Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My understanding of most filesharing lawsuits initiated by copyright holders is as follows:

  1. The monitoring agency will connect to a torrent swarm and collect the ip addresses of people downloading files to which they hold the copyright
  2. They identify the ISP's to which theses ip addresses belong and subpoena them for the identities of the end users in order to initiate legal proceedings against them directly.

What I'm wondering is if a 3rd party could legally start with your name and work backwards to find out if used Bittorrent or p2p. Let's say you're a public figure and they're looking for dirt. Wouldn't you need probable cause first?

Does it get more complicated if the person uses a secure vpn? Are there shortcuts that the 3rd party organization could take to gather p2p usage data without having to subpoena the ISP or vpn provider?

share|improve this question
add comment

1 Answer

There is no name in P2P networks. Your IP address is visible, but not your name. Of course, the name can be tracked back by asking the ISP, but this requires asking the ISP.

So the problem is: given an individual identified by name, can you find his current IP address without going through the subpoena+ISP path ? Well, it is sometimes possible. For instance, if the individual posts a message to Usenet through a client which uses the NNTP protocol, then chances are that the Usenet server will add an NNTP-Posting-Hostheader field containing his IP address -- thus his current IP address will be revealed (and published worldwide). Other common IP address leakages occur in sent email headers.

With a VPN and some care (e.g. not posting to Usenet directly, only through the VPN), an individual could keep his IP address "private", to be revealed only when legal action occurs.

share|improve this answer
    
IF you know, could also please clarify the following? If someone wanted to investigate an individual, would they need to meet some burden of initial evidence to receive compliance from the ISP to divulge IP address information? –  user20204 Jan 30 '13 at 19:46
    
It really depends on how things are done in the considered country; laws vary. But usually, yeah, ISP tend to require some kind of official court order or something like that before revealing the data, and whoever can issue such an order will need some "initial evidence". At least that's how it is supposed to go in democratic countries. –  Tom Leek Jan 30 '13 at 19:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.