Tor in Germany. What we really know about the BND, the NSA and the German police
Germany is one of the pillars of the Tor network. It is also the country where the NSA monitored a Tor server run by a student in Erlangen, where the BND tapped cables in Frankfurt, and where police in 2024 de-anonymised a user of the network. Here is what follows from all this - without conspiracy theories.
The Tor network runs on volunteers. Several thousand people and organisations around the world provide their servers, through which users' encrypted traffic passes. Every connection runs through three randomly chosen relays, and none of them knows both the sender and the destination at the same time. The more independent relays there are, the harder it is to track anyone down.
For years Germany has been among the countries hosting the most Tor relays - often in first place in the world. Cheap, fast connections, a strong hacker scene centred on the Chaos Computer Club and a tradition of civic distrust of surveillance all play their part. One of the few directory authorities - the servers that maintain the official list of all relays in the network - also ran at German addresses.
That is exactly why what happened in Germany matters for the whole of Tor.
The student from Erlangen
On 3 July 2014, the German public broadcasters NDR and WDR published a report that electrified the community. Journalists had obtained fragments of the source code of XKeyscore - the system the NSA uses to search intercepted internet traffic. The code contained specific rules: whom and what the system should flag.
One of the rules concerned a Tor directory authority run by Sebastian Hahn, a 28-year-old computer science student at the University of Erlangen. Anyone who connected to this server could be recorded. Other rules flagged people who simply visited the torproject.org website or searched for information about the Tails system - described in a code comment as "a comsec mechanism advocated by extremists on extremist forums". According to the report, the rule concerning the Tor website excluded people in the "Five Eyes" countries, that is the US, the UK, Canada, Australia and New Zealand. Everyone else was flagged - including Germans.
The origin of the code was never fully explained. Some experts believed it did not come from the Snowden archive but from another source. The NSA did not confirm its authenticity. But the conclusion was hard to ignore: mere interest in privacy tools could be enough to end up in an American intelligence database.
Eikonal: intelligence helping intelligence
Even more uncomfortable for Germany were the findings of the Bundestag committee of inquiry that investigated cooperation between the German intelligence service BND and the NSA. It revealed an operation code-named Eikonal.
From 2004 to 2008, the BND rented two secured rooms in the basement of a Deutsche Telekom switching centre in Frankfurt am Main. There it tapped cables carrying international telephone and internet traffic. The data was filtered using so-called selectors - addresses, numbers and keywords - supplied by both the BND and the NSA. The results went to a joint unit of the two services in Bad Aibling, Bavaria.
In theory the system was meant to filter out communications of German citizens, which the BND was not allowed to pass on. In practice, tests showed the filter was not one hundred per cent effective. In 2015 the so-called selector affair broke: it turned out that among the American queries the BND had let through for years were also targets in European countries, including institutions and companies of allies. Earlier, in 2013, Chancellor Angela Merkel - after reports that the NSA had tapped her mobile phone - uttered the famous sentence: "Spying among friends - that's just not done."
Eikonal was not an operation aimed at Tor. It was something more fundamental: proof that internet traffic flowing through Europe's largest data exchange hubs can be of interest to several services at once - and that the line between "our" and "someone else's" intelligence can be blurry.
Boystown: an attack that worked
In September 2024, journalists from the NDR programmes Panorama and STRG_F revealed something many specialists had feared for years. Germany's Federal Criminal Police Office (BKA) had succeeded in de-anonymising a user of the Tor network.
The case concerned the administrator of Boystown, a platform on the Tor network with child sexual abuse material. The man, arrested in North Rhine-Westphalia and convicted in 2022, communicated via Ricochet - a messenger that runs entirely inside the Tor network. According to the report, investigators monitored selected relays of the network for a long time and used so-called timing analysis: they compared when and which data packets appeared at different points. The mobile operator Telefónica handed over data on customers who connected to a particular Tor relay. Putting this information together made it possible to identify which entry relay the suspect was connecting through, and from there it was a short step to a specific person.
Matthias Marx of the Chaos Computer Club, who reviewed the material, judged that similar operations had most likely been carried out repeatedly and over several years.
How timing analysis works
It is easiest to explain with an example. Imagine a building with many entrances and exits, and inside a maze of corridors where you cannot see who is going where. If you watch one entrance and one exit, you may notice that every time someone in a red jacket enters at 14:02, someone leaves at 14:05. Once is a coincidence. A hundred times is a pattern.
On the Tor network, the "jacket" is the size and timing of data packets. Encryption hides their content, but it does not change the fact that at a particular second a chunk of data entered the network, and a moment later a similar chunk appeared somewhere else. Whoever can see both ends of a connection can link them. In the Boystown case, long-term observation was key: for many weeks the messenger maintained its connections in a similar way, which made it possible to gradually narrow down the set of relays its user could be connecting through - all the way to the one closest to him.
Tor's response
The Tor Project responded quickly and factually. It stressed that it had not seen all the documents, but that the available information suggested the arrested man had been using an old version of Ricochet that lacked protection against so-called guard discovery attacks. That protection, known as "vanguards", had been available in the actively maintained Ricochet-Refresh since June 2022. In the same year a simplified version of this protection was built into the Tor software itself.
This is an important distinction. The Tor network was not "broken" in a mathematical sense. Its encryption still works. What succeeded was something the project had warned about from the very beginning: an adversary who observes a large enough part of the network for long enough can use statistical analysis to narrow down the circle of suspects. Tor's designers never claimed that the network protects against someone who can see both the entry and the exit of the traffic at the same time.
Does Germany control Tor?
No. And that is the most important conclusion. There is no evidence that the BND, the NSA or the German police "control" the Tor network in Germany or anywhere else. There are several thousand relays, run by independent people in dozens of countries, and malicious relays are regularly detected and removed.
What we do know is three things. First: intelligence services are interested in Tor and its users - not only criminals, but anyone who wants to protect their privacy. Second: cross-border cooperation between services means that data collected in one country can end up in another. Third: statistical attacks are real, especially against people who use outdated software and connect in the same predictable way for long periods.
What follows
Tor is still one of the best tools for protecting anonymity that exists. But it is not a cloak of invisibility. It works best when you keep your software up to date, avoid abandoned projects, do not keep the same connections open for weeks and do not assume that one tool will do everything for you.
The German story also shows something broader. The infrastructure of the internet - cables, exchange points, operators - will always be a place where states try to look. Privacy does not mean that nobody ever sees anything. It means that what can be seen is not enough to identify you.