LowEndBox - Cheap VPS, Hosting and Dedicated Server Deals

Man Found Guilty of Child Porn, Because He Ran a Tor Exit Node (The Story of William Weber)

@William Weber has been a long-term LowEndTalk member, joining way back in 2011. A veteran you could say.

He’s a rather intelligent self-admitted high school dropout that loves his choice of drugs and guns… plus, he has a thing for operating in the grey area of the law.

That combination makes for a perfect storm… and that it did.

You see, William’s notoriety reaches further than just LowEndTalk… for a while, William was a bit of an Internet celebrity.

Way back in the early 2010s, William was directly responsible for an infamous Austrian court case revolving around Tor, specifically running Tor exit nodes.

It rang bells around the internet, particularly sites that revolve around hosting (like us!), torrenting, Tor, privacy, and beyond. Even reaching NBC news.

Why? Because it centered around child porn, and the moral argument that exists surrounding decentralized internet, plus, the people that help make that happen (running exit nodes).

Quite a bit of time has passed since this all went down, and it’s time this story gets revisited…

So, let’s take it from the top:

It All Starts With The Raid

(Austrian court order dated November 12th, 2012.)

Back in 2012, another LowEndTalk veteran named @joepie91 created a (now defunct) site simply titled: “Raided For Operating A Tor Exit Node,” revolving around the case.

It was only thanks to the WayBackMachine that I was able to get a bit of information surrounding the case from Joepie91’s old site.

Here’s how it all starts:

On Wednesday morning, around 10:00 AM local time, the apartment of the Austrian William Weber was raided by the Styrian Landeskriminalamt (LKA), a government agency, as a part of their investigation into a child pornography ring operating on/over the TOR anonymity network. During the raid, numerous computers and other electronic devices, as well as legal and registered firearms and some other items, were seized. William is likely to be charged with distribution and possible production of child pornography.

The TOR network, originally created by the United States Naval Research Laboratory, allows internet users to remain anonymous on the internet, and is used by journalists, activists, and military organizations around the world, to bypass censorship and communicate securely. To accomplish this, the network routes all traffic through a number of relay nodes before delivering the traffic to its final destination, making it infeasible to detect where the traffic originated from. William is the operator of several “exit nodes” (final hops) on the network, and this is an interview with him.

The site continues with an interview between @joepie91 and William:

What are your reasons for running a TOR node, and fighting this accusation?

I believe in freedom of information; I mainly run the exit nodes to make it possible for the not so privileged folks to have uncensored access to the internet, without fear of government prosecution. There are currently not many countries with a clear legal standpoint on TOR nodes. Some countries, like Germany, have complicated legal constructs regarding liability for software like TOR, but this only really applies to registered companies (such as the Telemediengesetz, the German telecommunications law). I’d like to establish a legal base – at least in Austria, and probably for the entire EU. Additionally, I was accused of sharing (and possibly producing) child pornography on a clearnet forum via an image hosting site that was probably tapped. If convicted, this could land me in jail for 6 to 10 years.

What hardware has been taken?

My colocated servers have not been taken, most likely as they are outside of EU jurisdiction (Liechtenstein, US, Hong Kong). It is of course possible that they are being wiretapped by now. The server running the exit node in question, was in Poland, and was already disabled since I moved to a different ISP. Only my flat was raided, which resulted in confiscation of around 20 computers (mainly barebone PCs, HP storage MicroServers and thin clients), external hard drives and USB thumbdrives, my main computer, gaming consoles, tablets (2 iPads) and my phones (Samsung Galaxy Note and a HTC PDA).

What was the raid like?

At 10AM, I was picked up at my workplace by the Styrian Landeskriminalamt (LKA), basically the Austrian equivalent of the FBI for local matters (state police). I was handed a copy of the court order for the search and confiscation of any computer-related hardware and storage media. Since I was not allowed to touch any computers anymore, I had to have a co-worker get me the phone number of the lawyer, who advised me not to say anything. My work laptop was confiscated, and the LKA brought me to my flat, where I had to allow them entry. If I refused, they would probably have forced open the door.

Seven LKA officers, two police offers, and a court-appointed expert witness started a search of the flat, without respecting my privacy or property whatsoever. Paper documents in a cupboard were read, and no care was taken of my cat (who I was allowed to lock into another room later). My storage cubes (HP MicroServers) were confiscated without any regard for the hardware – the power cords were simply ripped out / hard shutdown, instead of properly shutting them down by the operating system. My main PC was shut down normally, as far as i could determine. After finishing the search in my living room, they continued in my bedroom, where they confiscated my legal firearms, as well as my cable TV receiver, and my Xbox 360. Despite my statement that all firearms and ammunition were legally owned and registered, having passed all background checks, this was doubted by one of the LKA officers due to the caliber.

I was asked to open my safe, which I did, where more legal firearms were found (3 handguns), plus a few hundred Euros in cash, some rare coins, and around 3 grams of Hashish and 10 grams of Marijuana for personal use. After finding the drugs, I was asked where I purchased them, without explaining my rights. I replied that I did not wish to answer this question, and repeatedly stated that they were exclusively for personal use. The handguns and drugs were confiscated as a “Zufallsfund” (a German term for something that was not expected to be found during a search – a literal translation would be “coincidence find”). After this, I was allowed to lock my cat into the bathroom – which was either not searched, or searched without me noticing.

Some other things that were confiscated, were my pocket knife and a machete – both of which are fully legal to own under Austrian law. Larger and more threatening kitchen knives, however, did not get confiscated. I was not arrested and free to go after the search; I was however told by police that I had a temporary weapons ban for now, due to drug usage. One of the LKA officers informed me that I should show up for question at the LKA office in Graz, at 13:30 that day. I was also given her number, which was quite ironic, given they just confiscated my phones.

After the search finished, I first took care of my cat, who was extremely scared at that point, and then went to my bank to pick up an emergency phone and cash from a bank deposit box. These deposit boxes are explicitly protected under Austrian law. I used this money to purchase a new laptop. At this time, I was likely being followed by civil police on the street (who were under the impression I didn’t notice them), but they let me off after entering the bank building – again, probably because of laws preventing them from going any further.

Is it common for someone accused of such a crime not to be arrested immediately?

No, not as far as i know; I expected to be arrested as well, but seeing as they came to my workplace first, they don’t seem to have enough proof to even break into my flat by force. I do however expect that I am being monitored, it is possible that they are just waiting for me to contact someone regarding the raid.

What do you believe the legal consequences will be for drug possession?

In the best case, none, as I have no previous convictions, and I am not on probation. As the amount is very low, the sentence must be converted into 2 years of probation (§ 35 SMG). The only way around that would be convincing the judge that I sold them, but I believe that even in that case, it will most likely just be a fine and a probation due to the amount (approximately 4 grams of pure THC in total, I’d guess). The drugs are the least of my concerns right now.

Have you been in contact with the LKA? Have they contacted you since? Do you have any information from the lawyer, or any idea what’s going to happen next?

At 13:30, I showed up as appointed, at the LKAs Graz office. They let me wait outside for 20 minutes before someone finally escorted me to the officer in charge. Again, I was not immediately informed of my rights at this time.

I was handed two copies of the search warrant, with a list of confiscated items – one of them for my hardware, the other one for my guns and the drugs – which I agreed to sign. It was only at this time that I was informed of my right to consult a lawyer or to not say anything at all. I declined, as I had already gotten into contact with a lawyer before that. I, once again, told them where my firearms were purchased and that they were legal, and that the confiscated drugs were only for my personal use. I again declined to answer questions regarding the source of the drugs.

After this, I had them show me the offending IP address, which I identified as belonging to me in the specified timeframe. I explained that this was a TOR exit node under my control at this time. I attempted to explain what TOR is, and they appeared to be familiar with it, as the atmosphere suddenly became more friendly. They probably understood that it was very unlikely they had a child pornographer sitting in their office.

Some questions about my motives followed, which I attempted to answer – but this seemingly failed. I could not make them understand why I would “waste” resources and bandwidth (translating into money) to run a TOR node. I informed them that I was already contacted by the Polish police in May about this IP, regarding hacking attempts originating from it. Back then I had already explained to Polish police that this was a TOR exit node, and that no logfiles were held. After the report of hacking attempts, I shut down the TOR node on this server, but apparently this was too late and they were investigating (and/or wiretapping) already.

I was handed the interrogation transcript, which I agreed to sign after reading it. I was free to go, but again they failed to inform me of something of critical importance – that I was not allowed to leave the country without consent of police. I was informed of this by my boss later. This was quite a surprise and very annoying, as my family and girlfriend live in Slovenia, and I frequently visit them on weekends which is now much harder if not impossible in the next months.

The Raid Aftermath

After William is raided and accused of distributing and/or producing child pornography… they don’t arrest him.

They then spend years trying to build a case and it results in a conviction of “supporting the transfer of underage pornography.”

It was at this point in researching the case I realized almost all of the different sources I was using contained inaccurate information or broken links.

He hadn’t been active over on LowEndTalk in a while, so, I decided to reach out to William directly on Telegram for answers to a couple of questions…

Luckily, he got back to me almost immediately:

Did you accept a plea deal or take it to court?

The Austrian legal system has no plea deals. I was charged and convicted with the support, not the ownership. There is ownership, sale, distribution for no monetary gain, and support of general distribution. The last is what I got and the lowest of all.

But you were found guilty of that and given probation, though?

Yes, as they had to give me the minimum sentence. By law they were right as the law only protected registered companies, unlike in Germany for example. The law was changed a few weeks later to include private persons and sole traders as protected lsps, not just companies, but they had to convict me. No choice in the end.

What was the sentence?

I received 5 years probation instead of a 3-month jail sentence, but I left Austria shortly after sentencing.  There was no probation officer or anything similar. They let me leave without putting in an Inter or Europol warrant to return me. The probation was just on paper in the end.

I noticed they mentioned “logs” of you talking about hosting CP, can you elaborate?

They took a bunch of IRC logs where I stated what I can and can’t host at a web hosting provider I owned. The logs do exist but are taken out of context. 

Why did they originally want to raid you? Did you know or was it random?

I rented a server in Poland and someone uploaded CP to an Austrian image hoster. They reported it to the Austrian police, which contacted the ISP, which gave them my WHMCS login IP and then subpoenaed UPC Austria for my address, then queried the weapons registry.

(William is pictured with an AK-74, ammo is 7.62mm not 5.45mm.)

It didn’t go to the cybercrime unit, but child abuse. They had no idea what Tor was. 

A lot of the articles written about you call you Austrian, but you’re from Israel, right?

I am born there but have Austrian, Israeli, Kosovo, and Slovak passports. I grew up in Austria, my family had to leave around 1940 for obvious reasons.

How much did the court case cost you?

I paid my lawyer about 6k euros. I still owe him probably 3k.

What do you do now?

I left Austria and now work for a German company in IT, and have a data center in Kosovo… hosting grey area things there. Warez primarily.

Also, I do want to add that I have more backstory. The CP was not the only reason for the raid.

What do you mean?

Someone used the same exit to hack a NATO facility in Poland, which deals with chemical and biological weapons. Disarming, etc.

The US tried to extradite me from Croatia in 2017, with not much more info than national security.

They lost their case as I am married to a local and cannot be extradited outside the EU.

Interesting. Where do you stay now?

For most of the summer, I am in Croatia. Autumn is mostly in Kosovo/Albania, winter is mostly in Asia, don’t like the cold.

I asked him for some images for the article here and he sent me quite a few, one of them being him smoking a joint.

It led to a conversation about drug use, in which William says:

I can’t smoke anymore sadly, too much paranoia.

The Tor thing definitely left me damaged in some ways. I have an insanely high rivotril/klonopin (clonazepam) prescription for social phobia. 

To a certain extent, the Tor situation also drove me further into the grey area life.

Would you do it again?

Sure, I still run 3Gbit of exits, but under an anonymous offshore company.

Do you have a website?

He sent me the following:

  1. Ip6.im – free IPv6.
  2. Basehost.eu –  offshore hosting in Kosovo.
  3.  Adria-IX.org – Adriatic IX.

Why Kosovo?

I have very good relations with Serbia but like to keep options open, with my investment into Kosovo I received citizenship. It’s also not recognized by a lot of countries and not a UN member, which means I can ignore a lot of abuse for warez and even spam.

Do you have any future plans?

No idea, other than what I already mentioned. I work a lot on my internet exchange. I deal with IPs a lot and sell hosting on the side, too.

I’m always bankrupt but have no debt, drive a solid paid-off car and we own our house in Croatia and Kosovo.

Our conversation ended there with William sending me a picture about 5 minutes later…

(Picture taken in Croatia by William at his place.)

He added, “Also take this, maybe it’s useful, much better than grey Austria. This is what my life looks like nowadays.”

It Goes Without Saying…

Child porn is bad. Very bad. It shouldn’t be produced nor shared, ever.

Ultimately no one will ever know if William was intentionally “supporting child porn” — but if you ask me?

I think it’s unlikely. As William said, he’s one of those free-speech Tor guys…

With the good of decentralized solutions also comes the bad. It creates an anonymous environment that someone involved in that kind of thing would thrive on.

The moral question really comes down to:

Is it Williams’s fault the server he hosted in Poland as a Tor exit node was the middleman for bad things?

Maybe, if intentionally ignored… but that’s kind of the point of Tor.

You can’t look, so you don’t look… and you ignore the bad things that happen under the surface.

How do you know he intentionally supported child porn, instead of just supporting free speech? It’s a catch-22.

Don’t get me wrong, either. William has his issues and is far from perfect.

He’s at fault in the sense he loves to operate in the grey area… he thrives in it.

You can tell because he’s still actively doing the same thing that caused him all of his issues in the past. But he doesn’t care.

If there’s one thing for certain?

It’s that William is going to be William regardless if you like him or not.

Sir Foxy

2 Comments

  1. William:

    Considerign LET censored me lets go on herey.


    W

    July 25, 2023 @ 2:32 pm | Reply

Leave a Reply

Some notes on commenting on LowEndBox:

  • Do not use LowEndBox for support issues. Go to your hosting provider and issue a ticket there. Coming here saying "my VPS is down, what do I do?!" will only have your comments removed.
  • Akismet is used for spam detection. Some comments may be held temporarily for manual approval.
  • Use <pre>...</pre> to quote the output from your terminal/console, or consider using a pastebin service.

Your email address will not be published. Required fields are marked *