Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I received a mail about illegally sharing copyright-protected material on the Internet; I never did it. I checked my router's configuration and noticed that the MAC address of one of the connected devices doesn't match any of my devices. I'm afraid that somebody somehow hacked my wireless network and used my Internet connection to illegally download something.

About the legal questions: I'm living in Germany. However I guess it would be interesting to know how things are in the different jurisdictions.

  1. Is there any way for me to track this guy? I have his MAC address and can sniff his packets. Couldn't find any interesting detail in the packets since most of the packets are encrypted.
  2. Should I contact the police?
    1. Would the police be able to find out who bought a device with the given MAC address? Otherwise would they be able to get the packets decrypted to find out this guy's identity?
    2. Do you believe the police will actually do anything? In case they will, how long do you think it would take?
  3. I could change the router password right now to lock out this guy. I'm afraid, though, that if I do, it will be more difficult to prove that it was somebody else, rather than me, downloading the protected material. Is this fear found?
share|improve this question
Not an answer, but: if you are correct, and someone has accessed your wireless router even with a password set up, that person is probably also smart enough to spoof his MAC (so item 2.1.a is an overwhelming "no" -- even if it were possible to trace a MAC back to a purchaser somehow, you likely are not seeing the device's real MAC). In the event I'm wrong, see to look up the MAC's vendor. – apsillers Jul 15 '13 at 15:24… A similar question I had before – sudhacker Jul 15 '13 at 18:12
Either you are using WEP or you are using default / common passwords. Switch security to WPA2 and use a decent password – Ay0 Jul 15 '13 at 21:19
@Tom You have not provided details on the e-mail you got, but have you considered the possibility that the e-mail might be a phishing attempt from the intruder him/herself? If he is within your network, he might well have found out your e-mail address by gathering smaller details that go unencrypted. – Lex Jul 16 '13 at 11:35

I have to say the usual 'I am not a lawyer' here, and don't know the current law in Germany ( I believe this is changing a lot in recent times, as it is in all countries).

You should probably lock the other guy out and choose a more secure protocol such as WPA2. Not a good idea to let an attacker keep access to your network.

Any lawyers for the copyright holders will be holding you responsible as the packets went through your connection. You can keep a log of the traffic for the intruder on your system. It won't be that much proof, as you could easily spoof a mac address yourself and become your own 'intruder'.

There's really no way to prove your innocence which is what you will be asked to do, since the copyright holders will argue that all they have to prove is that the offending traffic went through your connection. Making it your responsibility to secure your connection properly. You can claim that the manufacturer of the router or your ISP made the protection trivial to break, and that you assumed that since there was a password, you were secure.

You could try some kind of man-in-the-middle attack on the intruder, since you are the man-in-the-middle. This might allow you to decrypt enough traffic to identify him/her, though I doubt it. If the traffic is mostly encrypted, it will be hard to spoof SSL certificates at this stage. This also raises the question that if the traffic is encrypted, how do the copyright holders know what data was in the offending traffic going to your connection.

Beware that a lot of these type of letters by copyright holders are scare-tactics, sometimes not even from the real copyright holders, to extort some money from you to make the problem go away.

Some mac addresses you might not have thought of might also be on your network such as smartphones / tablets / smart-tv / gaming console ... these might be your 'intruder'

share|improve this answer
Assuming the copyright infringement was done via Bittorrent, encryption doesn't help in that regard. Copyright owners sometimes hire companies to join Bittorrent swarms from which they can collect IP addresses. The main purpose of the encryption is to prevent throttling of BT by ISPs. – Dracs Jul 16 '13 at 0:49
In the United States, courts are beginning to understand that an IP address is not a person. Slowly. – Bob Brown Oct 16 '14 at 13:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.