case law on for exit nodes
Hi, Who knows about cases where the owner of Tor exit node was prosecuted or taken to court for information that was up- or downloaded using his/her Tor node? Basically, I'm looking for case law on running Tor exit-nodes. I am especially interested in case law from countries in Europe, but other examples are most welcome as well. If there is an interesting set of verdicts, I'll compile a summary and I'll share it with this list. Thanks for your help! -- Rejo Zenger . <rejo@zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger
Hi Rejo, On 22 May 2012 22:12, Rejo Zenger <rejo@zenger.nl> wrote:
Who knows about cases where the owner of Tor exit node was prosecuted or taken to court for information that was up- or downloaded using his/her Tor node? Basically, I'm looking for case law on running Tor exit-nodes.
From the Legal FAQ:
*Has anyone ever been sued or prosecuted for running Tor?* *No*, we aren’t aware of anyone being sued or prosecuted in the United States for running a Tor relay. Further, we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is lawful under U.S. law.
Thus spake Daniel Case (danielcase10@gmail.com):
On 22 May 2012 22:12, Rejo Zenger <rejo@zenger.nl> wrote:
Who knows about cases where the owner of Tor exit node was prosecuted or taken to court for information that was up- or downloaded using his/her Tor node? Basically, I'm looking for case law on running Tor exit-nodes.
From the Legal FAQ:
*Has anyone ever been sued or prosecuted for running Tor?*
*No*, we aren’t aware of anyone being sued or prosecuted in the United States for running a Tor relay. Further, we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is lawful under U.S. law.
AFAIK, this is still true in the US. However, I'm pretty sure I've seen at least 3 court cases in the EU on this list (though too busy to dig them up right now). There have also been several equipment seizures in the EU that never escalated to a court case... -- Mike Perry
On Tue, May 22, 2012 at 6:47 PM, Mike Perry <mikeperry@torproject.org> wrote:
Thus spake Daniel Case (danielcase10@gmail.com):
AFAIK, this is still true in the US. However, I'm pretty sure I've seen at least 3 court cases in the EU on this list (though too busy to dig them up right now). There have also been several equipment seizures in the EU that never escalated to a court case...
And there lies the rub. The corporate interests can make things so difficult for people they oppose, including Tor operators, even without an actual court case, that the damage is frequently hidden. The chilling effect of the direct threat of legal action makes the actual legal action unnecessary in all but a few cases. Mike Masnick at techdirt.com covers this phenomenon fairly frequently. I equate it to the much older tactic of "somethin' bad could happen ... if youse know what I mean?" style but using the legal system as the "bad" that could happen ... Very few have the wherewithal to carry a case all the way to court.
AFAIK, this is still true in the US. However, I'm pretty sure I've seen at least 3 court cases in the EU on this list (though too busy to dig them up right now). There have also been several equipment seizures in the EU that never escalated to a court case...
It does happen that exits are inquiried/seized from time to time. But from my read on the list, all cases have been dropped before anyone was found guilty. I'm pretty sure the list has instances of actual court proceedings (that dropped). Maybe search for expert witness or something. But the list isn't really searchable, nor do full plaintext archives exist for that purpose afaik :(
And there lies the rub. The corporate interests can make things so difficult for people they oppose, including Tor operators, even without an actual court case, that the damage is frequently hidden.
Yes, we all know helpdesks/corps hate any sort of tickets. See torservers.net for their take on ISP's. But note that putting node on already existing ISP with node doesn't really help.
The chilling effect of the direct threat of legal action makes the actual legal action unnecessary in all but a few cases. Mike Masnick at techdirt.com covers this phenomenon fairly frequently. I equate it to the much older tactic of "somethin' bad could happen ... if youse know what I mean?" style but using the legal system as the "bad" that could happen ...
I've never heard of such threatening someone not to run an exit relay. Only to shut down if they are receiving tickets, not as threat, but as (legal) nuisance/entanglement from their point of view.
Very few have the wherewithal to carry a case all the way to court.
And thankfully the cases seem to be dropped before then once the prosecutor is aware of Tor as a common carrier.
On 23 mei 2012, at 00:47, Mike Perry wrote:
AFAIK, this is still true in the US. However, I'm pretty sure I've seen at least 3 court cases in the EU on this list (though too busy to dig them up right now). There have also been several equipment seizures in the EU that never escalated to a court case...
Thanks! Someone sent me a few links to one or more cases in Germany, related to wikileaks.de. If you come across more, please let me know. -- Rejo Zenger . <rejo@zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger
On Wed, May 23, 2012 at 07:44:48AM +0200, rejo@zenger.nl wrote 2.4K bytes in 67 lines about: : Thanks! Someone sent me a few links to one or more cases in Germany, related to wikileaks.de. If you come across more, please let me know. To be clear, wikileaks.de and tor are completely separate cases. 'morphium' ran tor exit relays, wikileaks.de domain owner, and a few other things, like cgiproxy, from many servers in Germany. His Tor experience is here: https://lists.torproject.org/pipermail/tor-talk/2011-February/006828.html. His wikileaks.de experience is completely separate and unrelated to his tor activities. His wikileaks.de raid is here, http://wikileaks.de/wiki/Police_raid_home_of_Wikileaks.de_domain_owner_over_... As graramp mentioned, the CCC has been a central point of contact for most of Europe when running into these situations. A huge amount of gratitude to Juliusz and the CCC for helping tor relay operators in Europe. morphium may have been the only one to actually go to court. Most times the computers are seized and a forensics person analyzes them to find nothing more than tor. The owner then has to fight to get their own equipment back and charges are dropped. In some cases, we at Tor have contacted the relevant police to explain Tor and help the forensic team understand what is Tor and what is not Tor. There have been cases where a criminal runs a tor relay thinking it provides them cover while they do all of their illegal activities on the same computer. This latter method doesn't work, by the way. It's trivial for a forensic team to separate the legitimate tor relay from the criminal activity. There are at least two cases where the exit operator has been slapped with a 'national security' gag order and cannot talk about the case. In these situations, their lawyer contacts Tor and I've provided proof and notarized documentation that the person was running a tor relay at the time. I've also had to provide expert witness testimony about Tor as well. Overall, from a quick check of letters sent, there have only been around 12 exit relay seizures out of 1000 or so exit relays. -- Andrew http://tpo.is/contact pgp 0x6B4D6475
Hi Andrew, Thanks a lot for the extensive answer!
morphium may have been the only one to actually go to court. Most times the computers are seized and a forensics person analyzes them to find [...]
Yes. He has explained to me there were two cases where he was taken to court as a result from illegal activity relayed thru his exit node. I have asked him for some more (legal) details.
There are at least two cases where the exit operator has been slapped with a 'national security' gag order and cannot talk about the case. In
These two are both German cases? - if you are allowed to elaborate on that.
Overall, from a quick check of letters sent, there have only been around 12 exit relay seizures out of 1000 or so exit relays.
Yes. What are the countries for these cases? Are all of them European or does that number include US seizures as well? There is at least one Dutch seizure I am aware off. Do you know the reason for each of these seizures? -- Rejo Zenger . <rejo@zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger
On Thu, 24 May 2012 22:10:48 +0200 Rejo Zenger <rejo@zenger.nl> wrote:
There are at least two cases where the exit operator has been slapped with a 'national security' gag order and cannot talk about the case. In
These two are both German cases? - if you are allowed to elaborate on that.
I cannot comment on the cases. I'll let the operators de-anonymize themselves.
Overall, from a quick check of letters sent, there have only been around 12 exit relay seizures out of 1000 or so exit relays.
Yes. What are the countries for these cases? Are all of them European or does that number include US seizures as well? There is at least one Dutch seizure I am aware off. Do you know the reason for each of these seizures?
This is a fine question. These numbers may overlap, where a person emails us asking for confirmation their IP was in the consensus, and then their legal advisor asks for a formal letter or subpoena. As for reasons why, we generally don't get that information. For what we've been told by relay operators with seized relays, their exit relay IP address showed up in a child abuse material or copyright investigation. This is the result of 20 minutes of looking. Formal letters mailed: Germany: 1 USA: 1 Italy: 5 Email confirmations of a tor server existing: Germany: 4 UK: 1 Austria: 1 Switzerland: 1 Subpoena: US: 1 -- Andrew http://tpo.is/contact pgp 0x6B4D6475
On Thu, May 24, 2012 at 10:10:48PM +0200, Rejo Zenger wrote:
There are at least two cases where the exit operator has been slapped with a 'national security' gag order and cannot talk about the case.
These two are both German cases? - if you are allowed to elaborate on that.
I have no personal knowledge about the cases at hand, but "national security gag order" sounds like a USA NSL: http://en.wikipedia.org/wiki/National_Security_Letter -andy
Thus spake Andy Isaacson (adi@hexapodia.org):
On Thu, May 24, 2012 at 10:10:48PM +0200, Rejo Zenger wrote:
There are at least two cases where the exit operator has been slapped with a 'national security' gag order and cannot talk about the case.
These two are both German cases? - if you are allowed to elaborate on that.
I have no personal knowledge about the cases at hand, but "national security gag order" sounds like a USA NSL: http://en.wikipedia.org/wiki/National_Security_Letter
I would also like to take this opportunity to display my "I have not received an NSL" card. I think it's still legal to do *that*, right? ;) But who knows about the upstream ISP(s) or the random stool duster on shift at the datacenter that day... To be fair, it sounded like there was a possibility the NSL might have been more like "WTF just happened? Was that really a Tor node?" But who knows. It could have been "Give me dem keys, or else!" kind of thing. My vote would be "time for new keys" in that case. Maybe we should get a legal opinion on if these things can actually be arbitrarily coercive in nature. "Give me your key. Also, keep using it. Also, tell your mother you hate her and wish she was dead." Does the madness ever end? -- Mike Perry
I would also like to take this opportunity to display my "I have not received an NSL" card.
I think it's still legal to do *that*, right? ;)
Setting aside the inalienability of the hole in our face, some wobbly strips of flesh, some tubes, bags of air and muscles... I believe the US Constitution allows us to say whatever the fuck we want, period. And secondarily, that it trumps a lot of this 911 BS. It just hasn't been tested on it's face yet. And one well known case where it was, on later particulars, was won: calyxinstitute.org If I get a NSL, so long as *I* don't think it's a "national security risk", I'll speak freely as desired. And if I misjudge resulting in NYC getting nuked, oh well, we'll rebuild and do a little hunting of our own. They'd be better off telling the recipients what's up. Even Joe Sixpack can keep secrets and want to take part, if he's informed. As opposed to "trust us".
Maybe we should get a legal opinion on if these things can actually be arbitrarily coercive in nature.
Yes. Though it seems more for ACLU than EFF. Yes, I have seen one, it was boring. No, I have not received one. And I am not under order to say that. Or that. Or that. etc... :)
Does the madness ever end?
Just as soon as people stop being sheep and stand up for their rights.
Further, judges are always available, including secret FISA ones. Go get it signed by a judge before trying to order people around with what amounts to a request on pretty letterhead. I'd be afraid of complying with anything NOT signed by a judge, as that could put ME at risk. Not that any ISP's reading this would stop being sheep and want to spend money to actually defend themselves, their customers, their laws, or country. Then there's the DMCA.... similar, notices end up shutting people up without court order. Puts the cost of that from the complainant to the the recipient, with staffing help desk ticketing systems, etc. Oops, way off topic.
On Fri, May 25, 2012 at 01:40:13PM -0400, grarpamp wrote:
Further, judges are always available, including secret FISA ones. Go get it signed by a judge before trying to order people around with what amounts to a request on pretty letterhead.
I'd be afraid of complying with anything NOT signed by a judge, as that could put ME at risk. Not that any ISP's reading this would stop being sheep and want to spend money to actually defend themselves, their customers, their laws, or country.
There's a thread about it on NANOG right now.
Then there's the DMCA.... similar, notices end up shutting people up without court order. Puts the cost of that from the complainant to the the recipient, with staffing help desk ticketing systems, etc.
There's a thread about it on NANOG right now.
Presumably this one... "ISPs and full packet inspection" http://mailman.nanog.org/pipermail/nanog/2012-May/048364.html That seems to be more about network ops than targeting specific users. There's a world of difference between routine sniffing of your traffic for statistical, engineering, budget, policy, education and debugging purposes (ie: to prioritize/ban traffic, etc)... and taking action based on a user specific external report or request, or looking for users to act upon, or just plain spying on people. The former happens every day without much issue. The latter is the problematic area. There are some good links in that thread though. NSL and subpoena handling comes up on NANOG once in a while.
it all just boils down to one thing. us senate + whitehouse are infiltrated by zionists and they are shutting down any means of communication that isn't owned or controlled by zionists one by one... this whole thing is not about "copyright" or "money" at all, its about total world domination and them thinking "god" gave them the right to do so. i'd say, just shoot them. On Sat, 26 May 2012, Eugen Leitl wrote:
On Fri, May 25, 2012 at 01:40:13PM -0400, grarpamp wrote:
Further, judges are always available, including secret FISA ones. Go get it signed by a judge before trying to order people around with what amounts to a request on pretty letterhead.
I'd be afraid of complying with anything NOT signed by a judge, as that could put ME at risk. Not that any ISP's reading this would stop being sheep and want to spend money to actually defend themselves, their customers, their laws, or country.
There's a thread about it on NANOG right now.
Then there's the DMCA.... similar, notices end up shutting people up without court order. Puts the cost of that from the complainant to the the recipient, with staffing help desk ticketing systems, etc.
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
think it's time for a congress of internet owners about how to remove the zionist threat that is disney, sony, universal, and the banks that own them as well as the corrupted us regime etc from our networks. why let them make propaganda over -our- infrastructure while on the other hand they are sueing the crap out of us and our buddies. (not to mention an assasination attempt on me personally :P http://www.cb3rob.net/enemies.txt is a good start. On Fri, 25 May 2012, grarpamp wrote:
Further, judges are always available, including secret FISA ones. Go get it signed by a judge before trying to order people around with what amounts to a request on pretty letterhead.
I'd be afraid of complying with anything NOT signed by a judge, as that could put ME at risk. Not that any ISP's reading this would stop being sheep and want to spend money to actually defend themselves, their customers, their laws, or country.
Then there's the DMCA.... similar, notices end up shutting people up without court order. Puts the cost of that from the complainant to the the recipient, with staffing help desk ticketing systems, etc.
Oops, way off topic. _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
btw nanog is full of dusty nerds that are either no longer entitled to act on behalf of what used to be -their- companies or don't have the balls to do so, you can forget anything there that goes beyond the level of organizing a garage sale, let alone a revolution. On Fri, 25 May 2012, grarpamp wrote:
Further, judges are always available, including secret FISA ones. Go get it signed by a judge before trying to order people around with what amounts to a request on pretty letterhead.
I'd be afraid of complying with anything NOT signed by a judge, as that could put ME at risk. Not that any ISP's reading this would stop being sheep and want to spend money to actually defend themselves, their customers, their laws, or country.
Then there's the DMCA.... similar, notices end up shutting people up without court order. Puts the cost of that from the complainant to the the recipient, with staffing help desk ticketing systems, etc.
Oops, way off topic. _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
On 5/23/12 12:47 AM, Mike Perry wrote:
AFAIK, this is still true in the US. However, I'm pretty sure I've seen at least 3 court cases in the EU on this list (though too busy to dig them up right now). There have also been several equipment seizures in the EU that never escalated to a court case...
A close friend of mine in Italy some years ago has been running a Tor Exit form home and he got waken-up at 6.00am from State Police for seizure of computer equipment. In italy there is an excessively long court proceedings (5-6 years) due to very inefficient justice system. It means that even if you are innocent, for each penal issue it happen to you, you have to stay in the justice loop for many years. -naif
--- On Wed, 5/23/12, Fabio Pietrosanti (naif) <lists@infosecurity.ch> wrote:
It means that even if you are innocent, for each penal issue it happen to you, you have to stay in the justice loop for many years.
Not being charged is often worse than being charged. Being charged and going to court can lead to closure or clearing of your name. I believe many authorities understand this well. I had a strange case where I received a legal letter in the US, about a personal incident (non tor related) where it was addressed to the "Unknown Perpetrator" or something of the sorts after an investigation led nowhere. In the letter it was clear that our address would become "guilty" of a crime and therefore this would live on the records against us. The letter also made it clear that if you were not the perpetrator you could not dispute it!!! Talk about legal abuse, "if you disagree with this record, you must admit guilt"! It is not fun what can be done through the pre-legal system, -Martin
On 23 mei 2012, at 00:20, Daniel Case wrote:
Who knows about cases where the owner of Tor exit node was prosecuted or taken to court for information that was up- or downloaded using his/her Tor node? Basically, I'm looking for case law on running Tor exit-nodes.
From the Legal FAQ: Has anyone ever been sued or prosecuted for running Tor?
Thanks for the pointer to the FAQ. Of course I did some research before asking and of course I had came across that FAQ already. However, I was pretty sure there have been cases more or less recently (in Germany for example) and I felt this FAQ must have been missing some cases. I could have added that when I sent my mail to this list. :) But thanks a lot for the quick response. -- Rejo Zenger . <rejo@zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger
On Tue, 2012-05-22 at 23:12 +0200, Rejo Zenger wrote:
Hi,
Who knows about cases where the owner of Tor exit node was prosecuted or taken to court for information that was up- or downloaded using his/her Tor node? Basically, I'm looking for case law on running Tor exit-nodes. I am especially interested in case law from countries in Europe, but other examples are most welcome as well.
While I've never heard of anyone being indicted (in the US or EU) for running an exit node, there have been many cases of equipment seizure all over the world. These might be of interest to you: https://www.eff.org/deeplinks/2011/08/why-ip-addresses-alone-dont-identify-c... http://toddsnotes.blogspot.com/2009/11/because-i-ran-tor-police-took-all-my.... https://lists.torproject.org/pipermail/tor-talk/2011-May/020490.html —Sam -- Sam Whited pub 2048R/0DBB515F SamWhited.com sam@samwhited.com 404.492.6008a
On 23 mei 2012, at 01:24, Samuel Whited wrote:
While I've never heard of anyone being indicted (in the US or EU) for running an exit node, there have been many cases of equipment seizure all over the world.
These might be of interest to you:
https://www.eff.org/deeplinks/2011/08/why-ip-addresses-alone-dont-identify-c... http://toddsnotes.blogspot.com/2009/11/because-i-ran-tor-police-took-all-my.... https://lists.torproject.org/pipermail/tor-talk/2011-May/020490.html
Thanks a lot. The second link is new to me, that looks to be useful. Thanks! -- Rejo Zenger . <rejo@zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger
On 23 mei 2012, at 07:55, grarpamp wrote:
I am especially interested in case law from countries in Europe
Contact ccc.de.
also: exitnodes@lists.ccc.de
Thanks! -- Rejo Zenger . <rejo@zenger.nl> . 0x21DBEFD4 . <https://rejo.zenger.nl> GPG encrypted e-mail preferred . +31.6.39642738 . @rejozenger
participants (13)
-
Andrew Lewman -
andrew＠torproject.is
-
Andy Isaacson -
Bill Waggoner -
Daniel Case -
Eugen Leitl -
Fabio Pietrosanti (naif) -
grarpamp -
Martin Fick -
Mike Perry -
Rejo Zenger -
Samuel Whited -
Sven Olaf Kamphuis