US Court of Appeals: An IP address isn't enough to identify a pirate

https://www.techspot.com/news/76190-us-court-appeals-ip-address-isnt-enough-identify.html

by ohjeez • 8 years ago

207 65 8 years ago

The court holds that the plaintiff must demonstrate reasonable evidence the defendant was the person using the computer.

In this particular case, the defendant ran what amounts to lodging, was deposed, and it was immediately figured out it wasn't him. The complicating factor is that because his lodging was medical in nature, he was not able to hand over guest information.

I mention this context because it's unlikely you would be able to get out of being sued by saying "Well maybe it was my roommate LOL"

AnthonyMouse• 8 years ago

The facts of the actual case make it much easier to understand the problem, but how is that situation actually different? There are still multiple people it could have been, no evidence is presented to distinguish between them at all and it's an obvious injustice to punish one person when it was another who did it.

AmericanChopper• 8 years ago

How do you know it wasn't a nearby neighbour piggybacking on your wifi?

saagarjha• 8 years ago

I mention this context because it's unlikely you would be able to get out of being sued by saying "Well maybe it was my roommate LOL"

Well, the question is whether I'm responsible for the use of my computer network. If someone hacks into it and starts using it without me noticing, am I responsible?

zaroth2• 8 years ago

No, unlike something like a firearm which you are legally required to secure and can suffer potentially criminal and/or civil liability if someone steals it and uses it to commit a crime, there is no such legal requirement to secure your network against outsider misuse.

IANAL that’s just my personal understanding / belief.

The key point would be the use would have to be unsanctioned and you were totally unaware. Once you give someone your WiFi password, it’s less clear if you have any liability. I’m not sure of any case where the actual user was known but the person who provided the network connection was blamed.

Network access is fairly universal. The particular method used to access the Internet is practically irrelevant. The actor and the act are what is important, not how the packets are routed.

notafraudster2• 8 years ago

Suppose you lived alone, and this scenario unfolded. The plaintiff would reasonably argue that because you lived alone, you were the infringer. Would a court believe this to be reasonable? The ruling doesn't say. Now, if you then, using your own money, hired a computer forensics tech who discovered evidence you had been hacked, and also surrendered your computer and router in discovery and it was confirmed the router showed signs of unauthorized access and the computer didn't have file sharing programs or the file in question, I think it's fairly clear this court would let you off the hook. On the other hand, if your forensics tech found no evidence of tampering and did find filesharing software on your computer, I think you'd have a much harder time asserting that your alibi causes their allegation to fall apart.

The court is saying "Look, you can't just saying the IP address is the person, you need to offer a reasonable claim that it is". It is not saying IP addresses are useless or that your identity must be proven beyond a reasonable doubt.

Neither my first post nor this post were meant to be normative -- I'm not from the US, the country I am from makes passive filesharing (i.e. uploading while torrenting) more or less legal, and I would be very happy if legal rulings stopped piracy fishing expeditions. I just wanted to describe the substance of the ruling in a more substantial way than the headline did.

ninedays3• 8 years ago

France managed to create a law for that specific reason. France decided that any owner of a connection is responsible for it. So if you invite friends over and they start to torrent movies or else, you will be responsible.

PeterStuer4• 8 years ago

Assuming you live/operate the network in the US, it is grey, but your future operation of the open-wifi might be made more difficult.

Have a look here[1] of the potential actions that can be taken against you and your potential response to those.

In the end it will be a matter of how far you and the other party are willing to push this.

This will be different of course if it can be demonstrated that you intentionally ran the open-wifi to bamboozle or encourage illegal use. (because you advertized for or boasted about it in an online forum for instance).

[1]https://openwireless.org/myths-legal.html

onetimemanytime2• 8 years ago

>I mention this context because it's unlikely you would be able to get out of being sued by saying "Well maybe it was my roommate LOL"

Why not? It's illegal to download a movie and they have to prove what person did it. Roommate, father, sister...neighbor.

masonic• 8 years ago

This is a civil suit, not a criminal case.

analog31• 8 years ago

>> Judge rules that copyright trolls need more than just an IP address if they want to go after copyright infringement. An IP is not enough proof to tie a person to a crime.

I didn't see anything in the story to suggest that the plaintiff was acting as a "troll" in the sense that I understand from reading about patent trolls. In this case, the plaintiff, while found to be in the wrong, was in fact the creator of the content and probably intended to commercialize it.

mreome• 8 years ago

I would argue that in the case of file-sharing that it's Trolling when the plaintiff is going after an individual who, when removed from the system of distribution, would have no real effect on the rate or availability of the copyrighted work. Someone just downloading a copy would always fit this definition, and while BitTorrent always involves some amount of "distribution" by the legal definition, they don't represent a distributor in a meaningful way.

Going after this individual does not protect the the monetization of the copyrighted work. The individual's actions only represent the loss of motorization for the single copy they might have purchased. The only possible argument for this protecting monetization of the copyrighted work would be some kind of "chilling effect" on others sharing, but given the prevalence of file sharing after decades of such legal cases, this seems like a extremely weak argument.

Given that, then only reasonable conclusion is that the they are attempting to make money using the law itself, rather then using it to protect the monetization of the copyrighted work.

r3vrse• 8 years ago

It surprises me in a way that "big internet" (AT&T, Verizon, Comcast etc) and associated large enterprise interests have not been more staunch proponents of IPv6, at least for fixed consumer connections.

It would be trivial in that circumstance to blow away any kind of NAT and the pseudo-anonymity/plausible deniabililty it provides and make client devices performing illegitimate activity directly identifiable.

I wonder if such a ruling might be different in that context. It's a perturbing thought.

Turing_Machine• 8 years ago

It would be trivial in that circumstance to blow away any kind of NAT and the pseudo-anonymity/plausible deniabililty it provides and make client devices performing illegitimate activity directly identifiable.

Identifying the device and identifying the person using it are two entirely different things. Multiple people use the same device all the time.

viraptor2• 8 years ago

It would be trivial in that circumstance to blow away any kind of NAT

Why do you think so? NAT can be used for IPv6 is exactly the same way it's used for IPv4.

wmf2• 8 years ago

AFAIK no home router you can buy does NAT66, so in practice it's not used.

exabrial2• 8 years ago

IPv6 will _not_ have NAT be the default case... IPv4 NAT is the default for the vast majority of [home] routers, and offers a bit of privacy protection built-in.

dagenix• 8 years ago

Ipv6 defined "privacy extensions" to combat this very thing - and most operating systems use it by default. The idea is that devices generate random addresses instead of just using the device Mac address. I can't say how well this defeats tracking, however, this article (https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...) concludes

... the ability of security services to track you on IPv4 versus IPv6 is pretty much about the same.

wmf2• 8 years ago

Big ISPs don't want to become copyright enforcers; it costs them a lot of money already and enabling IPv6 would cost them even more. (ISPs that could cheaply deploy IPv6 have already done it, so the ones that haven't generally can't afford to.) They're greedy but they're not proactively evil.

dlgeek• 8 years ago

I don't agree. Keep in mind who owns the big ISPs and what corporate empires they're apart of. Several of the biggest ISPs (especially the cable ones) are part of giant media conglomerates - their corporate parents are also the parents of some of the biggest copyright owners out there.

Ex: https://en.wikipedia.org/wiki/List_of_assets_owned_by_NBCUni... (Comcast)

https://en.wikipedia.org/wiki/AT%26T#Corporate_structure (AT&T)

zaroth2• 8 years ago

I would expect the home router to provide some level of device obfuscation in this case, specifically to help protect user privacy. I don’t its a fight that can be outright “won” but certainly you don’t just hand over unique device identifiers if at all possible.

etaioinshrdlu• 8 years ago

I truly think that we are losing privacy when we give up NAT.

I really don't think it matters too much for client devices anyways, we've found plenty of workarounds by now where it matters. Maybe the best case is NAT-optional.

furi2• 8 years ago

How exactly would this work? It's my understanding the IP addresses have to be allocated in a somewhat uniform manner to make routing feasible so it looks like it would require you to give a block of IPv6 addresses to the customer's router for it to allocate to the attached PCs, phones and what not, which seems like it would take us back to chewing through the address space pretty quick and also not necessarily achieve the desired effect unless the router keeps logs of the assignments it makes.

But if every device has a fixed or randomized identifier then surely the identifier contains absolutely no routing information whatsoever (the machine might have an address starting ffff:ffff:... but might be behind routers eeee:eeee:... or dddd:dddd:... in completely different parts of the world).

delecti2• 8 years ago

If ISPs gave every customer as many IPv6 addresses as are in the entire IPv4 space to distribute among their personal devices, and "every customer" amounted to the entire population of the world, that would use roughly 1 / (10^19) of the total space.

https://en.wikipedia.org/wiki/IPv6

mirimir• 8 years ago

Good decision. It could have gone badly. That is, that hosting open WiFi without logging user activity makes you liable for infringement.

est• 8 years ago

Is it enough to identify state sponsored attacks?

Dylan168073• 8 years ago

Are you implying that those addresses are often used by airbnb guests?

wu-ikkyu• 8 years ago

It would seem so (though it shouldn't be). IIRC the Sony hack was attributed to NK because they found some NK IP addresses in comments in the code.

jeffdavis• 8 years ago

This doesn't seem to be anything new or different. Just because a muder victim's blood is found on your clothes and you are holding a knife doesn't necessarily mean you are the murderer -- but it is evidence.

At the end of the day you will be tried by a judge or a jury. If your only defense is some kind of grand, implausible chain of maybes and what-ifs, they will rule against you. If you have a perfectly reasonable explanation, then they won't.

An IP is just evidence.

exabrial2• 8 years ago

What aggravates me about using IP addresses to accuse alleged pirates is the same thing that aggravates me about traffic cameras: It's not my responsibility, duty, or privilege to enforce the law.

noobermin• 8 years ago

Who's up for Gorsuch and Kavanaugh declaring it is?

PeterStuer4• 8 years ago

Some IP addresses are more personal than others. What I mean is that yes, on it's own an IP address does not pinpoint persons, but devices. So it remains upon the complainer in the case of a copyright infringement case to present a further reasoning 'above the speculative level' that the by the IP identified device at the time of the infringement was under the control of the alleged infringer.

In this case they failed. That doesn't mean it will always fail.

If you're mobile ISP uses IPv6 for everything and assigned your mobile a static IPv6 address, then it will be harder to argue it wasn't you.

If you're Home router is provided and managed by your ISP, and it is configured to use DHCP Static Leases, then the local IP of your mobile phone (a fairly personal device) is close (not equal) to being equally as effective as a personal identifier as it's MAC.

If on the other hand you connected to an Open-Wifi set up by an amateur 4 NAT's down that does not keep logs, and you randomize your MAC every time you connect to a new network, it might be more difficult for tying an IP to your device without reasonable doubt.

In that last case if the pursuer wanted the open-wifi operator's operation could be made more difficult by DMCA complaints and leverage through the ISP's terms of service.

qoi2ijds0• 8 years ago

It usually points to a router, of which there can be hundreds of devices connected to it on your home network. Securing your wifi is one thing (which doesn't even absolutely prove that it was one of your home devices that did the torrenting, thanks to things like the KRACK attacks), but to then say "well you should secure your internal network such that torrenting cannot happen" is absolutely ridiculous. Torrent programs can work off any port, so that filters out port blocks. Is grandma going to install layer 7 traffic inspection so the grandkids can't doing illegal stuff on that newfangled interwebs? They'll switch to https then...

My point is that anyone with the technical know-how and very rudimentary internet access can bypass almost any restriction you try to put on it. What if the pirate is a minor and won't listen to their parents and keeps on torrenting? Do you permanently take their internet access away? How does that then stifle them for school homework or their social interaction? How can we expect each and every citizen to deploy NSA grade traffic monitoring on their router? The whole thing is ridiculous and the courts are still vehemently out of touch

PeterStuer4• 8 years ago

The article states that 'this is a win for privacy advocates and pirates'.

I'm not disagreeing, but I hope this will not re-open doors of trying to leverage this into getting IP addresses out of being privacy linked data in a privacy regulation context.

squirrelicus3• 8 years ago

When I was 18 or so a dozen years ago I had two detectives show up at my door (USA). Apparently my neighbor, with whom we were friendly, had connected to our wifi in order to try to hide his solicitation of a minor (luckily an FBI agent). They just stopped by to let us know trouble might be headed our way during the investigation and court proceedings. It was strange. They just left. Don't know if they ever contacted my dad about it further, but I do know he confessed to the whole thing.

magoon• 8 years ago

The content companies were so eager to settle out of court for just this reason; they knew that if enough of these cases went to court, a judgment against them results in case law that hinders their ability to strong-arm casual pirates.

saurik• 8 years ago

I am really curious how this would play out if the user had been running a Tor exit node.

US Court of Appeals: An IP address isn't enough to identify a pirate

Related Stories