Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A web server logs the client IP address but without the last octet due to GDPR, as well as other data such as URI, date, time, cookie, User-Agent etc.
Can law authorities identify a wrongdoer based on the logs from the web server, including the truncated IP address, and the logs from the ISP? I assume they have a subpoena to obtain the logs.
To sum it up, approximately: the ISP CANNOT trace the person (map the person, they have business with, to the site user). They cannot even know there is a site the person accessed. The website CANNOT trace the user (map the user to the person).
GDPR ensures that the log data are split among the parties in such a way that they can't join them (where this can't be done - because the website has, let's say... your biometric data?), they legally MUSTN'T use the data they have. For example a frisky employee should not be able to get the address of a customer who bought a particularly kinky sex toy, even if purchase data and delivery address are both on the Web site, and IP isn't even needed. If at all possible, purchase data and delivery information should be separate (1).
But the authorities can perform the join that the GDPR does not allow to anyone else. So you have privacy, but only so long as you don't run afoul of the law.
Of course the "physical person" is the owner of the ISP account, which might not be the wrongdoer if, e.g.
(1) I am actually consulting for an e-commerce site where this is exactly the case (not Amazon, if anyone wonders). The order has the delivery information from Accounting encrypted with a public key, and the corresponding private key was given to the logistics firm and immediately destroyed afterwards. So the site knows that an order has come from user 12345 for item XYZ, and tells logistics to ship item XYZ to user 12345, address Base64EncryptedBlob, but it doesn't have any idea who 12345 is, or where s/he lives; it only knows that Accounting vouches for their money being good.
I will describe a real situation. I am now connecting to Amazon Europe site, through my Fastweb ISP. Both entities have to comply with GDPR, and as far as I know, they do.
When I say "Connecting to Amazon Europe site" I am actually calling three different entities: let us call them Amazon Infrastructure, Amazon Application, and Amazon Accounting.
Amazon Infrastructure is responsible for the maintenance of the Web server, and they log my full IP address, my User-Agent, obviously the URI and other information. They are subject to the GDPR, so that information has to be kept safe, must be the minimum necessary to ensure proper operation, has to be purged after the data retention window expires. If it contained personally identifiable data, which it doesn't, I would have to be informed and would have the right to request rectification or cancellation. They are responsible for the session layer that ensures that I can communicate correctly and flawlessly with...
Amazon Application, which is the e-Shop front-end, and needn't know my IP and therefore doesn't. They have a Session ID (which they log) and, after authentication, a User ID. They should have nothing else because they don't need it, and an appropriate API allows Amazon Application to show me my personal information, which it will never log, from...
Amazon Accounting, who knows my name, purchase history, bank information and so on. They don't have my IP address or Session ID because they don't need it. Also, for obvious reasons, I expect Amazon Accounting to exist within the digital equivalent of a fortified citadel. Here are my personal identifiable data (the IP is just personal), and I have the right of requesting update or deletion, subject to other provisions of the law - for example, I can request they forget everything about me, but payment data have to be kept for - if I remember correctly - up to ten years. They shouldn't be able to access that information after my request, except in anonymous form.
Now, something bad happens - an order gets contested, and I swear I did not place the order. Things go downhill to the point that the police gets involved. The issue is between me and Amazon Accounting.
This is where Fastweb can be contacted, but Fastweb's data will not be shared with Amazon. The police will collect data independently from the three Amazon entities plus Fastweb and run their own matching, which will allow them to pinpoint where the fiber optic cable is installed from which packets from a certain IP address came around on a certain day at a certain hour. They can also access any data that I asked to be forgotten, and Amazon accordingly sealed (so, "forgotten" does not mean "destroyed").
If necessary, my device will be impounded and analyzed to determine whether it was the one that was used for the crime.
It is entirely possible and even likely that the plaintiff might win the suit and collect damages and still not know lots of the information that was assembled during forensic operations.
So, they will never "trace" anyone, because they can't. But that someone will, nonetheless, be traced. Neither Amazon logs or Fastweb logs are enough for the full trace (Fastweb doesn't know that I visited Amazon web site, nor can they legally sniff the traffic or log outgoing IPs except in very specific, limited scenarios; Amazon can't know where the other end of a connection is), but together they are; under EU law, only police officers with a valid warrant can perform the match.
This is an interesting question!
I'm assuming the operative scenario is a Web Server objects to some event associated with client IP nnn.nnn.nnn.xxx where "xxx" is unknown. In order for the Web Server to have functioned, it clearly knew the full address including the "xxx" at the time, but the premise is that it dutifully forgot the last octet in the logs. So at some later point it contacted the Client's ISP and asked them to pursue the client.
Let me just say that I find this whole GDPR restriction doomed to failure, but that's just my opinion.
First, there is no guarantee that the first 3 octets or /24 will necessarily correspond to a particular ISP although it's pretty good odds.
I assume the ISP contact will include the /24 IP, and time stamp. The time stamp will narrow things quite a bit, but how well may be dependent upon the ISP and traffic volume.
If the ISP contact also includes protocol and dynamic port, the potential is high that the individual connection could be determined by the ISP, assuming they actually log this level of detail and are willing to put in the effort.
