5 ms·

Is UK police so dumb that they suspect people solely based on ipv4? A malware can always attack a computer and set up vpn etc. There can be many thing so UK pol

Is UK police so dumb that they suspect people solely based on ipv4? A malware can always attack a computer and set up vpn etc. There can be many thing so UK police please stop your nonsense. Do they even realize how much tragedy those innocent people had to face due to their silliness?

pilif 5y ago
> Is UK police so dumb that they suspect people solely based on ipv4? It’s not dumb. It’s very practical. Very easy conviction and it entirely turns the burden of proof over to the accused who now have to prove their innocence which is much harder to do especially as they probably lack the resources to do so. If success is measured in amount of convictions and/or arrests, going with just the IP address is the easiest road to success. Articles like this are incredibly important to make it clear to judges that an IP address is not sufficient evidence. This is not common knowledge yet
- exhilaration 5y ago
  On might consider disabling the WiFi password entirely so there's plausible deniability if this happens. Pitch it as a public service. Maybe set up a separate router or VLAN and cap the bandwidth.
  - hhvn 5y ago
    Then you would have to prove that it's someone who used the service not you. The burden of proof is not on the accusor.
  - fnord77 5y ago
    has this ever been tested in court?
  - foobar33333 5y ago
    Sure, but you still end up with all of your devices seized for months and data dumped while you explain that you run an unprotected wifi router.
  - pilif 5y ago
    If your WiFi is entirely unprotected, depending on jurisdiction, you can be treated as an accessory which too can have serious consequences.
    - dannyw 5y ago
      Surely they'd have to prove intent?
      - pilif 5y ago
        It depends on jurisdiction. See for example https://www.itsecurityguru.org/2020/10/06/french-cafe-owners-arrested-for-running-no-log-wifi-networks/ https://www.itsecurityguru.org/2020/10/06/french-cafe-owners...
- quicksilver03 5y ago
  And yet, GDPR considers IP address personal data. As long as there are stupid things written in laws and directives, we can expect the judicial branch issue stupid rulings.
  - Ensorceled 5y ago
    My name is personal data. A bank robber can say "Hands up, this is Ensorceled, hand over your money or die." but that should not be proof I did the crime. Same with IP addresses, THEY ARE PERSONAL DATA. Ad tech companies routinely use IPs for tracking and identification.
  - ad404b8a372f2b9 5y ago
    This is a completely different matter with entirely different goals and implications. GDPR takes the hardest stance on what is and is not personal data for the sake of consumer protection. If a company had the IP of this couple they could link their online activity (most of which is their own) with their name, that's sufficient to spy on them. If you'd eaten chips this morning and there was a database of chip-eaters, eating chips would be considered personal information. It's tiring to see these uninformed hot takes on GDPR on completely unrelated subjects.
    - quicksilver03 5y ago
      > If a company had the IP of this couple they could link their online activity (most of which is their own) with their name, that's sufficient to spy on them. If "most" of their online activity is their own, then some of it coming from "their" IP address isn't. You can pretend to be able to identify a person behind an IP address, but that doesn't make it true.
      - IanCal 5y ago
        My name is personal data even though it's not unique, and my physical address is too even though I don't live alone.
  - pbhjpbhj 5y ago
dm319 5y ago
It's not surprising that people are suspected based on their IP address - most of the criminals involved in these kinds of crimes are unlikely to be tech-savvy enough to gain access to someone else's wifi router. The problem with suspicion is that collateral damage to those who are innocent, but I don't think the answer is to not investigate.
- actually_a_dog 5y ago
  I don't think what happened to these people can be reduced to the phrase "collateral damage."
  - IanCal 5y ago
    Collateral damage covers people getting blown up, it does not suggest mild outcomes.
    - actually_a_dog 5y ago
      As I said, I don't think an overly reductive euphemism intended to make people feel less bad about blowing other people up covers it.
dpwm 5y ago
UK Police are interested in finding non-exculpatory evidence and securing convictions. Computer forensics usually means software bought from a vendor and operated by a technician sometimes with no deep technical knowledge beyond the tool they use. It probably even works well for the common case, but breaks in cases where something unusual has happened. UK ISPs mostly use an IP pool – meaning they have to keep records about who was assigned which IP at which time. Some may run carrier-grade NAT. Those records are obviously trusted, but may not necessarily be accurate – and even if they are, human mistakes occur, especially when working with things like IP addresses, dates and timezones. But if not for following IP addresses, how else do you investigate this sort of thing? I would argue the fault is in a mentality that suggests presuming guilt based on an IP address, then looking for the confirmatory evidence as an "icing on the cake," and a mentality that the investigation process should be so harrowing that the guilty will always go punished even if there isn’t enough evidence for an attempt at conviction. This is long after several such scandals around the same type of crimes.
goatinaboat 5y ago
Is UK police so dumb that they suspect people solely based on ipv4? The police aren't really interested in catching criminals or helping people. There's no promotions in that. Meeting a quota of number of arrests however, you'll be chief inspector in no time!
pjc50 5y ago
They arrested Cliff Richard a few years ago in a highly publicised case that eventually they had to pay him for. This stuff tends to swing between "not investigating at all" and "jump on the first easy lead". Mind you, it is pretty difficult to investigate; if you have a seized messageboard and an upload record from an IP address, and that's all you have, how do you investigate? (It's also interesting to compare the amount of sympathy these wrongly accused people receive versus other victims of police action ...)
- Closi 5y ago
  > If you have a seized messageboard and an upload record from an IP address, and that's all you have, how do you investigate? I would say you search the computers, but do this in a very timely manor so that you do not have to involve employers and social services. These searches should take minutes or hours, not months, and shouldn’t ruin people’s lives if they are innocent.
  - kingosticks 5y ago
    > and shouldn’t ruin people’s lives if they are innocent. Yes. The searches are not designed to ruin anyone's life but informing other parties, like what happened in this article, is sometimes necessary and and can have life ruining consequences even when entirely innocent. Things could leak out from the school to parents, to other work colleagues, limit career progression, etc. These leaks may even be intentional when stupid people are involved. Doing the searches quicker and being innocent or not doesn't help avoid either of the below (from the article) from happening: > The police needed to unlock Matthew's work laptop, which was encrypted. He had to tell his boss about the case in order to get the decryption key. > And the police had also informed social services and the children's school about the investigation, meaning Kate was suspended from her role as a governor there. The first one could be unavoidable. The second one is technically avoidable but it is going to happen (in UK society, at least).
    - Closi 5y ago
      > Doing the searches quicker and being innocent or not doesn't help avoid either of the below [...] It could definitely have avoided the second. I think there is a moral duty to carry out investigations in a way that protects the lives, reputations and livelihoods of the innocent, and this example has fallen short of that in my opinion (although a reasonable person could disagree).
tzs 5y ago
How would you suggest that police investigate this kind of crime?
dehrmann 5y ago
In the US, I'd expect an IPv4 address to be enough for probable cause unless the ISP is doing carrier-grade NAT. IPv4 shouldn't be enough for a conviction since there's obvious reasonable doubt.

pilif 5y ago

> Is UK police so dumb that they suspect people solely based on ipv4? It’s not dumb. It’s very practical. Very easy conviction and it entirely turns the burden of proof over to the accused who now have to prove their innocence which is much harder to do especially as they probably lack the resources to do so. If success is measured in amount of convictions and/or arrests, going with just the IP address is the easiest road to success. Articles like this are incredibly important to make it clear to judges that an IP address is not sufficient evidence. This is not common knowledge yet

exhilaration 5y ago
On might consider disabling the WiFi password entirely so there's plausible deniability if this happens. Pitch it as a public service. Maybe set up a separate router or VLAN and cap the bandwidth.
- hhvn 5y ago
  Then you would have to prove that it's someone who used the service not you. The burden of proof is not on the accusor.
- fnord77 5y ago
  has this ever been tested in court?
- foobar33333 5y ago
  Sure, but you still end up with all of your devices seized for months and data dumped while you explain that you run an unprotected wifi router.
- pilif 5y ago
  If your WiFi is entirely unprotected, depending on jurisdiction, you can be treated as an accessory which too can have serious consequences.
  - dannyw 5y ago
    Surely they'd have to prove intent?
    - pilif 5y ago
      It depends on jurisdiction. See for example https://www.itsecurityguru.org/2020/10/06/french-cafe-owners-arrested-for-running-no-log-wifi-networks/ https://www.itsecurityguru.org/2020/10/06/french-cafe-owners...
quicksilver03 5y ago
And yet, GDPR considers IP address personal data. As long as there are stupid things written in laws and directives, we can expect the judicial branch issue stupid rulings.
- Ensorceled 5y ago
  My name is personal data. A bank robber can say "Hands up, this is Ensorceled, hand over your money or die." but that should not be proof I did the crime. Same with IP addresses, THEY ARE PERSONAL DATA. Ad tech companies routinely use IPs for tracking and identification.
- ad404b8a372f2b9 5y ago
  This is a completely different matter with entirely different goals and implications. GDPR takes the hardest stance on what is and is not personal data for the sake of consumer protection. If a company had the IP of this couple they could link their online activity (most of which is their own) with their name, that's sufficient to spy on them. If you'd eaten chips this morning and there was a database of chip-eaters, eating chips would be considered personal information. It's tiring to see these uninformed hot takes on GDPR on completely unrelated subjects.
  - quicksilver03 5y ago
    > If a company had the IP of this couple they could link their online activity (most of which is their own) with their name, that's sufficient to spy on them. If "most" of their online activity is their own, then some of it coming from "their" IP address isn't. You can pretend to be able to identify a person behind an IP address, but that doesn't make it true.
    - IanCal 5y ago
      My name is personal data even though it's not unique, and my physical address is too even though I don't live alone.
- pbhjpbhj 5y ago

dm319 5y ago

It's not surprising that people are suspected based on their IP address - most of the criminals involved in these kinds of crimes are unlikely to be tech-savvy enough to gain access to someone else's wifi router. The problem with suspicion is that collateral damage to those who are innocent, but I don't think the answer is to not investigate.

actually_a_dog 5y ago
I don't think what happened to these people can be reduced to the phrase "collateral damage."
- IanCal 5y ago
  Collateral damage covers people getting blown up, it does not suggest mild outcomes.
  - actually_a_dog 5y ago
    As I said, I don't think an overly reductive euphemism intended to make people feel less bad about blowing other people up covers it.

dpwm 5y ago

UK Police are interested in finding non-exculpatory evidence and securing convictions. Computer forensics usually means software bought from a vendor and operated by a technician sometimes with no deep technical knowledge beyond the tool they use. It probably even works well for the common case, but breaks in cases where something unusual has happened. UK ISPs mostly use an IP pool – meaning they have to keep records about who was assigned which IP at which time. Some may run carrier-grade NAT. Those records are obviously trusted, but may not necessarily be accurate – and even if they are, human mistakes occur, especially when working with things like IP addresses, dates and timezones. But if not for following IP addresses, how else do you investigate this sort of thing? I would argue the fault is in a mentality that suggests presuming guilt based on an IP address, then looking for the confirmatory evidence as an "icing on the cake," and a mentality that the investigation process should be so harrowing that the guilty will always go punished even if there isn’t enough evidence for an attempt at conviction. This is long after several such scandals around the same type of crimes.

goatinaboat 5y ago

Is UK police so dumb that they suspect people solely based on ipv4? The police aren't really interested in catching criminals or helping people. There's no promotions in that. Meeting a quota of number of arrests however, you'll be chief inspector in no time!

pjc50 5y ago

They arrested Cliff Richard a few years ago in a highly publicised case that eventually they had to pay him for. This stuff tends to swing between "not investigating at all" and "jump on the first easy lead". Mind you, it is pretty difficult to investigate; if you have a seized messageboard and an upload record from an IP address, and that's all you have, how do you investigate? (It's also interesting to compare the amount of sympathy these wrongly accused people receive versus other victims of police action ...)

Closi 5y ago
> If you have a seized messageboard and an upload record from an IP address, and that's all you have, how do you investigate? I would say you search the computers, but do this in a very timely manor so that you do not have to involve employers and social services. These searches should take minutes or hours, not months, and shouldn’t ruin people’s lives if they are innocent.
- kingosticks 5y ago
  > and shouldn’t ruin people’s lives if they are innocent. Yes. The searches are not designed to ruin anyone's life but informing other parties, like what happened in this article, is sometimes necessary and and can have life ruining consequences even when entirely innocent. Things could leak out from the school to parents, to other work colleagues, limit career progression, etc. These leaks may even be intentional when stupid people are involved. Doing the searches quicker and being innocent or not doesn't help avoid either of the below (from the article) from happening: > The police needed to unlock Matthew's work laptop, which was encrypted. He had to tell his boss about the case in order to get the decryption key. > And the police had also informed social services and the children's school about the investigation, meaning Kate was suspended from her role as a governor there. The first one could be unavoidable. The second one is technically avoidable but it is going to happen (in UK society, at least).
  - Closi 5y ago
    > Doing the searches quicker and being innocent or not doesn't help avoid either of the below [...] It could definitely have avoided the second. I think there is a moral duty to carry out investigations in a way that protects the lives, reputations and livelihoods of the innocent, and this example has fallen short of that in my opinion (although a reasonable person could disagree).

tzs 5y ago

How would you suggest that police investigate this kind of crime?

dehrmann 5y ago

In the US, I'd expect an IPv4 address to be enough for probable cause unless the ISP is doing carrier-grade NAT. IPv4 shouldn't be enough for a conviction since there's obvious reasonable doubt.