1

A web server logs the client IP address but without the last octet due to GDPR, as well as other data such as URI, date, time, cookie, User-Agent etc.

Can law authorities identify a wrongdoer based on the logs from the web server, including the truncated IP address, and the logs from the ISP? I assume they have a subpoena to obtain the logs.

0
2

Yes (unless the wrongdoer took precautions)

To sum it up, approximately: the ISP CANNOT trace the person (map the person, they have business with, to the site user). They cannot even know there is a site the person accessed. The website CANNOT trace the user (map the user to the person).

GDPR ensures that the log data are split among the parties in such a way that they can't join them (where this can't be done - because the website has, let's say... your biometric data?), they legally MUSTN'T use the data they have. For example a frisky employee should not be able to get the address of a customer who bought a particularly kinky sex toy, even if purchase data and delivery address are both on the Web site, and IP isn't even needed. If at all possible, purchase data and delivery information should be separate (1).

But the authorities can perform the join that the GDPR does not allow to anyone else. So you have privacy, but only so long as you don't run afoul of the law.

Of course the "physical person" is the owner of the ISP account, which might not be the wrongdoer if, e.g.

  • the wrongdoer exploited an unsecured WiFi belonging to someone else
  • the ISP account is not the real one due to VPN, TOR, or remote desktop. In these cases, a further investigative stage may or may not disclose who it was that accessed the intermediate node, whose IP turned out in the logs.

(1) I am actually consulting for an e-commerce site where this is exactly the case (not Amazon, if anyone wonders). The order has the delivery information from Accounting encrypted with a public key, and the corresponding private key was given to the logistics firm and immediately destroyed afterwards. So the site knows that an order has come from user 12345 for item XYZ, and tells logistics to ship item XYZ to user 12345, address Base64EncryptedBlob, but it doesn't have any idea who 12345 is, or where s/he lives; it only knows that Accounting vouches for their money being good.


I will describe a real situation. I am now connecting to Amazon Europe site, through my Fastweb ISP. Both entities have to comply with GDPR, and as far as I know, they do.

When I say "Connecting to Amazon Europe site" I am actually calling three different entities: let us call them Amazon Infrastructure, Amazon Application, and Amazon Accounting.

Amazon Infrastructure is responsible for the maintenance of the Web server, and they log my full IP address, my User-Agent, obviously the URI and other information. They are subject to the GDPR, so that information has to be kept safe, must be the minimum necessary to ensure proper operation, has to be purged after the data retention window expires. If it contained personally identifiable data, which it doesn't, I would have to be informed and would have the right to request rectification or cancellation. They are responsible for the session layer that ensures that I can communicate correctly and flawlessly with...

Amazon Application, which is the e-Shop front-end, and needn't know my IP and therefore doesn't. They have a Session ID (which they log) and, after authentication, a User ID. They should have nothing else because they don't need it, and an appropriate API allows Amazon Application to show me my personal information, which it will never log, from...

Amazon Accounting, who knows my name, purchase history, bank information and so on. They don't have my IP address or Session ID because they don't need it. Also, for obvious reasons, I expect Amazon Accounting to exist within the digital equivalent of a fortified citadel. Here are my personal identifiable data (the IP is just personal), and I have the right of requesting update or deletion, subject to other provisions of the law - for example, I can request they forget everything about me, but payment data have to be kept for - if I remember correctly - up to ten years. They shouldn't be able to access that information after my request, except in anonymous form.

Now, something bad happens - an order gets contested, and I swear I did not place the order. Things go downhill to the point that the police gets involved. The issue is between me and Amazon Accounting.

This is where Fastweb can be contacted, but Fastweb's data will not be shared with Amazon. The police will collect data independently from the three Amazon entities plus Fastweb and run their own matching, which will allow them to pinpoint where the fiber optic cable is installed from which packets from a certain IP address came around on a certain day at a certain hour. They can also access any data that I asked to be forgotten, and Amazon accordingly sealed (so, "forgotten" does not mean "destroyed").

If necessary, my device will be impounded and analyzed to determine whether it was the one that was used for the crime.

It is entirely possible and even likely that the plaintiff might win the suit and collect damages and still not know lots of the information that was assembled during forensic operations.

So, they will never "trace" anyone, because they can't. But that someone will, nonetheless, be traced. Neither Amazon logs or Fastweb logs are enough for the full trace (Fastweb doesn't know that I visited Amazon web site, nor can they legally sniff the traffic or log outgoing IPs except in very specific, limited scenarios; Amazon can't know where the other end of a connection is), but together they are; under EU law, only police officers with a valid warrant can perform the match.

9
  • I know for a fact where all data is logged, such as URI, cookie, User-Agent, and IP but with removed last octet. I presume that ISP can look at the time stamp, URI and other data to identify the device/user behind the IP address. I am talking about situation where website and ISP received subpoena for log data. – Quirik Sep 28 '20 at 7:22
  • @Quirik okay. Then, the ISP CANNOT trace the person (map the person to the site user). The website CANNOT trace the user (map the user to the person). On the other hand, authorities CAN trace the user by combining the data subpoena'd from both. "Privacy" means that neither the ISP nor the Website can peek into your affairs, and GDPR ensures that the log data are split among them in such a way that they can't (where this can't be done they legally MUSTN'T use the data they have). But the authorities can perform the join that the GDPR does not allow to anyone else. – LSerni Sep 28 '20 at 10:04
  • 1
    I was unclear. When I said ISP, what I really meant was whether a user with masked IP address can be identified. Therefore, based on the data from website and data from ISP, a user or client device can be traced. Am I correct? – Quirik Sep 28 '20 at 10:13
  • @Quirik yes, almost certainly. But no simple employee from either the ISP or the Website should be able to do that. If they can, then someone badly borked their GDPR compliancy, and actually I think (I'd need to check, but I'm pretty sure) this is to be considered a data breach. – LSerni Sep 28 '20 at 10:21
  • But it is OK in a case where authorities obtain data from the website, and that send a subpoena to ISP to obtain their logs based on the website data (since client's masked IP belongs to that ISP)? – Quirik Sep 28 '20 at 10:25
0

This is an interesting question!

I'm assuming the operative scenario is a Web Server objects to some event associated with client IP nnn.nnn.nnn.xxx where "xxx" is unknown. In order for the Web Server to have functioned, it clearly knew the full address including the "xxx" at the time, but the premise is that it dutifully forgot the last octet in the logs. So at some later point it contacted the Client's ISP and asked them to pursue the client.

Let me just say that I find this whole GDPR restriction doomed to failure, but that's just my opinion.

First, there is no guarantee that the first 3 octets or /24 will necessarily correspond to a particular ISP although it's pretty good odds.

I assume the ISP contact will include the /24 IP, and time stamp. The time stamp will narrow things quite a bit, but how well may be dependent upon the ISP and traffic volume.

If the ISP contact also includes protocol and dynamic port, the potential is high that the individual connection could be determined by the ISP, assuming they actually log this level of detail and are willing to put in the effort.

2
  • I find it hard to believe that ISP is not able to identify the client device. However, if this is not the case, it gives a lot of advantage to a possible wrongdoer. – Quirik Sep 27 '20 at 20:57
  • @Quirik - Even if if the ISP potentially can, it places a lot of dependency on the ISP's good graces. That's why I said it seems doomed. – user10216038 Sep 27 '20 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.