[tor-talk] Harvard student used Tor to send bomb threats, gets caught by old-fashioned policework

[Tempest]

tor at bitmessage.ch:
> I appreciate your perspective but still think the community may still be
> better off--including those who take the time to RTFM--by taking a harm
> reduction approach to the RTFM-related problems you've mentioned.

the fundamental problem here is that this is not a technological issue.
it's a user issue that will, in the end, breakdown at the "rtfm" point.
currently, the tor browser bundle has a link on the opening page which
documents the standard tips on remaining anonymous. outside of writing
more detailed instructions on identity correlation and linking them in
the basic instructions, there isn't much more that can be done outside
of discovering a technological means that makes connecting to the tor
network itself invisible.

> We may not feel sympathetic to this user's situation because of the
> circumstances, but I hoped to point out that something similar could
> plausibly happen to some *other* person using Tor for good that we
> probably wouldn't want to experience the Syrian equivalent or the Chinese
> equivalent of the consequences this person now faces.

the more you look at the circumstances involved, the less likely that
is. the man who made the threat was using tor for offensive, rather than
defensive, purposes. additionally, he was engaging in an offensive
operation against an entity that he was personally connected to. for
people looking to circumvent censorship, it is unlikely that they will
be viewing any servers run by their respective oppressors while using
the tor network. rather, they'll most likely be communicating with
servers that are not run by their respective oppressors and, instead,
are blocked by them. completely different scenarios.

> Framing user education as an
> important problem to solve or mitigate where possible seems like a more
> constructive approach to me. Maybe we can't prevent all users from making
> unwise choices, but to the extent we can help more of them, I still think
> we should try.

https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting

it's there. maybe the harvard student would have been smart enough to
figure out what it meant. maybe he wouldn't. or, like so many others,
maybe he would have decided to role the dice anyways under the
assumption that capture was unlikely. without the tor project
documenting every possible way someone may get caught through their
various uses of tor, i'm hard pressed to think of a solution to te
problem posed by ignorant users.