9 ms·

It starts off saying: > If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional...

It starts off saying: > If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional... Yet EFF has found that police and courts are regularly conducting and approving raids based on the similar type of unreliable digital evidence: Internet Protocol (IP) address information. I'm not sure that these two are equivalent. A better example would be the police raiding my home based on an illegal phone call that came from my phone number. Sure, the fact that it comes from my phone number doesn't mean I did it, but it's certainly evidence that points to me, just as an IP address can be. In general, the summary linked to above makes it sound like police should never use IP addresses. To be fair, if you read the whitepaper itself, it doesn't say this, but rather that police should be _careful_ in how they use IP addresses. Specifically, it recommends that police "conduct additional investigation to verify and corroborate the physical location of a particular decive connect to the Internet whenever police have information about an IP address’ physical location, and providing that information to the court with the warrant application".

crooked-v 10y ago
> A better example would be the police raiding my home based on an illegal phone call that came from my phone number. That's broadly overestimating the reliability of IP addresses, though. Consumer IP addresses change on a random basis, based on whatever obscure policies an ISP has set up at the time.
- jlarocco 10y ago
  That doesn't matter. Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do.
  - taormina 10y ago
    You have to remember that the ISP might have a physical location if this is a paying customer on a landline, but that's not usually the case. Reverse IP address location lookups are unreliable as worst and inaccurate at best. That house in Kansas that they mentioned? It's the default "middle of the US" location that is returned when they don't actually know where you are.
    - tedunangst 10y ago
      Any ISP is going to have a more accurate idea of which customer has an IP than a generic geolocation service. An ISP in Ohio is not going to return a latitude and longitude that happens to be in Kansas.
    - deleted 10y ago
      [deleted]
  - AnthonyMouse 10y ago
    > Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do. That isn't the source of the uncertainty though. It's part of it in the sense that cost-cutting ISPs may have inaccurate records, but the fundamental issue is that IP addresses are completely unauthenticated. Some people turn off their modems when they're not using them. One way to steal internet service on some ISPs is to clone the MAC of your neighbor's cable modem (and then the ISP thinks you're them). People have guests who use their WiFi. Some people use WEP, or weak passwords, or are just nice people who intentionally leave their WiFi open for public use. Anyone who controls (or compromises) a router can spoof any IP address that routes through it. Same with compromised client devices that can be turned into proxy servers. Even so, the probability that any given traffic is actually from the person whose name is on the bill is still pretty good, unless that traffic is illegal. Because people engaged in illegal activity have the incentive to do one of those things or any of a hundred other ways to get an IP address not tied to your name. And it isn't that hard to do those things. Which means there is a high probability that an IP address associated with illegal activity belongs to an innocent party rather than the perpetrator.
    - wmf 10y ago
      Taking all of that as given... when law enforcement sees illegal activity from an IP address, what are they to do? Use a search warrant to gather more specific evidence? Or just give up?
      - AnthonyMouse 10y ago
        That is a false dichotomy. They can gather some better evidence in ways other than executing a raid on a probably-innocent party.
        jessaustin 10y ago
        ...especially when their favorite form of "raid" is busting doors at 5:30 AM, shooting dogs, and shoving guns in children's faces. If the preference were, rather, to wait until a suspect left for work, detain her when she got to the sidewalk, have her call the house and arrange for all remaining residents to take a walk, and then enter the residence in non-destructive fashion, all sorts of speculative policing might be better justified.
- astrodust 10y ago
  What's an "illegal phone call"?
  - Hondor 10y ago
    A threat, insider trading information, transfer of copyright material by modem, planning to commit a crime, harassing someone, instructing someone to commit a crime. There are so many ways to break the law by saying the wrong thing. Speech isn't actually free.
    - astrodust 10y ago
      That's a better definition then, but it's really not so much the phone call that's illegal but making threats, planning a crime, or whatever activity is being discussed or carried out via a phone call. Simply making a phone call is not illegal even in the case where that phone could trigger an explosive device. Remember the phone companies are immune from prosecution in these cases because they're a common carrier, something that also applies to internet service companies now.
      - akiselev 10y ago
        If you know that the number you're dialing is a detonator, why isn't the phone call itself illegal? If it doesnt detonate, doesn't that make the call an illegal act itself (attempted murder) and if so, why isn't a call resulting in successful detonation illegal by the same reasoning? IANAL but I'd think the former would be just as illegal as the latter except that the successful phone call would be lumped into the greater charges of terrorism/homicide alongside any violations for actually building and placing the explosive device. I don't know much (or anything) about the prevailing criminal justice philosophies among the judiciary but this sounds like a question that can only be answered by a thorough review of the criminal code and precedent. Wire fraud, for example, is one of those felonies that you can be guilty of in the process of committing other more serious crimes so obviously some components can be broken out of the larger crimes.
        10y ago
deleted 10y ago
[deleted]
betenoire 10y ago
That's definitely a better analogy. I still don't want cops at my door just because my number showed up on their caller ID.
- dtnewman 10y ago
  But as a police officer, if you see something coming from an IP associated with me, it's probably wise to look into me further; even if IP address in and of itself may not be adequate evidence to justify a raid of my home. Similarly, if I saw your phone number associated with a bomb threat... yeah, I'd definitely have my suspicions and would want to look into you further, even if a phone number isn't definitive _proof_ of identity.
  - the_watcher 10y ago
    Look into further is far, far different than using it as sole evidence for a raid. IP address coupled with additional evidence would be perfectly valid.

crooked-v 10y ago

> A better example would be the police raiding my home based on an illegal phone call that came from my phone number. That's broadly overestimating the reliability of IP addresses, though. Consumer IP addresses change on a random basis, based on whatever obscure policies an ISP has set up at the time.

jlarocco 10y ago
That doesn't matter. Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do.
- taormina 10y ago
  You have to remember that the ISP might have a physical location if this is a paying customer on a landline, but that's not usually the case. Reverse IP address location lookups are unreliable as worst and inaccurate at best. That house in Kansas that they mentioned? It's the default "middle of the US" location that is returned when they don't actually know where you are.
  - tedunangst 10y ago
    Any ISP is going to have a more accurate idea of which customer has an IP than a generic geolocation service. An ISP in Ohio is not going to return a latitude and longitude that happens to be in Kansas.
  - deleted 10y ago
    [deleted]
- AnthonyMouse 10y ago
  > Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do. That isn't the source of the uncertainty though. It's part of it in the sense that cost-cutting ISPs may have inaccurate records, but the fundamental issue is that IP addresses are completely unauthenticated. Some people turn off their modems when they're not using them. One way to steal internet service on some ISPs is to clone the MAC of your neighbor's cable modem (and then the ISP thinks you're them). People have guests who use their WiFi. Some people use WEP, or weak passwords, or are just nice people who intentionally leave their WiFi open for public use. Anyone who controls (or compromises) a router can spoof any IP address that routes through it. Same with compromised client devices that can be turned into proxy servers. Even so, the probability that any given traffic is actually from the person whose name is on the bill is still pretty good, unless that traffic is illegal. Because people engaged in illegal activity have the incentive to do one of those things or any of a hundred other ways to get an IP address not tied to your name. And it isn't that hard to do those things. Which means there is a high probability that an IP address associated with illegal activity belongs to an innocent party rather than the perpetrator.
  - wmf 10y ago
    Taking all of that as given... when law enforcement sees illegal activity from an IP address, what are they to do? Use a search warrant to gather more specific evidence? Or just give up?
    - AnthonyMouse 10y ago
      That is a false dichotomy. They can gather some better evidence in ways other than executing a raid on a probably-innocent party.
      - jessaustin 10y ago
        ...especially when their favorite form of "raid" is busting doors at 5:30 AM, shooting dogs, and shoving guns in children's faces. If the preference were, rather, to wait until a suspect left for work, detain her when she got to the sidewalk, have her call the house and arrange for all remaining residents to take a walk, and then enter the residence in non-destructive fashion, all sorts of speculative policing might be better justified.
astrodust 10y ago
What's an "illegal phone call"?
- Hondor 10y ago
  A threat, insider trading information, transfer of copyright material by modem, planning to commit a crime, harassing someone, instructing someone to commit a crime. There are so many ways to break the law by saying the wrong thing. Speech isn't actually free.
  - astrodust 10y ago
    That's a better definition then, but it's really not so much the phone call that's illegal but making threats, planning a crime, or whatever activity is being discussed or carried out via a phone call. Simply making a phone call is not illegal even in the case where that phone could trigger an explosive device. Remember the phone companies are immune from prosecution in these cases because they're a common carrier, something that also applies to internet service companies now.
    - akiselev 10y ago
      If you know that the number you're dialing is a detonator, why isn't the phone call itself illegal? If it doesnt detonate, doesn't that make the call an illegal act itself (attempted murder) and if so, why isn't a call resulting in successful detonation illegal by the same reasoning? IANAL but I'd think the former would be just as illegal as the latter except that the successful phone call would be lumped into the greater charges of terrorism/homicide alongside any violations for actually building and placing the explosive device. I don't know much (or anything) about the prevailing criminal justice philosophies among the judiciary but this sounds like a question that can only be answered by a thorough review of the criminal code and precedent. Wire fraud, for example, is one of those felonies that you can be guilty of in the process of committing other more serious crimes so obviously some components can be broken out of the larger crimes.
      - 10y ago

deleted 10y ago

[deleted]

betenoire 10y ago

That's definitely a better analogy. I still don't want cops at my door just because my number showed up on their caller ID.

dtnewman 10y ago
But as a police officer, if you see something coming from an IP associated with me, it's probably wise to look into me further; even if IP address in and of itself may not be adequate evidence to justify a raid of my home. Similarly, if I saw your phone number associated with a bomb threat... yeah, I'd definitely have my suspicions and would want to look into you further, even if a phone number isn't definitive _proof_ of identity.
- the_watcher 10y ago
  Look into further is far, far different than using it as sole evidence for a raid. IP address coupled with additional evidence would be perfectly valid.