How do connection relays strengthen anonymity?

Question

We've all heard of the concept of some geek bouncing their internet connection over a number of servers to hide their trail when doing something secretive. I'm curious about why this is done. I know the raw basics of TCP and SSL, but it isnt clear to me how tracing someone's internet connection even works.

Let's say I'd like to run a black market online

• I place my web server in a shack purchased under a fake name in a country where it's hard for outside authorities to legally act/investigate.

• I want to remotely connect to this web server to manage my market, but I'm worried about the NSA or CIA or FBI catching onto my market and tracing the server back to me, at my house in the USA.

• So I could connect via an SSL encrypted connection, but if my packets are intercepted, the headers are going to still show the origin of my packets, even though they can't see the contents. That's enough to associate me with the illegal market run on the web server, and I'm in prison.

So, I need to encrypt not only the contents of my packets, but the headers too. This is where my knowledge ends. I'll note my current research on the subject to highlight where my confusion is:

• If the authorities know about my server, and want to find who it is connecting to it, to nail their culprit, they'll need to intercept my packets between the server and an unknown location. Where do they hook into the network and how do they know which packets are originating at the server? I suppose they could cut the wire coming from the server's location, place a machine that reconnects the two ends, and sends data through but watches the contents, where they can read the origins of my remote connection via the TCP headers. But that seems extreme. Do they run to the nearest ISP data center and plug into the servers? Is that where they look into the traffic and pinpoint any packets coming to/from my server?

• Tor manages to encrypt the headers so that's taken care of right? That can be done either via Tor or via my own software design.

• But next, the common idea is that I would next route my packets through a bunch of different servers. Tor does it, or I could do it via my own set of proxy servers. Perhaps 300 personal computers that I've compromised around the world, I could reflect my packets from each of them as my remote commands are sent to the server and responded to by the server.

And so here is/are my question(s):

1. Why, if it's possible to encrypt my TCP headers, do I need to bounce my packets all over the place as if to give authorities the slip.
2. How do internet ISP servers know where to route my packets if their headers are encrypted?
3. And what is the result of me bouncing my packets somewhere else before they reach me? What do authorities now have to do to follow the route of my packets, exactly? And why does it matter if the TCP headers can be encrypted?

In other words: Why do connection relays strengthen anonymity?

Answer 1

There isn't any real magic here. The thought is that it is non-trivial to trace a message to it's physical location. It generally involves support by the ISP and is strongly regulated by the prevailing laws. So, while it is possible to trace messages, it requires some effort.

If I use an intermediate relay, the thought is that anyone tracing packets to my server will first find my intermediate relay. Upon analysis, they will see that it is acting as a relay and then they need to trace the relayed packets. So you've roughly doubled the amount of effort required.

If the relay and the server are in different countries with different laws, someone tracing the packets would now need to navigate two legal systems. And if the countries are known for not supporting this type of research, this could be very costly. Adding more relays increasingly raises the cost of tracing packets to the server.

Some negatives of this are increased communication costs, increased complexity, and having to deal keep up with changes in multiple legal systems.