Can tor be easily traced by governments?

Question

Basically when you use tor, tor normally makes a circuit consisting of the client, 3 nodes, the server. However the client, server and each node, each have an isp, isps log everything they do, they know to who they send packets and from who they recieve packets, so basically the government can traceback to the client by getting logs from the isps of the each node and server?

Edit: I mean more like correlation attacks, For example if you hack a server using tor, the server has the ip address of your exit relay so law enforcements can get your exit node ip address from the server then they check your exit node isp to see to who this ip address was communicating at the time the server got hacked, then they get your middle node ip address from your exit node isp, then they do this to your middle node isp and vice versa untill they find the client.

Answer 1

Yes, the attack you describe -- tracing a single Tor circuit through the various relays using metadata -- is theoretically possible, however it requires a set of circumstances so unlikely as to make it practically impossible against anyone but the most unpleasant criminal elements:

1. All the relays you use have to be under surveillance. Someone has to be taking sufficient notice of the relay traffic to be capturing 4-tuples (src IP, dest IP, src port, dest port) for all of those relays, more-or-less all the time, and storing them for an extended period. This could either be because the relays are run by a malicious party, or because someone is keeping taps on all tor relays in their jurisdictions, or even that jurisdictions have universal metadata capture and retention laws (Australia is one such jurisdiction, for example). Frankly, I would be surprised if practically every public Tor relay wasn't having its communications metadata harvested, one way or another.

2. What you're doing has to be sufficiently serious for all the jurisdictions to cooperate. This is where dissidents and NGOs have a much better time than criminals, because if your circuit passes through a jurisdiction which does not, for instance, want to see people tortured for political communication, then the trace stops dead. On the other hand, if you're taking down the international financial network, it's quite likely that most every country would be OK to help out with whatever logs they've got.

3. The relays you used mustn't have a lot of other traffic. This is why "but criminals use Tor!" isn't entirely a bad thing. Every Tor user, regardless of what they're doing, is providing additional anonymity to other users, by increasing the number of near-simultaneous circuits running through a given relay. If the authorities have to gather the metadata for all the middle relays that a given exit talked to, and then the metadata for all the guards/bridges that all those middle relays talked to, it ends up being quite a lot of international cooperation, and quite a bit of data to sift through. Once again, you've got to be doing something sufficiently illegal that every jurisdiction in which the relays you used reside is willing to expend the time and effort required.

In short: if someone wants to unmask a Tor user, there are a lot of far easier ways to do so than tracing the user through the relays they used.

Answer 2

Your ISP and government can know that you're using Tor, but they won't know what you're doing on it. Because of Tor's method of signifying content, packet analysis will indicate that one is using Tor. Basically, packet entry/exit points, Tor protocols, and routing will give the user away.

You can prevent ISPs and possibly the government from knowing you're using Tor by using a VPN. Preferably one which doesn't keep logs. It is recommended not to use Tor with a VPN though. Alternatively, you can use bridges.