Re: [v6ops] [SUSPECTED SPAM] Google Alert - IPv6

[Dave O'Reilly <[e-mail]>]

Totally agree with your assessment of the value of IP data - it cannot alone be used to identify an individual, and I don’t think you’d find many law enforcement officers anywhere who would disagree with that assessment. As I mentioned in the email I just wrote, even if the IP address identifies a specific device/endpoint (which it almost always doesn’t) that in no way attributes the activity of that device to a specific individual. 

HOWEVER: taken in the broader context of an investigation, IP address can play an important role in either pointing the investigation in a particular direction or corroborating evidence gathered from other sources.

daveor


> On 30 Oct 2017, at 02:41, Fred Baker <[e-mail]> wrote:
> 
> 
> 
>> On Oct 29, 2017, at 11:48 PM, Mark Smith <[e-mail]> wrote:
>> 
>> Geoff Huston's article on
>> 
>> Metadata Retention and the Internet
>> 
>> https://telsoc.org/ajtde/2015-04-v3-n1/a4
>> 
>> might be of interest.
>> 
>> "The Metadata Retention measures being considered in Australia make some sweeping assumptions about the semantics of IP addresses and their association with individual subscribers to the Internet. But are these assumptions warranted?"
> 
> In that context, the European Data Retention Directive (which has now been struck down by the European Privacy Court) and the activities by the "Five Eyes" in that regard, notably the US NSA, have been very much about metadata. I asked a Dutch agency representative once what their reason for lawful intercept in general and metadata capture specifically was, and he indicated "mapping criminal networks". They wanted to determine who spoke with whom, with a view to identifying members of a community, presumably an evil community.
> 
> I note that the European Privacy Court has (apparently) specified that an IP address is "Individually Identifiable Information", the kind of thing that might be discussed in https://tools.ietf.org/html/rfc7721. I have asked repeatedly what privacy folks think might be an IID below the application layer, and that is the one thing they have come up with. On the point, I would argue that data of that type is not *identification*, but it might be possible to correlate it with other information due to operational practice. To my mind, stomping out correlations is a game of whack-a-mole; someone that desperately wants to find a correlation will probably find something that mostly works for their purposes, even if they have to discard spurious correlations to do so. In my view, that's what we see here: we might be able to correlate an IP address with a computer or subscriber, but we can't stop people in a business or family from using each other's computers. It is at best an investigative tool, not proof of something in particular.