This is a far more real risk than you might think, I'm currently on the tail end of a police investigation triggered by a device on my home network accessing child porn via Tor. My current theory is that something got added to a botnet and used as a proxy, but I'm not eager to leave things running to find out.

While the police have been incredibly professional about this, its been a truly horrible process. Anything in my house which could be used for digital storage was seized, and I spent 9 hours in a police station, variously being interviewed, and sitting in a cell with plenty of time to think about how horribly wrong it could all go. Since then I've been on bail with the condition that I'm not allowed to be unsupervised with anyone under the age of sixteen, which when you have a one year old son is inconvenient to say the least - there was a short time when it seemed a real possibility that he may be taken into care because social services didn't like that my wife believes I'm innocent. It also cost us hundreds of pounds in buying new laptops to use for work while we wait for our existing ones to be returned.

Thankfully the investigation is coming to an end now (in fact I got a call this morning to say the remaining two computers are going to be returned tomorrow), and it looks like everything is going to be ok. I've spent the last few months worrying that maybe one of our computers has also been used as a server.

To come vaguely back on topic, find a better way to get at TV you want to watch, because no amount of Game of Thrones is worth months of worrying whether the next knock at the door is going to be the police come to take you off to jail.

I'm not sure how downloading Game of Thrones is connected t oyour troubles.

I'd been using Tor to bypass torrent sites being blocked by UK ISPs - while Game of Thrones wasn't directly connected to my problems, the fact I had two computers with Tor installed definitely didn't do me any favours while being interviewed.

Ok. This was missing from your description. It seemed like what happened to you could have happened outside of people using VPNs/Tor to download pirated material. E.g. you could have even just been running an open access point.

Perhaps you haven't attempted to view GoT from "unapproved" locations? That is why some people used Hola: to VPN to an "approved" IP address. Parent's troubles are different, but similar, in that his unwanted traffic came from Tor [EDIT: or maybe just a pwned device? I see now that it's unclear...] rather than Hola. I appreciate reading anything he cares to share, as I am interested in running Tor nodes.

I've got very little information on precisely what happened. The wording on the warrant they had for my arrest was that they'd traced an attempt to access child porn using Tor "through undisclosed means". I'm assuming that means the police are running their own nodes and logging any traffic to go through them, but that's pure guesswork.

Also guesswork, but I think the source was probably the one Windows box in the house which I've run Tor on in the past to get round UK ISPs blocking torrent sites. The most likely thing seems to be that it was turned into part of a botnet and used as a Tor relay, but at least until I get that machine back I've got no way of verifying that (and in all honesty, will probably just format the disk and reinstall it).

As I understand it if you're just passively using Tor (on a computer which hasn't been compromised) then it won't cause you any trouble, but if you start running relay nodes or an endpoint then make sure you've got the number of a good solicitor who understands this stuff - the one I got given by the police opened the conversation with "I know nothing about computers", and was quite clearly convinced I was guilty as charged. Thankfully the police do seem to know what they're talking about, and are well aware that an IP address is far from damning evidence, they've looked like their just going through the motions because they're obliged to ever since finishing their interview the first morning.

> I'm assuming that means the police are running their own nodes and logging any traffic to go through them, but that's pure guesswork.

This is not how tor works. Every connection uses several nodes, and unless they control the entire chain they cannot determine both the origin and the destination of the traffic.

Unless you mean you (or one of your compromised servers) were running an exit node?