> It's not that they are suspected more, it's that they are a lead that can be followed on.

If they're not suspected more then it isn't a lead.

> If everyone that used that Tor exit node where known, the Police would be faced with a different problem, too many leads to follow up on, too little manpower to do so, and not enough info to differentiate one suspect from another.

Which is exactly the same problem they have when most of the users are unknown. The probability that it was any given person depends on how many other people there are, not how many of the other people you know the names of. When the way you got the one name provides no additional reason for suspicion over any of the others, investigating that one person is the same waste of resources as having the full list of thousands of users and then choosing one to investigate at random.

> In this case there is enough info to differentiate one suspect from another in that one suspect is known.

Being known doesn't differentiate a suspect from the others in terms of suspicion. It's like knowing somehow what town the suspect is in and then, because the investigating officer already knows the name of someone in that town, deciding to raid that person. Waste of police resources and undue harassment of someone who is with 99.995% probability not the offender.

> No, it's the same as someone running a wifi at their home.

That's not what I mean.

Your objection to not raiding the exit node operator is that otherwise someone who doesn't want the police to associate their internet activity with their IP address could put up an exit node. But people can already achieve the same effect by using somebody else's exit node or by using the wifi at a coffee house or a VPN service or any of a hundred other ways. There is no additional criminal advantage to be had by running an exit node.

> The scale is larger, but one thing we can assume with a fairly high degree use correctness is that the connection is also used by the people that live there, which is not something we can assume about a business, as nobody lives there.

So the internet connection in a business can be used by the people who work there instead of the people who live there, because people work in businesses and live in homes. What conclusion is that supposed to reach?

Also, many people have a work VPN account that causes their home internet traffic to go through their work internet connection, so the premise is incorrect.

> I would like to see those circumstances tightened significantly with corroborating evidence (such as repeated logging of activity and during times the suspect is known to be on premises, etc), but I don't believe discounting the information that the traffic went through the suspect's connection just because they allow public use is ultimately beneficial.

It's not a matter of discounting it, it's a matter of accurately calculating its evidentiary value. For the IP address of an exit node that value is very close to zero. The probability that some malicious traffic seen from that IP address came from the exit node rather than the occupants is not 100.0000% but is well in excess of 99%.

So yes, if you have a large pile of other evidence that the occupants are the perpetrators, knowing that it was their IP address will add another thousandth of a percent or so to the probability that it was them. But it isn't anything more than that. And it specifically shouldn't be enough to justify a warrant when it's the only thing you have.

> Should someone previously convicted of child molestation that's a Tor exit node operator and happens to have the IP address associated with some child pornography not be looked at simple because of the Tor exit node?

You're asking the question backwards. Knowing that it was the IP address of an exit node tells you nearly nothing. You don't then discount the operators, you just don't count them any more than you would have otherwise. Investigate as if you didn't know the IP address (because with extremely high probability you don't). If the same exit node operators were actually the perpetrators then the evidence will lead back to them regardless and operating an exit node would only explain the IP address but not any of the rest of it.

> That the suspect is linked (not necessarily in culpability) in some small way to the crime through this information should not be ignored simply because of probability if it's the only evidence you have.

Probability is exactly why it should be ignored. You're just advocating the law enforcement edition of "something must be done, this is something, therefore we must do this."

Doing nothing is better than doing something harmful, wasteful and unproductive.

> Sure it does. Plenty of businesses log all sorts of information.

Your original argument was that people at work would see you doing bad things. Now it's that there will be computer logs. But now the set of people who can "get away with it" expands to include the IT staff. And what logs are you expected to have tying a perpetrator to a personal device on a public guest network?

> Which I specifically noted.

But didn't really address. Granted there are some crimes that are less likely to be committed by corporate executives, but what about all the others? I'm not aware of any reason why executives would be any differently predisposed to child pornography than the population at large. Are you saying the police should raid AT&T every time they're investigating child pornography?

> As a single piece of evidence it's not obviously anything more than coincidental, but combined with further information may yield compelling enough evidence to investigate further, whether the person is ultimately responsible for the crime or not.

The point is that having the IP address of an exit node plus further information has approximately the same value as the further information. You don't ignore further evidence against the same party, you just don't credit the IP address with more than the almost-nothing which it is actually worth.