7 ms·

At what point will law enforcement ever come to accept that an IP address does not map directly to a person? As outlined in the article: * most residential IP

At what point will law enforcement ever come to accept that an IP address does not map directly to a person? As outlined in the article: * most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses I'd like to add a third case that I feel is often overlooked: * most consumer or ISP provided routers never have their firmware updated (unless the ISP pushes the update themselves) and are probably vulnerable to mirai, KRACK, and many others. Taking a these into account, even if LEO is able to get the correct information for an IP address, there's a non-zero chance that the people had/have a compromised device. No average consumer is going to be able to prove to LEO or a judge that their device was compromised, and I somehow doubt doing forensic analysis of the person's network is top of LEO's list of evidence to gather. Additionally, many compromises can be ephemeral so by the time the deed is done and the police show up, the router has been rebooted and evidence of the compromise is gone. There is zero chance that LEO is dumping RAM of the router before seizing it as evidence. Combine this with the fact that people may have an encrypted device and may legitimately forget the password before being requested to decrypt the device. I'm sure this can happen, as being arrested and going to trial can be quite stressful. The US government is already indefinitely detaining people for not decrypting their devices. [1] I'm not saying the suspect in this case is innocent or guilty, but consider what precedent is being set there. I don't see heading anywhere good... [1] https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont-decrypt-hard-drives-jailed-indefinitely/ https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...

aceofspad4s 9y ago
>* most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses You can ask the ISP. They are supposed to store metadata.
- thephyber 9y ago
  > You can ask the ISP. They are supposed to store metadata. What you say is true, but prosecutors/investigators have little incentive to jump through another hoop. If they are willing to prosecute someone with just circumstantial evidence of an IP address, they aren't really looking to find the perpetrator, only a fall guy.
  - aceofspad4s 9y ago
    There's no way a prosecutor/investigator can correlate an IP address to a person without asking the ISP so I don't see your point.
    - russh 9y ago
      As an ISP there's no way I can correlate an IP address to a person. I can only correlate it to one or more pieces of equipment.
      - aceofspad4s 9y ago
        Which are owned by a person. That's like saying you can only correlate a licence plate to a car, not to the owner of a car. Don't be ridiculous.
        manfredo 9y ago
        It's not ridiculous. Some countries (and States, iirc) require that speeding and red light tickets have to be issued to the driver of the car, so traffic cameras capture both the licence plate and the driver's face. Similarly, if I torrent pirated media in a Starbucks, should the store be charged?
        aceofspad4s 9y ago
        I expect something like the dmca "safe harbor" if you're a Starbucks.
        FireBeyond 9y ago
        Yes, but that's only partially the reason, or rather, in some cases. In my state, that was specifically to cover "well, if you deny driving the vehicle..." situations, where people would say "Oh, it wasn't me, I lent my car to someone/my kids drove/whatever", and law enforcement replying "Who?" "Oh, I don't know. Sorry." Now it's to increase the burden of proof. It's reasonable to assume that if you own a vehicle, you were driving it. It's furthermore reasonable to assume that you should be able to identify who was driving the vehicle, from the face, even if you do have multiple people driving. If you then refuse to identify the person, or "I don't know", then it's tantamount (in the law's eyes) to saying you weren't taking due regard to the care of operation of your vehicle (after all, if you don't even know their name, how do you know they're licensed?).
- profmonocle 9y ago
  To tie a request made over CGNAT to the ISP's customer you need both the IP address and the port number of the connection. In my experience, most software that logs IP addresses doesn't bother to log the port number. (Probably because it wasn't relevant before CGNAT came along.)
  - sp332 9y ago
    In that case the ISP would not be able to map the address to a customer, so no one would be getting wrongfully arrested.
woliveirajr 9y ago
Add that inside a home, the IP is again behind a NAT because the whole family is using the wi-fi. Including people who drop by to visit you, to have a dinner, to watch a game. One IP per person really doesn't hold.
- rhinoceraptor 9y ago
  Or someone in range of your Comcast router is using your xfinitywifi network. Edit: this is incorrect apparently.
  - megaman22 9y ago
    A number one reason to always buy your own equipment, and not pay to rent the shit that Comcast provides.
    - ars 9y ago
      xfinity has no affect on your connection at all. It uses its own IP, and the bandwidth used is not included in your allocation. It has the same affect on you as your neighbor does.
      - grepthisab 9y ago
        Sure, but it's going through your router, right? So if you were torrenting and someone else jumped on the xfinity wifi and started torrenting, it would affect your ability to use your bandwidth, right?
        meotai 9y ago
        yea, xfinitywifi affected our jitter test. We called Comcast to disable it & our jitter went down.
        ars 9y ago
        As another post said, only jitter (and only minorly). Bandwidth would be unaffected. Or more exactly, on WiFi (but not Ethernet): as affected as if your close neighbor used that amount (since WiFi itself has limited bandwidth). The connection from the router to the cable modem has lots of headroom, so that would be unaffected, as would wired connections.
lima 9y ago
You will be happy to hear that some countries got it right. Here in Germany, authorities treat IP addresses as very weak forms of circumstantial evidence due to the issues you mentioned (CGNAT, compromised devices). Nobody is going to be convicted purely based on an IP address.
- peeters 9y ago
  You don't have to convict someone to do irreparable damage to their life. See Nigel Lang, the man referred to in the article.
  - lima 9y ago
    Yes, but getting arrested requires "dringenden Tatverdacht" (strong suspicion) here. An IP address isn't sufficient without any additional evidence. (Disclaimer: I'm not a lawyer, exceptions apply)
    - chroem- 9y ago
      For future reference, there is no legal requirement that says you need to formally announce you're not a lawyer on internet forums.
      - stordoff 9y ago
        It can still be useful to do so thought, as a shorthand for there potentially being nuances or exceptions to the claim you are making of which you are unaware.
        thomastjeffery 9y ago
        > for there potentially being nuances or exceptions to the claim you are making of which you are unaware. Making a statement just to avoid an edge case is what we hackers like to call "boilerplate". We don't find it useful, and generally prefer to avoid it, both for the writer and the reader.
openasocket 9y ago
To be clear about [1], he isn't being held because he forgot the password to the device, he's claiming he doesn't have to decrypt the device even with a warrant. If he claimed he forgot the password, the government would have to prove he really knows the password to keep him in jail. But because he is refusing to respond to the order, he has to stay in jail until either he complies or he can prove in court the government doesn't have the right to demand it. Whether the government can compel you to decrypt a device is still a bit of an open question, with conflicting decisions from appeals courts. It's not nearly as cut-and-dry as you would suppose. The fifth amendment says you can't be made to testify against yourself, but you can, for example, be made to provide documents via subpoena that may prove your guilt.
- deleted 9y ago
  [deleted]
- manfredo 9y ago
  Maybe this guy is trying to set a precedent, but can't he just say he forgot? It's not like the government can prove he remembers the password when if he claims he does not.
otakucode 9y ago
You can forget convincing a judge, by the way. While there is a razor-slim chance that the judge might understand technical matters and wish to let you present your case, they can't. The prosecution will accuse the defense of attempting to 'bamboozle' the jury with confusing technical details. This is used in DNA evidence cases to prevent lawyers from pointing out that 1 in 100 DNA tests are in error due to lab errors or sample contamination. The ability to present technical information in a courtroom is basically nil in the USA. The standard used is a 'reasonable person' and it is assumed that no reasonable person has the ability to understand technical nuance. If the police say your IP address did something bad... you're just screwed, as far as I can tell.
- jdavis703 9y ago
  Why can't you ask your lawyer to subpoena the records from the ISP? If you're innocent the ISP's records should indicate you've never interacted with the servers you're being accused of accessing. Just alleging that something could be wrong isn't enough, reasonable doubt has to have a boundary line somewhere. Now if there are cases where defendants are prevented from admitting exculpatory evidence that would disprove circumstantial evidence, then that's a separate problem (i.e. when prosecutors hide evidence).
  - Chaebixi 9y ago
    > Just alleging that something could be wrong isn't enough, reasonable doubt has to have a boundary line somewhere. IANAL, but wouldn't a presumption of innocence require the prosecution prove that their evidence is not mistaken?
- nikanj 9y ago
  The jury saw it working on CSI. No paid expert witness is ever going to change their idea of how tech works.
pasbesoin 9y ago
When someone else has a bigger stick. A quip. But also, I think, how things like this work.
fencepost 9y ago
> most residential IP addresses are dynamic In theory perhaps, but in practical terms your mileage may vary widely. I'm not sure about the rest of the USA, but in the Chicago area Comcast appears to have pretty much abandoned rotating dynamically-allocated IPs, and I suspect many other carriers have something similar. On the other hand, experience last year with attempting to whitelist a remote user living in Germany showed that at least one ISP there appears to rotate home IPs every few days.

aceofspad4s 9y ago

>* most residential IP addresses are dynamic * more and more carriers are using cgNAT as they exhaust IPv4 addresses You can ask the ISP. They are supposed to store metadata.

thephyber 9y ago
> You can ask the ISP. They are supposed to store metadata. What you say is true, but prosecutors/investigators have little incentive to jump through another hoop. If they are willing to prosecute someone with just circumstantial evidence of an IP address, they aren't really looking to find the perpetrator, only a fall guy.
- aceofspad4s 9y ago
  There's no way a prosecutor/investigator can correlate an IP address to a person without asking the ISP so I don't see your point.
  - russh 9y ago
    As an ISP there's no way I can correlate an IP address to a person. I can only correlate it to one or more pieces of equipment.
    - aceofspad4s 9y ago
      Which are owned by a person. That's like saying you can only correlate a licence plate to a car, not to the owner of a car. Don't be ridiculous.
      - manfredo 9y ago
        It's not ridiculous. Some countries (and States, iirc) require that speeding and red light tickets have to be issued to the driver of the car, so traffic cameras capture both the licence plate and the driver's face. Similarly, if I torrent pirated media in a Starbucks, should the store be charged?
        aceofspad4s 9y ago
        I expect something like the dmca "safe harbor" if you're a Starbucks.
        FireBeyond 9y ago
        Yes, but that's only partially the reason, or rather, in some cases. In my state, that was specifically to cover "well, if you deny driving the vehicle..." situations, where people would say "Oh, it wasn't me, I lent my car to someone/my kids drove/whatever", and law enforcement replying "Who?" "Oh, I don't know. Sorry." Now it's to increase the burden of proof. It's reasonable to assume that if you own a vehicle, you were driving it. It's furthermore reasonable to assume that you should be able to identify who was driving the vehicle, from the face, even if you do have multiple people driving. If you then refuse to identify the person, or "I don't know", then it's tantamount (in the law's eyes) to saying you weren't taking due regard to the care of operation of your vehicle (after all, if you don't even know their name, how do you know they're licensed?).
profmonocle 9y ago
To tie a request made over CGNAT to the ISP's customer you need both the IP address and the port number of the connection. In my experience, most software that logs IP addresses doesn't bother to log the port number. (Probably because it wasn't relevant before CGNAT came along.)
- sp332 9y ago
  In that case the ISP would not be able to map the address to a customer, so no one would be getting wrongfully arrested.

woliveirajr 9y ago

Add that inside a home, the IP is again behind a NAT because the whole family is using the wi-fi. Including people who drop by to visit you, to have a dinner, to watch a game. One IP per person really doesn't hold.

rhinoceraptor 9y ago
Or someone in range of your Comcast router is using your xfinitywifi network. Edit: this is incorrect apparently.
- megaman22 9y ago
  A number one reason to always buy your own equipment, and not pay to rent the shit that Comcast provides.
  - ars 9y ago
    xfinity has no affect on your connection at all. It uses its own IP, and the bandwidth used is not included in your allocation. It has the same affect on you as your neighbor does.
    - grepthisab 9y ago
      Sure, but it's going through your router, right? So if you were torrenting and someone else jumped on the xfinity wifi and started torrenting, it would affect your ability to use your bandwidth, right?
      - meotai 9y ago
        yea, xfinitywifi affected our jitter test. We called Comcast to disable it & our jitter went down.
      - ars 9y ago
        As another post said, only jitter (and only minorly). Bandwidth would be unaffected. Or more exactly, on WiFi (but not Ethernet): as affected as if your close neighbor used that amount (since WiFi itself has limited bandwidth). The connection from the router to the cable modem has lots of headroom, so that would be unaffected, as would wired connections.

lima 9y ago

You will be happy to hear that some countries got it right. Here in Germany, authorities treat IP addresses as very weak forms of circumstantial evidence due to the issues you mentioned (CGNAT, compromised devices). Nobody is going to be convicted purely based on an IP address.

peeters 9y ago
You don't have to convict someone to do irreparable damage to their life. See Nigel Lang, the man referred to in the article.
- lima 9y ago
  Yes, but getting arrested requires "dringenden Tatverdacht" (strong suspicion) here. An IP address isn't sufficient without any additional evidence. (Disclaimer: I'm not a lawyer, exceptions apply)
  - chroem- 9y ago
    For future reference, there is no legal requirement that says you need to formally announce you're not a lawyer on internet forums.
    - stordoff 9y ago
      It can still be useful to do so thought, as a shorthand for there potentially being nuances or exceptions to the claim you are making of which you are unaware.
      - thomastjeffery 9y ago
        > for there potentially being nuances or exceptions to the claim you are making of which you are unaware. Making a statement just to avoid an edge case is what we hackers like to call "boilerplate". We don't find it useful, and generally prefer to avoid it, both for the writer and the reader.

openasocket 9y ago

To be clear about [1], he isn't being held because he forgot the password to the device, he's claiming he doesn't have to decrypt the device even with a warrant. If he claimed he forgot the password, the government would have to prove he really knows the password to keep him in jail. But because he is refusing to respond to the order, he has to stay in jail until either he complies or he can prove in court the government doesn't have the right to demand it. Whether the government can compel you to decrypt a device is still a bit of an open question, with conflicting decisions from appeals courts. It's not nearly as cut-and-dry as you would suppose. The fifth amendment says you can't be made to testify against yourself, but you can, for example, be made to provide documents via subpoena that may prove your guilt.

deleted 9y ago
[deleted]
manfredo 9y ago
Maybe this guy is trying to set a precedent, but can't he just say he forgot? It's not like the government can prove he remembers the password when if he claims he does not.

otakucode 9y ago

You can forget convincing a judge, by the way. While there is a razor-slim chance that the judge might understand technical matters and wish to let you present your case, they can't. The prosecution will accuse the defense of attempting to 'bamboozle' the jury with confusing technical details. This is used in DNA evidence cases to prevent lawyers from pointing out that 1 in 100 DNA tests are in error due to lab errors or sample contamination. The ability to present technical information in a courtroom is basically nil in the USA. The standard used is a 'reasonable person' and it is assumed that no reasonable person has the ability to understand technical nuance. If the police say your IP address did something bad... you're just screwed, as far as I can tell.

jdavis703 9y ago
Why can't you ask your lawyer to subpoena the records from the ISP? If you're innocent the ISP's records should indicate you've never interacted with the servers you're being accused of accessing. Just alleging that something could be wrong isn't enough, reasonable doubt has to have a boundary line somewhere. Now if there are cases where defendants are prevented from admitting exculpatory evidence that would disprove circumstantial evidence, then that's a separate problem (i.e. when prosecutors hide evidence).
- Chaebixi 9y ago
  > Just alleging that something could be wrong isn't enough, reasonable doubt has to have a boundary line somewhere. IANAL, but wouldn't a presumption of innocence require the prosecution prove that their evidence is not mistaken?
nikanj 9y ago
The jury saw it working on CSI. No paid expert witness is ever going to change their idea of how tech works.

pasbesoin 9y ago

When someone else has a bigger stick. A quip. But also, I think, how things like this work.

fencepost 9y ago

> most residential IP addresses are dynamic In theory perhaps, but in practical terms your mileage may vary widely. I'm not sure about the rest of the USA, but in the Chicago area Comcast appears to have pretty much abandoned rotating dynamically-allocated IPs, and I suspect many other carriers have something similar. On the other hand, experience last year with attempting to whitelist a remote user living in Germany showed that at least one ISP there appears to rotate home IPs every few days.