Feeds

How to find stolen laptops

The legal eye

Next gen security for virtualised datacentres

A more 'civil' discovery for IP addresses

The problem with the "John Doe" lawsuit model that we currently have is that it encourages the filing of lawsuits where the remedy sought by the court is mostly frivolous. In many of the cases where a lawsuit is filed against, for example a virus writer, a spammer, or a purveyer of malware, we don't really seek monetary damages, or redress of defamation. What we really want is just to find out where it is coming from and make it stop. Besides, the spammers and other miscreants likely have no money to satisfy a judgement, and may not even eventually be found to be subject to the courts in a particular jurisdiction. The remedy for the most part is the discovery itself.

Since Courts can only settle "cases and controversies" and can only award damages or other injunctive relief, how can we use them to get this massive discovery?

If we can establish that we only seek IP address information when it is reasonable and appropriate, and that there are adequate privacy safeguards concerning the collection and use of information, we might be able to streamline the discovery process.

Take, for example the electronic LoJack service. Imagine a standing court discovery order from an appropriate court that says the following: if a computer protected by this service is reported stolen, and it finds itself on a strange network, and "pings" home with its IP address, then and only then the owner or the provider of the LoJack services is entitled to an order of discovery from the ISP from which the IP address is associated, permitting discovery of the customer data associated with that IP address.

If the target is piggybacking off several different IP addresses, the discovery order permits discovery of all of them, which is up to the ultimate user. The information may ONLY be used for the purposes of either filing a lawsuit against the perpetrator, or to turn over to law enforcement, or other reasonable purposes. The court might also appoint a "Special Master" responsible for overseeing the discovery process.

In practical terms, this is how it would work. The LoJack system would ping back the company with an IP address, date, time, etc. This information would be used to generate a discovery demand - automatically and digitally. The Special Master would be required to review each such demand for accuracy. The demand would then be automatically transmitted to the appropriate ISP that is associated with the IP address, which could (but would not be required to) automate the process of producing the requested records. The requested records would then be available to the Special Master in accord with the standing discovery order. In this way, discovery of the relevant information could occur in minutes, rather months.

Now there are, of course problems with such an approach. By making discovery so easy, it may encourage abuse. Clerical and other mistakes will not only be made, but will be automated. Judicial oversight will be reduced to a somewhat ministerial function, with most oversight assigned to the Special Master who is subject to not only boredom but corruption.

Since computer crime is instantaneous and international, the approach would have to be harmonised with international privacy laws, discovery laws, and jurisdictional laws. And there would have to be significant oversight with sanctions for abuse or misuse of the system. If we had all of these safeguards, we could streamline discovery of discrete classes of information (say IP log information) in discrete classes of cases. That might put a bunch of lawyers out of business. And what would be so bad about that?

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.