Slashdot Mirror
How Boing Boing Handled an FBI Subpoena Over Its Tor Exit Node
An anonymous reader writes: Cory Doctorow has posted an account of what happened when tech culture blog Boing Boing got a federal subpoena over the Tor exit node the site had been running for years. They received the subpoena in June, and the FBI demanded all logs relating to the exit node: specifically, "subscriber records" and "user information" for everybody associated with the exit node's IP address. They were also asked to testify before a federal grand jury. While they were nervous at first, the story has a happy ending. Their lawyer sent a note back to the FBI agent in charge, explaining that the IP address in question was an exit node. The agent actually looked into Tor, realized no logs were available, and cancelled the request. Doctorow considers this encouraging for anyone who's thinking about opening a new exit node: "I'm not saying that everyone who gets a federal subpoena for running a Tor exit node will have this outcome, but the only Tor legal stories that rise to the public's attention are the horrific ones. Here's a counterexample: Fed asks us for our records, we say we don't have any, fed goes away."
I think it would be a great service to the Tor community to release the text of what Boing Boing sent to the FBI as a shining example of how to handle such requests. It may need to be specifically tailored to the sender, but something to go off of might be of benefit to folks running a node who don't have the funds to see legal help outside of /r/legaladvice.
Colin Dean Go a year without DRM
what logs?
would be funny if they sent them literal wood logs
have you seen my sig? there are many others like it but none that are the same
"Fed asks us for our records, we say we don't have any, fed goes away"
Normally the response is "Fed finds some way to screw with you until you cry uncle, end up in Club Fed, or both".
Federal prosecutors don't enjoy a conviction rate higher than the Spanish Inquisition because they're reasonable.
That is actually how it works. The FBI it not, by and large, dumb about investigations. They are arguably one of the best in the business. Part of that is they know that you can't always get the evidence you want. So they'll subpoena records, but so long as you make a good faith effort to comply, they tend to be happy.
At work (a university) we get FBI subpoenas once and awhile. Quite often it is for shit that we don't have, like someone's e-mail from a long time ago. We look, see if we have a backup, and if not let them know. They are then on their way.
When people get in trouble is when they try to jam them up or break their own rules. Like if you have a company rule that says you keep all documents of X type for Y years, and they are asking for something that is Y-3 years old, they may well get miffed and go after you if you don't have it. However if you do not retain document type X, and there is no law requiring it, simply letting them know that will make them happy.
This isn't to say nobody ever gets a bad/vindictive/whatever agent that tries to create problems, but if you were to do a study, I bet you'd find that most of the interactions are very professional and they are perfectly understanding if you don't have the information they want. In the cases where a hissing match started it was because someone had the information and refused (or made it sound like that) or otherwise jammed them up.
It's amazing that Doctorow is so thick as to not understand his privilege.
The FBI agent probably dropped it as soon as he realized who Boing Boing was.
Your average home user or small business running a tor exit node is not going to be treated with anywhere near that kind of kindness.
Please help metamoderate.
It's not subpoenas that worry node operators. A company gets subpoenas. An individual gets a squad arriving to smash the door down, throw everyone in the house to the floor and confiscate anything with a battery. All done for very good reason: If a suspect had any warning they may use that time to destroy evidence. Still disruptive enough to discourage operating an exit node.
The reason they have a high conviction rate is because they very rarely go to court frivolously. They go in ready. They are methodical about their evidence collection and they make sure they have someone 100% before they indict. A friend sat on a federal grand jury and he was stunned by the amount of evidence they presented. This was just a grand jury, the standard is much, much lower than trial but it didn't matter, they went in fully prepared all the time.
That's a good thing. A low conviction rate is not something we want to see in a court because it means either that the prosecutors are incompetent, or that they are abusing the court system and hauling in innocent people just to fuck up their lives. Ideally conviction rate would be 100%: They'd never bring in anyone unless they had iron clad proof of guilt, and they'd never make any mistakes. Of course we don't have that, but we should try to be as close to it as we can.
A high conviction rate does not imply a kangaroo court that just convicts anyone. Certainly those have high conviction rate, but a well functioning justice system does as well.
Are we capable of logging information at our workplace that would give concrete answers about some legal issues that could arise? Yes.
Do we do it? Oh, hell no.
We log some stuff, but we're careful not to do too much as we don't want to be accused as being "responsible" for the behaviour of some idiot or jerk because "we should have known what was happening".
A desire to nail someone for being naughty could be one of your own undoing.