Now I have the scene from "Liar, Liar" stuck in my head.
It's a dick move, and I'm fine with him being caught and punished.
I'm at reasonably large (~15000 students on-campus), and a friend using TOR to do ... something ... got caught not because he was the only one using TOR at the time, but because he was the only one using TOR, ever -- it was just too obvious.
He was caught because they probably assumed the threat was an internal hoax, checked the logs and found only one or a few internal users on Tor at the right time, then got a police officer to ask each of them if they had done anything wrong [1]. One confessed, and there you go.
Morale of the story: don't do illegal things, and if you do want to do illegal things, have a cover story and don't admit things based on inferences from investigators.
[1] In fact, they probably overrepresented the evidence and then left him to talk himself into being convicted.
edit: Or how about a prepaid cell phone 3g connection?
You really have to have a shallow life experience to think a bomb threat to get out of an exam is even remotely an okay idea.
He elucidated the disparity between the facade of harvard student esteem and the puerile, cowardice reality.
He disrupted the lives of thousands of self-entitled ivy league students, potentially even delaying some of them from further concentrating wealth.
He made the police experience a once-in-a-month type of excitement that might keep them from getting bored and harassing an unwitting minority for as long as a week.
</snark>
The submitter of yesterday's post joked,
> I guess I should have written a paragraph's worth of inane blog spam to get my submission title used? I was trying to make this exact point in my original title. The title my submission was assigned is not the real title of the PDF either... seems very arbitrary.[0]
I completely understand the desire not to editorialize discussions. That said, this is an interesting case study of how the title of the submission very strongly affects the actual discussion that unfolds. After the title was changed, more of the comments revolved around the actual bomb threat itself, rather than the security benefits (and caveats) of Tor.
That was my first submission to HN and I was really surprised to see my submission title changed, and you're correct that the title change directed the conversation away from what I intended. I'm probably not going to start a blog so that I can control the titles of my posts to HN, so I will probably be dissuaded from submitting content in the future.
Oddly, the Guidelines suggest exactly that:
If you want to add initial commentary on the link, write a blog post about it and submit that instead.
The first mistake this guy made was doing something that made the authorities want to know who he was, and have a good excuse for expending enormous resources (if necessary) to do that. Had he used TOR correctly, it would have been harder for them, but it's very likely they would still have succeeded.
Plenty of people here are making comments that sound suspiciously like advice for breaking the law. I realize that that's not actually the case -- lessons taken from somebody who did something illegal and got caught can be perfectly applicable to someone trying to do something legal, privately. We all should be aware, though, that TOR and other privacy tools (and other non-privacy tools, like bittorrent) have a reputation for being designed for criminals, and it's not a good idea to seem to sympathize too strongly with people who use TOR to send in bomb threats.
Any security can be broken given sufficient resources and motivation (e.g. if you can't brute-force the crypto, you can brute-force the keyholder, etc.).
The ISP knows that your IP is connecting to the IP of a TOR relay. (EDIT: the ISP is technically renting the IP address to you, so they obviously know it.)
And the admin of your network knows it too, which is exactly why the guy got caught.
However that is not without its hazards. He would need to evade CCTV and make sure he did not take his cell phone with him to the post box. The stationary he used would also have to be untraceable, so a stack of identical envelopes at home would not be ideal. He would also need an alibi lest any neighbours end up why he was posting letters at 4 a.m.
That would have required advance planning; seems he did this on impulse or, at least, not far enough ahead of time to use the mail.
Obviously, he should've just not done it from Harvard's network (and obviously, he shouldn't have done it at all)...but I think it's a good lesson when teaching others about security...know the conceptual limits of the black box you choose to use.
If I needed to be shielded from the Feds, and I depended on Tor for this, I'd feel increasingly nervous.
