Tor operator charged for child porn transmitted over his servers

Austrian man is latest to be held responsible for traffic passing through Tor.

by Dan Goodin

An Austrian operator of Tor servers—that were used to anonymously route huge amounts of traffic over the Internet—has been charged with distributing child pornography. This comes after police detected illegal images traversing one of the nodes he maintains.

William Weber, a 20-year-old IT administrator in Graz, Austria, said nine officers searched his home on Wednesday after presenting him with a court order charging him with distribution and possible production of child pornography. The crimes carry penalties of as many as 10 years in prison. Police from the Styrian Landeskriminalamt, which has jurisdiction over the Austrian state of Styria, confiscated 20 computers as well as a game console, iPads, external hard drives, USB thumb drives, and other electronics. Evidence cited in the document showed that one of seven Tor Project exit nodes he operated transported illegal images.

"My storage cubes (HP MicroServers) were confiscated without any regard for the hardware—the power cords were simply ripped out instead of properly shutting them down," he wrote in a blog post published Thursday morning. "After finishing the search in my living room, they continued in my bedroom, where they confiscated my legal firearms, as well as my cable TV receiver and my Xbox 360. Despite my statement that all firearms and ammunition were legally owned and registered, having passed all background checks, this was doubted by one of the LKA officers due to the caliber."

Short for the onion router, Tor was designed by the US Naval Research Laboratory as a way to cloak the IP addresses and contents of people sending e-mail, browsing websites, and doing other online activities. It is regularly used by political dissidents, journalists, law enforcement officers, and criminals who want to keep their online activities private. Tor works by encrypting a user's Internet traffic multiple times and funneling it through a dedicated server with its own IP address. The data is then passed to a second server, which decrypts one layer of the encryption before passing it to a third server. At that point the data is converted to its original form and sent to its final destination. Tor's onion-like architecture makes it infeasible for the contents to be intercepted by third parties, except by those monitoring an exit node. Even then, it's hard to know where the traffic originated.

Weber isn't the first operator of a Tor node to land in hot water as a result of the traffic traversing his server. In 2007, German police raided the home of a Dusseldorf man after bomb threats allegedly passed through his Tor server. Last year, a separate Tor operator said police confiscated hardware and software after someone misused his exit node.

During interview with police later on Wednesday, Weber said there was a "more friendly environment" once investigators understood the Polish server that transmitted the illegal images was used by Tor participants rather than by Weber himself. But he said he still faces the possibility of serious criminal penalties and the possibility of a precedent that Tor operators can be held liable if he's convicted.

"Sadly we have nothing like the EFF here that could help me in this case by legal assistance, so I'm on my own and require a good lawyer," he wrote in a blog post seeking donations.

Weber told Ars he typically ran about five to 10 nodes at any one time, from locations in the Czech Republic, Poland, Ukraine, Austria, and Hong Kong. He estimated that in all they carried about 30 terabytes of data each day.

"The safest way is a middle node, as it cannot be seen from the Internet at all (it only routes internal traffic)," he told Ars. "Entry is pretty safe as well. Exit is very dangerous (as I've seen now...)"