Not one person. Hundreds, maybe thousands. Because of a exploited vulnerability, and failure to pay attention to an upsurge in suspicious relays.
Unless you consider that the mistake was using Tor directly, rather than through a VPN service.
A bit more detail would be welcome about those "Hundreds, maybe thousands" of persons. Clearly the security researcher did find a vulnerability in the protocol and confirmed it by unmasking users, but I don't see the support for people getting "tracked down and put into [court]".
More important, what purpose is there to reference a 5 year old patched security vulnearbility? The same year as the above vulnerability was found in Tor, HTTPS was also broken with Heartbleed. The only fool-proof security is security in so many layers that it become statistically unlikely to cause a negative impact.
This is just the outcome from busting one site, PlayPen:
At least 350 U.S.-based individuals arrested
25 producers of child pornography prosecuted
51 hands-on abusers prosecuted
55 American children successfully identified or rescued
548 international arrests, with 296 sexually abused children identified or rescued
The article says that they likely did not have a warrant and simply just went and hired the researcher directly.
But fair enough, the claim that hundreds did get tracked down and arrested, due to a bug found by a security researcher after getting hired by the FBI, is true.
People selling zero days vulnerabilities is a major problem to security. Sadly it is something which new threat models need to take into consideration. The Tor Project did change how the Tor browser bundle updates, and I suspect this event did also caused some ripples in the project in how much they can trust researchers.
Once in while, Tor node operators will complain about DDOS on the tor mailing lists or similar sites. In most of the cases this is just an attempt to figure out guard nodes or real IP addresses of an individual or server.
> More important, what purpose is there to reference a 5 year old patched security vulnearbility?
Sure, it's old, and everyone screws up sometimes.
A few things bother me about it. One is that we know that the Tor Project did notice the malicious relays that CMU people were hosting. From what I've read, they weren't subtle about it.
So basically Tor Project staff said that they screwed up, and apologized. But somehow that just doesn't feel plausible.
There's also some email obtained through FoIA which could be read as evidence that "Tor developers are closely working with the US government".[0]
Sure, maybe that's just paranoia and conspiracy theory. And I do appreciate the delicacy of supporting strong anonymity for Tor without defending child pornographers.
There was a Harvard student a few years ago who got busted for e-mailing a bomb threat (during finals, maybe?) or something like that.
The school reviewed their (Netflow?) logs, found the users on their network who were using Tor at the time and so he quickly became a suspect (and confessed when questioned, IIRC).
If he hadn't been on the school's network, it would have obviously been much more difficult, if not impossible, to find him so I suppose this one could be classified as an opsec fail.