December 2012 - Test - lists.nanog.org

Fwd: [tor-talk] William was raided for running a Tor exit node. Please help if you can.
by Mitar 02 Dec '12

02 Dec '12

Hi! Forwarding my answer to tor-talk list. Mitar ---------- Forwarded message ---------- From: Mitar <mmitar(a)gmail.com> Date: Sat, Dec 1, 2012 at 12:29 AM Subject: Re: [tor-talk] William was raided for running a Tor exit node. Please help if you can. To: tor-talk(a)lists.torproject.org Cc: nanog(a)nanog.org Hi! On Fri, Nov 30, 2012 at 2:09 PM, Naslund, Steve <SNaslund(a)medline.com> wrote: > Remember, they did not raid the Tor exit node. They raided the home of > the guy running the Tor exit node. Way different. I can probably explain that. We were running a Tor exit node in Slovenia (neighboring country of Austria, EU too). We had Tor exit node on collocation at local ISP and the collocation was on friend's name (not on some legal entity). Twice they came to his home in early hours with warrant for all computer equipment he has at home. Once because somebody was using Tor for blackmailing, the second time for child pornography. Why they came to his home? I believe the reason is simple: they have IP, they write to ISP something like "Who is your client who had that and that IP at that and that time?" ISP responds: "This is X Y, living there and there and + some other personal information they have on who this person is." Criminal investigators go to the judge and say "We need a warrant for this and this person at this and this location." They get one and they come to visit you in early morning hours. In both cases he just had to explain that: 1) this IP is at collocation and not at that location and 2) that it is a Tor exit node and we do not keep any logs of activity through it. 1) tells makes their warrant invalid and you move from being a suspect (they had in mind that you are using your own home connection to do something illegal, this is the highest probability based on their information) to a witness (you are server admin and it is higher probability that some your user did something illegal). 2) tells them that even if you are a witness, you are worthless witness: you do not have typical users and services, and you are not even logging anything. For most services you are not really required to log anything. Running Tor is not illegal. Having logs for it also not required. They left without taking anything and he hasn't heard from them afterwards (this was few years ago). It might be because both cases were international (Interpol) so for local investigators it was the easiest to just write: it was Tor exit nodes, no logs possible to obtain, case closed. And move on with their lives. If it would be some local thing with a very motivated investigator they might not believe him and would still confiscate equipment. But from a point when they discover that their warrant is probably wrong they are on thin ice as obviously IP was physically somewhere else. It might be that in this case of a guy from Austria he didn't know that it raid is for Tor node but he thought that it might be for something else and just later on discovered that. Or that they simply didn't listen to or believe him. Probably it depends on how you communicate with investigators and your language skills. Mitar

1 0

When an ISP should run their own IRR for customers
by ML 01 Dec '12

01 Dec '12

I'm querying the community on the feasibility of running my own IRR on behalf of customers whom probably aren't/won't register their own objects. I'm going down this path since I don't believe RADB or ARIN would let me register objects on behalf of my customers. I know I'm going to need this in the near future once my AS starts to peer. Conservatively I would be proxy registering about 100 customers. Would a potential upstream/peer NOT want to query my IRR because I'm not RADB, ARIN, etc (Essentially not a well known registry)? If not, is it likely my IRR could get mirrored by RADB so other networks can retrieve good info via RADB. If I was to run my own IRR is Merit's IRRd they way to go or is there something better? Thanks

2 1

Re: William was raided for running a Tor exit node. Please help if you can.
by Anne P. Mitchell, Esq. 01 Dec '12

01 Dec '12

> Example of an actual warrant: > > > https://www.eff.org/sites/default/files/filenode/inresearchBC/EXHIBIT-A.pdf Please also keep in mind, if it's relevant, that *no warrant* is required for data that is stored by a third-party. Data on a server, TOR or otherwise, would by definition be data that is stored by a third party. Which means that if there is a person of interest (POI), it would not be terribly hard to get at personal information about the POI that is not on their own private machines. (Here is an article we wrote about that: http://www.theinternetpatrol.com/no-warrant-necessary-for-law-enforcement-t… ) > Not a lawyer. Is a lawyer, but hasn't been following this thread. That said, if there are specific questions, I'd be happy to answer them if I can. Anne Anne P. Mitchell, Esq CEO/President Institute for Social Internet Public Policy http://www.ISIPP.com Member, Cal. Bar Cyberspace Law Committee

1 0

[liberationtech] Internet back in Syria
by Eugen Leitl 01 Dec '12

01 Dec '12

----- Forwarded message from Rafal Rohozinski <r.rohozinski(a)psiphon.ca> ----- From: Rafal Rohozinski <r.rohozinski(a)psiphon.ca> Date: Sat, 1 Dec 2012 10:39:24 -0500 To: liberationtech Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] Internet back in Syria Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Secdev detected BGP announcements from Syria as of 7:30 AM Eastern standard time. For our initial monitoring we look at the updates that are broadcast, because dumps of those are available every 15 minutes. However a more complete status is available every two hours, which will provide better insight into when the return of the address space was stabilized. How resources across the country are now reporting connectivity in a number of cities. Rafal Sent by SecDev secure mobile. Please excuse typos or other oddities. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0