This blog post from a few years ago suggests that using BitTorrent services over Tor is a bad idea for multiple reasons. However, it also suggests some fixes to get over these problems.
Is using a
It doesn’t make you anonymous. Torrent protocol wasn’t designed with anonymity in mind and there are a million ways you’re going to leak your actual IP address.
Tor is a TCP only network.
While this doesn’t give you the anonymity you wanted, it will hurt the network for other users.
What “increased risks as far as csam”? You’re not hosting any yourself, encrypted or otherwise. You have no access to any data being routed through your node, as it’s encrypted end-to-end and your node is not one of the endpoints. If someone did use I2P or Tor to access CSAM and your node was randomly selected as one of the intermediate onion routers there is no reason for you to have any greater liability for it than any of the ISPs who are also carrying the same traffic without being able to inspect the contents. (Which would be equally true for CSAM shared over HTTPS—I2P & Tor grant anonymity but any standard password-protected web server with TLS would obscure the content itself from prying eyes.)
You are still possessing csam while being used as a node to transit it.
A compromised (or even honey pot) node can show all the people who were “just holding it for a friend”. And ignoring that ISPs have historically cooperated in investigations, they also have many more lawyers.
So regardless of your ethical/moral concerns over facilitating the transit of csam, you are opening yourself up to being caught in a semi-tech savvy investigation.
This is not how the law is applied to packet switching.
If it was store and forward then maybe just maybe law enforcement would care, but anybody smart enough to set up an I2P node to research it and who tried to track where packets from from would first see the packets originate from their own local node at 127.0.0.1, then in the I2P console they could see that packet came in via an active half-tunnel from their own end interfacing with the endpoint node of the other side’s half-tunnel, and they would know that node has no idea what it’s sending (just like their ISP)
You are assuming good faith on behalf of law enforcement
You are assuming any investigation would go beyond the equivalent of “Well, we see these twenty peers in the download queue. Look up to see if we can send a DMCA”
You are assuming “I was just trying to help people share material they don;t want law enforcement to know about. How was I supposed to know it was csam? I am the real victim here” will work, at all.
1: then they would go after literally anybody running a node
2: their client will not see peers on another IP. It will just see their own I2P node. Any I2P aware software will also not have any IP addresses as peers, only I2P specific internal addresses. They will not even be able to associate an incoming connection to any one node without understanding the I2P network statistics console.
3: by this argument all anonymization tools should be illegal, Signal too, etc, and nobody should help anybody maintain privacy. In the real world there’s plenty of reasons why anonymization tools are necessary. And there will be literally zero evidence tying you to a crime. Preexisting legal precedence says an IP address alone is not enough.
then they would go after literally anybody running a node
ACAB? Also, I’ll get back to this
their client will not see peers on another IP. It will just see their own I2P node. Any I2P aware software will also not have any IP addresses as peers, only I2P specific internal addresses. They will not even be able to associate an incoming connection to any one node without understanding the I2P network statistics console.
And only people with similar politics to you will ever gain that understanding? Again, more on this
by this argument all anonymization tools should be illegal, Signal too, etc, and nobody should help anybody maintain privacy. In the real world there’s plenty of reasons why anonymization tools are necessary. And there will be literally zero evidence tying you to a crime. Preexisting legal precedence says an IP address alone is not enough.
And countries around the world are increasingly pushing legislature to make “anonymization” and “encryption” tools illegal (or at least require backdoors).
Which gets back to the politics aspect. Even among those of us who care about personal security (which, again, has nothing to do with torrenting but here we are), the likelihood of others to use it for nefarious and evil purposes is a problem. I’ve taught a few journalist friends how to use tor but I personally do not because that, and tools like i2p, tend to also be used for csam and I have pretty strong morals and ethics about not facilitating the dissemination of that.
And, as we remember once or twice a year, there are “hacktivist” groups out there who like to have a field day. And compromising tools used for the distribution of csam is something that many groups do.
But also? Those piece of shit cops and governments trying to get their fascism on? It is a lot easier to push for “extreme measures” when it is going up against pedophiles and child abuse. We saw similar with how the US (and other western nations) cracked down on immigration under the guise of “stopping the Muslims from doing another 9-11”. And we are likely to see similar come out of the Israel/Palestine war.
MAYBE you get a really good lawyer so that you can get off on… Maybe you get a really good lawyer who cites the proper legal precedents AND a judge AND a jury who actually care about that. You have still had your reputation ruined for “being a pedophile” and laws are already being pushed to make using any of these tools illegal to begin with. And The People will generally support it because CSAM.
And getting back to “an IP address isn’t enough”: Yes, some judges have decided that. Was it Avatar that was the big case people like to cite? Been a minute. But that doesn’t stop other judges who just don’t give a shit about precedent still providing the subpoenas. And considering that getting the equivalent of a peer list requires “understanding the i2p network statistics console”: There are likely to be additional “fingerprints” involved. I’ve not spend much time looking at said console so am assuming there is nothing as stupid as a mac address, but it becomes a lot harder to say “Old Lady Withers across the street was using my wifi”.
Just because people are stupid and this is the inevitable drive by from the peanut gallery:
No, I am not saying that everyone who uses tor or i2p or whatever are pedophiles. What I am saying is that those are tools that are pretty notorious for being used to distribute and share csam. And while some people are okay with “Oh yeah, my private browsing of this website helped to mask child porn but I personally didn’t look at or share any”, I am not.
Your scenario would specifically require the cops to ask their techs for a detailed report and then deliberately lie about it’s conclusions to attack completely random people, and just FYI the last few rounds of this happened when public WiFi was new and the cops kept losing so badly in courts that this doesn’t really happen much anymore. You don’t even need a great lawyer, just an average one who can find the precedence.
There’s no “additional fingerprints” of relevance binding any node in a tunnel to the communications in the tunnel. It uses PFS and multiple layers of encryption (tunnels within tunnels). They need to run a debugger against their node to have any chance to really argue that a specific packet came from a specific node, which also would ironically simultaneously prove that node didn’t actually know and was just a blind relay (just like how mailmen aren’t liable for content of packages they deliver).
Your argument is literally being used to argue that nobody should have privacy because those who don’t break laws don’t need it, yet you yourself are arguing for why we still need privacy if we haven’t broken laws. The collateral damage when such tools aren’t available is so much greater than when privacy tools are available. One of the greatest successes of Signal is how its popularity makes each of its users part of a “haystack” (large anonymity set) and targeting individual users just for using it is infeasible, protecting endless numbers of minorities and other at-risk individuals.
In addition, it’s extremely rare that mass surveillance like spying on network traffic leads to prosecutions. It’s usually infiltration that works, so you running an I2P node will make zero difference.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !piracy@lemmy.dbzer0.com
⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.
What “increased risks as far as csam”? You’re not hosting any yourself, encrypted or otherwise. You have no access to any data being routed through your node, as it’s encrypted end-to-end and your node is not one of the endpoints. If someone did use I2P or Tor to access CSAM and your node was randomly selected as one of the intermediate onion routers there is no reason for you to have any greater liability for it than any of the ISPs who are also carrying the same traffic without being able to inspect the contents. (Which would be equally true for CSAM shared over HTTPS—I2P & Tor grant anonymity but any standard password-protected web server with TLS would obscure the content itself from prying eyes.)
You are still possessing csam while being used as a node to transit it.
A compromised (or even honey pot) node can show all the people who were “just holding it for a friend”. And ignoring that ISPs have historically cooperated in investigations, they also have many more lawyers.
So regardless of your ethical/moral concerns over facilitating the transit of csam, you are opening yourself up to being caught in a semi-tech savvy investigation.
This is not how the law is applied to packet switching.
If it was store and forward then maybe just maybe law enforcement would care, but anybody smart enough to set up an I2P node to research it and who tried to track where packets from from would first see the packets originate from their own local node at 127.0.0.1, then in the I2P console they could see that packet came in via an active half-tunnel from their own end interfacing with the endpoint node of the other side’s half-tunnel, and they would know that node has no idea what it’s sending (just like their ISP)
1: then they would go after literally anybody running a node
2: their client will not see peers on another IP. It will just see their own I2P node. Any I2P aware software will also not have any IP addresses as peers, only I2P specific internal addresses. They will not even be able to associate an incoming connection to any one node without understanding the I2P network statistics console.
3: by this argument all anonymization tools should be illegal, Signal too, etc, and nobody should help anybody maintain privacy. In the real world there’s plenty of reasons why anonymization tools are necessary. And there will be literally zero evidence tying you to a crime. Preexisting legal precedence says an IP address alone is not enough.
ACAB? Also, I’ll get back to this
And only people with similar politics to you will ever gain that understanding? Again, more on this
And countries around the world are increasingly pushing legislature to make “anonymization” and “encryption” tools illegal (or at least require backdoors).
Which gets back to the politics aspect. Even among those of us who care about personal security (which, again, has nothing to do with torrenting but here we are), the likelihood of others to use it for nefarious and evil purposes is a problem. I’ve taught a few journalist friends how to use tor but I personally do not because that, and tools like i2p, tend to also be used for csam and I have pretty strong morals and ethics about not facilitating the dissemination of that.
And, as we remember once or twice a year, there are “hacktivist” groups out there who like to have a field day. And compromising tools used for the distribution of csam is something that many groups do.
But also? Those piece of shit cops and governments trying to get their fascism on? It is a lot easier to push for “extreme measures” when it is going up against pedophiles and child abuse. We saw similar with how the US (and other western nations) cracked down on immigration under the guise of “stopping the Muslims from doing another 9-11”. And we are likely to see similar come out of the Israel/Palestine war.
MAYBE you get a really good lawyer so that you can get off on… Maybe you get a really good lawyer who cites the proper legal precedents AND a judge AND a jury who actually care about that. You have still had your reputation ruined for “being a pedophile” and laws are already being pushed to make using any of these tools illegal to begin with. And The People will generally support it because CSAM.
And getting back to “an IP address isn’t enough”: Yes, some judges have decided that. Was it Avatar that was the big case people like to cite? Been a minute. But that doesn’t stop other judges who just don’t give a shit about precedent still providing the subpoenas. And considering that getting the equivalent of a peer list requires “understanding the i2p network statistics console”: There are likely to be additional “fingerprints” involved. I’ve not spend much time looking at said console so am assuming there is nothing as stupid as a mac address, but it becomes a lot harder to say “Old Lady Withers across the street was using my wifi”.
Just because people are stupid and this is the inevitable drive by from the peanut gallery:
No, I am not saying that everyone who uses tor or i2p or whatever are pedophiles. What I am saying is that those are tools that are pretty notorious for being used to distribute and share csam. And while some people are okay with “Oh yeah, my private browsing of this website helped to mask child porn but I personally didn’t look at or share any”, I am not.
Your scenario would specifically require the cops to ask their techs for a detailed report and then deliberately lie about it’s conclusions to attack completely random people, and just FYI the last few rounds of this happened when public WiFi was new and the cops kept losing so badly in courts that this doesn’t really happen much anymore. You don’t even need a great lawyer, just an average one who can find the precedence.
There’s no “additional fingerprints” of relevance binding any node in a tunnel to the communications in the tunnel. It uses PFS and multiple layers of encryption (tunnels within tunnels). They need to run a debugger against their node to have any chance to really argue that a specific packet came from a specific node, which also would ironically simultaneously prove that node didn’t actually know and was just a blind relay (just like how mailmen aren’t liable for content of packages they deliver).
Your argument is literally being used to argue that nobody should have privacy because those who don’t break laws don’t need it, yet you yourself are arguing for why we still need privacy if we haven’t broken laws. The collateral damage when such tools aren’t available is so much greater than when privacy tools are available. One of the greatest successes of Signal is how its popularity makes each of its users part of a “haystack” (large anonymity set) and targeting individual users just for using it is infeasible, protecting endless numbers of minorities and other at-risk individuals.
In addition, it’s extremely rare that mass surveillance like spying on network traffic leads to prosecutions. It’s usually infiltration that works, so you running an I2P node will make zero difference.