How can an external observer detect if a malicious relay does excessive logging?

Question

In the entry "Criteria for rejecting bad relays" on the Network Health Team's wiki I found an interesting bullet point:

Malicious relays

---

• …
• Excessive logging (over notice) during normal operation, …
• …

How can an external observer possibly detect this? I can think of some hypothetical side-channel probes (like trying to overload only the storage subsystem of a relay and see if the traffic got slower due to logs taking longer to flush) but they seem a bit far fetched. Is the method published? Does anyone have some insight?

Answer 1

There is no way short of the hypothetical attacks you mentioned to determine if a relay is excessively logging. Excessive logging is a criterion for considering a relay malicious but that doesn't mean that there's a way to verify that it is actually logging sensitive information. However, if a relay operator openly admits to logging data that they shouldn't, it could result in their relay being removed from the consensus manually. We can only rely on the fact that most relays are run by honest parties.