Re:A Digital Rumor Should Never Lead to a Police Raid
by wmf on Thursday September 22, 2016 @06:35PM
(#12560906)
Taking all of that as given... when law enforcement sees illegal activity from an IP address, what are they to do? Use a search warrant to gather more specific evidence? Or just give up?
Re:A Digital Rumor Should Never Lead to a Police Raid
by AnthonyMouse on Thursday September 22, 2016 @06:54PM
(#12561019)
That is a false dichotomy. They can gather some better evidence in ways other than executing a raid on a probably-innocent party.
Re:A Digital Rumor Should Never Lead to a Police Raid
by jessaustin on Thursday September 22, 2016 @11:31PM
(#12562129)
...especially when their favorite form of "raid" is busting doors at 5:30 AM, shooting dogs, and shoving guns in children's faces. If the preference were, rather, to wait until a suspect left for work, detain her when she got to the sidewalk, have her call the house and arrange for all remaining residents to take a walk, and then enter the residence in non-destructive fashion, all sorts of speculative policing might be better justified.
Re:A Digital Rumor Should Never Lead to a Police Raid
by AnthonyMouse on Friday September 23, 2016 @12:08AM
(#12562241)
Not only that, notice that the tenuous thing is the link between the IP address and particular a person or endpoint location. You have the IP address, get a warrant to wiretap the IP address.
See if the illicit traffic to that IP address is really going to that residence. See if the traffic pattern looks like the traffic going in is coming right back out and being relayed somewhere else. Put a van full of government WiFi hardware on the street in front of the building and if the relevant traffic correlates to traffic to a wireless device, triangulate the exact location of that device and see whether it's actually inside the residence. See if anything at that IP address is in communication with C&C servers that imply it has been compromised.
Any of which can be done without shooting a single innocent dog.
That isn't the source of the uncertainty though. It's part of it in the sense that cost-cutting ISPs may have inaccurate records, but the fundamental issue is that IP addresses are completely unauthenticated.
Some people turn off their modems when they're not using them. One way to steal internet service on some ISPs is to clone the MAC of your neighbor's cable modem (and then the ISP thinks you're them).
People have guests who use their WiFi. Some people use WEP, or weak passwords, or are just nice people who intentionally leave their WiFi open for public use.
Anyone who controls (or compromises) a router can spoof any IP address that routes through it. Same with compromised client devices that can be turned into proxy servers.
Even so, the probability that any given traffic is actually from the person whose name is on the bill is still pretty good, unless that traffic is illegal. Because people engaged in illegal activity have the incentive to do one of those things or any of a hundred other ways to get an IP address not tied to your name.
And it isn't that hard to do those things. Which means there is a high probability that an IP address associated with illegal activity belongs to an innocent party rather than the perpetrator.