Hacker News Reader

Comment by pilif | Hacker News Reader

> Is UK police so dumb that they suspect people solely based on ipv4?

It’s not dumb. It’s very practical. Very easy conviction and it entirely turns the burden of proof over to the accused who now have to prove their innocence which is much harder to do especially as they probably lack the resources to do so.

If success is measured in amount of convictions and/or arrests, going with just the IP address is the easiest road to success.

Articles like this are incredibly important to make it clear to judges that an IP address is not sufficient evidence. This is not common knowledge yet

View on HN

On might consider disabling the WiFi password entirely so there's plausible deniability if this happens. Pitch it as a public service. Maybe set up a separate router or VLAN and cap the bandwidth.

Then you would have to prove that it's someone who used the service not you. The burden of proof is not on the accusor.

has this ever been tested in court?

Sure, but you still end up with all of your devices seized for months and data dumped while you explain that you run an unprotected wifi router.

If your WiFi is entirely unprotected, depending on jurisdiction, you can be treated as an accessory which too can have serious consequences.

Surely they'd have to prove intent?

It depends on jurisdiction. See for example https://www.itsecurityguru.org/2020/10/06/french-cafe-owners...

And yet, GDPR considers IP address personal data. As long as there are stupid things written in laws and directives, we can expect the judicial branch issue stupid rulings.

My name is personal data. A bank robber can say "Hands up, this is Ensorceled, hand over your money or die." but that should not be proof I did the crime.

Same with IP addresses, THEY ARE PERSONAL DATA. Ad tech companies routinely use IPs for tracking and identification.

This is a completely different matter with entirely different goals and implications. GDPR takes the hardest stance on what is and is not personal data for the sake of consumer protection. If a company had the IP of this couple they could link their online activity (most of which is their own) with their name, that's sufficient to spy on them.

If you'd eaten chips this morning and there was a database of chip-eaters, eating chips would be considered personal information.

It's tiring to see these uninformed hot takes on GDPR on completely unrelated subjects.

> If a company had the IP of this couple they could link their online activity (most of which is their own) with their name, that's sufficient to spy on them.

If "most" of their online activity is their own, then some of it coming from "their" IP address isn't. You can pretend to be able to identify a person behind an IP address, but that doesn't make it true.

My name is personal data even though it's not unique, and my physical address is too even though I don't live alone.

IP address might be part of a proof based on balance of probabilities (used in Civil law cases, torts like copyright/trespass) but is unlikely to be useful in proving 'behind reasonable doubt' (ie in a criminal case), IMO, it might lead to something that provides such proof though.

Reply on news.ycombinator.com