Ruling: IP address does not identify person

[JoeD]

Originally Posted by Hamlet53

Interesting. Forgive my ignorance on some of this, but for my home Internet connection I have a wired connection between my wireless router/modem. Then for the wireless devices I use in my home to make Internet connection the proper password must be entered and as well as the router is set up to allow connection only from the list of MAC addresses that correspond to the cards in my devices. I do leave my modem/router on all the time and so connected to the Internet. So to make unauthorized use of my connection someone would have to be within range of my modem, crack my password, and spoof one of the MAC addresses of my devices? Or is it worse than that?

Spoofing a mac address is trivial. The only safe guard is your wifi encryption of which wpa2 is afaik the only unbroken one at this time.

Also, this is assuming people are not using wifi or bluetooth keyboards. There's several cases where weak/no encryption has been used by those which could easily lead to someone hacking your network or sniffing passwords. The previous link is to an old news item, but I'm sure there'll be more recent cases (although I hope device makers stepped up their security after those reports)

[wodin]

Originally Posted by Hamlet53

Interesting. Forgive my ignorance on some of this, but for my home Internet connection I have a wired connection between my wireless router/modem. Then for the wireless devices I use in my home to make Internet connection the proper password must be entered and as well as the router is set up to allow connection only from the list of MAC addresses that correspond to the cards in my devices. I do leave my modem/router on all the time and so connected to the Internet. So to make unauthorized use of my connection someone would have to be within range of my modem, crack my password, and spoof one of the MAC addresses of my devices? Or is it worse than that?

Again, that's on your private network (on the house side of your cable modem), on the street side is the public (cable company's) network, and they are the ones who assign your public IP, based on the MAC address of your cable modem. If I connect another cable modem that has the same MAC address anywhere within the cable company's network (actually subnet, but that's beyond this discussion) they will give it an IP address, and log it as being assigned to you.

The caveat is that if two modems with the same MAC log on at the same time the DHCP appliance is going to call foul and alert the cable company that someone is spoofing MACs. Depending on the DHCP appliance manufacturer, it may or may not refuse to assign an IP.

[wodin]

Originally Posted by JoeD

Read the links I posted earlier, they briefly touch on this.

or read this one

If you do not know who drove your car and took reasonable steps to try to find out, nothing will happen. Remember this discussion is not about someone who did speed trying to get out of the fine, it's about an owner of the car who didn't speed and didn't know who was driving the car/had not given anyone permission to. They cannot be charged with speeding (or rather won't be found guilty) unless the police can provide evidence that they were the driver at the time. Prooving it was your car isn't sufficient.

Now if they really were driving, or they knew who was and the police later found out and could prove it, they're in a lot more trouble than if they'd just copped for the speeding ticket. However, again, we're talking about innocent car owners. Or rather, innocent router owners who have no idea that someone else used their connection let alone who it was.

How does UK law handle stolen or counterfeit number plates?

[Teknikal]

That actually reminds me I can remember reading about quite a big problem with my ISP a few years back where people were getting free internet by buying dodgy modems. I think they were basicly using other peoples mac addresses and the ISP was giving them the subscribers ip address and letting them online.

Simplest way I can put it is someone could buy a dodgy modem and steal someone elses internet they could pretty much do anything they wanted and the real cable subscriber would be the one blamed for it.

I'm not sure if that was ever fixed but presumably it's still a possibility.

[wodin]

Yeah, I'm not sure of just how the firmware in a modem works, and I'm sure the ISPs go to some extreem to prevent just that, but I'm also pretty sure there are some bright hackers around who are up to circumventing it.

Again; an IP address is NOT evidence!

[HansTWN]

An IP address is evidence, it is not final proof. In spite of the seemingly prohibitively high cost, getting a warrant for search and seizure of the devices does make sense. I think a few well publicized cases would go a long way towards scaring potential casual pirates enough to keep their noses clean.

Of course, current penalty levels are ridiculously high.

[sabredog]

I would certainly recommend those interested to read the final judgement of the High Court of Australia in response to the appeal by AFACT (MPAA front) in their battle against Australian ISP's (targetting iiNet).

Notices that list IP's as part of that notice issued to ISP's are NOT considered as evidence enough to force an ISP to disconnect a user that AFACT is accusing of copyright infringement.

[Jazzy_Jeffaz]

Originally Posted by HarryT

What sort of evidence did you have in mind? Forensic examination of computers is an extremely time-consuming and expensive process. Are there more practical alternatives?

You're damn skippy....

[Giggleton]

As to OP, perhaps not yet anyway.

[HarryT]

Originally Posted by wodin

How does UK law handle stolen or counterfeit number plates?

By taking photographs of the vehicle involved in the offence.

[HarryT]

Originally Posted by Elfwreck

"Then why is your hard drive full of movies datestamped at the time we tracked the copyrighted materials?"

An IP address should be enough to get a warrant; the issue is copyright holders wanting to *bypass* the court system and issue expensive settlement options based on IP addresses. Recent judges have thrown them out, not so much for not having enough identity info, but for the fact that they obviously had no intention of prosecuting anything--they were hoping for a lot of settlement $ from people too busy or ashamed (in the case of porn accusations) to face them in court.

If there's an actual crime or other violation with real damages involved, an IP address is certainly enough info to kick off a real investigation. Proving absolutely that this one person downloaded the fies may be impossible, but connecting usage logs to records on the hard drive can prove things beyond a resonable doubt.

The problem isn't the courtroom standard of proof--it's that the RIAA and MPAA want to avoid having to meet legal standards before inflicting punishments.

How does this help us exactly? If a shared household computer is found to contain copyrighted material, aren't we back to exactly the same question - whom do you prosecute? The result is that we start a new thread: "Computer does not identify person", don't we?

That's why I stand by my (unpopular) view that the only rational course of action in the case of shared ownership, where the owner refuses to divulge the identity of the real offender, is to prosecute the owner.

[Rob Lister]

Originally Posted by HarryT

How does this help us exactly? If a shared household computer is found to contain copyrighted material, aren't we back to exactly the same question - whom do you prosecute? The result is that we start a new thread: "Computer does not identify person", don't we?

You prosecute the person that downloaded the content. Determining which user is a function of discovery. If discovery does not yield any evidence pointing to any specific person, then the case falls flat. If it does, and that evidence convinces a judge that it meets the requirements for the class of case being brought (civil or criminal), then the case can proceed, and a jury can decide.

[HarryT]

Originally Posted by Rob Lister

You prosecute the person that downloaded the content. Determining which user is a function of discovery. If discovery does not yield any evidence pointing to any specific person, then the case falls flat. If it does, and that evidence convinces a judge that it meets the requirements for the class of case being brought (civil or criminal), then the case can proceed, and a jury can decide.

Do you have the concept of "common endeavour" in legal cases in the US? In the UK, if the police know that a crime was committed by someone among a group of people, but don't know specifically who did the actual deed, they can all be charged with the crime in that they did not actively take any action to prevent it. Common Endeavour is especially common in assault or murder cases, where a group of people attack someone, but there's no way to know who specifically struck the blow that did the injury.

It occurs to me that it could also be applied to cases such as this, where you know that someone in a specific group of people downloaded illegal material, but you cannot be certain which specific individual it was. It would be difficult to show that the other users of a shared computer were not aware of illegal downloads made on it.

[howyoudoin]

Originally Posted by HarryT

Do you have the concept of "common endeavour" in legal cases in the US? In the UK, if the police know that a crime was committed by someone among a group of people, but don't know specifically who did the actual deed, they can all be charged with the crime in that they did not actively take any action to prevent it. Common Endeavour is especially common in assault or murder cases, where a group of people attack someone, but there's no way to know who specifically struck the blow that did the injury.

It occurs to me that it could also be applied to cases such as this, where you know that someone in a specific group of people downloaded illegal material, but you cannot be certain which specific individual it was. It would be difficult to show that the other users of a shared computer were not aware of illegal downloads made on it.

It could not be applied to this because not all users of the wireless internet point can be proven to have the intention of piracy. If a group of individuals all come to blows with a person, there is demonstrable intent. They're different cases.

[Kumabjorn]

Am I the only one feeling uncomfortable that murder is equated with IP theft?