Given a nation-state has full access to the logs of the ISPs operating on its territory and given it knows that a certain activity has been conducted by a user from its territory, can they do the following:
- when starting their investigation, they trace initially the IP to a VPN server in another country
- then they identify all domestic IPs, that have communicated with that VPN server at the time of the activity and thus identify the user (or a small group of users).
Is this logic correct?
If this is correct, I'd say it is safer to use Tor than a VPN, as at least with Tor they have to go through all the users who were using TOR at that moment. With VPN, the chance is much smaller that more than one user was using a particular provider and was connected to exactly the given server of the provider at the precise moment.