I'd been using Tor to bypass torrent sites being blocked by UK ISPs - while Game of Thrones wasn't directly connected to my problems, the fact I had two computers with Tor installed definitely didn't do me any favours while being interviewed.
Ok. This was missing from your description. It seemed like what happened to you could have happened outside of people using VPNs/Tor to download pirated material. E.g. you could have even just been running an open access point.
Perhaps you haven't attempted to view GoT from "unapproved" locations? That is why some people used Hola: to VPN to an "approved" IP address. Parent's troubles are different, but similar, in that his unwanted traffic came from Tor [EDIT: or maybe just a pwned device? I see now that it's unclear...] rather than Hola. I appreciate reading anything he cares to share, as I am interested in running Tor nodes.
I've got very little information on precisely what happened. The wording on the warrant they had for my arrest was that they'd traced an attempt to access child porn using Tor "through undisclosed means". I'm assuming that means the police are running their own nodes and logging any traffic to go through them, but that's pure guesswork.
Also guesswork, but I think the source was probably the one Windows box in the house which I've run Tor on in the past to get round UK ISPs blocking torrent sites. The most likely thing seems to be that it was turned into part of a botnet and used as a Tor relay, but at least until I get that machine back I've got no way of verifying that (and in all honesty, will probably just format the disk and reinstall it).
As I understand it if you're just passively using Tor (on a computer which hasn't been compromised) then it won't cause you any trouble, but if you start running relay nodes or an endpoint then make sure you've got the number of a good solicitor who understands this stuff - the one I got given by the police opened the conversation with "I know nothing about computers", and was quite clearly convinced I was guilty as charged. Thankfully the police do seem to know what they're talking about, and are well aware that an IP address is far from damning evidence, they've looked like their just going through the motions because they're obliged to ever since finishing their interview the first morning.
> I'm assuming that means the police are running their own nodes and logging any traffic to go through them, but that's pure guesswork.
This is not how tor works. Every connection uses several nodes, and unless they control the entire chain they cannot determine both the origin and the destination of the traffic.
Unless you mean you (or one of your compromised servers) were running an exit node?
