Feeds

How to find stolen laptops

The legal eye

High performance access to file storage

A more 'civil' discovery for IP addresses

The problem with the "John Doe" lawsuit model that we currently have is that it encourages the filing of lawsuits where the remedy sought by the court is mostly frivolous. In many of the cases where a lawsuit is filed against, for example a virus writer, a spammer, or a purveyer of malware, we don't really seek monetary damages, or redress of defamation. What we really want is just to find out where it is coming from and make it stop. Besides, the spammers and other miscreants likely have no money to satisfy a judgement, and may not even eventually be found to be subject to the courts in a particular jurisdiction. The remedy for the most part is the discovery itself.

Since Courts can only settle "cases and controversies" and can only award damages or other injunctive relief, how can we use them to get this massive discovery?

If we can establish that we only seek IP address information when it is reasonable and appropriate, and that there are adequate privacy safeguards concerning the collection and use of information, we might be able to streamline the discovery process.

Take, for example the electronic LoJack service. Imagine a standing court discovery order from an appropriate court that says the following: if a computer protected by this service is reported stolen, and it finds itself on a strange network, and "pings" home with its IP address, then and only then the owner or the provider of the LoJack services is entitled to an order of discovery from the ISP from which the IP address is associated, permitting discovery of the customer data associated with that IP address.

If the target is piggybacking off several different IP addresses, the discovery order permits discovery of all of them, which is up to the ultimate user. The information may ONLY be used for the purposes of either filing a lawsuit against the perpetrator, or to turn over to law enforcement, or other reasonable purposes. The court might also appoint a "Special Master" responsible for overseeing the discovery process.

In practical terms, this is how it would work. The LoJack system would ping back the company with an IP address, date, time, etc. This information would be used to generate a discovery demand - automatically and digitally. The Special Master would be required to review each such demand for accuracy. The demand would then be automatically transmitted to the appropriate ISP that is associated with the IP address, which could (but would not be required to) automate the process of producing the requested records. The requested records would then be available to the Special Master in accord with the standing discovery order. In this way, discovery of the relevant information could occur in minutes, rather months.

Now there are, of course problems with such an approach. By making discovery so easy, it may encourage abuse. Clerical and other mistakes will not only be made, but will be automated. Judicial oversight will be reduced to a somewhat ministerial function, with most oversight assigned to the Special Master who is subject to not only boredom but corruption.

Since computer crime is instantaneous and international, the approach would have to be harmonised with international privacy laws, discovery laws, and jurisdictional laws. And there would have to be significant oversight with sanctions for abuse or misuse of the system. If we had all of these safeguards, we could streamline discovery of discrete classes of information (say IP log information) in discrete classes of cases. That might put a bunch of lawyers out of business. And what would be so bad about that?

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.