A Digital Rumor Should Never Lead to a Police Raid
eff.org
eff.org
It is perfectly logical to say that if there was an assault on a college campus and that the victim said the perp is an "Asian male", for the police to not prioritize the questioning of all non-Asians in the area. And if the report was made within minutes of the incident and the suspect is on foot, it may be justifiable to target the 5 Asian males loitering around rather than the 95 people of other demographics. What logical person would argue otherwise?
But the problem creep comes in the many, many cases when police don't have a threshold for how long and wide that demographic descriptor should be used. Within 1000 feet of the reported attack? A mile? Why not 2 miles? And why not 2 days or even 2 weeks after the incident, just to be safe?
The main difference in the ISP/IP metaphor is that in the digital world, it's possible to imagine search-and-question tactics that aren't time-consuming for the police or for the suspect. Hell, the suspect might not even know their internet-records were under any suspicion. OTOH, there are definitely real-world places in which for the police (and their community and most specifically the politicians), hand-cuffing and patting someone down has been so streamlined and accepted by the powers-that-be that it isn't a bother for them (the police) either.
edit: To clarify, I don't mean to get in the very wide debate on racial profiling, etc. But when I worked at a newspaper, we had a policy to not mention race unless the police could provide 4 or 5 other identifiers. That led to readers cussing us out because, they'd argue, knowing that the suspect was black is better than nothing. My point here is that sometimes, nothing is not always better than something, and that is most explicitly clear when it comes to broad IP range searches.
It's hard to construct a principled, narrow argument against profiling. If you have a single piece of exclusionary information, it's ludicrous to conduct a bunch of searches which are guaranteed to be worthless in the name of equality. (Leaving aside the accuracy of the tip for now.) And yet on a broader level, it's apparent that profiling can have all kinds of awful side effects.
An obvious example (and the metaphor carries) is secondary crimes discovered in the course of an investigation. There's another narrowly sensible rule: if a cop stops you for a broken taillight, they shouldn't have to ignore a corpse sitting in your passenger's seat. But combined with profiling, it produces a system where often-profiled people get the law enforced against them far more harshly than other groups. Add to that the cost and stigma of being investigated (a day in jail while innocent is a great way to lose a job), and you have a system where utterly sensible enforcement produces consistently biased harms.
The metaphor here carries really well. Imagine if those Kansas farmers torrented a bunch of movies, or that Seattle privacy advocate had a bit of marijuana. Well, those things are illegal, but it's still not fair that shoddy profiling amounts to selective enforcement against the profiled.
Even if you never, ever get incorrect data or wrongfully convict someone, profiling with limited data causes all kinds of secondary harms. This is a great non-racial example of why we should worry about it regardless of accuracy.
There are more than enough documented cases of rape, assault and other crime in which the victim could not identify the perpetrator with any degree of certainty.
Profiling is an important tool in law enforcement but it works when it's built on proper evidence and statistical models not sketchy witness reports.
I skipped accuracy to observe that even correct profiling has problems, but it's hugely important to see that over-reliance on profiling is a threat to solving cases.
The memory and facial recognition stuff starts here http://lawcomic.net/guide/?p=3034
The problem is that the main true benefit of the information is to exclude people, but that isn't how people use it.
Suppose there are 2 million people in an area and you know some demographic information about the perpetrator that will allow 95% of them to be excluded. That is useful information.
But the probability that a random person in the relevant demographic is the perpetrator is now 0.001%. The demographic contains 100,000 people and one perpetrator.
The fallacy is in assuming that just because not being in the relevant demographic is enough to exclude you, that being in the relevant demographic should by itself be enough to suspect you.
That's still a much higher probability than 1/(2 000 000) so I am not sure what is your point there to use numbers.
"Oh, to catch the thief we are going to stop 100000 people" sounds absurd, after all.
Of course you can use the clue to exclude a bunch of people, but were you going to go around arresting random people on the street without this? Of course not, so why do it after.
You hand-wave this part away too easily. It's precisely the reason that all protections in the legal system need to exist. If you hand-wave away uncertainty about facts, then there's no need to have warrants, reasonable suspicion, right to an attorney, trials, etc.
It also helps if you've ever been stopped by a police officer for any reason, such as a traffic stop. I've been on a couple of ride-alongs so I've also witnessed it from the officer side. When you hear of someone complaining about just being searched (as opposed to being beaten/arrested/shot), it can sound like whining. Unless you've been the target yourself and you've at least experienced how damn inconvenient it is (regardless of any racial motives from the officer). You really have to be the model of patience to go through that process and think, at the time, "Nevermind me being late, he's just doing his job!"
Imagine being stopped like that as a not-uncommon part of life, just because someone of your general descriptor did some assholish thing. Besides the search/frisk/force part, I think the most annoying thing is how hard it is to argue against that logic without sounding like a politically-correct whiner.
http://europeforvisitors.com/paris/articles/paris-gold-ring-...
(note in the link above, the writer says it happened to her 3 times in an hour. I had it happen one right after another, as if the second/third person didn't see me push the first one aside. So it's not just an Asian thing, I was just saying the rate that I perceived is how I empathize with being stereotyped at a quick glance)
There has to be a site somewhere listing them all.
I'd love to see a cultural narrative and expectational shift in the US, through which the act of simply arresting anyone at all is seen as a gross affront that only occurs on a preponderance of evidence of provable wrongdoing, else LEO is seen as having failed to do their job, serve their community, and are held accountable. A raise in the standards of policing that includes significant penalties for arrests that lead to dropped charges, no prosecutions, provable errors, etc. I also think we need to ban layering on charges like resisting arrest and other such nonsense that have become obvious tactical weapons in LEO misbehavior with citizens. We need a serious shift from automatically granting LEO the benefit of the doubt and nearly impenetrable immunity. Hell, treat it more like we treat politicians—term limits of wielding power and renewal via community review and acceptance of officers and their behavior. This would obviously be more difficult with federal LEO, but if we could change the local forces, perhaps that'd be a good enough start in people's lives.
The more recent example would be NextDoor, who learned the same lesson and experienced the same accusations:
http://www.nytimes.com/2016/05/19/us/website-nextdoor-hears-...
By definition every investigation technique is designed to be discriminatory in the proper sense of the word since you discriminate using the evidence you have so far.
There have been way to many discussions with one side claiming using certain kinds of evidence is unethical, and another side claiming the evidence does have some statistical power.
As far as I'm concerned most of those issues would be resolved if people actually cared to check they had a probable cause before doing anything, most objectionably evidence fails that test, and if it doesn't it shouldn't be ignored.
Telling someone to ignore the fact that group X is Y% more likely to commit a crime is very unlikely to work (since purposely ignoring something is somewhat contradictory). You'd likely get better results by asking someone why they did something despite lacking sufficient evidence.
It's from the UK, which I know has a very different situation to the US for race relations, but after 10 years of reform of the stop and search laws (to reduce racism and needless profiling) the UK recently found 25% of all stops illegal. One of the reforms required the police to record the reason for a stop - they either hadn't recorded anything or it was inadequate for 1 in 4.
Given the hugely higher number of stops of minorities, it's easy to see that they'd be identified in more crime - stop 10x more people of a group and you'll find more weed etc.
What hasn't been shown yet is evidence it's an effective crime fighting tactic, and it's easy to see why it causes minorities to distrust the police.
That's an absurd analogy. An IP address isn't perfect, but it's far more specific than knowing the perp is an "asian male." What's the size of the universe of people who might have had the same IP address over a given period of time? A few?
No, it's not - one example the article lists is a Tor exit node.
There's only just under 4.3 Billion IPv4 addresses available. And you can write off a decent chunk of those as being not available for public use.
As of right now there are only 891 listed Tor Exit nodes.[1]
https://metrics.torproject.org/userstats-relay-country.html
http://www.foxnews.com/tech/2012/06/06/internet-grows-by-tri...
I am indeed guilty of ignoring details when indifferent.
In residential settings, there's a collation that whoever owns the router is likely to own the devices on the LAN - but there are also enough cases where this isn't true. Hotels, universities, cafes. Also, Tor exit nodes or people with compromised Wifi. I'm sure it's possible to come up with more scenarios. As for a statistical probability, no idea. Is 80% or 95% acceptable? I think that's EFF's argument, that there's still enough room for error.
Anyone can use my laptop and "have" the same IP as myself.
In truth, nobody "has" an IP address. A computer has an IP address. Who can tell who is using a particular computer at a given time just by looking at an IP address?
In that sense an IP address is a way, way more tenuous connection to a physical person than a description of (apparent) race and gender.
This is not to disagree with you per se, because I do see your edited clarification at the bottom, but one of the problems here is assuming that the eye witness is correct in labeling the individual as "an Asian male" (per your example). Perhaps this is not true. Perhaps he is a short male with black hair, but not necessarily Asian. Perhaps he has some other ethnicity and will actually be overlooked by the police because of the assumption that the witness/victim has labeled them accurately when this may not be the case at all. (I will add: People are also sometimes misgendered.)
The big difference being the cumulative nature of peoples' experiences. If the same police are repeatedly exposed to a disproportionate amount of crimes being performed-by(or accused) by a specific group, then it would only be logical for them to naturally stop/search that specific group more often. It's a game of numbers, and I see no reason for it to be demonized as much as it has been as some "systemic oppression". As long as the police don't falsify reports that exaggerate those numbers, and behave in a civil manner towards complying citizens, then it should be "okay".
Personally, I would say that profiling by race and gender alone is way to wide of a search-criterion. For all we know, the police are actually using other side-properties of the individuals in order to profile them more specifically, yet on the surface to others it appears crass and simply based off crude properties such as race/gender. I.e. it may even be a layered approach where they "back-off" when they hit a dead-end in their search through the "good indicators for being a criminal or have just committed a crime".
E.g.: Broken tail-light -> hiding face behind hoodie -> oh, well spoken individual that just lost a family-member, must be fine.
Or: Broken tail-light -> hiding face behind hoodie -> hmm's and haw's when asked to leave vehicle for DUI test -> acting aggressive -> etc.
Your post focused on the cumulative nature of the police experience, but completely neglected the cumulative nature of the minority's experience. Therefore I downvoted you.
Edit: Grammar.
The "accused" part is the whole point. If police accuse a particular group disproportionally on the basis that they accused them disproportionally in the past, then we have a problem.
And that seems to be the case with racial profiling- that it builds upon the misconceptions of the past and therefore perpetuates them into the future.
It's really a case of GIGO, "garbage" in this case being historically prejudiced, and therefore bad, data on who should be suspected.
Of course, as others said, if you suspect and so search a particular group disproportionally often you may reasonably expect to also charge that group disproportionally often, even if that group has the same amount of perps as every othe group (which you leave well enough alone).
Another objection: there's no good reasons for police to be un-civil, even if someone is not complying. If the citizen is being a bit difficult and the police office responds in kind you can bet the situation is going to get out of hand - and who knows where it will stop? And because it's the officer that has the clear upper hand in an aggression situation (they can call backups, and their backups can call backups -with armored cars) it's the officer that has to remember to put their personal feelings aside and be professional.
Also, cops aren't the only ones who have to deal with rude and unprofessional behaviour at work. Everyone learns to deal with that sort of thing and the best way is always to set your ego aside and avoid escalation.
It takes two to tango and all that jazz.
And a last objection: that's a crap (sorry) way to profile people. A kid with a hoodie talking trash to a cop is most probably a teenager trying to grow up -and failing, currently. Give them the time to succeed and go bust someone actually doing some harm. Everyone 'll be the better off in a world with more adults than juvenile idiots.
How often do you guess real perps go looking for trouble with the police? I'd guess, not very.
Modifications to vehicles here are mostly not permitted or have to be certified by an engineer, including engine modifications.
Now it is clear to anyone that say, a Nissan Skyline, is much more likely to be modified with non-permitted modifications than the station wagon taking the kids to school.
Yet there are many complaints from Skyline drivers that they are constantly being stopped and it's not fair treatment.
So the argument from one side is "We know these cars are often modified, so we use that information to inform who we stop for spot checks". The argument from the drivers is of course "I did nothing wrong so I shouldn't have to deal with constantly being pulled over".
The challenge for me is that both sides make sense, yet there is clearly downsides to cattering to either side too.
Without the informed stops you will get less illegal cars off the road, with the stops you incur on peoples privacy and ability to go about their day.
The unbiased solution would be to stop more cars but randomly. The Skyline drivers still get stopped just as often, but so does everyone else so they can't say it's unfair.
But that is dumb, and only really solves the problem of political correctness.
The other option is to just accept that more modified cars will get away with it for longer.
Now there are other options in this circumstance, like mandatory vehicle inspections each year for example.
But thisbone thought experiment really made me think deeply about racial profiling and how complex the issue really is, and how damaging it can be to the individuals being profiled.
To be clear, I think racial profiling is far too damaging to be a solution to anything. But I can see the logic path people take to get to it. Even if they do not make the next step to seeing the damage it causes.
>> We know these cars are often modified, (b)
Note that those are not the same: (a) means "of all cars modified, more are Nissan Skylines than station-wagons"; (b) means "of all Nissan Skylines many are modified".
Police officers will want to know whether (b) is true, so that they can decide whether stopping Nissan Skylines disproportionally often is justified.
Unfortunately, (b) really does not follow from (a). For instance, (a) is true even if there are 0 modified station-wagons and a single modified Nissan Skyline. If only a small fraction of Nissan Sklyines is modified, cops are going to have to stop many, many Skylines before they hit one of the few modified ones.
Even worse, the only way to know how many Skylines are modified is to check each and every one of them (or stop "enough" of them and extrapolate).
On the other hand, cops will want to catch any illegally modified car. So they have to wonder how many other modified cars they let slip by if they're going after Nissan Skylines more than other cars.
If the cops wanted (or were able) to do proper data-driven policing or whatsitcalled, they should make a list of all the types of car they found modified in a particular time period, count how many times each type was modified, divide by the total and go after the ones with the highest ratio, and that only if the ratio is "high enough"- which again depends on exactly how many cars were modified in that time period.
But of course, all this is hard to do and costly, so cops will go by instinct and probably apply unwarranted prejudice- and get very sub-optimal results.
I'm sure that if you follow US news at all, you heard about the looting and arson in Baltimore in the Spring of 2015. While the city was on edge in the wake of a citizen's death in police custody, there had already been some minor demonstrations and a brawl between protesters, baseball fans, and provocateurs downtown earlier in the month.
Then, on the day of the funeral held for the man killed in custody, word started to spread of plans for some sort of riot or mass havoc being planned later in the day. Later, authorities pointed to a digital "flyer" being passed around yet nobody investigating this outside of the police has found any source or initial copy of this flyer that dates before this was published in the media. Trust me, we looked.
In response to this alleged threat to public order, cops with riot gear and a freaking mini-tank showed up at a major public transit hub right as school let out. Transit was shut down and everyone was corralled into a small area next to a busy street and without a way home for hours.
Eventually, tensions got high enough that when the first pissed off teenager or whoever chucked a bottle or a rock, it didn't take long for others to join in. In the ensuing vandalism and arson, hundreds of thousands in damage was caused, people got hurt, the city was put under curfew for a week, and to this day, businesses and residents have suffered from the reputation gained (worsened?) that day.
Looking back, the part that really sticks out to me is how the whole thing was triggered (assuming you don't think it was a deliberate provocation) by some "social media flyer" that claimed some teens were planning to run around starting shit after school. This rumor summoned riot police, shut down transit, stranded loads of adults and teens alongside the road, and facing down a phalanx of police plus one armored tactical vehicle.
Would those shops and homes still been damaged or those stores been looted and burned in a wave of unrest without this rumor-inspired flashpoint? No idea. But it sure didn't help.
This reminds me of Ghost in the Shell: Standalone Complex: 2nd Gig, wherein a single actor causes an AI to rotate military forces within a refugee area, with the explicit intention of increasing anti-police sentiment among refugees.
The world is a stage and, without proper leadership, crowds will behave in ways they believe are allowed within the hard constraints of the social order. This is at the core of the BLM movement, and a pillar of the Occupy movement: police must not view themselves as separate from the policed. For cybernetic reasons as well as pathos ones. Otherwise, from the perspective of the social order, the distinction between the two is error.
The original commentator described a standalone complex. Copy cats without an original.
It is strange to tell someone you have likely never met that they have missed something, based on very little information provided to you. This might be a sign of a cognitive impairment on your part, or perhaps a broken worldview. I don't have time to discuss either of these points, but it may be helpful for you to consider why you believe you can "read the minds" of people over the Internet.
So back at ya with the mind reading.
When you're expecting a riot, concentrating a bunch of people together and removing any way for anyone to leave (even people not kettled couldn't leave due to transit being shut down I presume) sounds like you're trying to make a riot.
It sounds like they read the textbook on dealing with riots, but forgot to read the part where you're only meant to do it when people are actually rioting.
Great police work validated.
The people responsible for mob violence are the individuals in the mob.
Ultimately, sure, someone can get up in your face and yell at you and try to get you to throw a punch but ultimately, it's your job not to throw that punch. I get that.
But in terms of maintaining peace and preventing brawls or riots, you don't want to go out of your way to instigate them. In this case, on the strength of an alleged photo being passed around (again, nobody has a copy of this photo dated before it hit the news), you had riot police shut down transit and corral hundreds of teenagers for hours, unable to leave because you were worried that some teenagers were planning to start trouble.
Watching it all unfold was very frustrating at the time. Basically, the riot cops were there before there was a riot and where there likely wouldn't have been one until they rounded up these hundreds of people and kept them there for hours.
My point isn't that it's someone else's "fault". It's that digital rumors and overreaction to them can be counterproductive if the goal is to keep the peace and not escalate. Just as in my earlier analogy, if you eventually get fed up at the guy screaming threats in your face and punch him, sure, you were the one who threw the punch. But I don't really want to have the screaming guy on my payroll as a guy hired to prevent fights either.
edit: not the most modern or professional blog out there but these guys have a pretty accurate timeline of the whole thing before the national news showed up - https://baltimoreeclipse.wordpress.com/2015/05/01/the-battle...
> If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional... Yet EFF has found that police and courts are regularly conducting and approving raids based on the similar type of unreliable digital evidence: Internet Protocol (IP) address information.
I'm not sure that these two are equivalent. A better example would be the police raiding my home based on an illegal phone call that came from my phone number. Sure, the fact that it comes from my phone number doesn't mean I did it, but it's certainly evidence that points to me, just as an IP address can be.
In general, the summary linked to above makes it sound like police should never use IP addresses. To be fair, if you read the whitepaper itself, it doesn't say this, but rather that police should be _careful_ in how they use IP addresses. Specifically, it recommends that police "conduct additional investigation to verify and corroborate the physical location of a particular decive connect to the Internet whenever police have information about an IP address’ physical location, and providing that information to the court with the warrant application".
That's broadly overestimating the reliability of IP addresses, though. Consumer IP addresses change on a random basis, based on whatever obscure policies an ISP has set up at the time.
Police get the physical address from the ISP. The ISP knows which IP was assigned to each customer at any particular time because they log it. Yeah, it's theoretically possible they don't keep the logs, but IRL they always do.
That isn't the source of the uncertainty though. It's part of it in the sense that cost-cutting ISPs may have inaccurate records, but the fundamental issue is that IP addresses are completely unauthenticated.
Some people turn off their modems when they're not using them. One way to steal internet service on some ISPs is to clone the MAC of your neighbor's cable modem (and then the ISP thinks you're them).
People have guests who use their WiFi. Some people use WEP, or weak passwords, or are just nice people who intentionally leave their WiFi open for public use.
Anyone who controls (or compromises) a router can spoof any IP address that routes through it. Same with compromised client devices that can be turned into proxy servers.
Even so, the probability that any given traffic is actually from the person whose name is on the bill is still pretty good, unless that traffic is illegal. Because people engaged in illegal activity have the incentive to do one of those things or any of a hundred other ways to get an IP address not tied to your name.
And it isn't that hard to do those things. Which means there is a high probability that an IP address associated with illegal activity belongs to an innocent party rather than the perpetrator.
See if the illicit traffic to that IP address is really going to that residence. See if the traffic pattern looks like the traffic going in is coming right back out and being relayed somewhere else. Put a van full of government WiFi hardware on the street in front of the building and if the relevant traffic correlates to traffic to a wireless device, triangulate the exact location of that device and see whether it's actually inside the residence. See if anything at that IP address is in communication with C&C servers that imply it has been compromised.
Any of which can be done without shooting a single innocent dog.
Simply making a phone call is not illegal even in the case where that phone could trigger an explosive device.
Remember the phone companies are immune from prosecution in these cases because they're a common carrier, something that also applies to internet service companies now.
I don't know much (or anything) about the prevailing criminal justice philosophies among the judiciary but this sounds like a question that can only be answered by a thorough review of the criminal code and precedent. Wire fraud, for example, is one of those felonies that you can be guilty of in the process of committing other more serious crimes so obviously some components can be broken out of the larger crimes.
This resulted in Congress passing laws that made it illegal for radios to be capable of listening in on cell phone frequencies or being easily modified to allow them to do so.
It is likely that only similar widely publicized embarrassments and privacy violations of the rich and powerful will result in any meaningful legislative attempts to curtail the growth of the police state in the United State.
They clearly don't intend to do much about it unless they themselves are the victims of such abuses of power. As long as it's just "nobodies" or social or political outcasts who are the victims the police and surveillance aparatus, it's doubtful that much will change.
But meanwhile we now have a stupid law that prevents honest people from buying interesting radio hardware and makes it even less likely that we will ever have open cellphone baseband processors etc.
http://arstechnica.com/tech-policy/2011/04/fbi-child-porn-ra...
The one I'm familiar with is the Sarasota, FL incident, where a married couple was raided in the middle of the night in response to alleged child pornography. Their unit was in a condominium, practically on the edge of Sarasota bay, where various boats moor and dock. After further investigation, it was discovered that the traffic had originated from some guy in a boat using a high gain antenna. If I remember correctly, he had cracked their WEP key and illegally accessed their network to obtain nasty images, lots of them. The insecurity of WEP has been known about for a long time, presumably by LE too.
It is conjecture on my part, but a few things come to mind regarding alternative methods of investigation that may have avoided this. 1. Contact the ISP first (in this case I think it may have been Verizon). I remember Verizon having the ability to remotely reset router passwords, which possibly suggests the ability to remotely view associated client data, e.g. MAC addresses and hostnames and maybe even OS. This may have provided valuable clues. 2. Note the protocol used by the wireless router. 3. Wardrive a bit. 4. Maybe check for logs of any accounts the boat guy logged into while on their network.
Regardless, the raid was botched and pretty traumatic for the couple, considering they were operating a legal AP probably secured with what they thought was adequate encryption. At the time of this event, WEP was standard default, straight from the ISP. They'd done nothing wrong.
More info: http://www.heraldtribune.com/news/20110131/wireless-router-h...
1 https://www.wired.com/2014/06/feds-seize-stingray-documents/
Perhaps they should not explain and make decisions which can have devastating effects on "techy stuff" they don't understand?
> If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional.
> Yet EFF has found that police and courts are regularly conducting and approving raids based on the similar type of unreliable digital evidence: Internet Protocol (IP) address information.
When police go after an IP address, it happens after there is evidence linking it to some crime. That makes the situation wholly unlike an anonymous phone call, where there is no evidence a crime has even been committed, and where the identifying information itself is trivial to falsify.
Also, IP addresses give a lot more information than the article implies. Especially these days now that everyone has a home router that probably keeps the same IP address for weeks at a time if not months. Not enough to trigger a police raid, of course (if we want to argue that the police have too low a standard of evidence for initiating a raid, I agree) but it's probably a good lead to go on in the common case.
EDIT: I don't disagree with the rest of the article.
This is the one thing that irks me the most, I don't expect law enforcement to understand the technical side of things but this is just a complete failure to do good old fashioned police work. If a judge was asked to sign a search warrant predicated around the results of a homemade drug test tutorial on Wikihow there's no chance that they would ever consider granting it yet when the same thing is asked in regards to an IP address somehow that passes muster.
At a minimum, police should be required to contact the IANA to figure out which AS an IP belongs to and then contact the AS to figure out what the service address is for the customer. Academia is built around citing any kind of source information, why is that too much to ask for from law enforcement?
Ideally, law enforcement would contact IANA to get the AS, look and verify that that AS was the only one advertising that IP block at the time in question, get the serial number of the modem in question from the AS if the subscriber is using a DOCSIS modem, go to the service address and confirm that the modem is actually present at the service address by doing a disconnect at the road, and then execute the warrant. I get that most of this is pie in the sky wishful thinking, but omitting any of those steps could result in raiding an innocent person needlessly and a lot of those steps could be executed concurrently. Heck, you could also throw in looking for signs that the IP address in question is being used as a Tor node or any other simple proxy and sniffing wireless traffic and trying to correlate the timing of wireless frames to the traffic from the modem in question. You could even do the wireless sniffing at the same time you go out to verify where a modem is on the node.
Even though this would be extra work for law enforcement, wouldn't it be worth it many times over if it just saves a small proportion of innocent citizens from a dangerous police raid?
Some might argue that that's how it should be, and is an example of the effectiveness of prosecutors, who save the state a lot of trouble and money in trying people who clearly are guilty by their own admission.
Others might call it a travesty of justice, and a mockery of the judicial process and the Constitution of the United States.
Remember the case of Aaron Schwartz.
It's also a good example as Schwart'z case is widely considered a blatant prosecutorial abuse of power, and symptomatic of a broken judicial system.
..., break down your front door in the middle of the night, shoot your dog or someone from your household, throw in flash grenades... You know simply ruin your life.
The EFF's problem is when IP information, as with an anonymous phone call, is used to spur action without enough additional evidence. This is the anecdote they cite in their whitepaper:
http://fusion.net/story/287592/internet-mapping-glitch-kansa...
edit: I responded to someone who clearly pointed out that I misunderstood raynier's argument. The comment was deleted by the time I hit Reply, but here is my reply:
I now agree that I'm at fault for short-shrifting raynier's argument. The whitepaper also includes up on top a story of a place being raided for being a Tor node, which may feel similar to the vagueness of justification that comes from a anonymous phone call, but that's not completely analogous either.
Perhaps the closer analogy would have been SWATting, but I don't think law enforcement supports that as a practice (because it's a result of them getting actively deceived). But I feel that's part of the EFF's overall point: SWATting is clearly a bad thing, whereas the specious reasoning the police sometimes uses to justify a raid based on IP information is not scrutinized enough, because of general tech ignorance.
Shouldn't it depend on the action? An IP address alone would not justify going to the location it was assigned to and arresting, charging, and holding in jail until trial the person(s) found there.
However, if the action is just to get a search warrant to search that location for more evidence, that seems OK to me. With nothing else other than that the IP address was used for some criminal activity, that is pretty good evidence that something related to the crime took place at the location the IP address was assigned to at the time.
If you've been following some of the recent stupidity police have opted repeatedly to just use some sort of resource to correlate ip address to physical location. This could be because this provides instant gratification or because they lack enough evidence as of yet to even justify THAT warrant.
As an example one such resource used to list a single coord for all unknown addresses in the US. This led to parties at that address dealing with hundreds of cases of unpleasant police contact wherein each officer individually learned that this address wasn't the center for criminality on planet earth. Unfortunately this knowledge didn't percolate upward.
So we aren't dealing with just proxies, tor exit nodes, open networks, many users connecting to the same router and other relatively complex matter. We are dealing with the fact that the police can't even be bothered to confirm with the ISP which customer even had that address at a given time.
In that context, without an initial warrant to gather the most basic of information IP addresses rarely are sufficient for anything at all except further research.
So you believe based on nothing more than your IP address showing up connected to alleged criminal activity, the police should be allowed to batter ram your door at 3am, shoot your dog dead, detonate explosive in your living room, and potentially kill you if you are not fully awake instantly and follow their commands to the letter with perfect accuracy?
Because that is how the US Police force "serves" a search warrant in 2016.
If I'm looking into an internet-related crime, the IP address of the offender is gonna be one of the first things I look at. Can someone falsify it? Yes. But not every offender _will_ falsify it, and so it's useful information to at least look into further, even if IP address by itself shouldn't be adequate evidence for a police raid.
http://wspd.iheart.com/onair/scott-sands-50988/swat-team-rai...
1. http://arstechnica.com/tech-policy/2012/06/swat-team-throws-... 2. https://www.salon.com/2013/08/29/11_over_the_top_u_s_police_... 3. https://en.wikipedia.org/wiki/Swatting 4. https://www.techdirt.com/articles/20150805/19343431865/no-im...
I'll refrain from posting dozens more supporting links.
Fundamentally, there is no good answer to that. Both options can result in lives lost. One is an active shooter being allowed to continue killing freely, the other is sending police officers ready to deal and face lethal force.
Obviously no-knock raids on suspected drug-dealers are a different matter - those are unacceptable by any sane metric. But you include swatting in your list. Swatting generally involves a violent emergency where delaying for verification would cost lives.
For that case, all I think we can do is treat the swatters as people committing aggravated kidnapping or even attempted murder. They're attempting to send men to detain somebody at gunpoint.
It depends on how many outwardly hidden death rooms there really are and how often the existence of these rooms is revealed by anonymous phone calls. You don't need much of a ratio there for urgent action against false calls to create more harm than the hidden death rooms.
And it doesn't have to be a binary choice; upon receiving notification of a hidden death room, the police could choose to investigate cautiously rather than escalating to extreme force. This will likely still have the effect of reducing the number of hidden death rooms without much risk of shooting innocent people in a raid.
I wholly concur that a much greater burden of responsibility is needed. In so many situations, there is no substantial accountability and either someone's life or dignity is lost for no legitimate reason. Not good for citizen morale.
Absolutely. In fact - if swatting results in the death of a person, then the swatter should be charged with first degree murder.
The problem, however, is that the swatters are not always in the US, so even identifying the swatter can be quite difficult; let alone extraditing them.
Thus, the swat teams also need to, in one way or another, tone down their violent, no-knock raids.
In common law, if somebody is killed in the commission of a violent felony even if the death was unplanned, it's "felony murder". In most of the USA, "felony murder" is first-degree murder.
The following one was highly suspicious and looked like a hit done by a swat team covered as a 'mistake'.
The US has a several hundred billion dollar revenue generating illicit drugs market, and that doesn't happen without alot of involvement from US agencies.
http://abcnews.go.com/US/tucson-swat-team-defends-shooting-i...
I thought that was how SWATting worked - anonymous denunciation by untraceable phone call?
Just last week a home with 5 children was wrongly raided: http://www.denverpost.com/2016/09/14/swat-officers-raid-home...
Wrong house with Grandmother and Teen girl raided with flash-bang: http://reason.com/blog/2015/08/03/swat-team-liable-for-wrong...
This gamer was "Swatted" and the web cam caught it: http://reason.com/blog/2014/08/28/militarization-of-police-h...
This 1-year old baby was critically burned by a flash-bang grenade thrown into the playpen: http://www.cnn.com/2014/10/07/us/georgia-toddler-stun-grenad...
This is the EFF's article, which is either a highly overzealous or highly prescient: https://www.eff.org/deeplinks/2016/04/rule-41-little-known-c...
But they do this all the time, especially in low income areas. They just don't call it a raid. They call it a "welfare check".
Maybe today, but when we have wide deployment of IPv6 (heh), won't ISPs do away with NATing and give everyone their own block of IPs? Then I would think you could reliably tie a person to an IP address as long as the ISP cooperates.
Still, you can't tie an IP address to a specific person or computer, v4 has NAT to contend with and privacy extensions with v6 (which Microsoft and Apple use by default, most Linux distributions do as well) - so regardless if you can get the physical location where that IPv4 address or IPv6 prefix is assigned it does you no good on determining who was actually behind that address (unsecured wifi or easy to crack passwords, malware, the list goes on).
An unverified call can never to be trusted. Read the whole twitter thread by ex BPD, USMC Retd., Michael A. Wood Jr [0] to understand why.
[0] https://twitter.com/MichaelAWoodJr/status/778813281376931840
Isn't that exactly what happens when you get SWATted?
Cops have limited resources to deal with a number of problems and if they don't have the training and procedures to use internet evidence they are going to waste those resources tracking down stolen cars, child porn and whatever in the wrong places.
Then, we can simply look up the physical address of the IP address holder.
We already do this, but it's called the MAC address. And it can be used to trace back the piece of hardware to the purchaser.
Unfortunately it can't solve the problem for innumerable reasons. For one, it turns out to be pointless to route internet packets or police raids to the location of my computer, knowing it has a unique number (currently the MAC) that can identify it as made in China and sold in Virginia...Better to use the dynamically assigned address (currently IP) of my home router which, with a call to Comcast, can give you my physical address in Hawaii.
Of course that physical address might serve any of my neighbors, but then again my computer's MAC also serves any guest in my house that asks nicely to use my computer or anyone tech savy enough to clone it.
You can most certainly narrow down an IP address to a particular ISP customer. Is it possible that they have an open wifi? Yes. Is it possible to narrow it down to a single member of the household? Depends! Is it possible that a computer at the destination is being used a proxy by the real attacker? Yes! But it's certainly not the blackbox that the EFF is trying to portray it as.
It's totally appropriate to execute a search warrant based on IP logs. A search warrant doesn't mean that any particular person is guilty, just that there is probable cause that there is information about a crime at a certain location.
Well "A computer" could be any TCP/IP enabled device nowadays, including a router. So no, it's not reasonable to look at traffic coming from an IP, and say that traffic originated from the physical location of that IP, just because the LAN beyond that router is opaque.
I mean, several ISP IP addresses are involved with routing, but "everybody knows" they're shared machines. But again, simply because a trace route stops at a certain machine doesn't mean the routing actually terminates there - for most cases this is not true. It's just that the person behind the router with NAT often owns all devices on the LAN/opaque side. Using this correlation alone is dangerously inaccurate.
A search warrant leading to a malware infected machine is acceptable in my eyes. Again, tying traffic to a location is fine, as long as the correlation ends at the computer that originally appears to be the source of the traffic (even if it ultimately isn't) is all that is targeted until evidence can determine the individual behind it.
Search warrant for what? All TCP/IP enabled devices? Or the router? An IP address doesn't even uniquely identify a single device.
(Also given how search warrants are executed in the US and how long they can seize these devices for, I don't know if I'd say it's "acceptable". I'm in favour of setting the bar high to protect the innocent.)
I think you're going to have a hard time here convincing a jury or judge with this argument. In general LOE isn't concerned with the intentional of what an IP address was meant for. At least with today's ISP an IP address can be a reasonable approximation of a person or persons.
An IP address is merely an end point to some internet traffic. There's a nearly infinite number of reasons why traffic could originate from an IP that was not initiated by the current responsible party. Anything from hacked machines to clever redirects to shared IPs to just plain network trickery.
It is so ambiguous at this point that you can't even make an analogy that it is like a home housing a dozen people. Because even in that situation it just means there's n more devices that could've been hacked and they've shared their wifi with n more guests.
An IP address by itself should never be used for anything but starting an investigation. For a warrant it had better be surrounded by corroborating evidence.
And it's important to sometimes be skeptical, because if they use this argument in a trial and lose then it sets a precedent that can be used in future cases.
And the prosecuting attorneys have plenty of examples where IPs successfully led directly to the perpetrator of a crime. Think of all of the people who have been arrested and prosecuted for online crimes and took a plea bargain.
It's a very uphill battle. I wish the EFF all of the best luck (I myself am a contributor and believer), but I don't think they're going to make much progress with this one.