Pretty sure no one was claiming it should. Rather they are claiming that the police should be required to collect evidence showing probable cause. If raids on tor nodes find CP more then 50% of the time then yeah they are collecting enough evidence. But if they don't then the police are in violation of the Constitution.

You are correct. The thing that should give you the blanket against police investigations is the fact that an IP address does not identify any particular person, and never has. It identifies--temporarily, I might add--a network interface.

A warrant based on an IP address should be specific to the computing device associated with that IP address at the time it was logged. The cops should never be able to threaten someone with additional seizures--beyond what is specified on the warrant--to coerce cooperation.

"...The computing device associated with that IP..."

Just the NAT router? Computer(s) behind the NAT router? Phones which have wi-fi and may or may not have been on it at the time? Computers on the other end of the site-site VPN which routes traffic out that NAT router to get around Geo IP restrictions? Any computer in the world which has TOR installed and therefore may have been "behind" that NAT router?

The Internet is really complicated, how specifically would you write that warrant without details of the network design?

Those defenses - whilst valid in many cases, and for many reasons - also are a core part of the "reasonable" in "reasonable doubt".

Many conflate reasonable doubt with "any doubt whatsoever", and think that any excuse that can be concocted which is technically feasible is an alibi. "But Your Honor, it is possible that someone snuck into his house, spoofed his MAC address to get on his Wifi, used that to download this and that, and then left undetected!"

So there's a standard of reasonability, and there should be corroborating evidence.

Should, at least. In theory.

Beyond reasonable doubt is the standard at a criminal trial. To conduct a search, you only need probable cause, which is a lesser standard.

But if it is not reasonable to believe that an IP address is connected with a person, it is not justifiable to search or seize anything else that person may own or possess, beyond the particular device identified by the IP. I don't think an IP address alone is sufficient to even meet the probable cause standard.

It is also possible that someone with authorized access to his computer used an unsecured browser to view a compromised advertisement on an ordinary website, which recruited the machine into a botnet, which used infected machines as a distributed filesystem.

It is also possible that a wardriver with a cantenna brute-forced his Wi-Fi WPS PIN and extracted the WPA password, obtaining easy access to the network.

It is also possible that the ISP regularly refreshes its IP leases, and gave the cops identifying information for the customer who had the IP at the time the request was made, rather than the customer that had the IP at the time the suspicious traffic was logged.

None of those scenarios are necessarily exculpatory alibis, but they may cast doubt on any hypothesis that purports to connect an IP to a particular person.

In practice, warrant-signing judges seem to believe that an IP address is analogous to a postal address, possibly because it also contains the word "address", which may be conceptually ingrained into their minds as a permanent physical location.

> The Internet is really complicated, how specifically would you write that warrant without details of the network design?

You've discovered the fundamental problem. You can't. An exit node IP address is completely useless for that purpose because it tells you nothing about where the ultimate endpoint is. The person who actually did it could be in Brazil or Korea or on the International Space Station. You have no actual information on which to base a search.

There is at least a reasonable argument to make that for most residential IP addresses the devices that use the IP address are in the same building as the NAT router. And then you have an obvious solution: You look at the NAT router and then you look at the devices it has given a DHCP lease to, as in most cases there will only be a small number of them which will be in the same building.

But that isn't always the case. The NAT router or one of the devices behind it could be routing traffic for a very large number of machines, e.g. an entire corporation or all of a small ISP's customers or a coffee shop's public wifi. And in those cases the number of different machines controlled by different people is large enough that the IP address no longer identifies anything with enough particularity to justify searching all of the possibilities.

Tor and other open proxies are the extreme far end of that spectrum. It could literally be anyone in the whole world. The IP address tells you nothing at all. And if you know it tells you nothing at all, it provides no justification to search anything in particular.

I wonder if it wouldn't be prudent, if you wanted to run an exit, to pay for dedicated static IP, maybe even on a totally different ISP. Hard to guess what the warrant would cover, exactly, in that case (probably still a free pass to all your machines). Of course, it's easy to imagine the opposite situation, where someone connects an exit node to ${random neighbors ap}, with terrible results.

I would have said the same, if it were not for the police's unnecessary and demeaning execution of their warrant at 6:00AM. If the police knew he was a tor exit node operator, then surely they could have executed this search at a more reasonable hour?

When planning an operation like this you need to plan for a time when the suspect is likely to be home. I imagine the most likely time someone is to be home is right at their regular waking time (people often get home at different times). Additionally, 6:00 AM is not excessively early for a large swath of the population. It's not a convenient time, but when is?

I couldn't help but imagine the police sending a request to view his outlook calendar while reading your comment.

At least he still has intact ear drums and door frame. Sounds fairly reasonable at least by contemporary standards.

They didn't seize the house either

A. That's not what "demeaning" means.

B. As others have said 6:00 AM is among the most likely time that most working professionals will be home.

C. I'm not sure what his status as an exit node operator has to do with the hour at which a search is executed?

Like at an hour when kids are up and running around maybe just on their way to school?

But a no knock swat raid killing people's dog is more fun