Re: [v6ops] Google Alert - IPv6

[Mikael Abrahamsson <[e-mail]>]

On Thu, 19 Oct 2017, Tore Anderson wrote:

> * Mikael Abrahamsson <[e-mail]>
>
>> If they do have a port, then LEA can have a single subscriber.
>
> Reading the original article (linked below) I am left with the feeling
> that the problem is that they generally *don't* know the source port,
> and therefore end up, quote, «[unable] to identify internet subscribers
> on the basis of an IP address».
>
> https://www.europol.europa.eu/newsroom/news/are-you-sharing-same-ip-address-criminal-law-enforcement-call-for-end-of-carrier-grade-nat-cgn-to-increase-accountability-online
>
> The article proceeds to define «CGN» as «technologies which allow
> sharing of IPv4 addresses with multiple internet users». In that
> context, MAP, even though it is not technically CGNAT, is just as
> problematic (to answer Rajiv).
>
> C'est la vie! If Europol don't like IP address sharing, I think the
> only thing they actually could do about it would be to put pressure on
> regulators and/or lawmakers to accelerate IPv6 adoption. I understand
> that's what already happened in Belgium with impressive results.

So I have no idea what's really going on here, but I can imagine someone 
doing CGN and just NATing people left and right, and not logging anything. 
Then it's near impossible to find who did what.

At least when I looked into this issue, the message I got back was that 
narrowing down the user list to a few tens of subscribers was still vastly 
better than no information at all. Of course LEAs don't like it, but it's 
a lot better than nothing.

Also, services who are typically involved in being targeted for crimes 
should start logging the source port of whoever is talking to them. This 
option is available in most web servers and has been for a considerable 
amount of time.

Mandating IPv6 is a hard sell. Mandating ISPs to log what subscriber 
accounts was behind an IPv4 address at a given point in time including 
port used by what account, that's less far fetched.

-- 
Mikael Abrahamsson    email: [e-mail]