Legal limits on traffic monitoring

Tor may be used for carrying out various activities illegal in domestic legislation, such as selling and buying illegal goods or disseminating child pornography. All these are generally criminalized under the national criminal legal framework. However, it should not be overlooked that traffic monitoring via Tor may also be illegal under national law.

Little legal analysis has been undertaken regarding the activities of a Tor exit node operator. There is no concrete evidence to claim that running the Tor exit node is illegal as such. However, it should not be disregarded that the Tor exit node operators have access to the traffic going through their exit nodes. Tor anonymizes the origin of the traffic and ensures encryption inside the Tor network, but it ‘does not magically encrypt all traffic throughout the Internet.’ Or in other words, Tor does not offer 100% anonymity since the exit node is in a position to capture any traffic passing through it. For example, the Tor exit node operator can intercept private e-mail messages (unless there is end-to-end encryption) and get access to usernames and passwords. In 2014, researchers identified over twenty ‘spoiled onions’ (Tor exit nodes) that were run to sabotage Tor traffic.

Even if such access to data and interception is done ‘in good faith’ such as when a researcher wants to find out what type of data is transferred by Tor to improve the service for legitimate users, and identifies and blocks traffic which is in contradiction with the law (for example, child pornography, hacking attempts, and most torrent traffic), such monitoring would be illegal in most legal systems.

Due to the differences in national legislation, countries may have various approaches to criminalizing activities that could be undertaken using Tor. For the sake of clarity, the following analysis will be based on the Council of Europe’s Convention on Cybercrime. Traffic monitoring could be categorized under various articles (such as Article 2 ‘Illegal access’). Still, foremost it should be analyzed in the context of Article 3 that obligates the Parties to criminalize ‘illegal interception’:

*Article 3 – Illegal interception
Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offenses under its domestic law, when committed intentionally, the interception without right, made by technical means, of non-public transmissions of computer data to, from or within a computer system, including electromagnetic emissions from a computer system carrying such computer data. A Party may require that the offense is committed with dishonest intent or about a computer system connected to another computer system.