Correlation Attack

Now we need to talk more about correlation. If you are suspected of being a "Black Hat", then your internet activity could be monitored to see if you connect to the Tor network. If you connect to the Tor network, and at the same time an infamous black hat creates a post somewhere, and then disconnects soon after, you could be found out. Your internet activity correlates with something happening on the internet that is also being monitored. If that happens multiple times in a row then there is a very high correlation that you are the black hat being tracked down. Even if you weren't a suspect being actively monitored it can still happen.

There was a case of a bomb threat at a college at finals week. The University checked the internet logs at the dorm and found a single Tor user at the time of the bomb threat. He immediately folded when they spoke to him. If he had simply walked off campus to a public coffee shop and called the bomb threat there the University wouldn't have been able to correlate that activity. Although the Feds might've later.