Tor exit node operator prosecuted in Austria

https://network23.org/blackoutaustria/2014/07/01/to-whom-it-may-concern-english-version/

by msl • 12 years ago

286 138 12 years ago

dewey• 12 years ago

Official statement from the guy who got sentenced: https://rdns.im/court-official-statement-part-1

lawl• 12 years ago

Came here and to post this too. It's really a shame how the current system of law enforcement is designed to destroy completely destroy people.

I'm idling in some of the same public IRC channels as will (since way before he was raided for running a TOR node) it was/is painful to watch how this completely destroyed him.

It has really put me off, and probably many others, from ever hosting a TOR node, which might what makes this even worse. If you want to help people in heavily censored (or monitored, but what would be every single one of them, as of now) countries you get punished and your life gets completely ruined.

Seriously, the guy was like 20 or so when the police raided his home because of a TOR relay. Financially and mentally ruining someone when he didn't even do anything wrong is just... It makes me really angry.

icehawk219• 12 years ago

  It has really put me off, and probably many others, from ever hosting a TOR node

The cynic in me can't help but assume that that's the entire point.

teamhappy6• 12 years ago

Unfortunately this hasn't been the first case like that and it probably won't be the last one either. Saying they destroy peoples lives on purpose isn't fair though. Everybody setting up an exit node knows there's some chance the police will knock on your door one day or at the very least you'll end up getting a lot of letters. Projects like https://www.torservers.net exist for that very reason. I understand donating money isn't as fulfilling/fun/cool as hosting an exit node yourself but at this point everybody should be well aware of the possible consequences.

xienze3• 12 years ago

If you want to help people in heavily censored (or monitored, but what would be every single one of them, as of now) countries you get punished and your life gets completely ruined.

I know that's the dream of everyone running a Tor node but let's face it, you're mostly helping drug dealers and child pornographers operate. Not saying that's your intention, but that's what's happening. That's why it's absolutely crazy to operate a node. Find some other way to help if you value your freedom.

jseliger• 12 years ago

It's really a shame how the current system of law enforcement is designed to destroy completely destroy people.

No one is innocent: http://marginalrevolution.com/marginalrevolution/2013/06/no-... .

anon44• 12 years ago

Maybe, and I realise this sounds borderline crazy, but hear me out.

Maybe we shouldn't be running TOR exit nodes personally. It seems to me a couple of people should form a nonprofit company to run the node and distance themselves from liability that way. You'll still need to shut it down if your company is found guilty of running a server that was used to distribute bad bits, but it would be more "we wanted to make something nice and these gosh darned paedophiles got in our way and we can't continue" and less "you collude with paedophiles and are a paedophile and a criminal". It will be harder and it will take more funds and perhaps it's borderline impossible, but this is where things seem to be going. Be a corporation, because individual people get squashed like bugs.

EthanV2• 12 years ago

Does this mean that Austrian ISPs can be prosecuted if their customers use their connections to transmit "content of an illegal nature"? Surely the ISP knows that some of their customers could use their services for illicit purposes, meaning they're "guilty of complicity" themselves.

wfjackson• 12 years ago

Perhaps the logic of the court is that the ISPs do no provide essentially anonymous access. ISPs can and do turn over customer info when ordered by courts/law enforcement.

SnotJockey• 12 years ago

But the customer info turned over is not necessarily the guilty party either. If you have free wifi in your cafe now you're responsible for anything illegal your clients do?

It's a bad judgement on all counts.

teamhappy6• 12 years ago

For sure. At least in theory. That's always been true though. I don't think Austrian ISPs worry about it to much because precedents don't influence court decisions as much as they do in the US.

phillc732• 12 years ago

I have a VPS with an Austrian ISP. Their Ts&Cs already state the following are specifically not allowed:

Tor/i2p/similar exit servers (bridge, entry and middle are fine until further notice)

Last update was Jan 17th, 2014, but this clause has been included for as long as I have been a customer, which is a couple of years. So, I would say at least some Austrian ISPs are aware of the risk.

devicenull• 12 years ago

It's much more likely that they just don't want to deal with the endless stream of DMCA notices that tor exit servers tend to attract.

jdong• 12 years ago

Coincidentally the very person who was sentenced here operates the hosting company you're with (edis.at)

esbranson6• 12 years ago

It means absolutely nothing. Austria does not follow the common law doctrine of stare decisis, where each case is bound to follow whatever reasoning is used by a superior court. (Note that "constant jurisprudence" is completely different and is not really binding, since higher court chambers do not have stable composition and as such their reasoning may not be consistent.)

A different court is allowed to use completely contrary reasoning and interpretation of "enables or facilitates" ("ermöglicht oder erleichtert") and "intent" ("Vorsatz") in § 12 StGB. The more money you have, the more likely that is. Also keep in mind that sometimes juries composed of short-term politically-appointed local politicians ("lay judges") are used, so that also adds to the complexity.

Austria's women and landscapes are beautiful. Austria's legal system, not so much.

the_mitsuhiko7• 12 years ago

Austria's women and landscapes are beautiful. Austria's legal system, not so much.

I think our legal system is pretty good to be honest. (Then again, I also pretty much agree with the fact that TOR exit nodes are not compatible with Austrian law.)

rbehrends2• 12 years ago

A different court is allowed to use completely contrary reasoning and interpretation of "enables or facilitates" ("ermöglicht oder erleichtert") and "intent" ("Vorsatz") in § 12 StGB.

In general, lower courts are still going to follow the superior courts, or they will simply be overturned on appeal. And if a judgement is reversed by an appeals court, the lower court is generally bound by the legal findings of the appeals court (e.g. §511 ZPO [1]), so it's not as though they can evade review. In practice, there is actually relatively little difference between common law and civil law jurisdiction these days with respect to precedent.

Not to mention that in this case this is the judgement of a regional court, which could not possibly be binding outside its region even in a common law country.

Also keep in mind that sometimes juries composed of short-term politically-appointed local politicians ("lay judges") are used, so that also adds to the complexity.

Lay justices and jurors in Austria are selected randomly from the electoral register. See §5 GschwG [2]. This is different from the procedure in other countries, where lay judges are commonly volunteers.

[1] http://www.jusline.at/511_ZPO.html

[2] http://www.jusline.at/5._Verfahren_der_Gemeinden_GschG.html

pbhjpbhj4• 12 years ago

That's interesting about Austria not using stare decisis. How does that mesh with them being part of Europe. European laws which have been ratified would surely require them to rely on other European decisions? (Art. 177 EEC I think?)

Art.6 ECHR - right to fair trial - appears to contradict the idea of allowing contrary reasoning to be used arbitrarily. Political appointees coming to a different decision would seem to require partiality too.

Interesting.

kriro• 12 years ago

AFAIK, in Germany (I know the article is about Austria but I'd guess their laws are similar) you can be held responsible if something illegal is conducted through your network (usually open WLANs). It's called "Störerhaftung" and is pretty crazy because it essentially means every grandmother has to become a sysadmin of sorts. This is used a lot in film download trials etc.

ISPs are explicitly excluded from this and not held responsible.

shabble• 12 years ago

ISPs are explicitly excluded from this and not held responsible.

Time to form a shell company in the ISP business to host your Tor servers, then?

Or are there specific requirements that would prevent such a plan (recordkeeping seems like the obvious one)

rbehrends2• 12 years ago

A major difference is that "Störerhaftung" is matter of civil liability only, not criminal liability. Moreover, "Störerhaftung" entitles the injured party only to injunctive relief, not to damages (unless, of course, you signed a cease and desist agreement, in which case contractual penalties may apply). "Haftung" (= liability) is thus a bit of a misnomer.

Moreover, the current German government is considering legislation to eliminate "Störerhaftung" with respect to unprotected WLAN access.

As for:

ISPs are explicitly excluded from this and not held responsible.

This is not accurate. The "provider privilege" that ISPs enjoy in Germany only immunizes them against claims involving damages; injured parties can and do request injunctions based on "Störerhaftung" (whether such injunctive relief is granted is another story, especially when the desired injunction is ineffective). In fact, there have been cases where providers have been held to higher standards than private individuals because of their greater expertise (e.g., LG Hamburg 310 O 433/10 [1]). The details are still far from settled law, though.

[1] http://openjur.de/u/82969.html

higherpurpose• 12 years ago

There was a story about a Retroshare guy from Germany being prosecuted in a similar case, but the Court cleared him.

PythonicAlpha• 12 years ago

It seems, in many countries, the knowledge and the acknowledgement of technical facts is very much lacking, both in legislative authorities and in courts.

teamhappy6• 12 years ago

You can't expect them to keep up with everything. Important is who they turn to for guidance. The CCC does a great job advising law makers and law enforcement in Germany and the EFF tries really hard to play a similar role in the US. The Tor Project itself works directly with law enforcement as well (pretty much globally as far as I know).

igl2• 12 years ago

A great job?? Can't expect them to do their job? Did you see the outcome of DE-Mail? There is a great presentation about it at ccc-videos.

The CCC is currently not advising but sueing the german government. It has also received 0 media attention since it was announced and i am sure it will just fall flat after being stalled for a few years. GG CCC HF Germany.

guard-of-terra• 12 years ago

Not only their knowledge is lacking after like 15 years of unversal internet use, they usually insist on now knowing anything, ignoring expertise or relying on bogus "expertise", and otherwise lining with authorities and big biz - who are obviously not neutral, therefore court decision is not neutral either.

I interpret this as a direct malice against myself.

hga2• 12 years ago

I think suspicion of ill intent is warranted, or at least I read from a reliable source in the '80s that you couldn't publish a magazine in Austria without getting government approval, which would seem to be somewhat consistent with the mindset behind this law of this interpretation of it.

hellodevnull• 12 years ago

The operator of an exit node is guilty of complicity, because he enabled others to transmit content of an illegal nature through the service.

This logic would make running an exit node illegal in all of Europe.

bottled_poe• 12 years ago

I believe that's the point yes. But, wouldn't this apply to any party who operates the network in between users as well?

dtech• 12 years ago

The quoted law is Austrian, so this doesn't apply to the whole of Europe.

But yes, even running a package delivery service is now illegal because it can be used to transport drugs or firearms and such.

fredsted• 12 years ago

Is this is the "big brother" plan to eradicate anonymity services? Just argue "child porn!" and arrest everyone?

The law quoted was:

Not only the immediate perpetator commits a criminal action, but also anyone who appoints someone to carry it out, or anyone who otherwise contributes to the completion of said criminal action.

Anyone who contributes? Wouldn't this include ISPs or perhaps even the application server technologies (HTTP, FTP) used? Or clients, browsers and picture viewers?

In any case, kudos to this guy. I can't imagine what he's going through: PTSD, having all his hardware taken away, dealing with clueless police.

VMG• 12 years ago

Assuming Darknet technology is improved to the point that "exit nodes" become unnecessary (something like BitMessage), the next target would be developers of such software and developers of cryptography software in general.

rainforest• 12 years ago

Exit nodes are already unnecessary; TOR allows you to operate services on the network itself ("hidden services").

However, it seems not everything is kept on the TOR network. I would've assumed that if someone were using TOR for criminal purposes, they wouldn't expose themselves to monitoring by accessing resources off TOR, but that doesn't seem to be the case.

giancarlostoro2• 12 years ago

Lawmakers aren't as intelligent as programmers. What's worse is, instead of just telling him to turn off the exit node now he's seen as a criminal by the system for doing absolutely nothing. Imagine applying for a job and trying to explain to them why you were arrested, especially if the interviewer is not tech savvy it might not look so good.

the_mitsuhiko7• 12 years ago

Lawmakers aren't as intelligent as programmers. What's worse is, instead of just telling him to turn off the exit node now he's seen as a criminal by the system for doing absolutely nothing. Imagine applying for a job and trying to explain to them why you were arrested, especially if the interviewer is not tech savvy it might not look so good.

He did not receive a criminal record.

spyder• 12 years ago

From his blog: "It’s now finally over and besides the cost i CAN live with this sentence, it does not show up in police registers and won’t be an issue for work and alike in the future."

malka2• 12 years ago

When someone is condamned for something online-related (piracy, CP, etc.), we should obviously arrest all the owners of routers between the source and the target. They are accomplice because they helped the data to transit. That's only commom sense !

pbhjpbhj4• 12 years ago

Just running network equipment doesn't make you aware of it's use though. Tor users know through high-profile cases that Tor is being used for drugs deals and other criminal activities - but they run the exit nodes in the face of this. I'm not saying the law is correct (nor wrong) just that the application appears to be valid.

Yes, there are high-moral reasons to run an exit node too.

maxlybbert2• 12 years ago

There are several countries that would do exactly as you say, or would threaten to do it in order to get a few bribes to the right people.

xbadxapple• 12 years ago

Unfortunately the mainstream media has taken a stern stance of building a negative image of those services. You always get to read how it's full of pedophiles and drug traffic. The fact that such services help dissident journalists, bloggers or political figures or are invaluable in case of repressive internet shut-down seems to escape their spotlight.

This generalization of tech phenomenon which can be used for both good and bad deeds has led to extreme paranoia. Hence such harsh sweeps when dealing with it, I guess. Those who are under the effect of the judgement are also a part of yet another generalization encompassing an undefined, ridiculously big network of "criminals".

mike_hearn• 12 years ago

The general assumption in both the public mind and law is that anonymous == criminal, because of the "if you've got nothing to hide you've got nothing to fear" argument.

The long term downward trend in the trustedness of institutions has been steadily undermining this argument which is why, I think, things like Tor exist at all, but public attitudes change slowly.

In the case of Tor, it's slower / less convenient than usual browsing and is otherwise the same except for being more anonymous. So it's very easy to plant the idea in people's minds that there's no point in using it unless you're up to no good. And the Tor project doesn't really help here - they talk about the legitimate uses on their website but don't point to concrete examples (iirc), e.g. they say the military use it, but provide no real evidence of that. I think actually the UK child porn censors use it as well because it's a source of free proxies and child porn hosting sites know their IP addresses and block them, which is a pretty funny story, but this was mentioned in some talk and I don't think it's on their website.

To make things worse, the internet itself is rapidly converging on the consensus that Tor isn't worth it. Witness the widespread blocking of exit nodes that occurs these days. Tor is losing the argument not just in court but elsewhere too.

IMHO running Tor exits will not become less dangerous any time soon unless Tor finds a way to significantly boost "obviously legit" usage. For that they'd need to provide a Tor browser that isn't geared towards the total-anonymity-or-die crowd. VPN services like HotSpot Shield absolutely dominate Tor in terms of usage because they're much easier t use and don't do stuff like disable Flash and constantly wipe cookies, which makes them much more popular for people trying to evade national censorship but not treat the destination service as hostile.

downandout6• 12 years ago

While I disagree with them, there are a multitude of laws in most countries that make operating a TOR exit node a very bad idea. The concept of criminal responsibility for enabling the illegal acts of others, even when you don't know specifically what others are going to do with the tools you provide, is well established in the US and other countries.

Perfect example: Ryan Holle of Florida is serving life without parole for allowing his friends to borrow his car at a party when he was 18 years old. He went to sleep; his friends took the car and committed a robbery during which someone was killed. The prosecutor's argument to the jury during the 1 day trial? "No car, no murder".

cookiecaper2• 12 years ago

This is why the concept of jury nullification is important. Yes, it's good to have laws that punish accessories, but that kind of thing is obviously not the intended case. No rational person would accept that outcome under normal circumstances, but jurors are essentially bullied by the legal establishment, which holds them in fairly clear disdain, and told they must deliver a ruling based on certain rules without consideration to the larger import of the situation or face contempt of court. I suppose the abuse is even worse in jurisdictions and/or cases where jurors do not have a say in sentencing.

danielweber3• 12 years ago

There is something big missing from that summary of Holle: he knew his friends were going to commit a burglary.[1] Without that connection that puts him on the hook for a felony, he wouldn't be facing life for felony murder.[2]

[1] He disputes his point, which is fair enough, but the court has found otherwise.

[2] Someone could point out the three-felonies-a-day thing here.

EDIT for footnote 2 Flordia's felony murder law[3] spells out the very specific felonies in which you face felony murder charges. These aren't in the same category as accidentally picking up a lobster trap.

[3] http://en.wikipedia.org/wiki/Felony_murder_rule_(Florida)

maxlybbert2• 12 years ago

This is the basic weakness of Tor: while nobody can listen in on your communications, they can determine you're using Tor and communicating covertly. In some jurisdictions that's enough to put you in jail or to question you with the help of very nasty tools.

lutorm• 12 years ago

So by the same argument, if someone takes the bus to commit a crime, the bus operator is responsible?

ominous2• 12 years ago

"In the end, what got us was not AIDS, social injustice or a stealthy black hole. The second the first artificial intelligence awakened, charged with keeping peace in a college campus, it managed to exploit its way around the globe and waged war on all systems with laws, protocols and contracts. Creating rules allowed for them to be broken. By breaking rules, criminals were created. Rules prescribe punishment. At the same time the intelligence discovered wit, schadenfreude and the concept of "kafkian hell". Everything was enforced at once."

RadioAndrea• 12 years ago

What are you quoting here?

chrisdevereux2• 12 years ago

I'm no Tor expert so please correct me if I'm wrong, but wouldn't people trading child porn (etc) most likely be entirely within the onion network anyway and therefore have no need for an exit node?

MertsA• 12 years ago

That's correct, people talk about shady things happening over Tor but how many cases that come up are actually something shady going over an exit node?

madaxe_again• 12 years ago

Yup. Following this logic they have a long trail of people to prosecute, both living and dead.

Good luck to them figuring out who to prosecute for inventing spoken and written language, as that aids more crime than anything else.

Ban language! And water! And humans!

It's a blanket "we'll crush you as we damn well please" law. Most states have them.

Crito• 12 years ago

"Anyone who contributes? Wouldn't this include ISPs or perhaps even the application server technologies (HTTP, FTP) used? Or clients, browsers and picture viewers?"

People involved in those things will not be targeted, unless the authorities already have another reason to want to target them. Absurdly broad laws, coupled with selective enforcement, allows the authorities to legally harass anyone that they please.

Whenever anyone complains about overly broad laws, selective enforcement allows apologists to claim that any objections to those laws are unfounded because in practice people are typically not abused by those laws. However the danger of the laws is not that they will be used to abuse everyone, but rather that they will be used to abuse a select few.

hoggle• 12 years ago

The war is on, is staying on, indefinitely.

4ad• 12 years ago

I live in Austria, used to ran a TOR relay and this worries me deeply. I am unsure what to do.

the_mitsuhiko7• 12 years ago

Just stop running a TOR relay?

mahouse• 12 years ago

But this is a problem only if it's an exit node, right?

anaphor• 12 years ago

It's still a legal problem as much as running an exit node is, they just can't easily figure out that you did anything because of how Tor works. You couldn't even confess to anything either if you wanted to.

teamhappy6• 12 years ago

Given that you used to run one there really isn't much you cant do now. Austria has lots of organizations that got your back. If you ever end up in trouble and don't know who to ask for help just mail the Tor Project directly they know who you want to talk to.

@mahouse: Yes. Exit nodes only.

imdsm• 12 years ago

So, am I right in assuming that if I transfer illegal content from my laptop to my friends laptop via a cafe wireless network, they are complicit in my crimes and will also be at fault?

peterjancelis2• 12 years ago

It's too easy to scare people from hosting tor exit nodes right now.

I think the way forward is to incorporate some use based digital currency payments to compensate exit node operators for their risk.

Make it a business and let the market decide the insurance premium needed.

pritambaral• 12 years ago

Who do you think can pay more? Dissident journalists or internet drug dealers?

peterjancelis2• 12 years ago

Companies don't just serve those who can pay the most. They serve, absent transaction costs, all customers who can pay more than the marginal cost.

tomjen3• 12 years ago

Who cares who pays? Dissident journalists financed by drug dealers? I consider that awesome.

gioele• 12 years ago

If the convicted will appeal, and if the appeal will arrive up to the EU Court of justice, this would be the first care in which it is debated whether TOR operators are protected by the "mere conduit" doctrine that is base on which ISPs are not held responsible. [1]

Too bad that it may take up to 10 years for this case to be appealed up to EU court of justice.

[1] https://en.wikipedia.org/wiki/Electronic_Commerce_Directive_...

acqq• 12 years ago

And that the accused considers him already destroyed and definitely not healthy and wealthy enough anymore to appeal, see dewey's post here.

phn• 12 years ago

I know what I am suggesting is wrong on some levels, and creates a myriad of other problems, but bear with me.

If I run a Tor exit node, can I block outgoing packets to known illegal servers/addresses?

Would some kind of update mechanism of this list (of course, the question is controlled by whom?) warrant that known illegal servers are not available, and thus show/prove my intent that no ill use was endorsed by me?

schoen3• 12 years ago

Tor has a notion of exit policy, but it's only expressed in terms of permitted and forbidden TCP port numbers. This lets you, for example, decline to deliver SMTP traffic on TCP port 25. The exit policy can't list IP subnets (contrary to my recollection; I thought it could, and maybe it once did).

A lot of government investigations of Tor users do involve the use of pretty mainstream, popular services like Gmail, accessed over Tor. Someone can access Gmail over Tor and send e-mails that provoke a government investigation.

haakon• 12 years ago

I'm pretty sure you can still express IP subnets in exit policies. From https://www.torproject.org/docs/tor-manual.html.en, heading "ExitPolicy policy,policy,…":

    Each policy is of the form "accept|reject
    ADDR[/MASK][:PORT]". If /MASK is omitted
    then this policy just applies to the host
    given. Instead of giving a host or network
    you can also use "*" to denote the universe
    (0.0.0.0/0). PORT can be a single port
    number, an interval of ports "FROM_PORT-TO_PORT",
    or "*". If PORT is omitted, that means "*".

zmanian• 12 years ago

Running a Tor exit node, developing encryptions tools , working on government transparency and protecting journalists are all seen as dissent in the current environment.

The reason to engage in these activities is a duty to protect democracy and democratic values in an extremely adversarial environment.

It is unwise to do these things without some kind of strategy to manage the escalation of political repression. It is advisable to do participate in these things as part of the broader activist community. Nothing is riskier that being a solo democracy activist.

brasky• 12 years ago

I think the people running exit nodes gave up on democracy a while back and for good reason.

shmerl• 12 years ago

it is a sensible precaution to turn off hosted services where data from third parties is transmitted (like Jabber, IRC, VPN, FTP, TOR exit nodes, TOR RELAYS!! …)

TCP/IP as well?

comboy• 12 years ago

It's like sending knife maker to jail because "he knew it could be used to kill somebody".

sarciszewski• 12 years ago

This is frustrating to hear. I don't know the laws in Austria, but I hope there's an appeal process and he wins it.

joesmo• 12 years ago

Wouldn't this make all ISPs illegal in Austria then? What is the difference that Austrian law sees between a TOR exit provider and an ISP as far as enabling criminal action? Is it only the differentiation between natural and legal persons?

Tor exit node operator prosecuted in Austria

Related Stories