Tor: An Anonymous, And Controversial, Way to Web-Surf

For more than four years, William Weber has helped run a free service called Tor that makes Web surfing anonymous for anyone.

Then on Nov. 28, the police showed up at the 20-year-old's home in Graz, Austria, and accused him of distributing child pornography. He says the authorities confiscated his computers, and he now awaits formal charges that could lead to jail time.

Mr. Weber says the porn isn't his. But it might have come through his computers as the unavoidable cost of serving as a volunteer for the fast-growing Tor network. "Sure it's bad" that Tor can be used by criminals, he says, but "there is nothing I or the Tor Project can do."

ENLARGE

His experience underscores the challenges facing the Tor Project Inc., a 10-year-old Walpole, Mass., nonprofit that is hoping to take anonymous Web surfing mainstream. The network depends on volunteers such as Mr. Weber whose computers help reroute and conceal Internet traffic.

Created in part to hide the online activity of dissidents in countries such as Iran and China that censor the Internet, Tor has seen its popularity grow in the U.S. and Europe amid concerns about online privacy. In the past year, use of the free software nearly doubled to about 600,000 people every day, the group says.

"Ten years ago, no one had this concept of privacy," says Andrew Lewman, Tor's executive director. "But with the [former General David] Petraeus scandal and cellphones recording your location, now this doesn't seem so far-fetched anymore." Today, some 14% of Tor's traffic connects from the U.S.; people living in Internet-censoring countries are now Tor's second-largest user base.

American users include Andrew Whitacre, 32, who works in the comparative media studies department at the Massachusetts Institute of Technology. He set the Tor software to run automatically on his home computer after learning about it from colleagues. "I can't be confident that I know everything out there that might do my computer or contacts harm," he says.

Tor gets about 80% of its $2 million annual budget from branches of the U.S. government that support free speech and scientific research, with the rest coming from the Swedish government and other groups.

To grow further, Tor must convince more volunteers to sign on to extend its network. That is because Tor, which began in 1996 as a project of the U.S. Naval Research Laboratory called Onion Routing, routes a user's Internet data between a series of random volunteer "node" computers.

This process makes it virtually impossible to trace the data request back to the original user. From the outside, it looks like the data request came from the last node on the chain, such as the one Mr. Weber was running.

Today, Tor has enough volunteer nodes—some 3,200—to allow the network to handle two million daily users. But to sustain millions more users and keep traffic from slowing down, Mr. Lewman says it needs 10,000 nodes.

Tor is developing hardware that volunteers could buy and plug into their home Internet connections to automatically become nodes. For people uncomfortable about running their own nodes with illegal activity on the network, Tor offers a program to sponsor a larger one that is operated by someone and serves as the final, and riskiest, node in the chain.

Tor is "a challenge for law enforcement," says John Shehan, executive director of the National Center for Missing & Exploited Children in Alexandria, Va. It is being used regularly to trade sexually exploitative images of children, he says, but there is little Tor's creators can do about it.

A spokeswoman for the Federal Bureau of Investigation, which polices child pornography, declined to comment.

Services such as Tor "provide lifesaving privacy and security for people who otherwise could face extreme reprisal from their governments," says Andre Mendes, director of technology, services and innovation at the U.S. government's International Broadcasting Bureau, which has given $2.5 million to Tor since 2006.

Tor's Mr. Lewman says the organization has received subpoenas, but hasn't ended up in court because it doesn't actually store any data that could be of use. "We spend a lot of time talking to various law enforcement agencies," he says, adding that some police use Tor themselves for undercover work.

Marcia Hofmann, senior staff attorney at digital-liberties group and Tor partner Electronic Frontier Foundation, says Tor volunteers are likely protected by U.S. law, but it hasn't been tested in court. "At the end of the day, a Tor is a neutral tool," she says, noting that Internet service and telephone providers aren't held accountable for how criminals use their networks.

Still, she recommends Tor volunteers with the largest exit nodes set up their servers at third-party server facilities rather than their homes or offices, if only to prevent authorities from temporarily seizing computers that they are using for other purposes.

In San Francisco, members of a nonprofit hacker workspace called Noisebridge decided a year ago to spend about $800 per month to run a node of their own. "We really care about freedom of expression," says Andy Isaacson, 35, one of the group's founders.

Initially, some of Noisebridge's members were concerned about potential legal challenges. So the group decided to host its node at a commercial server facility in Los Angeles instead of their San Francisco office. Still, they field queries from law-enforcement officials about three times a month, and twice have had officers show up at their San Francisco office.

To deal with these situations, Mr. Isaacson says Noisebridge keeps handouts about Tor near its front door to hand out to any police who show up. "We haven't had any really bad interactions," he says. "But it is always uncomfortable to have them stop by."

Write to Geoffrey A. Fowler at geoffrey.fowler@wsj.com