Admittedly from the article: "used two separate anonymity tools to cover his tracks — the routing service Tor, which covered his web traffic, and the temporary mail service Guerrilla Mail, which offered a one-time email"

Then they noticed that "that the originating IP address would have been revealed in the email header, which would have indicated Tor usage"

And from there "agents checked to see if anyone had accessed Tor through the local wireless networks. That led them to <culprit>, who promptly confessed."

Doesn't sound like they even had to engage with Tor infrastructure or Guerrilla Mail backends, just 'hmmm did a student use Tor, oh some did, let's check them out in full FBI livery' which freaked the kid out and he confessed.

It's easy to check if an IP is a Tor exit node, but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources.

> but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources.

It's an easy problem if you control the majority of the nodes. All it takes is throttling traffic on an exit node and watching which inbound traffic is affected. It is cheap for the US to fund the operation of all Tor nodes in return for the massive intelligence boost it offers.

At the end of the day, it's a DARPA project originally, I'm sure the US Gov't has been _heavily_ invested in monitoring it for a while. Still I'd argue when doing anything on the web the behemoth that is the US could probably flex some of that spending muscle to levy massive resources.

However FBI tracing bomb-threat is probably still not using NSA-level resources... given the whole not our citizens wink wink thing.

> given the whole not our citizens wink wink thing.

Intercepting encrypted domestic communication is fair game as far as the TLAs are concerned. They also always have the option of routing domestic traffic outside the country to make it "foreign origin".

But it's leaps and bounds more private than any VPN including this (no shade on these guys, if I ever need a VPN that isn't tor, I'll choose them). E

To me, comparing tor's privacy features against normal VPN is like comparing a jet plane to a tricycle

What opsec one might employee?

Grandma's Wifi up the street -> Public Library Network -> VPN1 -> Tor -> VPN2 /s

Only to get the best dial up speeds /s