3 ms·

>Law enforcement’s over-reliance on the technology is a product of police and courts not understanding the limitations of both IP addresses and the tools used t

>Law enforcement’s over-reliance on the technology is a product of police and courts not understanding the limitations of both IP addresses and the tools used to link the IP address with a person or a physical location. You can most certainly narrow down an IP address to a particular ISP customer. Is it possible that they have an open wifi? Yes. Is it possible to narrow it down to a single member of the household? Depends! Is it possible that a computer at the destination is being used a proxy by the real attacker? Yes! But it's certainly not the blackbox that the EFF is trying to portray it as. It's totally appropriate to execute a search warrant based on IP logs. A search warrant doesn't mean that any particular person is guilty, just that there is probable cause that there is information about a crime at a certain location.

snuxoll 10y ago
I mean, it's reasonable to link it with a physical location, but only to the extent that there's obviously A computer at the location that is being used for some purpose. The problem is when they use it to try to identify an individual, which is completely unreasonable.
- guitarbill 10y ago
  > obviously A computer at the location that is being used for some purpose Well "A computer" could be any TCP/IP enabled device nowadays, including a router. So no, it's not reasonable to look at traffic coming from an IP, and say that traffic originated from the physical location of that IP, just because the LAN beyond that router is opaque. I mean, several ISP IP addresses are involved with routing, but "everybody knows" they're shared machines. But again, simply because a trace route stops at a certain machine doesn't mean the routing actually terminates there - for most cases this is not true. It's just that the person behind the router with NAT often owns all devices on the LAN/opaque side. Using this correlation alone is dangerously inaccurate.
  - snuxoll 10y ago
    I never implied that a system in that network was the origin of the traffic, but if a traceroute ends there then obviously SOMETHING at that location is involved, knowingly or not. A search warrant leading to a malware infected machine is acceptable in my eyes. Again, tying traffic to a location is fine, as long as the correlation ends at the computer that originally appears to be the source of the traffic (even if it ultimately isn't) is all that is targeted until evidence can determine the individual behind it.
    - guitarbill 10y ago
      > A search warrant leading to a malware infected machine is acceptable in my eyes. Search warrant for what? All TCP/IP enabled devices? Or the router? An IP address doesn't even uniquely identify a single device. (Also given how search warrants are executed in the US and how long they can seize these devices for, I don't know if I'd say it's "acceptable". I'm in favour of setting the bar high to protect the innocent.)
      - marcoperaza 10y ago
        You realize that what you're suggesting would make it impossible to prosecute most computer crime, right?
michaelmrose 10y ago
You can usually only narrow it down by getting the ISP to give up the person using an IP address at a given point in time which may itself require a warrant. Police are frequently failing to do even this.

snuxoll 10y ago

I mean, it's reasonable to link it with a physical location, but only to the extent that there's obviously A computer at the location that is being used for some purpose. The problem is when they use it to try to identify an individual, which is completely unreasonable.

guitarbill 10y ago
> obviously A computer at the location that is being used for some purpose Well "A computer" could be any TCP/IP enabled device nowadays, including a router. So no, it's not reasonable to look at traffic coming from an IP, and say that traffic originated from the physical location of that IP, just because the LAN beyond that router is opaque. I mean, several ISP IP addresses are involved with routing, but "everybody knows" they're shared machines. But again, simply because a trace route stops at a certain machine doesn't mean the routing actually terminates there - for most cases this is not true. It's just that the person behind the router with NAT often owns all devices on the LAN/opaque side. Using this correlation alone is dangerously inaccurate.
- snuxoll 10y ago
  I never implied that a system in that network was the origin of the traffic, but if a traceroute ends there then obviously SOMETHING at that location is involved, knowingly or not. A search warrant leading to a malware infected machine is acceptable in my eyes. Again, tying traffic to a location is fine, as long as the correlation ends at the computer that originally appears to be the source of the traffic (even if it ultimately isn't) is all that is targeted until evidence can determine the individual behind it.
  - guitarbill 10y ago
    > A search warrant leading to a malware infected machine is acceptable in my eyes. Search warrant for what? All TCP/IP enabled devices? Or the router? An IP address doesn't even uniquely identify a single device. (Also given how search warrants are executed in the US and how long they can seize these devices for, I don't know if I'd say it's "acceptable". I'm in favour of setting the bar high to protect the innocent.)
    - marcoperaza 10y ago
      You realize that what you're suggesting would make it impossible to prosecute most computer crime, right?

michaelmrose 10y ago

You can usually only narrow it down by getting the ISP to give up the person using an IP address at a given point in time which may itself require a warrant. Police are frequently failing to do even this.