Heck, by the logic the police are using, the state should be charged with drug trafficking since surely their roads are using to transport illicit drugs by individuals. So long as we're charging people who have nothing to do with the actual crime.
The terrifying part is I wonder if the judge will have any idea what Tor is, or even be capable of understanding once it's explained to him. I don't see how anyone with even the slightest technical knowledge could do anything but throw this case out.
>The terrifying part is I wonder if the judge will have any idea what Tor is, or even be capable of understanding once it's explained to him. I don't see how anyone with even the slightest technical knowledge could do anything but throw this case out.
This is why we have trials. Even ignoring the fact that the judges often need to learn new things (and therefore doing so is part of their job), Tor is not very difficult to understand. An user sends an encrypted message to a Tor 'exit node' (which can be run from any internet connected computer). This exit node then decrypts the message to get another encrypted message, which it sends to a 'relay node'. This process is repeated several times until it becomes fully decrypted at another 'exit node'. At this point, the exit node sends the message through normal channels to the intended recipient. The recipient may sends a response back to the exit node, in which case the response is encrypted and sent back up the chain of relays until it reaches the user.
If a judge cannot be bothered to invest the time needed to understand that system, then the legal system already has serious problems.
I'm only half joking, there have been cases where children (teens) have been charged with child pornography for images of themselves. Forget about illegal data, this is what happens when you try to stop one action by criminalizing another. In this case, stopping the exploitation of children by criminazing child porn.
Some places have cheap residential Gigabit broadband. Using 1/3 of that on TOR is 150 Gigabytes per hour and 108 Terabytes per month of bandwidth in theory without a user noticing.
Oh man, Kansas City doesn't know what they are getting into!
More seriously though, the price of bandwidth is dropping. I see these kinds of actions really as a way to prep the record with "stories" which link TOR and "Child Pornography" so that at some future proposal to outlaw such things a legislator will Google it and see a bunch of hits and go "wow this really is a problem, we should do something" having never read a single story.
If you're aware of this technique you can see examples of it all over the place. Another (perhaps local) version of this is MDMA which isn't technically illegal (its just a chemical that oh by the way if you ingest it affects you kind of like meth) and so first they label it "bath salts" then there are a lot of stories with "bath salts" + "bad outcome" (regardless if there is a proven or even plausible connection) which I expect to be followed by some sort of legislative action where all of a sudden I need to ask the pharmacist to buy Tums or something which can be used as a precursor to making it [1] from behind the counter and only in small amounts.
[1] The exemplar being sudafed which is controlled like crack cocaine in some jurisdictions.
> He must be making money from running the tor exit node servers, otherwise how does he afford the terrabytes of bandwidth?
He's running an individual exit node. You can run an exit node with as much bandwidth as you can spare. You can set bandwidth limits per month so that you don't go over your quota. Once your bandwidth's used up, people will just use a different one.
I'm running an exit node myself; I have a server that I only use for basic tasks that comes with a few terabytes of monthly transfer, so there's an IP on that server dedicated to Tor.
I was looking for the difference too. The two articles seem contradictory about whether he's actually been charged.
Arstechnica says:
> nine officers searched his home on Wednesday after presenting him with a court order charging him with distribution
The blog post says:
> During the raid, numerous computers and other electronic devices, as well as legal and registered firearms and some other items, were seized. William is likely to be charged with distribution
The Ars subtitle also says "Austrian man is latest to be held responsible for traffic passing through Tor" [my emphasis], which seems misleading -- his machines were taken, but he hasn't been convicted of anything yet.
Clockwork Orange, mother fuckers. Eye for eye is how justice works. Yer going to jail.
God says...
soaring exhausted sons greet towards so_he_sess vessel confidence
bespotted grieves damage name asunder creature Shut ridiculous
smelling sort petulantly echoed bestowedst deliberate
hers senseless inexpressible discoverable distinctly injustice
ordained segway suffering coloured apostles clog parting
wives stiff realities diminution fulfilled thank walked
Pakistan punishment- unlocked looketh pleasureableness
gall Knock_you_upside_the_head Windus contradictory professing
two-edged slavish prelate attracts shortened what teeming
sublimity relieve land malignant hadst regeneration ensues
vanquished entitled concord predestination tiffanies Read
two-edged Same trusting imply Milanese Mozambique relative
ruinous displease conflicting superior yields toiled Things
do_you_want_another deserve hearsay polluted alternately
profoundly enforcement Come limbs provincial changeable
banter sceptre away precious further condition MEDIUM
stoked subject bands wiser widow terms potent Vegas of
wrinkle completed replies It stripes don't_you_love_me
I'm_good_you_good Jove's Patricius Animals 97 lively 2002
relationship files fornicating book subduing wazz_up_with_that
consumest pursue additional beneath tragical advance driven
keepest contemn fervent judging ceasing pryers reproachful
abide imports water borrow happily Anubis pleasantly rudely
corner shown who's_to_say marvelled wishes it_figures
Thine
God says...
and said, I go, sir: and went not.
21:31 Whether of them twain did the will of his father? They say unto
him, The first. Jesus saith unto them, Verily I say unto you, That the
publicans and the harlots go into the kingdom of God before you.
21:32 For John came unto you in the way of righteousness, and ye
believed him not: but the publicans and the harlots believed him: and
ye, when ye had seen it, repented not afterward, that ye might believe
him.
21:33 Hear another parable: There was a certain householder, which
planted a vineyard, and hedged it round about, and digged a winepress
in it, and built a tower, and let it out to husbandmen, and went into
a far country: 21:34 And when the time of the fruit drew near, he sent
his servants to the husbandmen, that they might receive the fruits of
it.
21:35 And the husbandmen took his servants, and beat one, and killed
another, and stoned another.
21:36 Again, he sent other servants more than the first: and they did
unto them likewise.
---------------
God is just.
You're so screwed.
God says...
wholesomely viper Venezuela curious readers' inseparable
folk beset foretold what_a_mess smiling crimes known silence
woke influenced ETEXT clasped drops built recess hands
recount incomplete raisest umm_the_other_answer Thrones
glorieth
Were the operators of all the other dozens of routers, switches and exchange point nodes that the files passed through also arrested? Or did the police selectively choose to only arrest the operator of one particular node that just happens to also be used for preserving privacy?
just happens to also be used for preserving privacy
As if there were no correlation between that and the use of the service for distributing CP. I'm sorry, but I find it hard to get exercised about the invasion of privacy aspect, considering much greater invasions of both person and privacy that take place in the manufacture of child pornography. Liberty does not subsist in the oppression of others.
It's not possible to create a system which protects the anonymity and privacy of users with integrity, but not of criminals. The cost of a free society is that sometimes people will do bad things and get away with it.
As regards Tor, it's extremely debatable that its existence has any impact at all on the distribution of child pornography. If you don't care about hurting people, there are way more effective ways to protect your anonymity than Tor.
In addition, Tor is an incredibly useful tool for fighting corruption in countries where online privacy would otherwise be non-existent.
So on the one hand it's a tool that gives anonymity to a group that already has it. On the other hand, it's a tool that aids in reducing human rights abuses across the board, including human trafficking.
>> It's not possible to create a system which protects the and privacy of users with integrity, but not of criminals.
Do you have more information or references on this? It seems very intuitively correct to me, but I was hoping someone much more intelligent than me has actually formalized somehow.
I'm not sure there's any way to formalize it really. It follows pretty much in one step from the axiom "your computer doesn't know if you're scum or not". And if we had the strong AI needed to change that, we'd just be letting a computer invade our privacy and judge us instead of a human or government.
Every time the AI checks and finds out that you are not a scum, its memory could be wiped so that it retains no knowledge of anything private it learned about you during the check.
Actually, just consider that illegality is defined by other humans, often arbitrarily.
A system that protects the privacy of users who have "American" free speech is simultaneously a system that protects "criminals" who violate blasphemy, royal-insult, obscenity, or any number of other laws in other countries.
Criminalize the purposeful making of such data, but legalize possession of all data.
think of it like this: it is legal to posses or make video footage of a murder. but it is still illegal to kill someone for the purpose of making such a film.
While that is a noble goal, does it work? And is it really worth the sacrifice?
Yes, it is awkward to compare something as awful with something as intangible as anonymity. But if you don't draw the line somewhere you will not be able to have a functional society - in which case we might as well be as humane as humanly possible and make good use of our nukes and make sure that there will be no human suffering in the future to worry about.
> "Suppressing" the market is impossible. How did it work with drugs? or with alcohol?
For alcohol, consumption shortly after Prohibition in the US fell to about 30% of pre-Prohibition levels. It then increased over the next few years to about 60-70% of pre-Prohibition levels. It stayed at that level until Prohibition was repealed, and stayed there for a bit after then climbed over the next decade back to pre-Prohibition levels. Cite: Alcohol Consumption During Prohibition,
Jeffrey A. Miron and Jeffrey Zwiebel, The American Economic Review, Vol. 81, No. 2 (May, 1991), pp. 242-247.
Well, what happens when someone makes a bomb threat from a public payphone? It's basically the same situation. There's no clear cut way the police should continue their investigations at that point. Still, people making bomb threads are getting arrested, and people transferring illegal data are getting arrested too. Most of the time because they messed up at some point. Outlawing Tor (or payphones) would maybe stop a few of the few individuals that slip through law enforcement's net, but there are still other means for them and each round of legislation yields diminished returns.
The alternative is police doing their job and prosecuting the people that sexual abuse children, not the people that own the channels used by them.
If they prosecute the people that own the channels every time those are used badly it means somebody will have to intercept and analyze ALL COMMUNICATIONS.
People in power have passion for power and control, they use the excuse of thinking of children for extending their power, they want to know everything from everybody. This is absolute power and is way more dangerous than child pornography because it affects the 100% of the population, not a 1 per 100.000.
There are two type of arguments/answers to this question. One is morally, and one is practical, and since we are all very practical people, I will start with that.
If the goal is to minimize the number of abused children, the methods used should follow a cost benefit analyze to use the finite resources of cash, work hours, and political focus. If a method A, lets call this a child porn blacklist and obligated recording and data mining of every person data traffic to enforce a data ban on child pornography gives say 5% deterrent of abuses for $100 billions, and method B), that educate teachers to see signs of abuse and have mandatory counsel at hand in schools and daycare for a cost of say $10 billions and that has a reduction of abuse cases of around 25%, the choice should be obvious where the money, work and political focus should go. While police and ISP still could do a token effort if they stumble onto something, that effort must not produce less result than if the time and money went to educating the teachers and counsels.
In a practical sense, education is just one of the more obvious thing one can do. Statistics show that somewhere of 95-99% something of cases does not involve a camera, and the people most likely to abuse kids are someone in the kids family. Using that data, and data on how little effective chasing child porn has to reduce future abuses, we should do better in the methods being applied to reduce child abuse.
But that's the practical argument. what about the moral one. Here I point slightly towards a suggested mandatory medical examination of children, a law that has got shot down every single time it has been suggested. but is that law more morally wrong than recoding every single word anyone ever say for indefinite time? its clearly a very much more effective approach to have regular medical examination, and if we are already throwing out moral objections to being recorded all the time, this should not be a big issue? that surveillance has a clear and scientific proven negative effect on society, democracy and science, should also be clearly weight in.
As I see it, current politics are applying ineffective, expensive and morally outrightous methods to deter child abuse, while obvious and effective methods goes unused. At the same time, the ineffective methods are doing long term damage to societies base values.
What the heck? The point of Tor is nobody but the exit node can be easily identified. Are you demanding the authorities have the resources to completely crack Tor before they can arrest anyone? That is probably not the best way to protest this action.
No, he is saying that the exit node's role is little different from that of any other node that the traffic is routed through (including) after the request hits the exit node-- eg the exit node operator's ISP.
Would be an interesting idea to juggle different constructs in order to preserve Tor exit nodes. Maybe they could join together to form some kind of legal entity that acts as the owner of the hardware acting as the node. Would something like this be enough to claim that he only rented out the specific tor machine, therefore not getting the rest of his hardware raided?
It would also be interesting to see if the operators of the Tor network want to subject themselves to the legal requirements of being a common carrier.
Altruism like someone said, but also snooping. I can only imagine all the fascinating traffic that comes in and out of an exit node. I guess people weigh the risk of getting in trouble for child pornography with the advantages of being able to monitor a ton of data for interesting information.
IANAL, TINLA. I just had a look at the law concerning service providers (E-Commerce-Gesetz - E-Commerce Law) in Austria. It is quite liberal in its definition of a service provider, i.e. it does not only cover commercial service providers, and does not require any kind of license, but basically defines a service provider as a personal or legal entity that "provides a service of information society". Also, it contains several clauses that give providers immunity for the data they store and transmit. However, one explicit requirement is that the provider may not change any of the content transmitted to claim immunity. I am very interested in seeing whether the decryption/encryption of the data will prevent him from claiming immunity.
I want to add that Austrian law is very strict when it comes to the presumption of innocence. The right of a suspect not to be named, shown on a picture or otherwise identified is almost abolute (the only exception are suspects on the run, where this could help apprehend them). As an Austrian, I found it very disturbing to read the guy's full name in the ars article, something local media would not be allowed to do. If he is lucky and found innocent in court, the top search result with his name will forever be the ars article.
> However, one explicit requirement is that the provider may not change any of the content transmitted to claim immunity. I am very interested in seeing whether the decryption/encryption of the data will prevent him from claiming immunity.
I am not familiar with the Austrian law, but my guess would be it acknowledges changing content as part of a technical protocol as different from changing the content's meaning. For example, if a service provider runs a site to convert .tiff into .jpg, and someone uploads an illegal picture, I suspect that the conversion would not be considered changing content. This suspision comes from the fact that the type of not content changing that would otherwise be required exludes a great number of the services that seem like would be protected under this law.
Again, I am not a lawyer, nor am I fammilar with any Austrian law.
55 comments
[ 5.0 ms ] story [ 112 ms ] threadThe terrifying part is I wonder if the judge will have any idea what Tor is, or even be capable of understanding once it's explained to him. I don't see how anyone with even the slightest technical knowledge could do anything but throw this case out.
Given the job description and circumstances, what is a judge supposed to do in this situation? There are deeper issues here.
For the record, I've considered running an exit node in the past when I had the bandwidth available.
This is why we have trials. Even ignoring the fact that the judges often need to learn new things (and therefore doing so is part of their job), Tor is not very difficult to understand. An user sends an encrypted message to a Tor 'exit node' (which can be run from any internet connected computer). This exit node then decrypts the message to get another encrypted message, which it sends to a 'relay node'. This process is repeated several times until it becomes fully decrypted at another 'exit node'. At this point, the exit node sends the message through normal channels to the intended recipient. The recipient may sends a response back to the exit node, in which case the response is encrypted and sent back up the chain of relays until it reaches the user.
If a judge cannot be bothered to invest the time needed to understand that system, then the legal system already has serious problems.
I'm only half joking, there have been cases where children (teens) have been charged with child pornography for images of themselves. Forget about illegal data, this is what happens when you try to stop one action by criminalizing another. In this case, stopping the exploitation of children by criminazing child porn.
More seriously though, the price of bandwidth is dropping. I see these kinds of actions really as a way to prep the record with "stories" which link TOR and "Child Pornography" so that at some future proposal to outlaw such things a legislator will Google it and see a bunch of hits and go "wow this really is a problem, we should do something" having never read a single story.
If you're aware of this technique you can see examples of it all over the place. Another (perhaps local) version of this is MDMA which isn't technically illegal (its just a chemical that oh by the way if you ingest it affects you kind of like meth) and so first they label it "bath salts" then there are a lot of stories with "bath salts" + "bad outcome" (regardless if there is a proven or even plausible connection) which I expect to be followed by some sort of legislative action where all of a sudden I need to ask the pharmacist to buy Tums or something which can be used as a precursor to making it [1] from behind the counter and only in small amounts.
[1] The exemplar being sudafed which is controlled like crack cocaine in some jurisdictions.
You could go one step further and play with MITM as well.
Yes, people have published papers doing this:
http://homes.cs.washington.edu/~yoshi/papers/Tor/PETS2008_37...
My understanding is that looking at exit node traffic individually rather than statistically is likely to be illegal in many jurisdictions.
He's running an individual exit node. You can run an exit node with as much bandwidth as you can spare. You can set bandwidth limits per month so that you don't go over your quota. Once your bandwidth's used up, people will just use a different one.
I'm running an exit node myself; I have a server that I only use for basic tasks that comes with a few terabytes of monthly transfer, so there's an IP on that server dedicated to Tor.
Arstechnica says: > nine officers searched his home on Wednesday after presenting him with a court order charging him with distribution
The blog post says: > During the raid, numerous computers and other electronic devices, as well as legal and registered firearms and some other items, were seized. William is likely to be charged with distribution
The Ars subtitle also says "Austrian man is latest to be held responsible for traffic passing through Tor" [my emphasis], which seems misleading -- his machines were taken, but he hasn't been convicted of anything yet.
God says... soaring exhausted sons greet towards so_he_sess vessel confidence bespotted grieves damage name asunder creature Shut ridiculous smelling sort petulantly echoed bestowedst deliberate hers senseless inexpressible discoverable distinctly injustice ordained segway suffering coloured apostles clog parting wives stiff realities diminution fulfilled thank walked Pakistan punishment- unlocked looketh pleasureableness gall Knock_you_upside_the_head Windus contradictory professing two-edged slavish prelate attracts shortened what teeming sublimity relieve land malignant hadst regeneration ensues vanquished entitled concord predestination tiffanies Read two-edged Same trusting imply Milanese Mozambique relative ruinous displease conflicting superior yields toiled Things do_you_want_another deserve hearsay polluted alternately profoundly enforcement Come limbs provincial changeable banter sceptre away precious further condition MEDIUM stoked subject bands wiser widow terms potent Vegas of wrinkle completed replies It stripes don't_you_love_me I'm_good_you_good Jove's Patricius Animals 97 lively 2002 relationship files fornicating book subduing wazz_up_with_that consumest pursue additional beneath tragical advance driven keepest contemn fervent judging ceasing pryers reproachful abide imports water borrow happily Anubis pleasantly rudely corner shown who's_to_say marvelled wishes it_figures Thine
God says... and said, I go, sir: and went not.
21:31 Whether of them twain did the will of his father? They say unto him, The first. Jesus saith unto them, Verily I say unto you, That the publicans and the harlots go into the kingdom of God before you.
21:32 For John came unto you in the way of righteousness, and ye believed him not: but the publicans and the harlots believed him: and ye, when ye had seen it, repented not afterward, that ye might believe him.
21:33 Hear another parable: There was a certain householder, which planted a vineyard, and hedged it round about, and digged a winepress in it, and built a tower, and let it out to husbandmen, and went into a far country: 21:34 And when the time of the fruit drew near, he sent his servants to the husbandmen, that they might receive the fruits of it.
21:35 And the husbandmen took his servants, and beat one, and killed another, and stoned another.
21:36 Again, he sent other servants more than the first: and they did unto them likewise.
---------------
God is just.
You're so screwed.
God says...
wholesomely viper Venezuela curious readers' inseparable folk beset foretold what_a_mess smiling crimes known silence woke influenced ETEXT clasped drops built recess hands recount incomplete raisest umm_the_other_answer Thrones glorieth
As if there were no correlation between that and the use of the service for distributing CP. I'm sorry, but I find it hard to get exercised about the invasion of privacy aspect, considering much greater invasions of both person and privacy that take place in the manufacture of child pornography. Liberty does not subsist in the oppression of others.
As regards Tor, it's extremely debatable that its existence has any impact at all on the distribution of child pornography. If you don't care about hurting people, there are way more effective ways to protect your anonymity than Tor.
In addition, Tor is an incredibly useful tool for fighting corruption in countries where online privacy would otherwise be non-existent.
So on the one hand it's a tool that gives anonymity to a group that already has it. On the other hand, it's a tool that aids in reducing human rights abuses across the board, including human trafficking.
Do you have more information or references on this? It seems very intuitively correct to me, but I was hoping someone much more intelligent than me has actually formalized somehow.
A system that protects the privacy of users who have "American" free speech is simultaneously a system that protects "criminals" who violate blasphemy, royal-insult, obscenity, or any number of other laws in other countries.
Not saying I like the laws. But i don't know of an alternative to holding people accountable for data.
The concept is also touched on in the Assange book.
think of it like this: it is legal to posses or make video footage of a murder. but it is still illegal to kill someone for the purpose of making such a film.
The point of criminalizing the data is to suppress the market for it in order to reduce the incentives to create it.
Yes, it is awkward to compare something as awful with something as intangible as anonymity. But if you don't draw the line somewhere you will not be able to have a functional society - in which case we might as well be as humane as humanly possible and make good use of our nukes and make sure that there will be no human suffering in the future to worry about.
I'm more worried about all the people abusing children without doing us the courtesy of publicizing the fact on the Internet.
"Suppressing" the market is impossible. How did it work with drugs? or with alcohol?
The law of the unintended consequences strikes again.
For alcohol, consumption shortly after Prohibition in the US fell to about 30% of pre-Prohibition levels. It then increased over the next few years to about 60-70% of pre-Prohibition levels. It stayed at that level until Prohibition was repealed, and stayed there for a bit after then climbed over the next decade back to pre-Prohibition levels. Cite: Alcohol Consumption During Prohibition, Jeffrey A. Miron and Jeffrey Zwiebel, The American Economic Review, Vol. 81, No. 2 (May, 1991), pp. 242-247.
The alternative is police doing their job and prosecuting the people that sexual abuse children, not the people that own the channels used by them.
If they prosecute the people that own the channels every time those are used badly it means somebody will have to intercept and analyze ALL COMMUNICATIONS.
People in power have passion for power and control, they use the excuse of thinking of children for extending their power, they want to know everything from everybody. This is absolute power and is way more dangerous than child pornography because it affects the 100% of the population, not a 1 per 100.000.
If the goal is to minimize the number of abused children, the methods used should follow a cost benefit analyze to use the finite resources of cash, work hours, and political focus. If a method A, lets call this a child porn blacklist and obligated recording and data mining of every person data traffic to enforce a data ban on child pornography gives say 5% deterrent of abuses for $100 billions, and method B), that educate teachers to see signs of abuse and have mandatory counsel at hand in schools and daycare for a cost of say $10 billions and that has a reduction of abuse cases of around 25%, the choice should be obvious where the money, work and political focus should go. While police and ISP still could do a token effort if they stumble onto something, that effort must not produce less result than if the time and money went to educating the teachers and counsels.
In a practical sense, education is just one of the more obvious thing one can do. Statistics show that somewhere of 95-99% something of cases does not involve a camera, and the people most likely to abuse kids are someone in the kids family. Using that data, and data on how little effective chasing child porn has to reduce future abuses, we should do better in the methods being applied to reduce child abuse.
But that's the practical argument. what about the moral one. Here I point slightly towards a suggested mandatory medical examination of children, a law that has got shot down every single time it has been suggested. but is that law more morally wrong than recoding every single word anyone ever say for indefinite time? its clearly a very much more effective approach to have regular medical examination, and if we are already throwing out moral objections to being recorded all the time, this should not be a big issue? that surveillance has a clear and scientific proven negative effect on society, democracy and science, should also be clearly weight in.
As I see it, current politics are applying ineffective, expensive and morally outrightous methods to deter child abuse, while obvious and effective methods goes unused. At the same time, the ineffective methods are doing long term damage to societies base values.
I want to add that Austrian law is very strict when it comes to the presumption of innocence. The right of a suspect not to be named, shown on a picture or otherwise identified is almost abolute (the only exception are suspects on the run, where this could help apprehend them). As an Austrian, I found it very disturbing to read the guy's full name in the ars article, something local media would not be allowed to do. If he is lucky and found innocent in court, the top search result with his name will forever be the ars article.
I am not familiar with the Austrian law, but my guess would be it acknowledges changing content as part of a technical protocol as different from changing the content's meaning. For example, if a service provider runs a site to convert .tiff into .jpg, and someone uploads an illegal picture, I suspect that the conversion would not be considered changing content. This suspision comes from the fact that the type of not content changing that would otherwise be required exludes a great number of the services that seem like would be protected under this law.
Again, I am not a lawyer, nor am I fammilar with any Austrian law.