12 ms·
US Court of Appeals: An IP address isn't enough to identify a pirate
- notafraudster 8y agoThe court holds that the plaintiff must demonstrate reasonable evidence the defendant was the person using the computer. In this particular case, the defendant ran what amounts to lodging, was deposed, and it was immediately figured out it wasn't him. The complicating factor is that because his lodging was medical in nature, he was not able to hand over guest information. I mention this context because it's unlikely you would be able to get out of being sued by saying "Well maybe it was my roommate LOL"
- AnthonyMouse 8y agoThe facts of the actual case make it much easier to understand the problem, but how is that situation actually different? There are still multiple people it could have been, no evidence is presented to distinguish between them at all and it's an obvious injustice to punish one person when it was another who did it.
- AmericanChopper 8y agoHow do you know it wasn't a nearby neighbour piggybacking on your wifi?
- rootw0rm 8y agobecause wifi is reasonably secure by default these days?
- mmt 8y agoThat notion is conradicted by numerous articles about WPA2 cracks. https://hn.algolia.com/?query=wpa&sort=byDate&prefix&page=0&dateRange=all&type=story&authorText=false https://hn.algolia.com/?query=wpa&sort=byDate&prefix&page=0&...
- a1369209993 8y agoYou don't, that's the point; claiming "the criminals had mail sent to 1342 Grass Lane, therefore the owner of 1342 Grass Lane is the criminal" is patently ridiculous, and it's good that the court realizes that the same applies (if anything, even more so) to IP addresses.
- saagarjha 8y ago> I mention this context because it's unlikely you would be able to get out of being sued by saying "Well maybe it was my roommate LOL" Well, the question is whether I'm responsible for the use of my computer network. If someone hacks into it and starts using it without me noticing, am I responsible?
- zaroth 8y agoNo, unlike something like a firearm which you are legally required to secure and can suffer potentially criminal and/or civil liability if someone steals it and uses it to commit a crime, there is no such legal requirement to secure your network against outsider misuse. IANAL that’s just my personal understanding / belief. The key point would be the use would have to be unsanctioned and you were totally unaware. Once you give someone your WiFi password, it’s less clear if you have any liability. I’m not sure of any case where the actual user was known but the person who provided the network connection was blamed. Network access is fairly universal. The particular method used to access the Internet is practically irrelevant. The actor and the act are what is important, not how the packets are routed.
- lostapathy 8y agoI believe the legal term you’re looking for is “strict liability”. Many states don’t actually have laws about securing firearms directly but have a concept of strict liability about what happens if they are stolen, or stolen and not reported.
- mehrdadn 8y agoThanks, this is super helpful terminology to know.
- chillwaves 8y ago> you are legally required to secure and can suffer potentially criminal and/or civil liability if someone steals it and uses it to commit a crime Where does this happen?
- 8y ago
- onetimemanytime 8y ago>>I mention this context because it's unlikely you would be able to get out of being sued by saying "Well maybe it was my roommate LOL" Why not? It's illegal to download a movie and they have to prove what person did it. Roommate, father, sister...neighbor.
- masonic 8y agoThis is a civil suit, not a criminal case.
- Dylan16807 8y agoA civil suit still requires 51% Multiple users will cut that percentage up pretty quickly.
- jdc 8y agoDisclaimer: IANAL To clarify, the plaintiff does have to prove it was the defendant that wronged them, but instead the standard of proof being "beyond a reasonable doubt" it's something like on "the balance of probabilities."
- onetimemanytime 8y agounless the law says "it's your internet connection and you're responsible for what happens" I doubt it matters that much. Standard of proof is much lower but still have to prove that x most likely downloaded the movie.
- anticensor 8y ago> unless the law says "it's your internet connection and you're responsible for what happens" Most subscription contracts have a clause to that effect.
- delecti 8y agoThat's a contract with the provider. I'm responsible to Comcast if my connection is used to download 17 TB of data on a metered subscription, even if I was hacked. That contract doesn't leave me responsible for anything except between me and Comcast.
- deleted 8y ago[deleted]
- analog31 8y ago>>> Judge rules that copyright trolls need more than just an IP address if they want to go after copyright infringement. An IP is not enough proof to tie a person to a crime. I didn't see anything in the story to suggest that the plaintiff was acting as a "troll" in the sense that I understand from reading about patent trolls. In this case, the plaintiff, while found to be in the wrong, was in fact the creator of the content and probably intended to commercialize it.
- mreome 8y agoI would argue that in the case of file-sharing that it's Trolling when the plaintiff is going after an individual who, when removed from the system of distribution, would have no real effect on the rate or availability of the copyrighted work. Someone just downloading a copy would always fit this definition, and while BitTorrent always involves some amount of "distribution" by the legal definition, they don't represent a distributor in a meaningful way. Going after this individual does not protect the the monetization of the copyrighted work. The individual's actions only represent the loss of motorization for the single copy they might have purchased. The only possible argument for this protecting monetization of the copyrighted work would be some kind of "chilling effect" on others sharing, but given the prevalence of file sharing after decades of such legal cases, this seems like a extremely weak argument. Given that, then only reasonable conclusion is that the they are attempting to make money using the law itself, rather then using it to protect the monetization of the copyrighted work.
- r3vrse 8y agoIt surprises me in a way that "big internet" (AT&T, Verizon, Comcast etc) and associated large enterprise interests have not been more staunch proponents of IPv6, at least for fixed consumer connections. It would be trivial in that circumstance to blow away any kind of NAT and the pseudo-anonymity/plausible deniabililty it provides and make client devices performing illegitimate activity directly identifiable. I wonder if such a ruling might be different in that context. It's a perturbing thought.
- Turing_Machine 8y ago> It would be trivial in that circumstance to blow away any kind of NAT and the pseudo-anonymity/plausible deniabililty it provides and make client devices performing illegitimate activity directly identifiable. Identifying the device and identifying the person using it are two entirely different things. Multiple people use the same device all the time.
- viraptor 8y ago> It would be trivial in that circumstance to blow away any kind of NAT Why do you think so? NAT can be used for IPv6 is exactly the same way it's used for IPv4.
- wmf 8y agoAFAIK no home router you can buy does NAT66, so in practice it's not used.
- exabrial 8y agoIPv6 will _not_ have NAT be the default case... IPv4 NAT is the default for the vast majority of [home] routers, and offers a bit of privacy protection built-in.
- viraptor 8y agoThis is true, but if the op meant what they wrote, then the default is irrelevant. If you keep a NAT, moving to IPv6 doesn't blow anything away.
- mirimir 8y agoGood decision. It could have gone badly. That is, that hosting open WiFi without logging user activity makes you liable for infringement.
- est 8y agoIs it enough to identify state sponsored attacks?
- Dylan16807 8y agoAre you implying that those addresses are often used by airbnb guests?
- wu-ikkyu 8y agoIt would seem so (though it shouldn't be). IIRC the Sony hack was attributed to NK because they found some NK IP addresses in comments in the code.
- jeffdavis 8y agoThis doesn't seem to be anything new or different. Just because a muder victim's blood is found on your clothes and you are holding a knife doesn't necessarily mean you are the murderer -- but it is evidence. At the end of the day you will be tried by a judge or a jury. If your only defense is some kind of grand, implausible chain of maybes and what-ifs, they will rule against you. If you have a perfectly reasonable explanation, then they won't. An IP is just evidence.
- exabrial 8y agoWhat aggravates me about using IP addresses to accuse alleged pirates is the same thing that aggravates me about traffic cameras: It's not my responsibility, duty, or privilege to enforce the law.
- noobermin 8y agoWho's up for Gorsuch and Kavanaugh declaring it is?
- PeterStuer 8y agoSome IP addresses are more personal than others. What I mean is that yes, on it's own an IP address does not pinpoint persons, but devices. So it remains upon the complainer in the case of a copyright infringement case to present a further reasoning 'above the speculative level' that the by the IP identified device at the time of the infringement was under the control of the alleged infringer. In this case they failed. That doesn't mean it will always fail. If you're mobile ISP uses IPv6 for everything and assigned your mobile a static IPv6 address, then it will be harder to argue it wasn't you. If you're Home router is provided and managed by your ISP, and it is configured to use DHCP Static Leases, then the local IP of your mobile phone (a fairly personal device) is close (not equal) to being equally as effective as a personal identifier as it's MAC. If on the other hand you connected to an Open-Wifi set up by an amateur 4 NAT's down that does not keep logs, and you randomize your MAC every time you connect to a new network, it might be more difficult for tying an IP to your device without reasonable doubt. In that last case if the pursuer wanted the open-wifi operator's operation could be made more difficult by DMCA complaints and leverage through the ISP's terms of service.
- qoi2ijds0 8y agoIt usually points to a router, of which there can be hundreds of devices connected to it on your home network. Securing your wifi is one thing (which doesn't even absolutely prove that it was one of your home devices that did the torrenting, thanks to things like the KRACK attacks), but to then say "well you should secure your internal network such that torrenting cannot happen" is absolutely ridiculous. Torrent programs can work off any port, so that filters out port blocks. Is grandma going to install layer 7 traffic inspection so the grandkids can't doing illegal stuff on that newfangled interwebs? They'll switch to https then... My point is that anyone with the technical know-how and very rudimentary internet access can bypass almost any restriction you try to put on it. What if the pirate is a minor and won't listen to their parents and keeps on torrenting? Do you permanently take their internet access away? How does that then stifle them for school homework or their social interaction? How can we expect each and every citizen to deploy NSA grade traffic monitoring on their router? The whole thing is ridiculous and the courts are still vehemently out of touch
- PeterStuer 8y agoThe article states that 'this is a win for privacy advocates and pirates'. I'm not disagreeing, but I hope this will not re-open doors of trying to leverage this into getting IP addresses out of being privacy linked data in a privacy regulation context.
- squirrelicus 8y agoWhen I was 18 or so a dozen years ago I had two detectives show up at my door (USA). Apparently my neighbor, with whom we were friendly, had connected to our wifi in order to try to hide his solicitation of a minor (luckily an FBI agent). They just stopped by to let us know trouble might be headed our way during the investigation and court proceedings. It was strange. They just left. Don't know if they ever contacted my dad about it further, but I do know he confessed to the whole thing.
- magoon 8y agoThe content companies were so eager to settle out of court for just this reason; they knew that if enough of these cases went to court, a judgment against them results in case law that hinders their ability to strong-arm casual pirates.
- saurik 8y agoI am really curious how this would play out if the user had been running a Tor exit node.