Slashdot Mirror
Austrian Tor Exit Node Operator Found Guilty As an Accomplice
An anonymous reader writes with this excerpt from TechDirt: Three years ago we wrote about how Austrian police had seized computers from someone running a Tor exit node. This kind of thing happens from time to time, but it appears that folks in Austria have taken it up a notch by... effectively now making it illegal to run a Tor exit node. According to the report, which was confirmed by the accused, the court found that running the node violated 12 of the Austrian penal code, which effectively says:"Not only the immediate perpetrator commits a criminal action, but also anyone who appoints someone to carry it out, or anyone who otherwise contributes to the completion of said criminal action." In other words, it's a form of accomplice liability for criminality. It's pretty standard to name criminal accomplices liable for "aiding and abetting" the activities of others, but it's a massive and incredibly dangerous stretch to argue that merely running a Tor exit node makes you an accomplice that "contributes to the completion" of a crime. Under this sort of thinking, Volkswagen would be liable if someone drove a VW as the getaway car in a bank robbery. It's a very, very broad interpretation of accomplice liability, in a situation where it clearly does not make sense.
for giving birth to evil people. Arrest them all!
We're moving, slowly but surely, towards making your IP address the equivalent of your social security number in the US.
Does make eminent sense. If you're that judge, anyway. Now you explain to the judge why it shouldn't make sense.
Personally I'd like to see large corporations persecuted for "aiding in any way" or whatever the legal bumf is. But somehow that sort of thing only happens to the little citizen, and so it's probably time to get that overly broad law amended. Austrians reading should probably consider petitioning their politicians.
Is the ISP an accomplice too? And the operating system vendor?
Did the editors do this, or is it in TFA?
A bullet may have your name on it, but artillery is addressed to " Whom It May concern"
They contributed at least as much. And, a few backbone providers. This guy was just a single hop, they contribute many.
"National Security is the chief cause of national insecurity." - Celine's First Law
It'll come down to an opinion as to whether or not the use of Tor implies an intent to allow others to break the law. While an anonymizer service itself can be used for both legal and illegal purposes, if the court later finds that its use is far more illegitimate than it is legitimate, then that will dictate how they rule on the matter.
That's the biggest difference compared to the car analogy, in that the demonstrated legitimate use of cars far, far outweighs the illegitimate use of cars. Using cars is the norm. Using Tor is not the norm, and so then it becomes a matter of scrutinizing what it does, who uses it, and for what purposes.
Same issues held true for networks like Napster and MegaUpload, and holds true for bit torrent.
Do not look into laser with remaining eye.
By this logic, anyone running an internet router is guilty under this interpretation of that law if they connect between a piece of malware and a C&C server.
By this logic, should Microsoft, Intel, ASUS, the store he bought the ethernet cable from, etc, etc all be guilty as providing the means to commit the crime? Very broad, very scary.
In the post-911 world, police departments all over the world are moving into Orwellian territory. They spot someone that they "know" is doing a crime, and they go searching for a law to hammer them.
With laws that don't sunset, and legislative organizations (worldwide) passing more rules and regulations and laws as fast as they can write them down, the state is moving to consolidate it's power. Once, a congressman from the United States said of his constituents, "There are no law-abiding citizens, there are only citizens who haven't yet broken a law."
Wait for it. The police are choosing to persecute (sic) whomever they want to, and due process seems to be fading into the sunset.
Don't take life too seriously; it isn't permanent.
Under this sort of thinking, Volkswagen would be liable if someone drove a VW as the getaway car in a bank robbery.
No. Under this sort of thinking, the owner of a Volkswagen would be liable if someone drove their VW as the getaway car in a bank robbery. And indeed, in some countries you can be held [partially] liable for misuse of your vehicle even if all you did was leave the keys in the car, especially if you have even a passing relationship with the perpetrators.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Prima: I need to do some dodgy shit.
Secunda: I am going to offer a resource for people to do dodgy shit.
Prima: I am going to use your resource to do dodgy shit.
Secunda: OK, please carry on using it.
It'd be possibly like going into a car dealership and announcing that you'd like to buy a getaway car and could they suggest, equip and sell the most suitable.
And, yes, making a request to your computer in your ownership+control is the same as making a request to you.
You can spin up your own Tor exit node in Austria here: http://lowendbox.com/tag/austria/
Or, if you prefer, you can just donate to people that are running nodes here: https://www.torproject.org/docs/faq#RelayDonations
Eh...regardless of what I think about the verdict, the Volkswagon analogy is a bit off. It's not like the manufacturer of the computer is being held accountable, just the person who let it be used from criminal activity.
A more accurate Volkswangon analogy would be if someone asked you if they could use your Volkswagon, you said yes, and then they used it as a getaway car.
"Under this sort of thinking, Volkswagen would be liable if someone drove a VW as the getaway car in a bank robbery"
That may be the case, but probably only if VW knowingly pursued bank robbers as customers (e.g.; in their ads they said something to the effect of "Perfect as a get-away vehicle!")
I'd bet the courts/prosecutor said something to the effect "As the 'administrator' of a TOR exit node, It's not unreasonable for the operator to expect illicit or illegal activity to take place, as the intent of TOR is anonymity", or something along those lines...
More like arresting a taxi driver for transporting a bank robber when the taxi driver didn't know he was a bank robber.
we would attack the car companies for what they're responsible for. They hate unions so much they were willing to destroy GM in order to punish the UAW. That is the way of their kind. They'd rather have us all starve than have a few people succeed. In this case, they are incapable of comprehending the Internet so they punish innocent people. They hate the Internet and want to kill it so they see this as a good thing.
1. Apparently a final ruling has not been reached. While a court has found the operator guilty it's not clear if that will ultimately hold.
2. None of TFA provide any details of what the ruling was based on, beyond the TOT node being used for illegal activity by someone else. Without more details, it is impossible to conclude that merely running a TOR node is illegal; the only conclusion from TFA is someone was prosecuted for running one. A relationship between the operator and the user committing fraud, or if the operator new the user was using the node of illegal purposes, is vastly different than merely running a node where a user is using it for illegal activities. The former is much more reasonable to prosecute than the latter.
3. As others point out, in keeping with /. traditions, the car analogy is bogus.
I'm a consultant - I convert gibberish into cash-flow.
Let's hope lots of kidnap victims will now sue the phone company and the post office because they aided the kidnapper by allowing and delivering anonymous phone calls and ransom notes.
You got it wrong here:
Secunda: I am going to offer a resource for people to do dodgy shit.
It's
Secunda: I am going to offer a my car for people to do who don't want to use their own car. The key is in the car. Please return when done. No questions asked.
So is the gist of this that anything which prevents the government from spying on you is now illegal?
Have we come that far already?
Sad, the world used to be such a nice place, but governments have become so demanding in their surveillance that anything which they can't defeat is now illegal.
Lost at C:>. Found at C.
Why is everyone acting surprised when some government does this?
You give government the power to "fix things" or "take care of you", and THIS is what such governments are going to do.
The government that gives you health care is going to control how big a soda you can buy.
The government that gives you internet service is going to control the traffic you send across it.
The government that wants to protect you is going to monitor every damn thing you do.
We need a system that blends in better with regular traffic.
“He’s not deformed, he’s just drunk!”
Aussies..
Since, after all, the ISP carried the traffic that facilitated the crime..
Ultimately you are responsible for the traffic that exits your PC. Sure, if you are infected with a virus, you have a potential 'out' but if you *allow* it, then not so much.
The "VW" analogy in the story line, is ludicrous. If you want to use a car analogy; its like letting your friends store gym bags in your trunk while you drive cross country. You didnt ask what was in the bags, but know there could be drugs..
---- Booth was a patriot ----
The car analogy is so flawed it really should be removed from the story for this significant reason: cars are designed to move people and stuff. They can be used to commit crimes, but that is not their intended use.
Tor on the other hand, is explicitly designed to allow people to remain anonymous, to prevent detection. While honest people most certainly use Tor, so do criminals and it is because of Tor's intended purpose that the police are justifying their actions.
Before anyone flames me, I am not justifying what is taking place. I am only giving a much better explanation than that ridiculous car analogy for why this is taking place.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Actually, more like leaving the keys in the ignition AND putting up a notice "feel free to borrow my car, don't tell me what you do with and I won't ask." Some people would consider that a kind gesture and only use it for a quick trip to the store when they're out of bread and it's raining, and they'd otherwise have to ride their bike, but someone could also choose use it to drive drunk, without a license, and run over a toddler. I'm not saying you are directly responsible for other's actions, but in all honesty, you can be absolutely certain that some percentage of people WILL use it for something illegal sooner or later (and very likely something they would not do using a car that can be traced back to them). Sticking your fingers in your ears and saying "na na na na" doesn't really change that.
It's actually a really tricky concept to nail down as there are certain actions that are absolutely assisting in the commission of a crime (for example loaning your car to a specific person when you have knowledge or at least strong reason to believe that they're going to use it to commit a crime) and others that are fully innocent (for example, manufacturing and selling cars to the public).
while this situation seems closer to the innocent side, it's definitely at least a shade of grey. You know what kinds of things (a very significant percentage of) people use the service for, and you choose to allow your resources to be used for those purposes because either: A. You believe that offering honest people anonymity and privacy is more important, or B. You disagree with the laws they will be violating and/or support and condone their behavior. Having various courts in various countries make rulings one way or the other is actually a good thing because it will help to eventually achieve a consensus about what is/should be legal vs illegal in democratic countries, instead of each person having to guess how far they can go before getting smacked down.
if your regular traffic is illegal in nature, any illegal tor traffic will blend right in!
Copyright (c) 1990 - 2014 Dice. All rights reserved. Use of this comment is subject to certain Terms and Conditions.
lol that was a really bad idea, i wonder just how many kids of people in politics can be chargerd there, i bet there parents are also liable for paying for the internet connection!
Hardware manufacturers are clearly to blame for enabling this man to commit crimes. Transmission line owners are at fault for supplying him with power to commit crimes. ISPs gave him direct access to the internet, allowing him to perform these acts. I say lock them all up.
The government that gives you anonymizing routers so you can subvert your oppressive government. And then develops attacks on said anonymizing networks. WHAAAAA???!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
The problem isn't that the car owner was convicted of a crime, the problem is that it was absolutely the WRONG crime. First-degree murder? Not even CLOSE. There are specific charges for things like assisting in the commission of a murder or helping to cover it up, etc. There are also things like second degree murder, manslaughter, involuntary manslaughter, etc, which might be at least a little less inappropriate. In this case, David Rimmer (the prosecutor with his head so far up his ass that he has to make arguments out of his belly button) should be disbarred and serving time, and Ryan Holle (the irresponsible car loaner) should be free. I'd prefer that he were charged with a lesser crime instead if he actually had knowledge that they were going to commit a crime of some kind, but that not being the case he would have to simply be found not guilty due to the incompetence of the prosecutor/DA/etc. Then next time they might be a little more hesitant to lodge completely false and inappropriate charges against a semi-accomplice (at worst).
If history has taught us anything at all it has taught us that Austria has a tendency to be way over the edge of reasoning in its legal practices. The reason the car analogy is correct is that in fact the average car will at some point be used to commit a crime. For example driving a bit drunk is a crime. Forgetting to make a timely renewal on the cars insurance is also a criminal act. Speeding is a crime as well. Therefore the average car is sold with the seller knowingly being an accomplice to the crimes. A more sane interpretation would require the party to know clearly what crime would be committed as well as a rather precise accounting of what the seller knew, time, place, etc. in advance of the crime.
Does this make every link, switch, and router on the route an accomplice? Why not?
Postal mail - the original pirate transport mechanism!
they need to be shut down, stat!
If they had put up a sign that says "Come on through. No security guard on duty. No cameras in use, and I won't look." in addition to the normal "We're Open" sign. In that case, yes, they knowingly provided means to assist such criminals, AND let the criminals know they were doing so; in-effect inviting them to. It should obviously be a much less severe crime than actually robbing the bank, but it could well constitute a crime of some kind.
This has been a long time coming. Not to say is the right thing, but I think it was bound to happen. Freedom for the masses is a very dangerous thing for the stability of our society ... I mean ... for the billionaire multinational "elite" and their puppet "democratic" governments. I'll consider him a martyr for the evolution of human society (sorry Fritz!). :-(
For things to get better, they sometimes have to get worse
When my Karma level reaches 0 I feel in piece with the Universe
Trying to pretend otherwise is just fooling yourself. Whether or not it should actually constitute a crime is a larger a more complex question, but the original analogy is so far off that it's just plain stupid and does nothing to further the argument (and in fact weakens it).
ONLY if the cab driver has a stated/posted policy of "I'll pick up anyone, anywhere and not ask any questions." So he doesn't pay attention to (or perhaps doesn't even look or listen at all so claims no knowledge of) the alarm going off at the bank he's in front of, and the ski mask, and big bag of cash the robber happens to be carrying. Sorry, but weak and incorrect analogies that only make your point BECAUSE they are weak and incorrect, like the one in the summary, really aren't helpful at all.
Most of the world uses something called Civil Law as opposed to your Common Law that you inherited from UK.
Which is why in most of the world precedents don't carry as much weight as they do in Common Law legal systems like yours, where the rationale for the decision makes each sentence a binding precedent in other courts.
And that is why this single decision DOES NOT "effectively now make it illegal to run a Tor exit node" in Austria.
NOR would "Volkswagen be liable if someone drove a VW as the getaway car in a bank robbery".
Mit der Dummheit kämpfen Götter selbst vergebens
So, equally:
The owner of a public payphone used to deliver a ransom after a kidnapping is guilty?
If a man escapes the scene of a robbery via bus - the bus driver is guilty?
Gun manufacturers are guilty of assisting murder?
This is idiotic.
An AC post could be trivially tracked to source (IP/physical location at minimum) by any TLA, or with a bit more effort by local law enforcement or various others. It's mostly just "I don't feel like logging in today" or "I'm sick of having to maintain a named account and password in umpteen different sites" or "I'd prefer that my boss not see that I posted that comment complaining about how IT management sucks at our company." It's pseudo-anonymity. Trying to offer "true" anonymity is very significantly different, and while it does have some valid purposes, e.g. protect people under repressive regimes and give them at least some form of free speech, help to better protect users from corporate tracking and so forth, a very large percentage of the use is for legally/morally questionable activities or to directly support actions that are almost universally criminal.
Just as bad as the completely laughable one in the summary.
There are plenty of posts above with analogies that are actually more valid, and they pretty much all involve in-effect knowingly inviting the criminals in.
So if the payphone has a sign that says "Calls are not tracked, use this phone for anything you want without fear" or if the bus driver puts on blinders and ear-plugs and picks up a robber wearing a ski mask, in front of a bank with the alarm going off, or if the gun manufacturers market the guns as "the best way to murder cops, now with no traceable serial numbers and a polymorphic barrel that never produces the same pattern on the bullet twice." Then yes, absolutely.
"Under this sort of thinking, Volkswagen would be liable if someone drove a VW as the getaway car in a bank robbery. It's a very, very broad interpretation of accomplice liability"
Have no fear. Such laws will not be applied to large corporations and individuals rich enough to buy their own politician.
. . .Therefore the entire country is guilty.
Maybe now we can get some intelligence in our cars so we cant commit crimes with them. I think it is iresponible to make a car that can kill someone. They have choosen to make the car now they have to take the consequences their action. Nobody forced them to make the car.
Does not the DMCA do this also? If one link points to a copyrightinfighed torrent on your website, posted by somone else, you are liable for that link.
The torrent might not even be hosted on your site.
What is the different? You have third-party liablity in US and most(all?) countrys have this also
Isn't this more like if almost all the employees at McDonald's were also dealing drugs out the back door? Pretty sure all the franchise owners would at least be investigated/harassed out of business in that case. Not saying it's right, but it makes way more sense than the car thing.
You are applying technical logic, not political logic. This law will never be used to prosecute a major ISP. It is obvious to every enforcer that the ISPs are providing a very generic service with which the vast majority of common uses are perfectly legitimate. TOR, however, is only legitimate in theory, with (in their opinions) the vast majority of common uses being illegal. Therefore, it is quite obvious that the operator of an exit node is an accomplice, whereas the ISP is not.
I would not be surprised, however, if they did extend this to include anyone who has any involvement in TOR (so long as it is direct hosting or coding, not merely providing internet connectivity).
The wording of the law will give them the logical wiggle-room they need to do this, and they simply won't apply it to ISPs because that is obviously not within the spirit of the law.
...to know that us Americans are not the only ones who are batshit crazy.
They provide 80% of the Tor Project's funds.
http://en.wikipedia.org/wiki/T...
VLC Remote for iPhone and Android
So if I rob a bank in Austria then use the bus to get home, the bus driver (who had no knowledge of the crime) is held criminally liable as an accomplice?
That sounds stupid.
common carriers are also accomplices to all on-line crimes then.
The govt teached the person at school,
The telco helped too,
The power company,
The food shop
Hey Austria, you helped Hitler, isnt that illegal.
Liberty freedom are no1, not dicks in suits.
It was my understanding (from chatting with lawyers) that intent is an important component in any criminal case. Perhaps there was evidence to show that it was the intent of this particular Tor operator to disguise the unnamed crimes (presumably crimes that involved children in need of saving)?
knowing full well that it may sometimes be used for getting groceries, or a trip to the park... but realizing that it COULD be used for a bank robery... YES they would be liable.
I was under the impression TOR was explicitly designed to allow others to break the law
Tor was explicitly designed created through a grant by the US. Naval research Laboratory as " a circuit-based low-latency anonymous communication service".
Sometimes people with power are so stupid, it boggles the mind. This discussion about holding Tor node operators responsible as accomplices for things done on the Tor network is so offensive and ridiculous as to almost not warrant a response.
"Under this sort of thinking, Volkswagen would be liable if someone drove a VW as the getaway car in a bank robbery"
Volkswagon would be guilty if the router manufacturer were found guilty, not the person running the Tor node.
This is more like if a bus or train driver were arrested for unknowingly transporting, along with a bus/train mostly full of normal innocent people, a single criminal on their way to/from committing a crime.
I don't know about Austrian law, but under UK law, a person is guilty of "assisting or encouraging" an offender if (a) their conduct assists others to commit crimes, (b) they are aware that their conduct may assist others to commit crimes and (c) their conduct was not reasonable.
So the volkswagen dealer is safe as it is clearly reasonable for them to sell cars to the general public, even though they may be aware that some of their customers may use the cars that they sell for illegal purposes.
The TOR exit node operator is assisting others to break the law by making it harder for law enforcement to catch them and must be aware that some people use TOR for illegal purposes. Therefore it comes down to whether or not running a TOR exit node is a reasonable thing to do or not. This basically comes down to what a court decides and a court may well conclude that anything that makes it harder to catch serious criminals is de facto unreasonable.
the birth country of adolf hitler, that says it all
My impression of Tor is that it's used by people at political risk and people who do illegal activity- mostly drugs and child porn.
What's the degree of criminal activity over your average ISP? The degree of criminal activity could arguably show intent to aid and abbet.
Sure- a VW could be used in a robbery, but it's clear that they are not sold as a brand to help robberies.
Sure- a random ISP could be used to abet criminal activity, but it's clear they are not intentionally aiding any crimes. (you could argue You Tube intends to allow massive copyright violation-- the only reason I can't see they haven't been busted is that they are a large corporation).
But with Tor, you know when you put up a node that illegal activity will be conducted over it. People are not using Tor to post on Facebook.
In fact- it's child porn which is leading the charge to pierce Tor's anonymity. Just google "how common is child porn on Tor" and you can see articles about law enforcement agencies in multiple countries breaking into Tore as a result of child porn.
Indeed- that's what they found this person guilty of-- "Ferrying Child Porn".
http://www.theregister.co.uk/2...
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
Neither the summary, nor the linked article, nor the article linked to in the linked article give the crucial information: What exactly did the court decide?
Quite obviously if I use Tor for criminal activity, and my best buddy sets up a Tor exit node exclusively for me to support my criminal activity, then he will be convicted for running that exit node. Not just in Austria, but everywhere.
And equally obviously, someone who operates a Tor exit node, which is without his knowledge and without his agreement used by a criminal for criminal activity, that operator _should not_ be convicted, neither in Austria nor elsewhere.
What all these articles don't say is what exactly the Tor operator has done. And without that we can't judge what happened.
If you repair a car that is then used in a robbery, you shouldn't be accused of being an accomplice. Except if you knew it was going to be used in a robbery. For example, if you repeatedly fixed a car that was used to drive into shop windows, and even fix steel plates to the front of the car.
Tor is really an all-or-nothing proposition: either you have complete anonymity and freedom from cesnsorship, or you can't have Tor. (the censorship part refers to hidden services). I'm for free sharing of information, but I get the feeling that most people aren't. In my experience, people usually want to control at leat one type of inromation, be it illegal porn, (leaked) state secrets, copyrighted works or other things. It doesn't matter if Tor is only used for illegal business by 0.001% of its users -- the incentive for blocking that information is just as strong.
I have to admit, the car analogy sort of works, but I think Tor is more of a drastic change than the car. Having a car is by no means a guarantee for pulling off a successful robbery, while with Tor it's technically impossible to get "de-anonymized" (if done right).
Arrest the connecting Internet infrastructure, as clearly this applies under those rules. And good luck with that.... achtung!
(( shaking my head )) This is the sort of thing that will bury net neutrality, especially if it spread elsewhere.
If Tor is NOT illegal, then they shouldn't have busted him. If it IS illegal, then why isn't it on the frikken books? Or is it now acceptable to make just any old thing illegal on a whim?
Then the US government needs to be sued as well as inventors of the technology behind the Tor network. Dumb court decision, it is like shooting the messenger.