How Not to Admin a Tracker

I'm assuming most of the audience that is actually moving in the tracker direction is running or planning to run a small operation, for the time being at least. That means spamming all over the place for your site, and that means your previous identity (with all its slip-ups) is irrevocably connected with your site.

Chances are, when you first got involved in the P2P community, you were scared shitless. If you weren't, you should've been. If you were paranoid, you should have made a new account unrelated to any other you might have online. If you didn't, go do that now. Otherwise you're opening yourself up to a whole world of hurt. After a while, you start to relax, to become blasé about the whole copyright issue, and you start to get sloppy again.

Now take this unconcerned you and put it in charge of a BitTorrent tracker. You're probably a little concerned, but that goes away fast. It's just a small operation, after all. It can't hurt.

The problem is that small operations have a way of becoming big operations, and your behavior has a way of sticking around. Even if you've been careful to delete posts as you grow, the curse/blessing that is archive.org will remember your transgressions. All of a sudden, you're at the head of a booming site, and oh shit, what have you done? You go to cover your tracks, but it's too late, of course.

Chances are that if you're headed down this road, you're not far along. You can still change now. Don't make these silly mistakes. If you're going to be involved in your own community, which I recommend, create a new username for it. Don't let hubris enter into the equation. It's tempting to join other torrent sites and go "look at my awesomeness!". Don't. Your admin username should be used only in the context of your own site, and in your dealings with other sites. It's tainted in a different way, and it's dangerous to mix things together.

As well, it's helpful to have an alter ego. Create somebody that is plausibly of the same character as you, but comes from a dramatically different background. Trust me, it's a good idea. You're role-playing, and you should never drop that identity, even with your closest online friends.

Of course, this is the product of much painful experience. Do as I say, not as I do. Accessible as I want the prospect to be, it can be dangerous work, and you have to take it seriously, no matter the size of your site.

Staff Privacy

Running a tracker can gather quite a bit of heat under your persona, especially if you live in a country that dislikes sharing the type of material on your site. It's good to insulate yourself as an admin from these type of things as much as possible, so be diligent and conscientious. Think ahead for the long term when exposing yourself. There was a good writeup on this sort of thing at TorrentFreak, so I'm going to expand from there.

Encryption is king, but nothing quite takes the crown like OTR messaging. For chatting between staff, running OTR offers encryption, authentication, deniability, and perfect forward secrecy. As a supplement and/or alternative, it's very convenient to run your own private XMPP chat server such as OpenFire or Jabberd. XMPP/Jabber allows greater control over configuration and supports SSL encryption.

Paranoia is a positive feeling as a admin, and nothing satiates that feeling quite like running your network connections over Tor, the encrypted onion routing software. This works well when you want to obscure your location or ISP. Practically, it's a difficult thing to put up with considering you'll likely see a significant drop in network speeds over Tor. Nevertheless, it's possible to run two browsers or their mobile package in order to not disturb your normal surfing. Using a VPN solution such as OpenVPN is another handy option to encrypt traffic or create a tunnel.

As a brief aside, never torrent over Tor. Despite the tempting alliteration in the names, they do not go well together. Tor is, by and large, extremely slow, and running BitTorrent through it is a gross abuse of the bandwidth donated by willing volunteers that believe in the free flow of information. Tor is slow for all of us, and if you're torrenting on it, that speed is your fault.

Anyway, if you're like me and don't trust a free email host with your information, set up an email server on your box with webmail. The most easily configured mail setup I've come across is Postfix with RoundCube Webmail, but be aware that the learning curve for the inexperienced is daunting. I still suffer headaches and driving pains to my geeky ego. :P At any rate, this allows you to send and receive site-related email without worrying about your origin or alias. Note that it wouldn't be wise to send email via your server's SMTP service as this could expose your IP in the mail headers.

If you've been good about obfuscating yourself, you won't need to delete server logs that might point to an IP you used, but it's reassuring to not log those things just in case. Scrutinize both Apache and SSH server logs as well as any other services you connect to.

I hope I've provided you with some options to protect your privacy. The best summary would be to quote the TorrentFreak article, "Identity is everything , If you never tell anyone, no-one will ever know."