Eric Jardine from Virginia Tech in Blacksburg, Virginia; Andrew Lindner from Skidmore College in Saratoga Springs, New York; and Gareth Owenson, from the firm Cyber Espion in Portsmouth, UK, said in a paper published on 30 November that this percentage of users was clustered unevenly across countries.
They found that the more potentially malicious Tor users (7.8%) were from so-called free countries while the figure (4.8%) was lower for so-called not free regimes.
"These results suggest that the countries which host most of the infrastructure of the network and house the Tor Project plausibly experience a disproportional amount of harm from the Tor anonymity network," the trio said.
|
|
"Tor clients (users) randomly choose an entry node from the set of available nodes in the network (weighted by available bandwidth)," Jardine, Lindner and Owenson wrote,
"By running 1% of guard nodes, we observe a random sample of all Tor relay users, although our data does not include those who employ Tor bridges to access the network.
"By analysing unique signatures in the traffic (for example, directory look-ups), we can distinguish whether clients are using Tor to visit either the clear web (e.g., CNN.com) or a Tor Onion/Hidden Service (e.g., xyz.onion).
"This process does not reveal anything about the precise content a user is querying. Additionally, we geolocate the user’s incoming IP address to a country of origin and aggregate these data into a count of all Tor network users per country per day and a count of Onion/Hidden Services users per country per day."
The trio said they then merged the aggregate Tor network data "with measures of country-level political freedom, taken from both Freedom House’s annual Freedom in the World reports and the 'PolityV Political Regime Characteristics and Transitions' dataset; the most recent available country-level indicators for wealth, Internet penetration, and population size from the World Bank; and an estimate of per capita darknet cryptomarket activity at a country level in the years immediately preceding our study period".
The Tor Project has been contacted for comment.
