Feeds

How to find stolen laptops

The legal eye

Securing Web Applications Made Simple and Scalable

A more 'civil' discovery for IP addresses

The problem with the "John Doe" lawsuit model that we currently have is that it encourages the filing of lawsuits where the remedy sought by the court is mostly frivolous. In many of the cases where a lawsuit is filed against, for example a virus writer, a spammer, or a purveyer of malware, we don't really seek monetary damages, or redress of defamation. What we really want is just to find out where it is coming from and make it stop. Besides, the spammers and other miscreants likely have no money to satisfy a judgement, and may not even eventually be found to be subject to the courts in a particular jurisdiction. The remedy for the most part is the discovery itself.

Since Courts can only settle "cases and controversies" and can only award damages or other injunctive relief, how can we use them to get this massive discovery?

If we can establish that we only seek IP address information when it is reasonable and appropriate, and that there are adequate privacy safeguards concerning the collection and use of information, we might be able to streamline the discovery process.

Take, for example the electronic LoJack service. Imagine a standing court discovery order from an appropriate court that says the following: if a computer protected by this service is reported stolen, and it finds itself on a strange network, and "pings" home with its IP address, then and only then the owner or the provider of the LoJack services is entitled to an order of discovery from the ISP from which the IP address is associated, permitting discovery of the customer data associated with that IP address.

If the target is piggybacking off several different IP addresses, the discovery order permits discovery of all of them, which is up to the ultimate user. The information may ONLY be used for the purposes of either filing a lawsuit against the perpetrator, or to turn over to law enforcement, or other reasonable purposes. The court might also appoint a "Special Master" responsible for overseeing the discovery process.

In practical terms, this is how it would work. The LoJack system would ping back the company with an IP address, date, time, etc. This information would be used to generate a discovery demand - automatically and digitally. The Special Master would be required to review each such demand for accuracy. The demand would then be automatically transmitted to the appropriate ISP that is associated with the IP address, which could (but would not be required to) automate the process of producing the requested records. The requested records would then be available to the Special Master in accord with the standing discovery order. In this way, discovery of the relevant information could occur in minutes, rather months.

Now there are, of course problems with such an approach. By making discovery so easy, it may encourage abuse. Clerical and other mistakes will not only be made, but will be automated. Judicial oversight will be reduced to a somewhat ministerial function, with most oversight assigned to the Special Master who is subject to not only boredom but corruption.

Since computer crime is instantaneous and international, the approach would have to be harmonised with international privacy laws, discovery laws, and jurisdictional laws. And there would have to be significant oversight with sanctions for abuse or misuse of the system. If we had all of these safeguards, we could streamline discovery of discrete classes of information (say IP log information) in discrete classes of cases. That might put a bunch of lawyers out of business. And what would be so bad about that?

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.