It’s incredibly irresponsible to take action against someone based on their IP address alone.
If you have an idea on how abusive actors behind CG-NAT can be identified and blocked without blocking the entire CG-NAT, and that idea is not morally unacceptable to the hacker community (as captchas, fingerprinting, and IP bans are), then you can make a billion dollars on that idea.
But it's been twenty years now that we've needed that idea, and I'm not holding my breath. Tech continues to insist that anonymity is more important than accountability. Our users pay the price of our insistence to this day.
I don't think a general solution would be required in this instance.
In this case, as I understand it, the abusive actors did the following:
1) tried to join with an abusive name
2) impersonated a student login and yelled abusive things in chat
It seems that (1) could be solved by blocking connections from any user name that is not on a whitelist of approved student names and nicknames, and (2) is most likely an issue of someone else accessing the student's login credentials, so it could potentially be mitigated by multifactor authentication.
It's also likely that there isn't a single person in a leadership position with the entire school board who is even slightly technically competent.
Next we already have precedent that IP addresses don't uniquely identify people for the purposes of law. It is incredibly likely that such an action wouldn't pass the sniff test if the IP addresses given were entirely correct.
Lastly even if he actually did try to log in with "i will murder u all of u" no reasonable person would consider this an actual threat without talking with the student. Kids are stupid, and kids say stupid things. Time and again schools fail to address the real problem children before things blow up and then use their persistent failures to justify overreaction to the detriment of students.
Suspensions like these are common, especially among black boys. I saw all sorts of overly punitive nonsense, not to mention that we had to queue up for an xray + metal detector every day we went to school. Really, really felt like you weren't treated with a shred of dignity.
If the school board knew that it had incriminating information, it could ask the family to waive its privacy rights, and then if that didn't happen, explain that, without violating any law.
The school admits to punishing this kid based primarily on his IP address. We all know this is utterly worthless. The technical details make it even clearer that this is unreliable.
Also, the teachers uniformly spoke of the kid as quiet, respectful, and studious. This should be worth far more than an IP address. It's not, because administrators consider the opinions of their own teachers to have no value.
AND, let me be blunt here!, even if the kid did do it, which I think highly unlikely, this is NOT an excuse to deprive him of an education!
---
For whatever reason, many people have this fetish for authority, even when that authority through their own words shows their unreliability.
I also think a lot of people respond positively to stories about cruelty and punishment.
Working with the carrier? Depending on the kind of abuse, it could very well be against the ISP's ToS, and the ISP hopefully doesn't want its users blocked wholesale just because of a few bad actors dragging down the reputation of its IP blocks.
I appreciate the theory that you’re sketching, and I think it certainly has potential. But we already have the theoretical capability you describe today, and have had it for decades, and yet online abuse continues unchecked — so you’ll have to talk more about how and why your recommendation improves on what we have today.
But companies like Zoom (as would be relevant in this scenario) might hold more sway, especially if the looming threat is "deal with this on your end, or we will, with the blunt instrument that is IP banning". (Now, whether Zoom would engage in an IP ban just for abuse affecting a single school is a different story. But I imagine they must have some motivation to deal with zoombombing. Right??)
The school itself might not have the resources to engage in a legal battle, but they could certainly get law enforcement involved, especially if the abuse enters, say, hate crime territory, as it seems like it may have in this case.
(Granted, the privacy concerns that you raise are an entire issue in themselves, and I don't have any answers there.)
To be clear -- this isn't a novel proposal, per se, unless talking to other people is novel :) But, it's just a suggestion that while circumventing CG-NAT is technologically infeasible from the outside, technical solutions are not the only option.
And if it's not possible from the outside, well, there's one entity who's positioned to further trace the abusive users...
The entity delivering service to the abusive customer is profiting from that delivery. Terminating service to that customer hurts their bottom line. They have strong incentives to not only refuse all requests for help, but to resist even the most serious of requests, in order to protect their bottom line.
I’m sorry to rain on your parade - it’s nothing personal! I wish I could be more supportive! - but there is overwhelming evidence that every entity that is positioned to help will do whatever it takes to avoid helping.
If this remains unsolved, we’re going to end up losing anonymity on the Internet. Several online food delivery systems in the US already permanently block Cloudflare’s 1.1.1.1 VPN product by IP, using Cloudflare’s own CDN protection tools! Because it turns out that effective anonymity for all comers protects abusers from accountability.
That’s why this is a billion-dollar problem.
If they use Cloudflare, then that block is dumb. Sites behind Cloudflare are able to see the real IP of a 1.1.1.1 WARP user. Non-Cloudflare sites will see Cloudflare's IP.
WARP isn't a traditional VPN service[0]:
> "From a technical perspective, WARP is a VPN. But it is designed for a very different audience than a traditional VPN. WARP is not designed to allow you to access geo-restricted content when you’re traveling. It will not hide your IP address from the websites you visit."
I do wish that the market would work as intended such that failures in handling abuse (e.g. frivolous accusations as we're plausibly seeing here) would lead to organizations moving away from Zoom to competitors, whether it's Teams or Meet or BlueJeans or whatever else. But unfortunately the friction of changing platforms is high, between sunk cost of contracts, needing to vet / compare multiple new systems, training on the use of new software, etc.
Meanwhile, the existing solution mostly just works 99% of the time.
(All this said -- even if CG-NAT is to blame for multiple students showing up with the same IP address, that should be tangential to the actual identification of abuse. Either there's a process failure (students aren't required to sign in), or Zoom's not logging or looking at the right things (e.g. display name changes).)
(Intended?! By whom?!)
In this case, the market is working exactly as markets are supposed to. Effectively dealing with abuse is expensive, and has no profit potential whatsoever.
The market will therefore penalize companies that spend money on dealing with abuse, and reward companies that do not. Economically, companies that manage to sweep abuse under the rug for the minimum possible cost will naturally dominate, and companies that spend the considerable investments needed to do a good job on it will eventually go to the wall.
If "market working as intended" has any meaning, maximizing profits is certainly it. It's very economically logical for a provider to not cater to the 1% or so abuse victims, who are expensive to handle, offer little revenue, and might stay with you anyway out of a lack of other places to go. It might be unfair, lack compassion, and be cruel to prioritize abusers over the abused, but none of these terms have any meaning by the metric of "markets"
But I see your point that the markets are working logically from the perspective of there being insufficient incentive for companies (well, Zoom at least) to invest in dealing with this issue. Negative press only goes so far, and it doesn't matter much when it's the dominant player in the market by far (in part due to design choices that facilitated these flaws -- minimized friction in the interest of accessibility also minimizes friction for malicious action).
There is absolutely no mystery as to why. The for-profit corporations that provide these services have absolutely no interest in preventing online abuse, because doing so is expensive and there's no way to make money out of it.
[the provider blah blah]
As a human being, I really don't give a tuppenny damn about "the providers" anymore. This has been a problem for decades, and for decades we've had nothing but whining excuses from "the providers" while they continue to do nothing.
"The providers" should have been investing in anti-abuse technologies and systems starting in the previous century. They haven't done anything.
Draconian measures are needed. If "the providers" have to scramble, maybe even take losses for a few quarters, it's too damn bad for them.
There's contexts where that doesn't work. A zoom call isn't one of them.
I'm not sure why anonymity would play any role in terms of connecting to an online class.
But many carriers simply ignore or don’t respond, much less investigate. To the point that people regularly take to other means to establish backend contact with larger carriers like Comcast, resorting to list serves like nanog.
Ultimately it’s on the carriers to doll out the money to support it. But they could easily implement strike policies like DMCA reports have for many. Against both customers engaging in malicious activity snd reporters abusing the system or making spurious reports that waste resources.
However that would mean carriers like comcast would need to stop their efforts to completely frustrate communication with other NOC's etc.
We either need something provided by the government that is unique to each recipient and services tuple (so it can't be used to trace anything), but will be the same each time, and so can be banned.
Else we need something like a proof of work, but that would either have to so expensive to create that we would have to reuse it across all the end points.
I guess we could also mandate ipv6, but then blocking the addresses wouldn't be very useful.
Finally I guess we could mandate that all IPs be treated equally and then companies that can't handle that would have to close down.
I know, the reality is most of the world is just stuck with IPv4 in some capacity. It is probably good that using IPv4 starts to hurt else we will never migrate. Btw. HackerNews is stuck with IPv4 only in 2021 still...
Not sure what you meant by this comment. The kid whose life is ruined won’t know what this is. The people who care about ipv4 vs v6 is unlikely to act based on this incident.
The kid might actually do quite ok as I have suggested in other comments. Really depends on the family and its personality.
What we really should do though is help make clear to the non-tech world what part of what they see in TV is real and fake science
IP address is like the hair analysis of 70s / 80s
Absolutely wrong.
The kid is a victim of an incompetent and unfair school system.
> The kid might actually do quite ok as I have suggested in other comments.
He might well recover from this serious loss, yes. Will his mother, who was stricken when this happened, recover her health?
A cruel injustice is not acceptable just because the victim "might actually do quite OK".
Of course, we will never see the full picture. I can imagine, having a kid at home puts more stress on the parents that otherwise might rely on the school for something approaching day care/ basically "storage" for human beings. I find just the thought of something like this distasteful but that might be the reality in many families.