Comments on: Getting Personal with IP Addresses http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/ Jim Molini's Software and Information Security Blog Fri, 27 Aug 2010 00:34:42 +0000 hourly 1 http://wordpress.org/?v=3.0.2 By: jmolini http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-26 jmolini Mon, 17 Aug 2009 00:31:24 +0000 http://www.codeguard.org/blog/?p=40#comment-26 <a href="#comment-24" rel="nofollow">@Jeff Yablon </a> Jeff, If a case can be built against you based on your IP address, I guess you're saying that removing your anonymity makes the IP address PII. It's kind of like saying that seeing you driving a Pontiac GTO after you've robbed a bank makes the GTO a personally identifiable vehicle. I don't think that's covered by most laws. If the IP address is not owned by you, can you make a claim against it? I hope they don't say that anyone using an IP address can claim that it's somehow supposed to be protected on their behalf. That would really hammer the system. I guess this is going to be sorted out in court sooner or later. Thanks for your comment. @Jeff Yablon

Jeff,
If a case can be built against you based on your IP address, I guess you’re saying that removing your anonymity makes the IP address PII. It’s kind of like saying that seeing you driving a Pontiac GTO after you’ve robbed a bank makes the GTO a personally identifiable vehicle. I don’t think that’s covered by most laws. If the IP address is not owned by you, can you make a claim against it? I hope they don’t say that anyone using an IP address can claim that it’s somehow supposed to be protected on their behalf. That would really hammer the system.

I guess this is going to be sorted out in court sooner or later. Thanks for your comment.

]]> By: Jeff Yablon http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-24 Jeff Yablon Fri, 14 Aug 2009 01:42:28 +0000 http://www.codeguard.org/blog/?p=40#comment-24 Sorry, I have to disagree. Speaking as not-a-lawyer, my opinion isn't meant as one bound by legal definition of property, etc. In fact, I gladly defer to your reading of the ruling; so fine, it isn't 'property' per se. Nevertheless, because the ISPs who own (hmmmmm, not really) the addresses are often required by one regulating/governing body or another to keep track of who the IP addresses they control are assigned to, and are sometimes subpoenaed for that information, an IP address IS personal identifying information, at least transiently. If your point is to remove ownership 'rights' then of course you want to see IP addresses as not PII. But if you are afraid that someone hitching a ride on your network (yes, it ought to be protected, but still) might do something illegal while there and you could get left holding the bag, then you have to be afraid and err the other way. In other words, if a case can get built against me based on my IP address (and we've seen this many times, now), then call it what it is: PII. And plan your actions from there. Jeff Yablon President & CEO <a href="http://answerguy.com" rel="nofollow">Virtual VIP Business Coaching and Virtual Assistant Services</a> Sorry, I have to disagree.

Speaking as not-a-lawyer, my opinion isn’t meant as one bound by legal definition of property, etc. In fact, I gladly defer to your reading of the ruling; so fine, it isn’t ‘property’ per se.

Nevertheless, because the ISPs who own (hmmmmm, not really) the addresses are often required by one regulating/governing body or another to keep track of who the IP addresses they control are assigned to, and are sometimes subpoenaed for that information, an IP address IS personal identifying information, at least transiently.

If your point is to remove ownership ‘rights’ then of course you want to see IP addresses as not PII. But if you are afraid that someone hitching a ride on your network (yes, it ought to be protected, but still) might do something illegal while there and you could get left holding the bag, then you have to be afraid and err the other way.

In other words, if a case can get built against me based on my IP address (and we’ve seen this many times, now), then call it what it is: PII. And plan your actions from there.

Jeff Yablon
President & CEO
Virtual VIP Business Coaching and Virtual Assistant Services

]]> By: Your IP address isn’t personal information (new legal case) « David Strom’s Web Informant http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-22 Your IP address isn’t personal information (new legal case) « David Strom’s Web Informant Thu, 13 Aug 2009 17:46:31 +0000 http://www.codeguard.org/blog/?p=40#comment-22 [...] by strom on August 13, 2009 Jim Molini, in his blog post Getting Personal with IP Addresses, mentions a ruling last month in US District Court that states that your IP address isn’t [...] [...] by strom on August 13, 2009 Jim Molini, in his blog post Getting Personal with IP Addresses, mentions a ruling last month in US District Court that states that your IP address isn’t [...]

]]> By: Jamie Welch http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-21 Jamie Welch Mon, 27 Jul 2009 21:38:54 +0000 http://www.codeguard.org/blog/?p=40#comment-21 I agree that IP addresses are not personally identifiable information. Most change every day. They are collected automatically by all servers for logging purposes. If you choose to send a request to the server, that gives the server the right to collect and log certain information about you, such as your Operating System, web browser, IP address. This information is all sent automatically by your web browser. Tor is an option for anonymity on the internet. If you don't want people collecting your ip address, you must be doing something that you don't want people to know about. Great blog Mr. Molini, I will be coming back often. I agree that IP addresses are not personally identifiable information. Most change every day. They are collected automatically by all servers for logging purposes. If you choose to send a request to the server, that gives the server the right to collect and log certain information about you, such as your Operating System, web browser, IP address. This information is all sent automatically by your web browser. Tor is an option for anonymity on the internet. If you don’t want people collecting your ip address, you must be doing something that you don’t want people to know about. Great blog Mr. Molini, I will be coming back often.

]]> By: Twitted by avalonhawk http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-20 Twitted by avalonhawk Thu, 23 Jul 2009 18:19:42 +0000 http://www.codeguard.org/blog/?p=40#comment-20 [...] This post was Twitted by avalonhawk [...] [...] This post was Twitted by avalonhawk [...]

]]> By: Jerry http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-19 Jerry Thu, 23 Jul 2009 14:31:52 +0000 http://www.codeguard.org/blog/?p=40#comment-19 This also is a great ruling with regards to the abusive suits filed by the RIAA on a regular basis! This also is a great ruling with regards to the abusive suits filed by the RIAA on a regular basis!

]]> By: Sunny Molini http://www.codeguard.org/blog/2009/07/22/getting-personal-with-ip-addresses/comment-page-1/#comment-18 Sunny Molini Thu, 23 Jul 2009 05:07:18 +0000 http://www.codeguard.org/blog/?p=40#comment-18 Every good web developer knows, that when analytics tells you that you've received 1,000 unique visitors in the past 3 months, you take it with a grain of salt. People might use 3 different computers to view your site. Or their IP leases may very well have refreshed a few times in that period. IP addresses are used a lot to approximate unique visitors, but most power users know that that can't be relied on. I'm glad the judge was able to learn that much in time for his decision. I've heard other analysis on this that likened that line about the IP identifying a computer to how an address identifies a house. There are serious differences with IP. Most people don't change addresses every month, and most people don't live in more than one house either. DNS is effective because it's fexible, far too flexible to be used in a courtroom. Every good web developer knows, that when analytics tells you that you’ve received 1,000 unique visitors in the past 3 months, you take it with a grain of salt. People might use 3 different computers to view your site. Or their IP leases may very well have refreshed a few times in that period. IP addresses are used a lot to approximate unique visitors, but most power users know that that can’t be relied on.
I’m glad the judge was able to learn that much in time for his decision.

I’ve heard other analysis on this that likened that line about the IP identifying a computer to how an address identifies a house. There are serious differences with IP. Most people don’t change addresses every month, and most people don’t live in more than one house either. DNS is effective because it’s fexible, far too flexible to be used in a courtroom.

]]>