Tor exit node operator convicted of abetting spread of child porn
The decision will probably have no direct effect on the liability issues of running Tor services, an Austrian ISP association said
The operator of a Tor server used by someone to download a pornographic image of a minor has been given a three-month suspended prison sentence by an Austrian court for abetting access to pornographic images of minors.
The man was sentenced on June 30 to three years' probation, according to a summary transcript of the verdict that was provided by the Regional Criminal Court of Graz, Austria, on Wednesday.
Though the man is unnamed in the court ruling, which was anonymized before release, William Weber [CQ] has made no secret that it is him, chronicling the case online since his initial announcement of his arrest. He will not appeal the verdict, he said earlier this week via email. "For me it ends here," he said, adding that the high legal costs were bankrupting him.
Weber operated a Tor exit node. Tor routers, or nodes, many run by volunteers such as Weber, set up links with other nodes on demand and encrypt the traffic passed between them, concealing its content and its ultimate source and destination. Unless users take other precautions, though, their traffic will still be readable as it passes between their PC and the node where it enters the Tor network, and between the exit node and its ultimate destination.
When the case began, it was viewed by some as a test of the legality of the Tor network, which like many tools can be used for both good or bad -- for example, circumventing censorship, safely linking whistleblowers and journalists, anonymously trafficking in child pornography or conspiring to perform criminal acts.
As Weber's case went on, though, things became murkier.
The court noted that experts had found and reconstructed image files from the "lost cluster" of a hard disk containing pornographic depictions of minors. However, it found the accused not guilty of knowingly accessing those images, since it could not be established with the certainty required in criminal proceedings that they had been downloaded by him rather than by the automatic action of a Web browser.
But there was more: In its verdict, the court cited transcripts of chat sessions uncovered during the investigation in which the defendant told an unidentified correspondent "You can host 20TB child porn with us on some encrypted hdds" and, in German, "You can host child porn on our servers" and "If you want to host child porn ... I would use Tor."
This showed that he was at least aware of the possibility that the exit node could be used to download child porn, and that he did not appear to disapprove of such use, the court said.
On his personal blog, Weber wrote that the chat conversations, though real, were taken out of context. "I recommended Tor to host *anything* anonymously, including child pornography," he said.
The court's decision in this case will probably have no direct effect on the liability of those running Tor services, said Maximilian Schubert, [CQ] general secretary of the Austrian association of Internet Service Providers (ISPA).
"The decision highly depended on the special circumstances of the case and particularly on the statements of the defendant which were seen by the court as encouraging the use of Tor services and its servers for the dissemination of child sexual abuse material. We are thus positive that it cannot be seen as a general ruling against Tor services," Schubert said.
The case however has highlighted legal challenges, he said.
"It still remains to be seen how the Austrian courts proceed in this issue. The decision was a very unfortunate one as it might cause misunderstandings as to the responsibility for running Tor services, when leaving aside the particular circumstances of the case at hand," Schubert said.
ISPA however is positive that Austrian courts will follow the reasoning of the Austrian Constitutional Court, which last month declared the country's data protection law unconstitutional because it violates fundamental privacy rights.
The Constitutional Court held that privacy and especially the secrecy of communication on the Internet have to be protected, Schubert said, adding that he expects that because of this ruling the legality of running Tor services will not be challenged.
Loek is Amsterdam Correspondent and covers online privacy, intellectual property, open-source and online payment issues for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to email@example.com