0

Suppose I send death threats using Tor. Then, I send update again. Victim says it is me. Police checks logs on the server and at my ISP. The IP addresses do not match since I used Tor, but there's logged Tor traffic from my laptop which correlates with what was found on the server and at my ISP. And even worse, it happened twice, since I've sent two messages.

Can this be used in court as only evidence?

4
  • 5
    This is more of a legal question than an IT security question. Pretty much anything can be introduced as evidence in a US court; the question is if it's relevant and/or useful. That's all a question for lawyers, not IT security folks. Dec 8 '17 at 15:37
  • 1
    Of course it's possible. That's How FBI catch the Harvard bomb threat suspect. If the suspect was using Tor Bridges, he wouldn't have been caught. Tor bridges can hide from your ISP that you are using Tor.
    – defalt
    Dec 8 '17 at 16:47
  • You could try asking on Law.SE - you may need to give your jurisdiction etc.
    – Rory Alsop
    Dec 8 '17 at 17:51
  • This happened with Freenet. However even with Freenet, it turned out that the method they used was pretty much bogus, and they were using it as an excuse to break into random Freenet users' houses and arrest them in hopes that they'll find something illegal on their computer. So yes, it worked with Freenet, even if the attack itself didn't work.
    – forest
    Dec 9 '17 at 5:10
3

I don't know about the legal side, but law enforcement does this to find the bad guys. See for example

https://www.theverge.com/2013/12/18/5224130/fbi-agents-tracked-harvard-bomb-threats-across-tor

2
  • This could become a great answer. I was going to post this too, but perhaps you could add more details? Right now, this is just a comment. Dec 8 '17 at 17:54
  • I didn't go into more details because I voted to close the question as off-topic... Dec 8 '17 at 18:15
0

Well it depends on the legislation of your country. It may be enough evidence and/or is allowed as evidence in front of a court. Also this is more of a law question than information security in my opinion.

If it could be used as evidence in court a judge decides if the correlation is strong enough. This has to be done by case to case, therefor I can't give you a yes/no to your question.

Not the answer you're looking for? Browse other questions tagged or ask your own question.