In today's news, a student at Harvard was arrested for making a bomb threat. According to the affidavit for the arrest warrant an FBI agent wrote:

Harvard University was able to determine that, in the several hours leading up to the receipt of the e-mail messages described above, ELDO KIM accessed TOR using Harvardâ(TM)s wireless network.

I guess I don't understand two things about this:

(1) How would they know it was Kim that logged on to the wireless network? Wireless access points I use just have a generic password, not a user specific password.

(2) How would Harvard know he had "accessed Tor". I thought Tor nodes were just generic IP addresses. How would Harvard know the difference between an IP address running Tor and one not?

(3) Even if Harvard magically can tell the difference between Tor IPs and non-Tor IP addresses, are they logging the source, destination and originating user of every single IP packet their network sends?

What is the mechanism by which Harvard would have known this?

closed as off-topic by CharlieRB, Shevek, James P, Carl B, Ƭᴇcʜιᴇ007 Dec 18 '13 at 15:04

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – CharlieRB, Shevek, James P, Carl B, Ƭᴇcʜιᴇ007
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    TOR at a very basic level is a proxy service. There are a lot of ways to identify somebody on TOR, if they always use TOR, its even easier. There are lots of articles on the subject so I won't speak that information. Harvard was supplying the internet so they are able to determine the type of traffic leaving their network. I would guarantee that Harvard is logging your traffic just like every single ISP on this planet does. Its called deep packet inspection or DPI. – Ramhound Dec 18 '13 at 12:38
  • You can never be completely anonymous or the internet would not work. Obfuscation helps, but when you both are physically on the same network most tools like TOR do little. – Austin T French Dec 18 '13 at 14:30
  • @Ramhound logging every single packet seems like kind of a storage intensive operation. Just a single gigabyte download might generate hundreds of millions of packets. – Tyler Durden Dec 18 '13 at 15:29
  • I would imagine it's just connections and not every packet being logged. – user55325 Dec 18 '13 at 15:34
  • Here the question should be: I understand how they determined that the student used Tor, but how can they determine he did so in order to send a message, and in particular, that specific message? – MariusMatutiae Dec 18 '13 at 15:55
  1. I don't know how it is at Harvard, but at my university, students had to log onto the network using their own credentials (there was guest access provided as well, but it wasn't usually used by students).

  2. The list of Tor nodes is not a secret. Anyone can tell what IP addresses are currently Tor servers.

  3. It's certainly possible. I don't know how long they would keep this information for, though. It might be that only "suspicious" activity is logged. There's no way to tell exactly how they did it, but it would not have been difficult for them to figure out.

Not the answer you're looking for? Browse other questions tagged or ask your own question.