In today's news, a student at Harvard was arrested for making a bomb threat. According to the affidavit for the arrest warrant an FBI agent wrote:
Harvard University was able to determine that, in the several hours leading up to the receipt of the e-mail messages described above, ELDO KIM accessed TOR using Harvardâ(TM)s wireless network.
I guess I don't understand two things about this:
(1) How would they know it was Kim that logged on to the wireless network? Wireless access points I use just have a generic password, not a user specific password.
(2) How would Harvard know he had "accessed Tor". I thought Tor nodes were just generic IP addresses. How would Harvard know the difference between an IP address running Tor and one not?
(3) Even if Harvard magically can tell the difference between Tor IPs and non-Tor IP addresses, are they logging the source, destination and originating user of every single IP packet their network sends?
What is the mechanism by which Harvard would have known this?