Ruling: IP address does not identify person

[JSWolf]

Originally Posted by JoeD

For many years ISPs shipped routers to their customers that were pre configured with open WiFi, customers had no idea it was insecure. Others knew enough to turn on WEP but not enough to know people could break the security of it in a few minutes. Those who knew about WEP were smart enough to turn on WPA (which if they've failed to keep up with geeky tech news, they'll not know it is also breakable in a minute or so and should be running WPA2)

This is one of the reasons I think the first wave of letters is a very good idea. People need to be aware there's a possible problem and either know how to configure the security of their device to fix it OR pay someone to do so. The letter would ensure they're aware and can take the steps needed to check/sort it.

Now chances are the current WPA2 will be eventually broken and hopefully by then there's a new flavour out we can all move to temporarily, but if/when it is, there's going to be a lot of vulnerable wifi connections because people won't know it's broken. Those people should not be responsible for someone cracking and abusing their network and been fined on evidence of nothing more than their IP been used.

There is another security measure in place in router firmware these days. MAC address filtering should be used. That way, someone would have to have an authorized MAC address to be able to access the router.

[Elfwreck]

Originally Posted by HarryT

Oh well, given that the law appears to favour your viewpoint, I guess you don't have to worry too much about my warped views about the way the world should be becoming a reality, do you? It concerns me deeply, though, that the criminal appears to be being given a "get out of jail free" card here. "Oh it wasn't me, officer. Someone else must have used my IP connection!".

"Then why is your hard drive full of movies datestamped at the time we tracked the copyrighted materials?"

An IP address should be enough to get a warrant; the issue is copyright holders wanting to *bypass* the court system and issue expensive settlement options based on IP addresses. Recent judges have thrown them out, not so much for not having enough identity info, but for the fact that they obviously had no intention of prosecuting anything--they were hoping for a lot of settlement $ from people too busy or ashamed (in the case of porn accusations) to face them in court.

If there's an actual crime or other violation with real damages involved, an IP address is certainly enough info to kick off a real investigation. Proving absolutely that this one person downloaded the fies may be impossible, but connecting usage logs to records on the hard drive can prove things beyond a resonable doubt.

The problem isn't the courtroom standard of proof--it's that the RIAA and MPAA want to avoid having to meet legal standards before inflicting punishments.

[Rob Lister]

Originally Posted by JSWolf

There is another security measure in place in router firmware these days. MAC address filtering should be used. That way, someone would have to have an authorized MAC address to be able to access the router.

or a spoof of an authorized mac address. spoofing a mac is far easier than spoofing an ip.

[JSWolf]

Originally Posted by Rob Lister

or a spoof of an authorized mac address. spoofing a mac is far easier than spoofing an ip.

But in order to do that, they have know the MAC addresses allowed on the network. Not an easy thing to get.

[twowheels]

Originally Posted by HarryT

Yes, I do. If you don't have the knowledge yourself, get it done by someone who does have the knowledge. We require training and certification before someone is allowed to drive a car. An internet connection is potentially a more "dangerous" thing to possess - should we not require responsibility from its owner?

An internet connection more dangerous than a car?

I wasn't agreeing with you, but at least sympathetic to your side until I read that... then you lost me. That's a load if I ever heard one.

[teh603]

Originally Posted by Elfwreck

, but connecting usage logs to records on the hard drive can prove things beyond a resonable doubt.

Wonder if that would suddenly breathe new life into ext2. "Sorry, this drive isn't formatted in NTFS and doesn't journal."

[keeska]

Originally Posted by JSWolf

But in order to do that, they have know the MAC addresses allowed on the network. Not an easy thing to get.

If you have a wireless network then you are giving me your valid MAC addresses every time one of the valid clients sends or reecives traffic. Using MAC addresses to filter traffic on a wireless network just makes it harder for you to use your network. It has no effect on anyone who wants to get onto your network without your permission.

If you do not use wireless then I have several options depending on how much I want to use your IP address. If I were a casual user I would go to a neighbor with wireless. If I really wanted to use your IP address there are many ways to do so. Ask any college network admin how well they are able to enforce the one IP per dorm room drop policy. It is well known how to share an IP address provided by an ISP even without the help or knowledge of the owner of that IP address.

The judge was correct. The ISP can only prove that traffic was sent to an IP address. Unless you have a goverment/military secure channel from end to end there is no way to prove who received that traffic. It could be the owner of that IP address, anyone who stole it or a completely different IP address because the orginal IP address was modified before it arrived at the destination.

[Andrew H.]

Originally Posted by Elfwreck

"Then why is your hard drive full of movies datestamped at the time we tracked the copyrighted materials?"

An IP address should be enough to get a warrant; the issue is copyright holders wanting to *bypass* the court system and issue expensive settlement options based on IP addresses. Recent judges have thrown them out, not so much for not having enough identity info, but for the fact that they obviously had no intention of prosecuting anything--they were hoping for a lot of settlement $ from people too busy or ashamed (in the case of porn accusations) to face them in court.

If there's an actual crime or other violation with real damages involved, an IP address is certainly enough info to kick off a real investigation. Proving absolutely that this one person downloaded the fies may be impossible, but connecting usage logs to records on the hard drive can prove things beyond a resonable doubt.

The problem isn't the courtroom standard of proof--it's that the RIAA and MPAA want to avoid having to meet legal standards before inflicting punishments.

Karma for saving me the time of writing this myself.

An IP address is decent evidence that the IP address holder was involved in whatever violation or crime is at issue. It's enough to get a warrant, or to issue a subpoena, or to take other steps to make sure that the address holder is actually the person who committed the violation. But it's not precise enough to allow you to avoid doing other due diligence.

[Teknikal]

Ip address should never alone be enough to point fingers and accusations, I think every torrent client in existence has the option of which IP to send to the tracker, now while that's there to make incoming connections easier to establish it could easily be used to give any torrent any ip address you wanted and get people you don't like sued.

I'm sure someone could knock up a program in 20 minutes that does nothing but send other peoples Ip's to random infringing torrents.

Then there the issues of the amount of hacker controlled botnets out in the wild I'm pretty sure lot's of innocent people are unknowingly infected and could easily have their computers used as proxys/bounces without their knowledge.

As for wifi security it has never existed, mac addresses are easy to spoof and all of the current encryptions can be cracked pretty quickly by someone with a sniffer and the right rainbow tables.

Even if you ignore all that how can you prove who was using the computer or if it was even at the address, I've even seen cable repair guys plugging their laptops into the cable box across the street and using peoples connections I presume they can do this at ISP level as well.

[Elfwreck]

Originally Posted by Teknikal

Ip address should never alone be enough to point fingers and accusations,

Sure it is. It's just not enough to convict. It's enough to point a finger and say, "this needs more investigation!"

If you find the gun used in a murder in the house of the guy who owns the gun, you have grounds to suspect him, and demand a lot of access to the details of his life while you find out what happened.

You don't have grounds to declare him "probably guilty" or "guilty of SOMETHING since his gun was used" and assign penalties thereby.

Even if you ignore all that how can you prove who was using the computer or if it was even at the address, I've even seen cable repair guys plugging their laptops into the cable box across the street and using peoples connections I presume they can do this at ISP level as well.

The internet was never designed for security, and the larger businesses are just now figuring that out. It was designed to allow you to send secure *information*--encrypted so that only intended receivers could read it--but the sending-and-receiving parts were designed to be as accessible as possible. Early internet systems were buggy and prone to crashing; allowing several alternate routes was seen as a reliability feature, not a security bug: it helped your data get where it was going.

Tracking exactly who-did-what online is not impossible (usually), but an IP address is only the starting point for that.

[wodin]

IP addresses are assigned by the DHCP appliance at the ISP based on the MAC address of the modem. There is nothing preventing me from buying a cable modem from Best Buy, spoofing someone else’s MAC, and plugging it in to the cable network thus getting an IP that’s logged as whoever has that MAC. The only restriction is that the legitimate modem can’t be on line at the same time, but how many people stay on line 24/7? And I can tell if you’re on line with nothing more than a cell phone.

The IP address of a perpetrator is NOT evidence!

That, by the way is the reason for the Enhanced 911 system, There is no way guarantee the location of a VOIP telephone, since it is connected to a routable network.

[JoeD]

edit: others already replied, no point duplicating those posts

Originally Posted by wodin

IP addresses are assigned by the DHCP appliance at the ISP based on the MAC address of the modem. There is nothing preventing me from buying a cable modem from Best Buy, spoofing someone else’s MAC, and plugging it in to the cable network thus getting an IP that’s logged as whoever has that MAC. The only restriction is that the legitimate modem can’t be on line at the same time, but how many people stay on line 24/7? And I can tell if you’re on line with nothing more than a cell phone.

The IP address of a perpetrator is NOT evidence!

That, by the way is the reason for the Enhanced 911 system, There is no way guarantee the location of a VOIP telephone, since it is connected to a routable network.

Interesting. Forgive my ignorance on some of this, but for my home Internet connection I have a wired connection between my wireless router/modem. Then for the wireless devices I use in my home to make Internet connection the proper password must be entered and as well as the router is set up to allow connection only from the list of MAC addresses that correspond to the cards in my devices. I do leave my modem/router on all the time and so connected to the Internet. So to make unauthorized use of my connection someone would have to be within range of my modem, crack my password, and spoof one of the MAC addresses of my devices? Or is it worse than that?

[JoeD]

Originally Posted by Bilbo1967

You may be right, but that is not the way it works under UK law. As Harry explained.

Read the links I posted earlier, they briefly touch on this.

or read this one

If you do not know who drove your car and took reasonable steps to try to find out, nothing will happen. Remember this discussion is not about someone who did speed trying to get out of the fine, it's about an owner of the car who didn't speed and didn't know who was driving the car/had not given anyone permission to. They cannot be charged with speeding (or rather won't be found guilty) unless the police can provide evidence that they were the driver at the time. Prooving it was your car isn't sufficient.

Now if they really were driving, or they knew who was and the police later found out and could prove it, they're in a lot more trouble than if they'd just copped for the speeding ticket. However, again, we're talking about innocent car owners. Or rather, innocent router owners who have no idea that someone else used their connection let alone who it was.

[wodin]

Originally Posted by JSWolf

There is another security measure in place in router firmware these days. MAC address filtering should be used. That way, someone would have to have an authorized MAC address to be able to access the router.

That only protects the private side, the public side is still wide open, and it’s the public IP address that is logged at the ISP.