suspicion. (beyond suspicion - no user is more suspicious than other). Collaborating jondos Consider a set of collaborating corrupted jondos in the crowd. Because each jondo can observe plaintext traffic on a path routed through it, any such traffic, including the address of the end server is exposed to this attacker. The question we consider here is if the attacker can determine who initiated the path. The goal of the collaborators is to determine the member that initiated the path. We now analyze how confident the collaborators can be that their immediate predecessor is in fact the path initiator: Let Hk, k >= 1, denote the event that the first collaborator on the path occupies the kth position on the path, where the initiator itself occupies the 0th position (and possibly others). Let define Hk+ = Hk or Hk+1 or Hk+2 or . . . . Let I denote the event that the first collaborator on the path is immediately preceded on the path by the path initiator. Note that H1 => I, but the converse I => H1 is not true, because the initiating jondo might appear on the path multiple times. There can be a case where path is composed as follow: initiator jondo(0 - position) ----> jondo(1 - position) ----> initiator jondo(2 - position) ----> Collaborating jondo(3 - position) Note that the first collaborator on the path is in the third position. 4.Given this notation, the collaborators now hope to determine: P(I|H1+) - given that a collaborator is on the path, what is the probability that the path initiator is the first collaborator's immediate predecessor? Definition: The path initiator has probable innocence if P(I|H1+)<=1\2. In order to yield probable innocence for the path initiator, certain conditions must be met in our system. In particular, let pf > 1/2 (the probability of forwarding in the system.) (c - number of collaborators in the crowd) (n - total number of crowd members when the path is formed) The theorem below gives a sufficient condition on pf, c, and n to ensure probable innocence for the path initiator. Theorem: The path initiator has probable innocence against c collaborators in case Proof: we want to show that pf > 1/2 if note that: P(Hi) = in order for the first collaborator to be in the ith position on the path, the path must first wander to i-1 noncollaborators each time with