Ruling: IP address does not identify person

[howyoudoin]

Or we could make the phrase 'burden of proof' actually mean something.

[HarryT]

Originally Posted by howyoudoin

Or we could make the phrase 'burden of proof' actually mean something.

OK. What would you like that "burden of proof" to actually consist of?

[howyoudoin]

Originally Posted by HarryT

OK. What would you like that "burden of proof" to actually consist of?

Something that does not resemble a buck shot approach. I'm not technologically proficient enough, but if there's a technical limitation they're facing, it's a cross for the media companies to carry, not the persons they've decided to prosecute.

[JoeD]

Originally Posted by HarryT

But, once the proof is there that it's your IP address, then either you take the fine, or you state who was responsible, just like you do with a speed camera conviction. Is that unreasonable?

The owner might be responsible to an extent, but they're not fully responsible for all penalties. For example, if you get a parking ticket, you're not responsible if you were not the one driving, you don't have to prove you were not the one driving, they have to prove you were.

With speeding, they have to show _you_ were the driver in order for you to be the one who is fined. Sure the fine will go to the registered keeper of the vehicle and they may just pay it, but they can also argue they were not the driver and go to court. Then the prosecution has to prove they were the driver (if you falsely claim you're not then get presented with a photo showing you were, you're in even more trouble as deserved) however my point is, even with speeding, just having a picture of the car/plate is not enough they need to prove who was driving (picture, witnesses etc)

Why should IPs be treated differently? Notices should go to the registered owner of the connection who should be expected to make sure their connections are secure (or pay someone to verify it for them) but when it comes to prosecuting them I think they should have to prove who was responsible.

Perhaps copyright infringement needs to be made into an offence the police can handle by seizure of computers at the address in question for a search for infringing material. However that would place even more of a burden on the police who are likely already overworked in dealing with more serious crimes. But, I can't see any real way a company could be expected to show you were the one who downloaded something unless they can have the police seize your computers to find out. I don't think just saying it's your IP you're responsible is good enough, but I also don't think companies have a valid alternative at this point.

[Rob Lister]

Originally Posted by howyoudoin

Something that does not resemble a buck shot approach. I'm not technologically proficient enough, but if there's a technical limitation they're facing, it's a cross for the media companies to carry, not the persons they've decided to prosecute.

If you read the article, that is essentially what the judge in this case said; what other judges have only alluded to. He stuck a big middle finger up at the RIAA and their associated parasitic law firms (and parasitic is an overly kind term).

[HarryT]

Originally Posted by JoeD

The owner might be responsible to an extent, but they're not fully responsible for all penalties. For example, if you get a parking ticket, you're not responsible if you were not the one driving, you don't have to prove you were not the one driving, they have to prove you were.

Not under UK law. Here, if you are the registered keeper of a vehicle, you have a legal responsibility to know who is driving it at all times. Hence, if an offence is committed by that vehicle, you are legally required to disclose the identity of the driver at that time. If you are unable to do so (or refuse to do so) you'll face prosecution as if you were the driver.

That's why I say that I think that the same principle can be (and indeed, IS, in the UK) extended to IP connections, because there is a long-established legal precedent for doing so.

[Rob Lister]

Here, parking tickets are the exception to the rule. Here, a car gets the parking ticket, not the owner. If your car gets more than a few without paying them, they arrest the car.

You can bail the car out if you want.

I once found a whole stack of parking tickets my car was hiding in the glove box.

[Talldog]

When the cable company set up my cable modem, they set the wireless up with WEP and a simple password. A serious hacker could crack that without a lot of trouble and many people have no clue when it comes to that kind of stuff. Imagine someone breaks it and uses the connection to download child pornography. Then what? We're talking way beyond a fine.

[HarryT]

Originally Posted by Talldog

When the cable company set up my cable modem, they set the wireless up with WEP and a simple password. A serious hacker could crack that without a lot of trouble and many people have no clue when it comes to that kind of stuff. Imagine someone breaks it and uses the connection to download child pornography. Then what? We're talking way beyond a fine.

To tie in for a moment to the "British High Court blocks TBP", that's one reason that all UK ISPs block (and have done so for many years) child porn sites. Do they not do so in the US?

[Talldog]

Originally Posted by HarryT

To tie in for a moment to the "British High Court blocks TBP", that's one reason that all UK ISPs block (and have done so for many years) child porn sites. Do they not do so in the US?

I imagine that they try, but I'm sure that like most other illegal activities, ways are found around it. Stories about people being arrested for that stuff are not that uncommon. But that's not the point. The point is, should a technically ignorant but innocent person be potentially exposed to a prison term because something happened on his IP address that he didn't know about? I for one am glad that judge said no.

[Rob Lister]

Originally Posted by HarryT

To tie in for a moment to the "British High Court blocks TBP", that's one reason that all UK ISPs block (and have done so for many years) child porn sites. Do they not do so in the US?

The 'blocking' of an IP block is trivially bypassed. Every router on the entire internet--worldwide--would have to block it for it to have any impact whatsoever. We have entire IT industries and technologies that have sprung up specifically to subvert those well-meaning yet utterly naive laws.

[kacir]

Originally Posted by HarryT

Let's suppose there are four people using your IP connection, not to mention school friends, etc. There is proof that an illegal download was made via your IP connection.

Very few of us have dedicated IP address. I get assigned a completely new IP address quite often. I do not think that ISP logs are kept with enough accuracy and security to base hundreds of thousands dollars worth of fines on.
A few minutes difference in timing might mean that they will accuse you instead of Joe Random Copyright Infringer.

[HarryT]

Originally Posted by kacir

Very few of us have dedicated IP address. I get assigned a completely new IP address quite often. I do not think that ISP logs are kept with enough accuracy and security to base hundreds of thousands dollars worth of fines on.
A few minutes difference in timing might mean that they will accuse you instead of Joe Random Copyright Infringer.

ISPs do keep records of which dynamic IP is assigned to which subscriber at which times. They have to, by law, because they can be required to supply such information by a court order.

[JoeD]

Originally Posted by HarryT

Not under UK law. Here, if you are the registered keeper of a vehicle, you have a legal responsibility to know who is driving it at all times. Hence, if an offence is committed by that vehicle, you are legally required to disclose the identity of the driver at that time. If you are unable to do so (or refuse to do so) you'll face prosecution as if you were the driver.

That's why I say that I think that the same principle can be (and indeed, IS, in the UK) extended to IP connections, because there is a long-established legal precedent for doing so.

Not if you go to court. They have to prove who was driving.

I had a quick google and found the following links which have a bit more info

http://www.pepipoo.com/NIP.htm
http://www.abd.org.uk/defence.htm

In particular the second one has a quote from a magistrate.

Now bear in mind, there's a separate offence for not provding details of the real driver if it wasn't you. That's not relevant to this discussion though as we're assuming you don't know who used your IP to download infringing material (and of course it wasn't you).

As far as I can tell though, with speeding and parking fines they have to show you were the driver (or have you admit to it). Usually with speed cameras that's just a matter of looking at the photo, chances are if it's your car and the photo looks close enough to you, the burden may shift to you then proving it wasn't you (IANAL so don't know if that's true). With the IP question this would imo be akin to your computer been searched and the movie/book/whatever is found on it, now it's up to you to prove you didn't download it.

[JoeD]

Originally Posted by HarryT

ISPs do keep records of which dynamic IP is assigned to which subscriber at which times. They have to, by law, because they can be required to supply such information by a court order.

ISPs have in the past produced the wrong IPs when people have been accused. For example during daylight saving time change overs.

Unlikely, yes, but possible and has occurred. Problem for the people who were accused in those cases is, do they risk the cost of a court case to prove they didn't download anything (during which time maybe the mistake over the IPs might be found) or do they just pay the fine.

With the potential introduction of three strikes, that's even more worrying for people who are innocent.

I don't actually mind the idea of ISPs sending out notices of infringement, it'll encourage innocent people to get the security of their wifi and computers checked and to ensure family members are aware of the potential problems.

However, when it comes to issuing a fine or court proceedings, I really think they need something more than just the IP. That unfortunately may mean we need laws* allowing the police to seize or search computers for IP related offences. An IP address should only be used as reasonable grounds for the police to obtain more detailed evidence.

* Assuming they don't exist already and it's just a cost/time preventing the police going after those cases vs more serious crimes.