10 ms·

IP address errors lead to wrongful arrests

154 points by alphabettsy 9y ago

conbandit 9y ago
How do we convince courts/LEOs that ip address != identity?
- diabeetusman 9y ago
  When getting it wrong starts costing them money, is my guess.
  - gruez 9y ago
    so never? when they get sued, the city (or the insurer) pays for it, not the police department.
  - coding123 9y ago
    Which, after evidence planting, is never.
- bhhaskin 9y ago
  The reality is that it is the only tool they have. However they should require more evidence than just an ip address.
  - betterunix2 9y ago
    Read the article; the police absolutely do have better tools, but they are so terrified of leaving a suspected pedophile in a house with children that they do not wait for any corroboration before making the arrest.
    - bhhaskin 9y ago
      So I did read the article and no where does it mention any other tools for identifying activity online. Unless I am missing something.
    - otakucode 9y ago
      They are so terrified of leaving a suspected pedo in a house with children... that they guarantee the safety of pedophiles and continued access to children in their care for weeks or months as they chase phantoms by not being careful. They protect the pedophile, and their mistakes endanger children while destroying innocent lives. There is a reason that child advocacy organizations actively oppose these sorts of raids where police go after downloaders and such. It does nothing to protect children, and is so alluring and easy for police officers that they neglect any actual useful efforts completely in favor of it. You can either go online and claim to be a turbosexual 15 year old whose parents are out of town and bust anyone who shows interest and net 5 busts in an evening.... or you can investigate the most profoundly disturbing case of your career of parents abusing their own children for months and then get 1 bust. The police make the easy choice, and the kid getting abused by their parents (the absolute most common case by a country mile) gets no help. Child advocacy groups do not waver in their mantra: Education and empowerment. They are the only things that actually STOP child abuse. But they're not as flashy and quick and easy, and society generally doesn't want to educate or empower kids, so everyone just does what makes them feel good without thinking too much about whether it actually helps real children.
      - thomastjeffery 9y ago
        Choosing available criminals and quantifiable laws is, in my opinion, our justice system's worst shortcoming. It plagues our judicial system from the most trivial crimes (speeding), to the most awful (sexual abuse and murder).
- jbob2000 9y ago
  When you give them something better to identify people with. Which is probably worse.
- jstarfish 9y ago
  It's unlikely to happen. The incentives for both detectives and prosecutors both align with putting someone behind bars. They do know damn well that IP addresses != identity, but if the circumstances are convenient enough they'll press forward with cases regardless to keep their case closure/conviction rates up. It's the public, the yokels on the jury, that you need to correct the perceptions of. When most of them get their CS understanding from daytime television crime procedurals, you have a lot of work ahead of you.
  - jandrese 9y ago
    So when defense lawyers get smart about proving just how weak IP == Identity is? They'll keep doing it as long as it puts perps behind bars.
    - otakucode 9y ago
      It doesn't matter what the defense lawyers know. They are not permitted to present that information in court. If they tried to, the prosecution would raise an objection that the defense was attempting to 'bamboozle' the jury with technobabble and it would be suppressed.
      - jandrese 9y ago
        What is the point of a defense lawyer if they are not allowed to argue for their client?
        thomastjeffery 9y ago
        That's a good question.
  - Buttons840 9y ago
    Ah yes. The final layer of protection, a jury of my "peers", none of which work in the same industry or understand the most basic principles of what I do (as a programmer).
- keenrodent 9y ago
  Anecdotally I have had some success getting judges to think of IP addresses mapping to individuals like they already think of post office boxes mapping to individuals. For example, a post office box is a real address, but what goes in can be put there by anybody with access to the box, whether it's with the key from the customer side, or from the open back from the post office side. Similarly, what goes out can be removed by anyone with access to the open back of the box, or from the front with a key. No one checks to ensure that the holder of a key is the owner of the box. Of course this is a very blunt metaphor, but with it one can see the light go on....
  - ryacko 9y ago
    Given that people probably understand the postal system as well as they do any other network, it would be the best metaphor.
kogepathic 9y ago
At what point will law enforcement ever come to accept that an IP address does not map directly to a person? As outlined in the article: * most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses I'd like to add a third case that I feel is often overlooked: * most consumer or ISP provided routers never have their firmware updated (unless the ISP pushes the update themselves) and are probably vulnerable to mirai, KRACK, and many others. Taking a these into account, even if LEO is able to get the correct information for an IP address, there's a non-zero chance that the people had/have a compromised device. No average consumer is going to be able to prove to LEO or a judge that their device was compromised, and I somehow doubt doing forensic analysis of the person's network is top of LEO's list of evidence to gather. Additionally, many compromises can be ephemeral so by the time the deed is done and the police show up, the router has been rebooted and evidence of the compromise is gone. There is zero chance that LEO is dumping RAM of the router before seizing it as evidence. Combine this with the fact that people may have an encrypted device and may legitimately forget the password before being requested to decrypt the device. I'm sure this can happen, as being arrested and going to trial can be quite stressful. The US government is already indefinitely detaining people for not decrypting their devices. [1] I'm not saying the suspect in this case is innocent or guilty, but consider what precedent is being set there. I don't see heading anywhere good... [1] https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...
- aceofspad4s 9y ago
  >* most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses You can ask the ISP. They are supposed to store metadata.
  - thephyber 9y ago
    > You can ask the ISP. They are supposed to store metadata. What you say is true, but prosecutors/investigators have little incentive to jump through another hoop. If they are willing to prosecute someone with just circumstantial evidence of an IP address, they aren't really looking to find the perpetrator, only a fall guy.
patcheudor 9y ago
A natural progression of the ten immutable laws of computer security: https://technet.microsoft.com/en-us/library/hh278941.aspx https://technet.microsoft.com/en-us/library/hh278941.aspx "When you attach your computer / computing device to the Internet it's no longer yours." and from that: "There is no such thing as nonrepudiation on any computing device which is not actively monitored by an outside, independent, air-gapped system under the strictest of operational control." Which takes us here: "No credible forensics expert can tie user interaction to any specific event or file on a computing device with any certainty as no forensics expert can be aware of all attack surfaces and vectors over time available through the platform they are reviewing. Nor can they be aware of attack motivations and the capabilities of an attacker to obfuscate said attack."
coding123 9y ago
Also if this is so error prone, what time window do they consider appropriate for matching logs to usage? Are they accounting for time-zones or are they just going to court and saying "5pm" blah blah blah. What percentage of the victims of this kind of error are also getting their hard-drives tampered with fake evidence like child porn. There is an incentive on the police department to not back down if they arrest someone - they can get sued - a hard drive full of that would have that lawsuit thrown out very quickly and likely without anyone wanting to pay for an external investigation.
dsfyu404ed 9y ago
When you consistently let an organization off the hook for bad or sloppy performance "because law enforcement" or "because government" you will consistently get The stakes are low. Nobody in law enforcement (or government in general) stands to lost their job or have their career ruined if the organization they run ruins someone else's life in error. It's no surprise that they play fast and loose when it comes to anyone who isn't part of their in-group.
k33n 9y ago
Why are people who have no idea how the Internet works conducting investigations related to Internet crime?
- thomastjeffery 9y ago
  They are also the ones defining "internet crime" and "evidence". Those of us who do understand don't have an appealing alternative, because the entire thing is nonsense. We have the same problem with DRM and software patents.
otakucode 9y ago
The mindset of "This resolved to a house with kids, we need to move now" cuts both ways. When they screw it up, they vastly, vastly increase the amount of time it takes before they actually go after the correct location - which might very well have children as well. By cutting corners, they do nothing but inflate their own egos and feed their own lust for persecution, destroying innocent lives in their wake. They do not help abused children. At all. Since the 1990s I have been very bothered by the practice law enforcement follows of using IP addresses as evidence against people. I can't imagine how many fathers have had their lives ruined because their young teen son went searching for something they shouldn't have, or because someone used their open wifi connection, or routed through them via malware, or spoofed that IP address, etc. There are multitudes of ways in which it might not point to the right person. And it is very important to remember that when you act on information that points at an innocent person - you are protecting the actual offender. You are shielding them from prosecution. You are guaranteeing that they remain available to continue to commit the crime you are investigating. I would think, just generally, police would be motivated to not be providing that sort of shielding... but getting those headlines seems to just be so damned tempting...
Feniks 9y ago
IP adress should be used as the START of an investigation. Not evidence at a trial. Still I understand the prosecution. Pedophiles and other assorted scum know OPSEC and society wants criminals off the street. So just letting people walk because they were clever enough to encrypt their HDD is not an option.

154 points by alphabettsy 9y ago

conbandit 9y ago

How do we convince courts/LEOs that ip address != identity?

diabeetusman 9y ago
When getting it wrong starts costing them money, is my guess.
- gruez 9y ago
  so never? when they get sued, the city (or the insurer) pays for it, not the police department.
- coding123 9y ago
  Which, after evidence planting, is never.
bhhaskin 9y ago
The reality is that it is the only tool they have. However they should require more evidence than just an ip address.
- betterunix2 9y ago
  Read the article; the police absolutely do have better tools, but they are so terrified of leaving a suspected pedophile in a house with children that they do not wait for any corroboration before making the arrest.
  - bhhaskin 9y ago
    So I did read the article and no where does it mention any other tools for identifying activity online. Unless I am missing something.
  - otakucode 9y ago
    They are so terrified of leaving a suspected pedo in a house with children... that they guarantee the safety of pedophiles and continued access to children in their care for weeks or months as they chase phantoms by not being careful. They protect the pedophile, and their mistakes endanger children while destroying innocent lives. There is a reason that child advocacy organizations actively oppose these sorts of raids where police go after downloaders and such. It does nothing to protect children, and is so alluring and easy for police officers that they neglect any actual useful efforts completely in favor of it. You can either go online and claim to be a turbosexual 15 year old whose parents are out of town and bust anyone who shows interest and net 5 busts in an evening.... or you can investigate the most profoundly disturbing case of your career of parents abusing their own children for months and then get 1 bust. The police make the easy choice, and the kid getting abused by their parents (the absolute most common case by a country mile) gets no help. Child advocacy groups do not waver in their mantra: Education and empowerment. They are the only things that actually STOP child abuse. But they're not as flashy and quick and easy, and society generally doesn't want to educate or empower kids, so everyone just does what makes them feel good without thinking too much about whether it actually helps real children.
    - thomastjeffery 9y ago
      Choosing available criminals and quantifiable laws is, in my opinion, our justice system's worst shortcoming. It plagues our judicial system from the most trivial crimes (speeding), to the most awful (sexual abuse and murder).
jbob2000 9y ago
When you give them something better to identify people with. Which is probably worse.
jstarfish 9y ago
It's unlikely to happen. The incentives for both detectives and prosecutors both align with putting someone behind bars. They do know damn well that IP addresses != identity, but if the circumstances are convenient enough they'll press forward with cases regardless to keep their case closure/conviction rates up. It's the public, the yokels on the jury, that you need to correct the perceptions of. When most of them get their CS understanding from daytime television crime procedurals, you have a lot of work ahead of you.
- jandrese 9y ago
  So when defense lawyers get smart about proving just how weak IP == Identity is? They'll keep doing it as long as it puts perps behind bars.
  - otakucode 9y ago
    It doesn't matter what the defense lawyers know. They are not permitted to present that information in court. If they tried to, the prosecution would raise an objection that the defense was attempting to 'bamboozle' the jury with technobabble and it would be suppressed.
    - jandrese 9y ago
      What is the point of a defense lawyer if they are not allowed to argue for their client?
      - thomastjeffery 9y ago
        That's a good question.
- Buttons840 9y ago
  Ah yes. The final layer of protection, a jury of my "peers", none of which work in the same industry or understand the most basic principles of what I do (as a programmer).
keenrodent 9y ago
Anecdotally I have had some success getting judges to think of IP addresses mapping to individuals like they already think of post office boxes mapping to individuals. For example, a post office box is a real address, but what goes in can be put there by anybody with access to the box, whether it's with the key from the customer side, or from the open back from the post office side. Similarly, what goes out can be removed by anyone with access to the open back of the box, or from the front with a key. No one checks to ensure that the holder of a key is the owner of the box. Of course this is a very blunt metaphor, but with it one can see the light go on....
- ryacko 9y ago
  Given that people probably understand the postal system as well as they do any other network, it would be the best metaphor.

kogepathic 9y ago

At what point will law enforcement ever come to accept that an IP address does not map directly to a person? As outlined in the article: * most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses I'd like to add a third case that I feel is often overlooked: * most consumer or ISP provided routers never have their firmware updated (unless the ISP pushes the update themselves) and are probably vulnerable to mirai, KRACK, and many others. Taking a these into account, even if LEO is able to get the correct information for an IP address, there's a non-zero chance that the people had/have a compromised device. No average consumer is going to be able to prove to LEO or a judge that their device was compromised, and I somehow doubt doing forensic analysis of the person's network is top of LEO's list of evidence to gather. Additionally, many compromises can be ephemeral so by the time the deed is done and the police show up, the router has been rebooted and evidence of the compromise is gone. There is zero chance that LEO is dumping RAM of the router before seizing it as evidence. Combine this with the fact that people may have an encrypted device and may legitimately forget the password before being requested to decrypt the device. I'm sure this can happen, as being arrested and going to trial can be quite stressful. The US government is already indefinitely detaining people for not decrypting their devices. [1] I'm not saying the suspect in this case is innocent or guilty, but consider what precedent is being set there. I don't see heading anywhere good... [1] https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...

aceofspad4s 9y ago
>* most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses You can ask the ISP. They are supposed to store metadata.
- thephyber 9y ago
  > You can ask the ISP. They are supposed to store metadata. What you say is true, but prosecutors/investigators have little incentive to jump through another hoop. If they are willing to prosecute someone with just circumstantial evidence of an IP address, they aren't really looking to find the perpetrator, only a fall guy.

patcheudor 9y ago

A natural progression of the ten immutable laws of computer security: https://technet.microsoft.com/en-us/library/hh278941.aspx https://technet.microsoft.com/en-us/library/hh278941.aspx "When you attach your computer / computing device to the Internet it's no longer yours." and from that: "There is no such thing as nonrepudiation on any computing device which is not actively monitored by an outside, independent, air-gapped system under the strictest of operational control." Which takes us here: "No credible forensics expert can tie user interaction to any specific event or file on a computing device with any certainty as no forensics expert can be aware of all attack surfaces and vectors over time available through the platform they are reviewing. Nor can they be aware of attack motivations and the capabilities of an attacker to obfuscate said attack."

coding123 9y ago

Also if this is so error prone, what time window do they consider appropriate for matching logs to usage? Are they accounting for time-zones or are they just going to court and saying "5pm" blah blah blah. What percentage of the victims of this kind of error are also getting their hard-drives tampered with fake evidence like child porn. There is an incentive on the police department to not back down if they arrest someone - they can get sued - a hard drive full of that would have that lawsuit thrown out very quickly and likely without anyone wanting to pay for an external investigation.

dsfyu404ed 9y ago

When you consistently let an organization off the hook for bad or sloppy performance "because law enforcement" or "because government" you will consistently get The stakes are low. Nobody in law enforcement (or government in general) stands to lost their job or have their career ruined if the organization they run ruins someone else's life in error. It's no surprise that they play fast and loose when it comes to anyone who isn't part of their in-group.

k33n 9y ago

Why are people who have no idea how the Internet works conducting investigations related to Internet crime?

thomastjeffery 9y ago
They are also the ones defining "internet crime" and "evidence". Those of us who do understand don't have an appealing alternative, because the entire thing is nonsense. We have the same problem with DRM and software patents.

otakucode 9y ago

The mindset of "This resolved to a house with kids, we need to move now" cuts both ways. When they screw it up, they vastly, vastly increase the amount of time it takes before they actually go after the correct location - which might very well have children as well. By cutting corners, they do nothing but inflate their own egos and feed their own lust for persecution, destroying innocent lives in their wake. They do not help abused children. At all. Since the 1990s I have been very bothered by the practice law enforcement follows of using IP addresses as evidence against people. I can't imagine how many fathers have had their lives ruined because their young teen son went searching for something they shouldn't have, or because someone used their open wifi connection, or routed through them via malware, or spoofed that IP address, etc. There are multitudes of ways in which it might not point to the right person. And it is very important to remember that when you act on information that points at an innocent person - you are protecting the actual offender. You are shielding them from prosecution. You are guaranteeing that they remain available to continue to commit the crime you are investigating. I would think, just generally, police would be motivated to not be providing that sort of shielding... but getting those headlines seems to just be so damned tempting...

Feniks 9y ago

IP adress should be used as the START of an investigation. Not evidence at a trial. Still I understand the prosecution. Pedophiles and other assorted scum know OPSEC and society wants criminals off the street. So just letting people walk because they were clever enough to encrypt their HDD is not an option.