U of Chicago Professor Questions RIAA’s Use of IP Addresses in Lawsuits

Concerned that are “accepted without question in a number of legal discussions” when they are merely assigned to a network interface, never to a person.

University of Chicago Computer Science professor Mike O’Donnel has posted a response on Recording Industry vs The People to a recent ruling that denied the RIAA’s request to force the College of William and Mary to turn over the names of students behind a number of IP addresses suspected of illegal file-sharing.

In his response he writes that he is “…disturbed by the assumption about IP numbers that appears to be accepted without question in a number of legal discussions,” and how an “…IP number on a packet has only suggestive value and is not reliable evidence at all.”

What makes him particularly concerned are the following 2 assumptions that are most commonly made and cited in cases that the RIAA has brought to trial:

Yet, as we all know, an IP address is never so “unique” or so binding to an individual as to make it a source of concrete proof of identification.

Professor O’Donnel goes on to note specifically why it is that an IP address is not a definitive means of identifying a specific individual. He writes:

1. IP addresses are never assigned to persons. They are assigned to network interfaces on particular hosts or virtual hosts. A virtual host is pretty much any computational abstraction we like.

2. IP addresses are not assigned by any authority with the mission to identify the persons responsible for the network interfaces to which they are assigned. In most cases, the assigner has no competence to make such an identification.

3. Most IP addresses are in fact assigned by an immediate neighbor on a local area network. Furthermore, that neighboring router is the only agent that deals with the assignment in any way. Incoming traffic to a given IP address reaches the “assigned” interface through the information stored only at that neighboring router.

4. Network protocols provide no way whatsoever to determine whether incoming traffic to a particular IP address has been solicited by some action at that address, or is gratuitous. (It is not at all crazy to worry that some offending traffic is generated by RIAA action in its attempts to identify offenders, and probably not even as a conscious attempt to frame the recipient).

5. The IP number given as return address in a packet is provided initially by the actual sender, which may (and in the case of an attacker often does) provide an address used by another interface not at all involved in the production of the packet. So the return IP address in a packet received by an RIAA detection effort does not indicate even the IP address of the actual sender in any reliable way.

I am one of at least thousands of people who could easily provide expert testimony on the points above.

Tracing of identities through IP numbers can definitely have value in law enforcement, but by itself an IP number on a packet has only suggestive value and is not reliable evidence at all. The association of packets bearing a particular IP number with the actions of a particular person depend on assumptions about the behavior of that person and all other persons who take actions causing packets to be transmitted (since any IP number can be entered by any network software anywhere, with no necessary connection to the network interface “assigned” that number).

A mere IP address should never be considered sufficient evidence, and I only wished that more judges would agree.

Looking for more stuff to watch or download?
RIAA Strikes Again, Accuses Guitar Teacher of Copyright Infringement
Tips on how to not get busted for file-sharing
Gotcha! New MPAA Site Tries to Trick Users into Illegally Downloading Movies
BitTorrent torrent sites & search engines
Azureus – A Beginner’s Guide to BitTorrent Downloading
Watch The Simpsons, The Office, Jackass, South Park, Lost, X-Men, and More, On-Demand For Free
News Tip? Comment? Suggestion? [email protected]