Syphilis
10-08-2009, 03:51 AM
Ever wondered what happens when the police record your IP address doing something naughty online, and turn up at your doorstep?
Not just child porn, I just thought it would make a catchy title. I'm not a lawyer, so this may be slightly off, but you'll get the general idea. This post IS NOT about innocuous everyday things like downloading music and movies from bittorrent.
---------------------------------------------
Say you're sharing nude photos of 9 year olds, or bragging about all the illegal stuff you've done on an internet forum, or something more serious.
Your IP address will be tied to that activity. Your ISP keeps records of IP addresses, the sites that IP visits, and who the IP address belongs to. If you have a dynamic IP, the ISP will have a record of what IP address you had at what specific time.
---------------------------------------------
Anyway, one day you are awaken by a knock on your door at 4AM. It's the police, and they have a search warrant, and seize all of your computer equipment.
They tracked your IP address to illegal activity. That gave them enough circumstantial evidence to get a search warrant, but in most countries, not enough for prosecution.
Direct evidence = irrefutible, proven evidence of guilt.
Circumstantial evidence = evidence which implies guilt, but does not prove it.
Or, in a little more detail: "Direct evidence supports the truth of an assertion (in criminal law, an assertion of guilt or of innocence) directly, i.e., without an intervening inference. Circumstantial evidence, by contrast, directly supports the truth of evidence, from which the truth of the assertion may be inferred."
If your hard drive is not encrypted, the police find what they're after (e.g. nude photos of 5 year olds), you get charged with whatever the police are after you for (in this example, possession of child pornography), and you get locked up.
---------------------------------------------
But say your drive is encrypted. Things get a little more complex. If your country does not have a law requiring you to give up your encryption keys, you are free to go.
However, in many cases, a judge can order you to provide the decryption keys if there is enough circumstantial evidence. In some countries, the prosecutors don't even need evidence, just "reasonable suspension".
If you refuse, you are charged with obstruction of justice.
If you comply and they find the illegal material they are looking for, you are charged with that specific crime.
If you comply and they find nothing, you should be free to go.
If you refuse and they crack/brute force the encryption and find illegal material, you are charged with that specific crime AND obstruction of justice.
---------------------------------------------
Moral of the story? Use full disk encryption with a strong password, and use proxies/Tor.
A quick though on proxies: If you use a single layered proxy server (you > proxy > target server), the ISP working with the victim would be able to see your IP address connecting to the proxy server, and then the IP address of the proxy server committing the illegal activity at the exact same time. That would count as circumstantial evidence, although weaker than if it were your naked IP address. Using an onion router (e.g. Tor) should help prevent that.
Not just child porn, I just thought it would make a catchy title. I'm not a lawyer, so this may be slightly off, but you'll get the general idea. This post IS NOT about innocuous everyday things like downloading music and movies from bittorrent.
---------------------------------------------
Say you're sharing nude photos of 9 year olds, or bragging about all the illegal stuff you've done on an internet forum, or something more serious.
Your IP address will be tied to that activity. Your ISP keeps records of IP addresses, the sites that IP visits, and who the IP address belongs to. If you have a dynamic IP, the ISP will have a record of what IP address you had at what specific time.
---------------------------------------------
Anyway, one day you are awaken by a knock on your door at 4AM. It's the police, and they have a search warrant, and seize all of your computer equipment.
They tracked your IP address to illegal activity. That gave them enough circumstantial evidence to get a search warrant, but in most countries, not enough for prosecution.
Direct evidence = irrefutible, proven evidence of guilt.
Circumstantial evidence = evidence which implies guilt, but does not prove it.
Or, in a little more detail: "Direct evidence supports the truth of an assertion (in criminal law, an assertion of guilt or of innocence) directly, i.e., without an intervening inference. Circumstantial evidence, by contrast, directly supports the truth of evidence, from which the truth of the assertion may be inferred."
If your hard drive is not encrypted, the police find what they're after (e.g. nude photos of 5 year olds), you get charged with whatever the police are after you for (in this example, possession of child pornography), and you get locked up.
---------------------------------------------
But say your drive is encrypted. Things get a little more complex. If your country does not have a law requiring you to give up your encryption keys, you are free to go.
However, in many cases, a judge can order you to provide the decryption keys if there is enough circumstantial evidence. In some countries, the prosecutors don't even need evidence, just "reasonable suspension".
If you refuse, you are charged with obstruction of justice.
If you comply and they find the illegal material they are looking for, you are charged with that specific crime.
If you comply and they find nothing, you should be free to go.
If you refuse and they crack/brute force the encryption and find illegal material, you are charged with that specific crime AND obstruction of justice.
---------------------------------------------
Moral of the story? Use full disk encryption with a strong password, and use proxies/Tor.
A quick though on proxies: If you use a single layered proxy server (you > proxy > target server), the ISP working with the victim would be able to see your IP address connecting to the proxy server, and then the IP address of the proxy server committing the illegal activity at the exact same time. That would count as circumstantial evidence, although weaker than if it were your naked IP address. Using an onion router (e.g. Tor) should help prevent that.