[mpyne]

A Tor user at Harvard was successfully tracked when he sent a bomb threat, since he was the only user on the Harvard LAN using Tor at the time the threat was issued.

That wasn't proof, of course, but it didn't need to be proof, just a good lead for law enforcement to kick-start their investigation.

[grugq]

My analysis of that incident: http://grugq.github.io/blog/2013/12/21/in-search-of-opsec-ma...

[tempestn]

Enjoyed, thanks. Particularly liked "Let's call it half a win."

[jlgaddis]

If memory serves, there were several people who had been or were using Tor at the time the threat was sent. When he was questioned by the police, however, he confessed.

[mpyne]

That's possible, but doesn't really change the point. By bootstrapping a associations of identity-masking technologies with possible identities you allow "normal" law enforcement investigative techniques to unmask the identity.