More likely they'll go after the rally operators by going after hosting providers. I used to run a TOR exit relay on a server in Amsterdam and I had to respond to complaints daily so that the hosting provider wouldn't shut down my server. My response was a copy/pasted very wordy version of "I can't monitor or control the traffic coming from this IP address, sorry!"