwidth's used up, people will just use a different one.

I'm running an exit node myself; I have a server that I only use for basic tasks that comes with a few terabytes of monthly transfer, so there's an IP on that server dedicated to Tor.

thinkling• 14 years ago

This was just discussed here: http://news.ycombinator.com/item?id=4847468

graeme• 14 years ago

This seems like new news. There's a difference between a raid and a charge.

bstpierre• 14 years ago

I was looking for the difference too. The two articles seem contradictory about whether he's actually been charged.

Arstechnica says: > nine officers searched his home on Wednesday after presenting him with a court order charging him with distribution

The blog post says: > During the raid, numerous computers and other electronic devices, as well as legal and registered firearms and some other items, were seized. William is likely to be charged with distribution

The Ars subtitle also says "Austrian man is latest to be held responsible for traffic passing through Tor" [my emphasis], which seems misleading -- his machines were taken, but he hasn't been convicted of anything yet.

droithomme• 14 years ago

Were the operators of all the other dozens of routers, switches and exchange point nodes that the files passed through also arrested? Or did the police selectively choose to only arrest the operator of one particular node that just happens to also be used for preserving privacy?

anigbrowl• 14 years ago

just happens to also be used for preserving privacy

As if there were no correlation between that and the use of the service for distributing CP. I'm sorry, but I find it hard to get exercised about the invasion of privacy aspect, considering much greater invasions of both person and privacy that take place in the manufacture of child pornography. Liberty does not subsist in the oppression of others.

mistercow3• 14 years ago

It's not possible to create a system which protects the anonymity and privacy of users with integrity, but not of criminals. The cost of a free society is that sometimes people will do bad things and get away with it.

As regards Tor, it's extremely debatable that its existence has any impact at all on the distribution of child pornography. If you don't care about hurting people, there are way more effective ways to protect your anonymity than Tor.

In addition, Tor is an incredibly useful tool for fighting corruption in countries where online privacy would otherwise be non-existent.

So on the one hand it's a tool that gives anonymity to a group that already has it. On the other hand, it's a tool that aids in reducing human rights abuses across the board, including human trafficking.

kevinskii• 14 years ago

The sentiments of the parent comment may differ from yours (and mine), but they are intelligently stated and do not deserve to be downvoted.

pwniekins• 14 years ago

These are the nonsensical laws that result from "illegal data".

duaneb• 14 years ago

Well, the alternative is... legal child porn?

Not saying I like the laws. But i don't know of an alternative to holding people accountable for data.

cynicalkane• 14 years ago

What the heck? The point of Tor is nobody but the exit node can be easily identified. Are you demanding the authorities have the resources to completely crack Tor before they can arrest anyone? That is probably not the best way to protest this action.

polshaw• 14 years ago

No, he is saying that the exit node's role is little different from that of any other node that the traffic is routed through (including) after the request hits the exit node-- eg the exit node operator's ISP.

cypherpunks01• 14 years ago

Where exactly do you find a 'child face in sliced red onion' stock photo?

Karunamon• 14 years ago

One of Ars' editors, Aurich, is a serious photoshop wizard. He's known for some pretty witty headline images.

ChuckMcM2• 14 years ago

No, he is frickin' AMAZING with photoshop. I love his work.

Tyrant505• 14 years ago

So why would anyone run a exit node?

anonymous2• 14 years ago

Altruism?

fiatpandas• 14 years ago

Altruism like someone said, but also snooping. I can only imagine all the fascinating traffic that comes in and out of an exit node. I guess people weigh the risk of getting in trouble for child pornography with the advantages of being able to monitor a ton of data for interesting information.

konstruktor• 14 years ago

IANAL, TINLA. I just had a look at the law concerning service providers (E-Commerce-Gesetz - E-Commerce Law) in Austria. It is quite liberal in its definition of a service provider, i.e. it does not only cover commercial service providers, and does not require any kind of license, but basically defines a service provider as a personal or legal entity that "provides a service of information society". Also, it contains several clauses that give providers immunity for the data they store and transmit. However, one explicit requirement is that the provider may not change any of the content transmitted to claim immunity. I am very interested in seeing whether the decryption/encryption of the data will prevent him from claiming immunity.

I want to add that Austrian law is very strict when it comes to the presumption of innocence. The right of a suspect not to be named, shown on a picture or otherwise identified is almost abolute (the only exception are suspects on the run, where this could help apprehend them). As an Austrian, I found it very disturbing to read the guy's full name in the ars article, something local media would not be allowed to do. If he is lucky and found innocent in court, the top search result with his name will forever be the ars article.

gizmo6863• 14 years ago

> However, one explicit requirement is that the provider may not change any of the content transmitted to claim immunity. I am very interested in seeing whether the decryption/encryption of the data will prevent him from claiming immunity.

I am not familiar with the Austrian law, but my guess would be it acknowledges changing content as part of a technical protocol as different from changing the content's meaning. For example, if a service provider runs a site to convert .tiff into .jpg, and someone uploads an illegal picture, I suspect that the conversion would not be considered changing content. This suspision comes from the fact that the type of not content changing that would otherwise be required exludes a great number of the services that seem like would be protected under this law.

Again, I am not a lawyer, nor am I fammilar with any Austrian law.