Slashdot Mirror
Tufts Tells Judge, We Can't Tie IP To MAC Addresses
NewYorkCountryLawyer writes "Protesting that Tufts University's DHCP-based systems 'were not designed to facilitate forensic examinations,' but rather to ensure 'smooth operations and to manage capacity issues,' the IT Office at Tufts University has responded to the subpoena in an RIAA case, Zomba v. Does 1-11, by submitting a report to the judge (PDF) explaining why it cannot cross-match IP addresses and MAC addresses, or identify users accurately. The IT office explained that the system identifies machines, not users; that some MAC addresses have multiple users; that only the Address Resolution Protocol system has even the potential to match IP addresses with MAC addresses, but that system could not do so accurately. For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit."
I suppose in the US you have judges with clue. In the UK it's fuddy duddy old men in wigs who go "What is this 'internet'?".
http://www.theinquirer.net/en/inquirer/news/2007/05/17/judge-has-beatles-moment-over-internet
or maybe he didnt:
http://www.theinquirer.net/en/inquirer/news/2007/05/18/judge-didnt-have-beatles-moment-after-all
Apparently the original story of the judge saying 'Who are the Beatles?' might be a myth anyway...
In both cases the retention notice arrived in such close proximity to the expiration of the ten day retention period of the DHCP data that we were unable to access the data before it was overwritten.
So they used the same excuse twice - log rotation - RIAAs new enemy.
At the dorm I used to live we had to authenticate our computers in order to gain access to the network, this was done via username/password combos. There were several that multiple people knew (mostly to get around bandwidth limits - you'd just jump on another account if you exceeded your quota).
It registered the MAC address at this point, but I doubt they were actually saved, as the quota was obviously tied to the user account and not the MAC.
And with Wifi, it's even easier (useful for these Kiosk-type nets wthat present you with a login page on first access):
Well, occasionally you (or the victim) might get one or the other dropped connection, but in practice, this is extremely rare.
you're the reason we aren't keeping logs of this stuff.
Good people go to bed earlier.
For reasons which are unclear, the IT department then suggested that the RIAA next time send them 'notices to preserve information,' in response to which they would preserve, rather than overwrite, the DHCP data, for the RIAA's forensic benefit.
Why? The RIAA is not a court of law or even a government agency. Surely the university would have no obligation to comply with its requests? Talking about the RIAA in these terms ("notices", "forensic") lends it unwarranted legitimacy and authority.
That's what I want to know. Why?
Ray Beckerman +5 Insightful
... then you're liable! I'm expecting the courts to come up with that simple principle. Kinda like when your car is caught speeding: identify the driver or pay the fine.
That, of course, will make not only university LAN's but also corporate LAN's much more expensive to build. It'll also make it difficult to support multi-user machines as you'd have to tie each and every TCP connection to a user.
And after that liability scheme collapses under its own weight, we'll be rid of the whole copyright nonsense.
This only compounds the fact that a loghost doesn't really help whether you have it or not.
Crackin' Wise - Blogging about whatever we want
The RIAA and the courts will eventually figure out that any computer forensic logs can be faked, and will not be a reliable means of identifying computer users.
Trying to pin criminal or civil liability on someone based on DHCP logs or ARP tables is sheer stupidity. These records could easily identify multiple users - we aren't talking about DNA evidence here.
The justice system is slow - intentionally. It will take a while before judges get the technical details of this and realize that these identification methods are unreliable.
What worries me is that the RIAA/MPAA will buy enough of congress to legislate unique tokens for computer users and mandatory log retention. It is possible that congress will make all of us (network admins) do the dirty work for private industry. It happened in banking, and it will probably happen again.
I think I need to make another donation to the EFF and to the ACLU. Those organizations might be our only hope.
-ted
Why don't you go a step further and just assume that everyone does their illegal sharing in a virtual machine? Hell, you could change the MAC every day. The possibilities for error by tying an IP to a MAC are pretty boundless.
If I change my name via deedpoll, I'm not 'spoofing' everyone I meet from then on into referring to me with a name that isn't mine. That is my name. If I change my name and then change it back, or simply cut out the actual changing of the name and just introduce myself with a different name for a week, I've spoofed them into thinking my name is something that it isn't.
Technologically I don't think there's a difference. If you consider intent, then you can draw a small, pretty inconsequential difference.
A block of code, sufficiently well-written, is indistinguishable from magick.
What you need to do then is restrict traffic based on IP leases.
My ISP will refuse to let traffic pass if the IP address set is not dynamic. They require you to enable dhcp, even if you're a static customer. In rare occasions if my dhclient has acted up, my internet will no longer work.
This not only makes administering your network easier and network safer (less chance of spoofing), but also better for your customers so they don't get conflicting IPs if someone decides to be 'naughty'.
The "Clone MAC Address" feature is there because some ISP's (Cox comes to mind) will grab the mac addy. of the first device you hook up and refuse to provide service to anything else. So when you plug your laptop straight in to check if they've turned up the line it works. Plug in your router and it's dead.
Tech support swears they don't do this, so you have two choices: call/hold/bitch at tech support till they reset your account (locking you into your current router's MAC so you start over if you get another router) or just clone the MAC and start moving packets.
I've always prefered the word "steal". It's so much more accurate (and honest). Of course if you own the CD you are ripping or burning, then it's really just copying ("I copied my CD over to my Ipod."). I try to avoid slang like "burn" or "rip", because it's just so imprecise. Can you imagine if we used that kind of slang back in the 80s:
- "I 'ripped' an INXS tape to my Commodore=64."
- "Awesome! 'Magnetize' me a copy onto a floppy."
- "Wouldn't you prefer I 'etched' a record instead?"
- "No man, etching records is so 1970s."
The government is not your daddy. Its purpose is not to raid middle-class neighbors' wallets and give it to you.
You missed the point... on the wireless network, one must login to get an address. Thus, there should be records of who logged in and was given a specific address. So, they should have one and only one name for the two wireless addresses.
Of course, if they expire those logs as fast as the dhcp logs, there's nothing to search.