The potential harms of the Tor anonymity network cluster disproportionately in free countries

Significance Measuring the proportion of Tor anonymity network users who employ the system for malicious purposes is important as this technology can facilitate child abuse, the sale of illicit drugs, and the distribution of malware. We show that only a small fraction of users globally (∼6.7%) likely use Tor for malicious purposes on an average day. However, this proportion clusters unevenly across countries, with more potentially malicious Tor users in “free” countries (∼7.8%) than in “not free” regimes (∼4.8%). These results suggest that the countries which host most of the infrastructure of the network and house the Tor Project plausibly experience a disproportional amount of harm from the Tor anonymity network.
The Tor anonymity network allows users to protect their privacy and circumvent censorship restrictions but also shields those distributing child abuse content, selling or buying illicit drugs, or sharing malware online. Using data collected from Tor entry nodes, we provide an estimation of the proportion of Tor network users that likely employ the network in putatively good or bad ways. Overall, on an average country/day, ∼6.7% of Tor network users connect to Onion/Hidden Services that are disproportionately used for illicit purposes. We also show that the likely balance of beneficial and malicious use of Tor is unevenly spread globally and systematically varies based upon a country’s political conditions. In particular, using Freedom House’s coding and terminological classifications, the proportion of often illicit Onion/Hidden Services use is more prevalent (∼7.8%) in “free” countries than in either “partially free” (∼6.7%) or “not free” regimes (∼4.8%).