[Zak]

Ignorance of the law is not generally accepted as a legal defense, but ignorance of facts is. Most crimes involve a mental state of knowledge or intent with respect to the wrongdoing, and an exit node operator does not know what users are accessing.

Taking the wrong jacket by mistake is not theft, and operating the exit node through which someone downloads CSAM is not criminal possession of CSAM or knowing facilitation thereof.

[Manuel_D]

Do you think drug mules get off scot-free when they say "I didn't know what was in that package"?

[Zak]

If the prosecutor can't convince the jury that they did know, yes.

That rarely happens in practice because prosecutors are usually pretty good at their jobs, and tend not to bring cases they can't prove.

[Manuel_D]

The prosecutor doesn't need to definitively prove that the mule knew he was transporting drugs. Only that a reasonable person should have known.

Back to our Tor example: if you've been repeatedly told by the government that your node is being used for illegal activity, it's hard to plead ignorance.

[Zak]

You've described the legal mental state of negligence, and it's true that some crimes use it. Some jurisdictions have "criminally negligent homicide" as a crime with a lower penalty than manslaughter (reckless homicide) for example.

A look at federal drug distribution statutes in the USA[0] shows the mental state used for most of the forbidden acts is "intentionally" or "knowingly". Other jurisdictions could have different laws, but in the USA, it does appear the prosecutor has to prove that a drug mule knew what they were doing.

Similarly, the federal statute in the USA criminalizing distribution and transmission of child pornography[1] says "knowingly". Someone operating an ISP, an internet router, a VPN, or an exit node has no obligation (and often no ability) to inspect the data they're transmitting to find out if it contains child pornography, and knowing that there's a certain probability a given amount of random traffic contains some does not trigger criminal liability because the operator does not know that any particular data is child pornography.

In another comment you mentioned that ISPs can aid law enforcement because they know details about their customers. They usually do for billing purposes, but in many jurisdictions they're not required to. There is not, to my knowledge a KYC law in the USA for providing internet service.

[0] https://www.law.cornell.edu/uscode/text/21/841

[1] https://www.law.cornell.edu/uscode/text/18/2252A

[Manuel_D]

Continuing to operate a Tor node after being informed by the government that it's being used for illegal activity means the operator did this "knowingly". It's even more egregious than a drug mule transporting an unmarked package:

Imagine the government tells the mule that their employer is shipping dugs in these packages, and the mule still tries to claim that they didn't know that they might be transporting drugs.

[Zak]

It's not enough in parts of the world usually considered free and democratic for an information services provider to know that some of the data they're transmitting might be illegal. If it was, everyone from ISPs to messaging apps to social media sites would be at risk. In the case of child pornography, most jurisdictions require them to report it if they discover it, but they are not required to actively attempt to discover it.

The EU Chatcontrol proposal seeks to change that in some cases (TOR exit nodes not among them), and most people here are vehemently opposed to it.