Subject: Re: [v6ops] Google Alert - IPv6

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 08:08:51 +0100

Totally agree, however there is a subtle situation here, when we associate this to the origin of the thread … CGN

If an unlawful action has been done with that phone, the phone owner will be responsible in front of the law to identify the person who has go the phone. Otherwise, the courts will judge you as the author of the unlawful action.

Same as if you are the owner of a car that has an accident and don’t stop, unless you identify in and undoubtable way a third person driving the car, it will be your problem.

So, and this is what I was trying to point to the EU article 29 working party many years ago, even if you identify an IP address, it is almost impossible to say this is personal data, you need to correlate that with many many many other data, and even do, unless you have a live record of he/she being in front of the keyboard at that specific time.

However, the implications of CGN for the police is that, without a CGN, the owner for the phone that done that unlawful act (in EU you need to provide a legal ID to have a phone line) using that IP address, the identification is “direct”, no further investigation is needed and is the owner the responsible to identify a third party if that's the case. With CGN, if the IP address is shared and there are no source ports records, the investigation brings the police to a number of people, may be only 16, may be hundreds, which is a big issue.

Regards,
Jordi

-----Mensaje original-----
De: v6ops <[email-masked]> en nombre de Fred Baker <[email-masked]>
Responder a: <[email-masked]>
Fecha: miércoles, 1 de noviembre de 2017, 2:59
Para: DY Kim <[email-masked]>
CC: v6ops list <[email-masked]>, Tore Anderson <[email-masked]>, Dave O'Reilly <[email-masked]>
Asunto: Re: [v6ops] Google Alert - IPv6

    I think that misses the point. If you identify yourself to the phone, it knows that you are holding it. You might then pass it to someone else, who uses it. The phone doesn't know who is holding it, only that you unlocked it.
    
    But that's not the point. The point is that someone *else* observing your phone's traffic or location data makes the assumption that the phone is with or being used by you. You didn't present your fingerprint to them; they are observing after the fact and making inferences.
    
    Now, as an investigative tool, that makes sense - in a high percentage of cases, the person using your phone is you. So they can use that as a working assumption in the conduct of an investigation. But the working assumption doesn't prove anything, it only gives hints that have to be further verified to turn into proof.
    
    > On Nov 1, 2017, at 5:47 AM, DY Kim <[email-masked]> wrote:
    > 
    > When unlocking your smart phone, you might use the ‘finger touch’ identification, in which case the device use might identify the individual.
    > 
    > When a password or swipe pattern is used, the association might be weaker since those could be stolen.
    > 
    > ---
    > DY
    > 
    >> On 1 Nov 2017, at 10:42, Mark Smith <[email-masked]> wrote:
    >> 
    >> There really needs to be something else that supports or proves use of a device other than an assumption that an IP address is tightly coupled to a device's owner, and therefore all actions associated with an IP address are those of the device's owner.
    > 
    > _______________________________________________
    > v6ops mailing list
    > [email-masked]
    > https://www.ietf.org/mailman/listinfo/v6ops
    
    _______________________________________________
    v6ops mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/v6ops

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.consulintel.es
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 01 Nov 2017 18:32:31 +1100

In message <[email-masked]>, JORDI PALET M
ARTINEZ writes:
> Totally agree, however there is a subtle situation here, when we
> associate this to the origin of the thread  CGN
>
> If an unlawful action has been done with that phone, the phone owner will
> be responsible in front of the law to identify the person who has go the
> phone. Otherwise, the courts will judge you as the author of the unlawful
> action.

Please cite the relevent law.  Phone are hacked all the time.  Phones
are shared all the time.  There is only ever a strong correlation
never absolute proof.  For proof you need other data.

> Same as if you are the owner of a car that has an accident and dont stop,
> unless you identify in and undoubtable way a third person driving the
> car, it will be your problem.

Cars get stolen all the time and sometimes the first you know about
is a knock on the door.  The owner of the vehicle is just the first
step in the investigation.  Things like a speeding fine may get
lumbered on you but failure to stop requires more that you are the
owner of the vechicle to be proven.

> So, and this is what I was trying to point to the EU article 29 working
> party many years ago, even if you identify an IP address, it is almost
> impossible to say this is personal data, you need to correlate that with
> many many many other data, and even do, unless you have a live record of
> he/she being in front of the keyboard at that specific time.
>
> However, the implications of CGN for the police is that, without a CGN,
> the owner for the phone that done that unlawful act (in EU you need to
> provide a legal ID to have a phone line) using that IP address, the
> identification is direct, no further investigation is needed and is the
> owner the responsible to identify a third party if that's the case. With
> CGN, if the IP address is shared and there are no source ports records,
> the investigation brings the police to a number of people, may be only
> 16, may be hundreds, which is a big issue.

Only if you are looking at single events.  Multiple events will
probably whittle the set down to a subscriber.  That doesn't
necessarially identify a individual.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 08:53:05 +0100

I’m not a lawyer, but I can tell this are the facts in EU, in general. I’m sure you can google for that.

If the phone has been hacked or the car stolen, your lawyer will need to prove that it was the case. If you know who hacked your phone you lawyer need to prove that, police may believe you and do the investigation by themselves but it they don’t find a way to prove that … it is your problem, unless you have an irrefutable alibi.

I’ve a case recently (and this happened many times in Spain). A company car drove by one employee was exceeding speed limit in 10 Km/h (100 euros fine). The fine comes to the company. Company has 10 days to identify the driver, and did that. The driver denies it. If you don’t have a way to prove that he is lying, you now pay the fine, plus 600 additional euros because the law assumes that you tried to cheat them. So, unless the driver voluntarily recognizes it, or you have a record signed by the person taking the car, you’re lost (because you made the mistake to provide the car to an employee, friend, thief, without actually having a record for that).

There are plenty of cases that a car is stolen to do something wrong, and unless you prove that you were at that time in another place, your lawyer need to defend you. Just consider if you were sleeping alone and the car was stolen during the night, and the bad thing happened during the night, but you only claim to the police for the stolen car in the next morning … How you prove that actually was not you?

Note that I fully agree. IP is not personal data (and I tried to argue about that many times), but law says so in EU (not sure in other countries/regions).

Regards,
Jordi

---

From: Lee Howard <[email-masked]>
Date: Wed, 01 Nov 2017 10:07:04 -0400

On 10/29/17, 8:32 PM, "Dave O'Reilly" <[email-masked]> wrote:
>
>> 
>> 
>>> Can we regulate our way out of this problem?
>>> ——————————————————————————————
>> 
>> Probably not. Countries with the highest IPv6 deployment have had either
>> no government influence, or little more than government talking with
>> industry about their IPv6 deployment plans. Countries with IPv6 mandates
>> on industry seem to have very low actual deployment.
>> 
>
>I completely agree with you that there are too many regulatory models
>around the world for a recommendation of regulatory solutions to this
>problem to be likely to meet with much success. However, Belgium has the
>highest IPv6 adoption rate on the planet according to
>https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-a
>doption&tab=per-country-ipv6-adoption and I understand that the reason
>for this is that the telecoms regulator in Belgium required that a
>maximum of (I think it was) 16 people can be sharing a single IP address
>on a CGNAT at any given time. I forget the exact figures but it was
>definitely a regulatory intervention.

My understanding, which is indirect, is that Belgian law enforcement and
telecom regulators sat down with ISPs and said, “Our reading of EU law
says CGN is illegal.” And ISPs said, “We have to do CGN, or turn off the
Internet, (or maybe increase Internet prices to buy IPv4 addresses).”  So
the regulators agreed to forebear enforcement of the no-CGN law unless
address sharing exceeded 16 users per address.

I have been unable to find this agreement in writing, though. That might
be intentional.

So, yes, I suppose it is regulatory intervention, but it’s not new
regulation, it’s a different inteprpretation than other EU member states
have of EU law. And it’s not a regulation, it’s an unwritten understanding
(or forebearance). 

I would welcome correction if my understanding is inaccurate our outdated.

>
>>> 
>>> 
>>> However, the obvious question to ask is - are the Belgian authorities
>>> catching any more criminals now that they have such a high adoption
>>>rate
>>> of IPv6? Has the problem of crime attribution due to CGNAT gone away
>>>for
>>> them, or does it actually require global adoption of IPv6?
>> 
>> The question is more like, “Are Belgian authorities catching more
>> criminals than other countries in proportion to their IPv6 deployment?”
>> They’re probably not catching more bad guys than they were before CGN,
>> they’re just trying not to lose ground.
>> And the answer is probably not good, because although Belgium has great
>> numbers on eyeballs, their IPv6 deployment on content sites is still
>>weak
>> (https://www.vyncke.org/ipv6status/detailed.php?country=be ).
>> 
>> 
>
>Exactly! So they can attribute domestic IPv6 activity to domestic IPv6
>addresses but the second IPv4 to IPv6 transition takes place they’re no
>better off than anyone else.

Do you mean IPv6 is no better than CGN for attribution, or do you mean
IPv6 is no better than native IPv4?

>
>>> 
>>> The role of the IETF in this
>>> ——————————————————————————————
>>> 
>>> Right from the front page of the IETF website: "The mission of the IETF
>>> is to make the Internet work better by producing high quality, relevant
>>> technical documents that influence the way people design, use, and
>>>manage
>>> the Internet.”
>>> 
>>> Large scale address sharing technologies present a challenge to the
>>> management of the Internet so that seems to fit right within the remit
>>>of
>>> the IETF to me. Correct me if I’m wrong...
>> 
>> Not entirely, but this seems more operational to me, and might be better
>> targeted as a recommendation for how to manage servers.
>> 
>
>Well, the IETF has already published such recommendations (RFC6302). The
>question is what, if anything, else the IETF can/should do.
>
>I wrote this document and I didn’t really know what to do with it, so I
>published it as an internet draft and have been trying to collect input
>on what/where the best places to progress the conversation are…and here
>we are.

I do think it has been a good discussion. You might propose it as a talk
at NANOG, RIPE, or whatever your local NOG is. Even better would be to get
in front of web server operators, but I don’t know whether or where they
meet.

Lee

>daveor

---

From: Tom Herbert <[email-masked]>
Date: Wed, 1 Nov 2017 08:09:41 -0700

> I’ve a case recently (and this happened many times in Spain). A company car drove by one employee was exceeding speed limit in 10 Km/h (100 euros fine). The fine comes to the company. Company has 1…
Jordi,

In California there was a proposal to equip garbage tracks with
cameras that would capture license plates and send them to law
enforcement for tracking. The ostensible rationale was to only track
criminals and that the information wouldn't be used to track otherwise
law abiding citizens. This plan, not unexpectedly, cause a huge
backlash because of privacy concerns. License plates are associated
with vehicles which are associated with owners. Tracking license
plates of personal vehicles is equivalent to tracking the whereabouts
of the owner or at least someone in their family or friends. In the US
at least, there's not a lot of trust in the government that it
wouldn't use such information for widespread surveillance of citizens.

> Note that I fully agree. IP is not personal data (and I tried to argue about that many times), but law says so in EU (not sure in other countries/regions).
I think this may contradict your example above. If a crime is
committed and the IP address traces back to my device then it's clear
that I'm going to be investigated at least as a person of interest if
not a suspect. So I personally have been identified by authorities via
IP address and it's now up to me to prove I didn't do anything wrong.
In this case, the IP address is personally identifiable information
because it was used to identify an individual.

Again, it is not within the definition of an IP address that it
doesn't identify individuals. Whether it does or not determined by how
they are used and assigned.

Tom

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 18:16:56 +0100

Hi Tom,

Not sure to understand what is a garbage track … Anyway, yes, laws unfortunately differ and sometimes too much from country to country. What I said apply to Spain, and I believe to most of the EU countries.

I wrote it wrong, let me rephrase it: “I fully agree that considering an IP as personal data is broken”.

Regards,
Jordi

-----Mensaje original-----
De: Tom Herbert <[email-masked]>
Responder a: <[email-masked]>
Fecha: miércoles, 1 de noviembre de 2017, 16:09
Para: Jordi Palet Martinez <[email-masked]>
CC: v6ops list <[email-masked]>
Asunto: Re: [v6ops] Google Alert - IPv6

    Jordi,

    
    
    Tom

---

From: Tom Herbert <[email-masked]>
Date: Wed, 1 Nov 2017 11:11:26 -0700

Jordi,

I meant "garbage truck".

> I wrote it wrong, let me rephrase it: “I fully agree that considering an IP as personal data is broken”.
Brokenness is relative. It seems that for LEA gleaning identity from
an IP address is a good thing. For someone very concerned about their
privacy, an IP address containing PII is a bad thing. I believe IETF
tries to be agnostic in such matters. Protocols and mechanisms can be
built with strong security and privacy without purposely building in
trap doors for regulatory authorities to exploit. But, neither does
IETF do much to prevent individual countries to regulate
communications within their jurisdiction.

Tom

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 19:21:07 +0100

Broken (in my opinion) in the sense of the EU privacy considerations.

They consider IP addresses as personal data, which is not. And this consideration has many implications and extra cost for operators, etc., as it implies further security measures to keep that data “safe”.

For LEA, IP addresses being personal data or not, has no difference, in the sense that rules that mandate the storage to be able to track criminals aren’t different one way or the other.

Saludos,
Jordi

-----Mensaje original-----
De: Tom Herbert <[email-masked]>
Responder a: <[email-masked]>
Fecha: miércoles, 1 de noviembre de 2017, 19:11
Para: Jordi Palet Martinez <[email-masked]>
CC: v6ops list <[email-masked]>
Asunto: Re: [v6ops] Google Alert - IPv6

    Jordi,
    
    I meant "garbage truck".

    Tom

---

From: Tom Herbert <[email-masked]>
Date: Wed, 1 Nov 2017 11:46:52 -0700

Jordi,

That might be an issue to take up with EU then. AFAICT an effort
illegalize CGNAT or limit the number of users behind a NAT address is
an attempt to put PII into IP addresses for law enforcement purposes.
This is policy, there's nothing inherent in IP protocol or addressing
architecture that prevents that. The article that Mark posted
(https://telsoc.org/ajtde/2015-04-v3-n1/a4) might demonstrate that
implementing such a policy is futile to achieving its underlying
goals.

Tom

---

From: "t.petch" <[email-masked]>
Date: Thu, 2 Nov 2017 12:59:54 -0000

----- Original Message -----
From: "Mark Andrews" <[email-masked]>
Sent: Wednesday, November 01, 2017 7:32 AM

>  JORDI PALET MARTINEZ writes:

Mark

UK law changed some years ago and introduced, or reinforced, the concept
of a Registered Keeper of a vehicle and, in some cases, they are legally
responsible, e.g. to say who was driving at the time an offence was
committed; if they do not oblige, then they are liable, and can and do
get convicted in a court of law.  It means that change of ownership must
be registered promptly which has led to a number of court cases.  As I
recall, this change in the law came about because too many people were
saying 'I cannot remember' and so prosecutions were failing.

The popular press is for ever referring to an IP address as
'identifying' who was doing what; while we may know better, most people,
doubtless some law enforcement agencies, do not.  As the use of the
Internet for crime grows, and people's losses mount, so I see this wish
to identify who did what when via an IP address growing ever stronger so
I think we will see changes to the law to identify who 'owns' an address
and who is then obliged to reveal data about its use at a given time.

On the other hand, prosections for criminal negligence against companies
fail, or are not even brought, because UK law has required individuals
to be identified as responsible, not the company, per se, as a legal
entity.  This has been the case for decades and this issue often
surfaces after a significant tragedy but the appetite for change seems
limited, so perhaps identifying people by IP address will go the same
way.

Either way, I think we need to keep abreast of developments in our
varous jurisdictions.

Tom Petch

---

From: Dave O'Reilly <[email-masked]>
Date: Thu, 2 Nov 2017 16:56:46 +0000

Totally agree with your assessment of the value of IP data - it cannot alone be used to identify an individual, and I don’t think you’d find many law enforcement officers anywhere who would disagree with that assessment. As I mentioned in the email I just wrote, even if the IP address identifies a specific device/endpoint (which it almost always doesn’t) that in no way attributes the activity of that device to a specific individual. 

HOWEVER: taken in the broader context of an investigation, IP address can play an important role in either pointing the investigation in a particular direction or corroborating evidence gathered from other sources.

daveor

> On 30 Oct 2017, at 02:41, Fred Baker <[email-masked]> wrote:
> 
> 
> 
>> On Oct 29, 2017, at 11:48 PM, Mark Smith <[email-masked]> wrote:
>> 
>> Geoff Huston's article on
>> 
>> Metadata Retention and the Internet
>> 
>> https://telsoc.org/ajtde/2015-04-v3-n1/a4
>> 
>> might be of interest.
>> 
>> "The Metadata Retention measures being considered in Australia make some sweeping assumptions about the semantics of IP addresses and their association with individual subscribers to the Internet. But are these assumptions warranted?"
> 
> In that context, the European Data Retention Directive (which has now been struck down by the European Privacy Court) and the activities by the "Five Eyes" in that regard, notably the US NSA, have been very much about metadata. I asked a Dutch agency representative once what their reason for lawful intercept in general and metadata capture specifically was, and he indicated "mapping criminal networks". They wanted to determine who spoke with whom, with a view to identifying members of a community, presumably an evil community.
> 
> I note that the European Privacy Court has (apparently) specified that an IP address is "Individually Identifiable Information", the kind of thing that might be discussed in https://tools.ietf.org/html/rfc7721. I have asked repeatedly what privacy folks think might be an IID below the application layer, and that is the one thing they have come up with. On the point, I would argue that data of that type is not *identification*, but it might be possible to correlate it with other information due to operational practice. To my mind, stomping out correlations is a game of whack-a-mole; someone that desperately wants to find a correlation will probably find something that mostly works for their purposes, even if they have to discard spurious correlations to do so. In my view, that's what we see here: we might be able to correlate an IP address with a computer or subscriber, but we can't stop people in a business or family from using each other's computers. It is at best an investigative tool, not proof of something in particular.

---

From: Dave O'Reilly <[email-masked]>
Date: Thu, 2 Nov 2017 16:58:54 +0000

Totally agree. As I mentioned in the email that I just wrote, even if the IP address identifies a device that is no indication of who was in control of that device at a particular time. Don’t forget that there are other possibilities, for example, that the device may have been remote controlled by e.g. malware - I think this point would be pretty well understood in the law enforcement community but I will review the draft and clarify this point if necessary.

Thanks,
daveor

> On 30 Oct 2017, at 09:03, Ole Troan <[email-masked]> wrote:
> 
> Hi Dave,
> 
>>> Major comment:
>>> 3) The document talks about identifying an individual, and in places a subscriber endpoint. What it does identify, is the _originating network_. What you get is the public interface address of the customer CPE. Which looks like a network from the inside.
>>> Make it very clear that this does not identify individual hosts. And it might be worth noting that traffic my enter the originating network from outside. E.g. through VPNs, TOR exits, shared WIFI and whatnot.
>>> 
>> 
>> Yes, I completely agree.
>> 
>> I do address this point in the -01 revision scope section:
>> 
>> "Clearly no single solution will address the problem of crime attribution on the Internet.  Load balancers, proxies and other network infrastructure may also, intentionally or as a side-effect, obfuscate the true source of Internet traffic and these problems will continue to exist with or without the presence of large-scale address sharing technologies (like Carrier-Grade NAT and A+P).”
>> 
>> I wanted to mention the point without getting dragged into details of all of the possible scenarios where an IP address does not represent an individual or subscriber endpoint (apart from CGNAT). I was of the opinion that there is a risk of trying to “boil the ocean” with a  document like this so I was trying to keep the focus as tightly as possible on the issues raised by CGNAT.
>> 
>> In light of this, do you think this needs to be more explicitly discussed or clarified?
> 
> I think that's fine.
> As long as you make it clear that:
> - the IP address _never_ identifies an individual.
> - it identifies a host, a source network, or the obfuscated result of a TOR gateway, VPN, another NAT, LB etc, etc...
> 
> But never, ever by itself an individual person.
> 
> Best regards,
> Ole

---

From: Dave O'Reilly <[email-masked]>
Date: Thu, 2 Nov 2017 17:01:40 +0000

Two questions getting slightly conflated here. 

1. Whether an IP address represents a specific device (it doesn’t in most cases) or individual (it doesn’t without corroborating evidence from some other source)
2. Whether an IP address is judged (legally) to be personally identifying information (it is, in the EU at least)

I don’t think I have much more to contribute on these points apart from what I have already put in the emails just sent.

daveor

> On 30 Oct 2017, at 14:48, Tom Herbert <[email-masked]> wrote:
> 
> On Mon, Oct 30, 2017 at 2:03 AM, Ole Troan <[email-masked]> wrote:
>> Hi Dave,
>> 
>>>> Major comment:
> Ole,
> I don't think this is something that can be part of the definition of
> an IP address, it's more of a desirable property of how IP addresses
> are assigned and used. For instance, a smartphone is given an IP
> address and technically identifies the host. But given that there is a
> likely one to one correspondence between personal device (and its
> address) to an individual user, the IP address of the device
> effectively identifies the individual or at least can be used with a
> little more information to do so. In this case, the IP address seems
> to be Personally Identifiable Information.
> 
> Tom
>

---

From: Dave O'Reilly <[email-masked]>
Date: Thu, 2 Nov 2017 17:07:09 +0000

All sorts of scenarios could still arise to challenge that assumption. For instance, a person could be forced to enter their credentials under duress. If you need to establish that a person was using a device at a particular time “beyond a reasonable doubt” you really need something like a statement from them that they were the only person to ever use their device and/or a statement that they had it in their possession at a particular time (i.e. wasn’t lost or stolen). All pretty standard stuff from a law enforcement point of view. 

That is all, of course, presuming you can associate an IP address with a specific device (you may have seen the recently published Internet Draft on crime attribution in cases involving large-scale IP address sharing :-))

daveor

> On 1 Nov 2017, at 01:47, DY Kim <[email-masked]> wrote:
>

---

From: Dave O'Reilly <[email-masked]>
Date: Thu, 2 Nov 2017 17:12:29 +0000

Tom, I have a question.

You say:
 
>> 
> Mark,
> 
> I think the point is that for privacy we _don't_ want IP addresses to
> identify individuals, but it is work to ensure that they don't. The
> fact that a device can be shared makes the coupling weaker, but
> probably not weak enough to be considered good privacy unless the
> population sharing the device is large enough to avoid statistical
> inference.
> 

I never understood this to be a design consideration of IPv4 (I don’t know about IPv6 but perhaps others could enlighten me?). In either case, is it the case that “we don’t want IP addresses to identify individuals”? Is it not more the case that the evolution of technologies on the Internet has, as a side effect, meant that IP addresses don’t identify individuals?

>> There really needs to be something else that supports or proves use of a
>> device other than an assumption that an IP address is tightly coupled to a
>> device's owner, and therefore all actions associated with an IP address are
>> thoe se of the device's owner.
> 
> I believe there is. It is common for apps, like email, social
> networking, etc. to login to a service with username and password.
> When login is done, the service now has a mapping of an individual to
> an IP address. That mapping could then be exploited to identify the
> same individual in completely unrelated communications, hence breaking
> privacy. This could be done external to the device and the network
> provider and across different jurisdictions. The problem is
> exacerbated if the app is always connected so that whenever the
> devices gets a new IP address to user mapping maintained by some third
> party is kept up to date. Also, in this case, randomizing addresses at
> some frequency may no provide much benefit to privacy unless every
> connection gets a different source address (which is effectively is
> what CGNAT gives).
> 

You don’t even need to log in to anything - isn’t this exactly how doubleclick et-al work? They drop a cookie on your browser and then follow you around the Internet on all sites with double-click banners? 

Same problem for any application layer identifying information - but also a bit beyond the scope of the CGNAT discussion...

daveor

---

From: Dave O'Reilly <[email-masked]>
Date: Thu, 2 Nov 2017 17:16:58 +0000

> On 1 Nov 2017, at 14:07, Lee Howard <[email-masked]> wrote:
> 
> 
> 

I know it was a regulatory intervention alright but I don’t know the details of the discussion, perhaps it is a voluntary code of practice. In either case, such interventions are unlikely to be broadly applicable as a solution to the crime attribution problem.

> IPv6 is no better than native IPv4?

What I meant was that at some point IPv6 to IPv4 translation will need to take place, which is essentially a form of large scale address sharing, similar but not identical to the CGNAT problem (similar enough to form part of this discussion in any case). Until IPv6 is ubiquitous and IPv4 is no longer routable this problem will remain to a greater or lesser extent.

> in front of web server operators, but I don’t know whether or where they

Good idea, I will investigate this further. I have been trying to find out how best to approach OWASP and the apache software foundation to try and get the discussion going with them at least. No success so far, but I’ll keep going.

daveor

---

From: Tom Herbert <[email-masked]>
Date: Thu, 2 Nov 2017 11:07:44 -0700

> I never understood this to be a design consideration of IPv4 (I don’t know about IPv6 but perhaps others could enlighten me?). In either case, is it the case that “we don’t want IP addresses to ide…

Dave,

It wasn't and isn't a design consideration of IPv4. However, it seems
to be an accidental side effect of NAT. With a large population of NAT
users behind a NAT address there is a strong decoupling between an
address and the device or individual associated with the device as
viewed externally.

That can be contrasted with some of the addressing concepts of IPv6
which entailed used stable identifiers based on a permanent MAC
address. In the absence of any mechanisms like NAT that obfuscate
addresses, addresses with stable identifiers allow unrelated flows to
be correlated to have come from the same source device. When the
device is a personal device, then the address can then be correlated
to an individual with some degree of accuracy that they are the user.
This issue is addressed in RFC4941 which randomizes interface
identifiers. RFC4941 allows an IPv6 address to be changed with some
frequency, but isn't really intended to give a different source
address per flow like NAT effectively does.

> You don’t even need to log in to anything - isn’t this exactly how doubleclick et-al work? They drop a cookie on your browser and then follow you around the Internet on all sites with double-click…
IIRC (I spent some time working in ads), cookies aren't used that way
any more since it's an obvious violation of privacy. There is need for
remarketing and cross device advertising, but the correlations can be
made within double-click system and not exposed to just any
advertiser. Companies such as Google obviously collect a lot of PII,
and it's clear that they have obligation and got to great pains to
protect it (grant it Equifax and others seem to be glaring failures in
protecting PII).

> Same problem for any application layer identifying information - but also a bit beyond the scope of the CGNAT discussion...
Right, but similar to security, if we want to build a system that has
good privacy characteristics then privacy at every layer, even
networking layer, should be considered.

Tom

---

From: Ole Troan <[email-masked]>
Date: Thu, 2 Nov 2017 22:02:23 +0100

Dave,

> Totally agree. As I mentioned in the email that I just wrote, even if the IP address identifies a device that is no indication of who was in control of that device at a particular time. Don’t forge…

Thanks that would be appreciated.
It doesn't appear to be equally well understood in e.g. the copyright industry, so it is worth making this point very clear.

Best regards,
Ole

---

From: Mark Smith <[email-masked]>
Date: Fri, 3 Nov 2017 08:07:18 +1100

On 3 Nov. 2017 3:56 am, "Dave O'Reilly" <[email-masked]> wrote:

Totally agree with your assessment of the value of IP data - it cannot
alone be used to identify an individual, and I don’t think you’d find many
law enforcement officers anywhere who would disagree with that assessment.
As I mentioned in the email I just wrote, even if the IP address identifies
a specific device/endpoint (which it almost always doesn’t) that in no way
attributes the activity of that device to a specific individual.

HOWEVER: taken in the broader context of an investigation, IP address can
play an important role in either pointing the investigation in a particular
direction or corroborating evidence gathered from other sources.

I doubt anybody here disagrees with that.

The concern I have is that LEAs adopt a view that because address sharing
is not necessary in IPv6, an IPv6 address becomes believed to be
indisputable and absolute evidence that a particular individual who owns
the device assigned that IPv6 address is the person responsible for all
actions committed using that IPv6 address. I think the fundamental human
desire for doing the least possible and making your evidence collecting job
as easy as clicking a mouse button a few times makes that a risk.

Regards,
Mark.

daveor

>> "The Metadata Retention measures being considered in Australia make some
sweeping assumptions about the semantics of IP addresses and their
association with individual subscribers to the Internet. But are these
assumptions warranted?"
>
> In that context, the European Data Retention Directive (which has now
been struck down by the European Privacy Court) and the activities by the
"Five Eyes" in that regard, notably the US NSA, have been very much about
metadata. I asked a Dutch agency representative once what their reason for
lawful intercept in general and metadata capture specifically was, and he
indicated "mapping criminal networks". They wanted to determine who spoke
with whom, with a view to identifying members of a community, presumably an
evil community.
>
> I note that the European Privacy Court has (apparently) specified that an
IP address is "Individually Identifiable Information", the kind of thing
that might be discussed in https://tools.ietf.org/html/rfc7721. I have
asked repeatedly what privacy folks think might be an IID below the
application layer, and that is the one thing they have come up with. On the
point, I would argue that data of that type is not *identification*, but it
might be possible to correlate it with other information due to operational
practice. To my mind, stomping out correlations is a game of whack-a-mole;
someone that desperately wants to find a correlation will probably find
something that mostly works for their purposes, even if they have to
discard spurious correlations to do so. In my view, that's what we see
here: we might be able to correlate an IP address with a computer or
subscriber, but we can't stop people in a business or family from using
each other's computers. It is at best an investigative tool, not proof of
something in particular.