3 ms·

That doesn't matter. Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they lo

That doesn't matter. Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do.

taormina 10y ago
You have to remember that the ISP might have a physical location if this is a paying customer on a landline, but that's not usually the case. Reverse IP address location lookups are unreliable as worst and inaccurate at best. That house in Kansas that they mentioned? It's the default "middle of the US" location that is returned when they don't actually know where you are.
- tedunangst 10y ago
  Any ISP is going to have a more accurate idea of which customer has an IP than a generic geolocation service. An ISP in Ohio is not going to return a latitude and longitude that happens to be in Kansas.
- deleted 10y ago
  [deleted]
AnthonyMouse 10y ago
> Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do. That isn't the source of the uncertainty though. It's part of it in the sense that cost-cutting ISPs may have inaccurate records, but the fundamental issue is that IP addresses are completely unauthenticated. Some people turn off their modems when they're not using them. One way to steal internet service on some ISPs is to clone the MAC of your neighbor's cable modem (and then the ISP thinks you're them). People have guests who use their WiFi. Some people use WEP, or weak passwords, or are just nice people who intentionally leave their WiFi open for public use. Anyone who controls (or compromises) a router can spoof any IP address that routes through it. Same with compromised client devices that can be turned into proxy servers. Even so, the probability that any given traffic is actually from the person whose name is on the bill is still pretty good, unless that traffic is illegal. Because people engaged in illegal activity have the incentive to do one of those things or any of a hundred other ways to get an IP address not tied to your name. And it isn't that hard to do those things. Which means there is a high probability that an IP address associated with illegal activity belongs to an innocent party rather than the perpetrator.
- wmf 10y ago
  Taking all of that as given... when law enforcement sees illegal activity from an IP address, what are they to do? Use a search warrant to gather more specific evidence? Or just give up?
  - AnthonyMouse 10y ago
    That is a false dichotomy. They can gather some better evidence in ways other than executing a raid on a probably-innocent party.
    - jessaustin 10y ago
      ...especially when their favorite form of "raid" is busting doors at 5:30 AM, shooting dogs, and shoving guns in children's faces. If the preference were, rather, to wait until a suspect left for work, detain her when she got to the sidewalk, have her call the house and arrange for all remaining residents to take a walk, and then enter the residence in non-destructive fashion, all sorts of speculative policing might be better justified.
      - AnthonyMouse 10y ago
        Not only that, notice that the tenuous thing is the link between the IP address and particular a person or endpoint location. You have the IP address, get a warrant to wiretap the IP address. See if the illicit traffic to that IP address is really going to that residence. See if the traffic pattern looks like the traffic going in is coming right back out and being relayed somewhere else. Put a van full of government WiFi hardware on the street in front of the building and if the relevant traffic correlates to traffic to a wireless device, triangulate the exact location of that device and see whether it's actually inside the residence. See if anything at that IP address is in communication with C&C servers that imply it has been compromised. Any of which can be done without shooting a single innocent dog.

taormina 10y ago

You have to remember that the ISP might have a physical location if this is a paying customer on a landline, but that's not usually the case. Reverse IP address location lookups are unreliable as worst and inaccurate at best. That house in Kansas that they mentioned? It's the default "middle of the US" location that is returned when they don't actually know where you are.

tedunangst 10y ago
Any ISP is going to have a more accurate idea of which customer has an IP than a generic geolocation service. An ISP in Ohio is not going to return a latitude and longitude that happens to be in Kansas.
deleted 10y ago
[deleted]

AnthonyMouse 10y ago

> Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do. That isn't the source of the uncertainty though. It's part of it in the sense that cost-cutting ISPs may have inaccurate records, but the fundamental issue is that IP addresses are completely unauthenticated. Some people turn off their modems when they're not using them. One way to steal internet service on some ISPs is to clone the MAC of your neighbor's cable modem (and then the ISP thinks you're them). People have guests who use their WiFi. Some people use WEP, or weak passwords, or are just nice people who intentionally leave their WiFi open for public use. Anyone who controls (or compromises) a router can spoof any IP address that routes through it. Same with compromised client devices that can be turned into proxy servers. Even so, the probability that any given traffic is actually from the person whose name is on the bill is still pretty good, unless that traffic is illegal. Because people engaged in illegal activity have the incentive to do one of those things or any of a hundred other ways to get an IP address not tied to your name. And it isn't that hard to do those things. Which means there is a high probability that an IP address associated with illegal activity belongs to an innocent party rather than the perpetrator.

wmf 10y ago
Taking all of that as given... when law enforcement sees illegal activity from an IP address, what are they to do? Use a search warrant to gather more specific evidence? Or just give up?
- AnthonyMouse 10y ago
  That is a false dichotomy. They can gather some better evidence in ways other than executing a raid on a probably-innocent party.
  - jessaustin 10y ago
    ...especially when their favorite form of "raid" is busting doors at 5:30 AM, shooting dogs, and shoving guns in children's faces. If the preference were, rather, to wait until a suspect left for work, detain her when she got to the sidewalk, have her call the house and arrange for all remaining residents to take a walk, and then enter the residence in non-destructive fashion, all sorts of speculative policing might be better justified.
    - AnthonyMouse 10y ago
      Not only that, notice that the tenuous thing is the link between the IP address and particular a person or endpoint location. You have the IP address, get a warrant to wiretap the IP address. See if the illicit traffic to that IP address is really going to that residence. See if the traffic pattern looks like the traffic going in is coming right back out and being relayed somewhere else. Put a van full of government WiFi hardware on the street in front of the building and if the relevant traffic correlates to traffic to a wireless device, triangulate the exact location of that device and see whether it's actually inside the residence. See if anything at that IP address is in communication with C&C servers that imply it has been compromised. Any of which can be done without shooting a single innocent dog.