Ruling: IP address does not identify person

[wodin]

Originally Posted by HarryT

Do you have the concept of "common endeavour" in legal cases in the US? In the UK, if the police know that a crime was committed by someone among a group of people, but don't know specifically who did the actual deed, they can all be charged with the crime in that they did not actively take any action to prevent it. Common Endeavour is especially common in assault or murder cases, where a group of people attack someone, but there's no way to know who specifically struck the blow that did the injury.

It occurs to me that it could also be applied to cases such as this, where you know that someone in a specific group of people downloaded illegal material, but you cannot be certain which specific individual it was. It would be difficult to show that the other users of a shared computer were not aware of illegal downloads made on it.

I'm reminded of a law that was passed in the State on Maine, USA back in the sixties. It was "Being present where marajuana is used." It was a class two or three felony, and didn't survive the first court test.

[HansTWN]

Originally Posted by wodin

I'm reminded of a law that was passed in the State on Maine, USA back in the sixties. It was "Being present where marajuana is used." It was a class two or three felony, and didn't survive the first court test.

But you do have a responsibility to report a crime, don't you?

[Elfwreck]

Originally Posted by HansTWN

But if you do have a responsibility to report a crime, don't you?

There is no responsibility to report a crime in the US.

Whatever the background for that legal setup, it would be almost impossible to change it now, and make people responsible for reporting crimes. The police would be *flooded* with claims of all sorts of crimes... from jaywalking to parking violations to claims of "slander" every time someone badmouthed their coworkers.

Doesn't matter that the statute might say "obligation to report a felony;" there's not enough common understanding of the law to make that distinction. They'd still get flooded with rumours and hearsay of all types of crimes and imagined crimes.

There'd be lawsuits from crime victims from cases where the police got reports of the crime and didn't act (or didn't act soon enough), because they were flooded with reports.

For example, a large rock concert's in town; they get several hundred calls insisting there is drug dealing, assault & battery, attempted murder (someone waved a knife around), grand theft auto, rape, attempted rape, minors being served alcohol, drunk driving, more drug dealing, vandalism, theft, and so on... how do they sort out the real problems from the swarm of "I think I see a crime being committed" calls? How do they sort out how many of the calls are reporting the same event?

Next morning, the guy who was stabbed and left bleeding goes to the hospital and files a lawsuit against the city for not acting promptly only the "assault and battery" call, which they got. The police might be able to claim "we were too busy to investigate everything;" they can't get away with "after the twenty-fifth call from the phone both outside the stadium we stopped listening."

The idea of requiring people to report IP violations is just mind-boggling. (Nobody's directly suggested that, I know.) "Hello, Police? I'm at the library and I think I just saw someone download a video from YouTube without the owner's consent."

[keeska]

Originally Posted by Hamlet53

... to make Internet connection the proper password must be entered and as well as the router is set up to allow connection only from the list of MAC addresses that correspond to the cards in my devices.

Sorry to quote only part of your message but this is the important part.

The pass phrase (it should not be word) is what protects your network. The MAC filtering offers no protection at all. If I am able to crack your pass phrase then I can get onto your network by using one of the authorized MAC addresses. The authorized MAC addresses are broadcast anytime a legitimate client device sends or receives a packet on your network. In practical tests it takes longer for you to configure a MAC address in your router then it takes someone to set that MAC address on their PC/other device.

To crack your pass phrase I need to capture the WPA/WPA2 authentication frames between your device and your router when it first connects to the network. I can then run my crack program offline and if I get your pass phrase I clone the MAC address of a legitimate station and authenticate to your router as if I was the legitimate device. If I am able to do this depends entirely on the quality of your pass phrase.

You would be surprised at the number of routers which have the factory default pass phrase or something like "123456" or a word which is easy to guess.

All of which goes to show your IP address cannot be used to prove anything. Even if you do not have wireless there are ways for someone to steal your IP address if they want to do so.

[Andrew H.]

Originally Posted by Elfwreck

There is no responsibility to report a crime in the US.

I think in about 20 states it is a crime to fail to report child abuse, which can include a variety of crimes. (In more states people in certain professions have that duty). However, in my state at least, there has been zero interest in the legislature in expanding the duty to report to any other crimes. Although you do have to report a corpse within 3 hours.

[Kumabjorn]

I went out on a long walk yesterday, thinking about this discussion. Now, I know I'm not going to convince HarryT, because he is a direct victim of IP theft and I truly appreciate his frustration. But I'm going to give it one last try, no analogies, just a theoretical case.

I live in the woods, a decent distance from nearest movie house, and they seem to be disappearing anyway. My alternative is to stream or download movies from vendors on the net. Unfortunately, the available speed in the woods is such that it isn't really feasible.

Every weekday I drive to work in a small village. On the outskirts of that village lives TerryH, a computer wizard (from my back in the woods view) who is equipped with the latest in fiber optic connections and WiFi routers. So in the morning I stop outside TerryH's house and hack into his WiFi router with my laptop (I have sufficient speed to learn from cracker sites) I set it up to use a BitTorrent to download two movies into a hidden folder on TerryH's computer. I then drive to work.

On the way home from work I again stop by at TerryH's house, enter his network in stealth and copy the movie files over to my own hard drive. This goes on for six months. I happen to be a lazy person so I just leave the movie files on TerryH's computer. His IP provider notices that he is taking down several GBs before noon every day and inform the police.

Based on his IP address the police pays TerryH a visit, impounds his computer and discovers some 300 illegally downloaded movies on his hard drive. TerryH has two teenage children, a daughter and a son. In the police officer's mind that explain the variety in downloaded movies.
TerryH claims, rightfully so, absolutely no knowledge about the downloaded movies. He points to his secure setup, the passwords, no broadcasting of SSID, MAC filtering etc all so that his children will not make illegal downloads. Hence, TerryH is arrested since he has to be the culprit being the owner of the IP address.

Me? I draw a deep breath of relief when I read about the arrest in the local paper. Happy that the law didn't force the police to dig deeper in their investigation, they were happy to go by the rule that says IP address owner is the guilty party. Now, all I have to do is find another sucker with a hi-tec setup, and then crawl back into the woods.

I believe I have here described a possible scenario that complies with HarryT's premises. Was I able to change your mind?

[HansTWN]

You are forgetting something. TerryH can easily prove that he wasn't at home every noon, but at work. And his children were at school. So the police doesn't arrest him but sets up a trap to check who is downloading from his connection every day at that time. And you get caught.

Besides, you can hack into his network, but why would you copy everything to his hard drive? You can't watch it from there. You need to download it to your PC and then take it home to watch it. Why stay the extra time to copy the movies over to his HD? Quite an unlikely scenario, all of this. A search of his hard disks will come up empty. And everything can be explained so that TerryH doesn't have to pay the fine.

The IP address is strong evidence, obviously not final proof. And a good lead to follow to get to the bottom of things.

[Kumabjorn]

The torrents are downloading to his hard drive while I am at work, they do take a significant time to download. But a high-speed WiFi makes a file copy a lot faster, that is why I stop again on my way home.
TerryH is a consultant, working from home. He can be downloading torrents even if he is away from the computer btw.
The premises stand because they comply with HarryT's support of "common endevaour".

[HarryT]

It's easy to come up with wildly improbable scenarios, but court cases for civil offences operate on what is most probable, not on the remote possibility of the fantastic.

[Kumabjorn]

I don't think it is either improbable nor fantastic. These things happen on a daily basis. My students keep telling me stories on what they do to circumevent the barriers set up by their parents.
But hey, I knew i wasn't going to convince you, all I could do was give it my best try.

[JSWolf]

Originally Posted by HansTWN

An IP address is evidence, it is not final proof. In spite of the seemingly prohibitively high cost, getting a warrant for search and seizure of the devices does make sense. I think a few well publicized cases would go a long way towards scaring potential casual pirates enough to keep their noses clean.

Of course, current penalty levels are ridiculously high.

What if your IP is found to have downloaded some illegal files yet you did not do it. The authorities come knocking on your door and take away your computer. You need your computer for work. You can't do your work. Can you sue for damages?

[HansTWN]

Originally Posted by JSWolf

What if your IP is found to have downloaded some illegal files yet you did not do it. The authorities come knocking on your door and take away your computer. You need your computer for work. You can't do your work. Can you sue for damages?

I don't know, what if they take away your computer because they suspect you of having child porn pictures on it. Or they look for tracks of tax evasion. Then they find there was nothing, can you sue? I am not sure what the law says about your right to sue for damages in such cases.

[HarryT]

Originally Posted by HansTWN

I don't know, what if they take away your computer because they suspect you of having child porn pictures on it. Or they look for tacks of tax evasion. Then they find there was nothing, can you sue? I am not sure what the law says about your right to sue for damages in such cases.

I don't believe you can - at least not in the UK. Just as you can't sue if you're held in prison on remand, and then found "not guilty" at your trial.

[Rob Lister]

Originally Posted by HansTWN

I don't know, what if they take away your computer because they suspect you of having child porn pictures on it. Or they look for tracks of tax evasion. Then they find there was nothing, can you sue? I am not sure what the law says about your right to sue for damages in such cases.

Who are you going to sue? Permission to take the computer was granted by a judge based on probable cause. You certainly can't sue the judge. Assuming no one misled the judge, you're out of luck.

[Elfwreck]

Originally Posted by HansTWN

I don't know, what if they take away your computer because they suspect you of having child porn pictures on it. Or they look for tracks of tax evasion. Then they find there was nothing, can you sue? I am not sure what the law says about your right to sue for damages in such cases.

If they had probable cause and a warrant, you can't sue. The police are allowed to make "honest mistakes" where, by the evidence they had, they believed you had broken the law; if it turns out that wasn't true (or they didn't have enough evidence to convict), you don't get recompense for what you lost to the process.

If, however, they didn't have proper evidence when they got the warrant (lied to the judge, or misunderstood info they had), or there were other problems in the procedures--you *can* get compensated for how much they messed up your life, along with getting back whatever they took from you.

Which is what's currently happening in the MegaUpload case. Always interesting to see how well my tax dollars are working for my safety.