It’s not dumb. It’s very practical. Very easy conviction and it entirely turns the burden of proof over to the accused who now have to prove their innocence which is much harder to do especially as they probably lack the resources to do so.
If success is measured in amount of convictions and/or arrests, going with just the IP address is the easiest road to success.
Articles like this are incredibly important to make it clear to judges that an IP address is not sufficient evidence. This is not common knowledge yet
Same with IP addresses, THEY ARE PERSONAL DATA. Ad tech companies routinely use IPs for tracking and identification.
If you'd eaten chips this morning and there was a database of chip-eaters, eating chips would be considered personal information.
It's tiring to see these uninformed hot takes on GDPR on completely unrelated subjects.
If "most" of their online activity is their own, then some of it coming from "their" IP address isn't. You can pretend to be able to identify a person behind an IP address, but that doesn't make it true.
Computer forensics usually means software bought from a vendor and operated by a technician sometimes with no deep technical knowledge beyond the tool they use. It probably even works well for the common case, but breaks in cases where something unusual has happened.
UK ISPs mostly use an IP pool – meaning they have to keep records about who was assigned which IP at which time. Some may run carrier-grade NAT. Those records are obviously trusted, but may not necessarily be accurate – and even if they are, human mistakes occur, especially when working with things like IP addresses, dates and timezones.
But if not for following IP addresses, how else do you investigate this sort of thing?
I would argue the fault is in a mentality that suggests presuming guilt based on an IP address, then looking for the confirmatory evidence as an "icing on the cake," and a mentality that the investigation process should be so harrowing that the guilty will always go punished even if there isn’t enough evidence for an attempt at conviction. This is long after several such scandals around the same type of crimes.
(It's also interesting to compare the amount of sympathy these wrongly accused people receive versus other victims of police action ...)
I would say you search the computers, but do this in a very timely manor so that you do not have to involve employers and social services.
These searches should take minutes or hours, not months, and shouldn’t ruin people’s lives if they are innocent.
Yes. The searches are not designed to ruin anyone's life but informing other parties, like what happened in this article, is sometimes necessary and and can have life ruining consequences even when entirely innocent. Things could leak out from the school to parents, to other work colleagues, limit career progression, etc. These leaks may even be intentional when stupid people are involved. Doing the searches quicker and being innocent or not doesn't help avoid either of the below (from the article) from happening:
> The police needed to unlock Matthew's work laptop, which was encrypted. He had to tell his boss about the case in order to get the decryption key.
> And the police had also informed social services and the children's school about the investigation, meaning Kate was suspended from her role as a governor there.
The first one could be unavoidable. The second one is technically avoidable but it is going to happen (in UK society, at least).
It could definitely have avoided the second.
I think there is a moral duty to carry out investigations in a way that protects the lives, reputations and livelihoods of the innocent, and this example has fallen short of that in my opinion (although a reasonable person could disagree).
This is the bit I disagree with personally, as I think it conflicts with 'innocent until proven guilty' when a person can be removed from their position and have their reputation destroyed by the police without sufficient evidence to convict (remember - no charge was ever made from the police).
It's pretty feasible to do an initial scan of a few devices within a few hours - and if you don't find enough evidence after a few hours of looking then IMO you don't have enough evidence to ruin someone's life (go get more evidence first in that case!).
The 'blast zone' of this investigation was ultimately two innocent people's reputations ruined in an attempt to find one guilty person (who wasn't found).
(Again, reasonable people will disagree on how far an investigation should be able to go prior to charge - my own view is clearly more on the 'protect the innocent, even if it means investigation is harder and a few baddies escape justice' side than some others might be!)
If I ran a message board, not only would I not capturing the upload IPs in any log files (hello GDPR in any case), I'd be tempted to put fake upload IPs in instead -- change the first two or three octets so the logs point to a government owned range.
The problem with suspicion is that collateral damage to those who are innocent, but I don't think the answer is to not investigate.
The police aren't really interested in catching criminals or helping people. There's no promotions in that. Meeting a quota of number of arrests however, you'll be chief inspector in no time!