[tor-relays] How to handle an abuse report

[Jeroen Massar]

On 2014-05-14 13:29, Lunar wrote:
> Jeroen Massar:
>>> Now, I have to report to Hetzner, I will tell them that I'm running a
>>> TOR exit node in "restricted" mode, but how can I defend myself, I am
>>> not sure that my "restricted node" and "given the nature of the TOR
>>> network" arguments will convinced them the Hetzner dudes.
>>
>> You cannot "defend" yourself. There is no way for anybody to be able to
>> claim that it was you, not you, or somebody else. That is the bad thing
>> about an exit. You are responsible what happens from that IP.
> 
> Sorry but the last statement is wrong in many jurisdictions:
> https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines#Legal
> 
> For Germany, see TMG §8 and §15.

Thanks for the pointers, but how is my statement "wrong"?

Note that I specifically do not state anything about "law" there.

As the ISP hosting the IP and/or the law enforcement involved cannot
know the difference between the "owner/user" of the IP exiting or
whatever traffic is going through Tor, you might just get in trouble,
even for hosted boxes[1][2]. (though you must be stupid to put up a red
flag like a Tor exit and then use that exit yourself for illegal things)

While what is linked on that page might be defined in the "law", has
that ever been tested in court in those jurisdictions specifically for
Tor[3][4]?

If they have been tested in court, links to the results of those cases
would be awesome to see there as they actually have value.

The Dutch, Austrian and German ones are mostly similar (same three
points) (did not check the other lingos). As they all fall under
European law, having a court case in anywhere in the EU would already be
a great start.

I personally would never consider a "proxy" (which is what Tor is in
every which way you would define it, even though there is a forwarding
"network" behind it) a "common-carrier" in the most general case how
they call this.

Not that I wouldn't like to see it treated like that, but that is likely
the way that courts will treat it most very likely.

The German variant "Kommunikationsnetz" might be more appropriate to
Tor, depends though (the three points in $8) if one considers the
unwrapping of the layers "modification of the information" or not of
course. (then again, IP inside Ethernet inside PPPoE etc...).

The big 'no' in that three point list is that the source address is
changed though, which would disqualify from "choosing the addressees of
the information" depending on interpretation, hence, until those laws
have been tested in court... nothing much one can really state about it.

To add to it all, the EFF's Tor Legal FAQ
(https://www.torproject.org/eff/tor-legal-faq) has a rather important
message:
8<-----------------
Should I run an exit relay from my home?

No. If law enforcement becomes interested in traffic from your exit
relay, it's possible that officers will seize your computer. For that
reason, it's best not to run your exit relay in your home or using your
home Internet connection.

Instead, consider running your exit relay in a commercial facility that
is supportive of Tor. Have a separate IP address for your exit relay,
and don't route your own traffic through it.
---------------->8

The last part "don't route your own traffic through it" is dubious,
especially when requesting a VPS or some other setup with only 1 IP, you
will be doing at least management through it, you will also not be able
to claim you never send traffic through it (which is the intent of that
sentence I would say).

To put it maybe better: running a Tor exit node on a
VPS/dedicated-server where you host both private and Tor on, is likely a
bad idea...

Greets,
 Jeroen

PS: Nope, not "giving" "legal advice" or anything either, just my point
of view, thus comments on this subject extremely welcome of course!

--
[1] http://raided4tor.cryto.net/
[2]
https://www.techdirt.com/articles/20121130/07495221185/tor-exit-node-operator-charged-with-distributing-child-porn.shtml

[3] Especially as the top of that page mentions:
"NOTE: This FAQ is for informational purposes only and does not
constitute legal advice."

[4] https://www.torproject.org/eff/tor-legal-faq
8<-------
Has anyone ever been sued or prosecuted for running Tor?

No, we aren’t aware of anyone being sued or prosecuted in the United
States for running a Tor relay. Further, we believe that running a Tor
relay — including an exit relay that allows people to anonymously send
and receive traffic — is lawful under U.S. law.
------------>8