The risk to Tor exit nodes

Question

I'm asking a couple of Tor questions today (they're unrelated), and one of which (I'm hoping it's a simple one) is that my understanding is that all requests will be delivered to a server from an exit node. Despite the fact the request has been encrypted and pushed through an arbitrary amount of nodes before it gets there, is the exit node now not the one seemingly responsible for any malicious activity?

E.g. an injection attack is made as part of a web request, and somebody decides to trace the apparent origin of that request - surely the exit node is now the node under investigation/suspicion?

If, for example, I chose to navigate via Tor for a totally legitimate/ethical task, there is a real possibility (if not a probability) that traffic appearing to come from my IP was part of something totally illegitimate. An attack, or worse. Surely, at some point, in the history of Tor, somebody must have been contacted by law enforcement regarding traffic apparently originating from an IP they had? And if not, why?

Answer 1

is the exit node now not the one seemingly responsible for any malicious activity?

Correct, the traffic appears to be coming from the exit node.

there is a real possibility (if not a probability) that traffic appearing to come from my IP was part of something totally illegitimate.

As a normal Tor user you are never an exit node. You are only a middle relay between other nodes. So all traffic from and to your IP is encrypted and your IP would never show up in any server logs of the clearnet.

Surely, at some point, in the history of Tor, somebody must have been contacted by law enforcement regarding traffic apparently originating from an IP they had?

Yes, that occasionally happens. But the Tor network keeps a history of all the IP addresses that were exit nodes at some point. For example, you can use ExoneraTor to check for a particular IP at a particular date. So law enforcement will be able to recognize that an IP involved in an illegal activity was a Tor exit node and searching their home would probably not make much sense (although it can still happen).

That's why the EFF discourages running an exit node from your home in the FAQ for relay operators:

Should I run an exit relay from my home?

No. If law enforcement becomes interested in traffic from your exit relay, it's possible that officers will seize your computer. For that reason, it's best not to run your exit relay in your home or using your home Internet connection.

Instead, consider running your exit relay in a commercial facility that is supportive of Tor. Have a separate IP address for your exit relay, and don't route your own traffic through it.