What stops someone from masking their own behavior by falsely attributing it to a TOR user. That is, someone runs a TOR exit relay and whenever a complaint comes in for an action actually executed by the relay host, falsely attributing it to a TOR user.
The very same person could just use tor to begin with, without running an exit node at all. And from some perspectives, including mine, that's a good thing, at large.
Actually, there's a very simple and elegant answer to this: Tor doesn't save anything from relayed traffic to disk. So if forensic traces exist on the behavior, it was PROBABLY the node operator.
(I used to have a source for this, but I think I bookmarked it on my dead laptop.)
Not really, sometimes you need pcaps to diagnose network problems as an admin. I anonymize the IPs and shred the files afterwards. But recorded == operator is a bad heuristic.
