I work on a U.S. government crisis/suicide hotline as a rescue coordinator. We receive phone calls, (mostly cell) text and chat from all over the world. Most times the caller/chatter will not disclose their idenity. When the crisis responder feels that a person is a danger to themself or others, I take over to try to identify and locate the person and dispatch the correct emergency response.

We also get many prank calls. Our states protocol we will not report prank calls to any authority as one day that person may acually need assistance and we do not want to ever discourage a caller form utilizing our service.

When a person calls in, even if they have blocked their number, it is captured by a program we utilize, but only the number is dispalyed; no other info is available. In this case we ask law enforcement to ID/ping the subscriber via the service provider. When a person is coming in through chat the only thing we have is an IP address. Again, we contact law enforcement and ask them to find a location through the ISP. There are times when a tech from AT&T or another ISP will say that the IP is not traceable but cant explain why. For instance the last time this occured the IP was a satic coporate IP and tech stated that it didnt seem to be an open proxy but could not find out who/what this IP address was assinged to.

While I have a basic understanding of the technology I dont understand why the ISP could not ID the subscriber. I am familar that an internet user is able to hide thier IP by using a proxy server and some what understand how an IP can be hidden with a router in home (I think). I also underssatnd that cell providers like T-Mobile are now allowing calls via WiFi, and I assume that these calls can not be traced? Additonally some chatters are using a mobile device (I-Pad, smart phone) to come in over chat...also untraceable?

What I am looking for is a better understanding of how things work with regard to IPs so I can better maximize my effort, as some times lives do hang in the balance. I also pass this on tho the other coordinators and supervisors. This hotline is only 7 years old and I have had to train myself and others to increase the percentage of sucessful "finds" of those in crisis who are handed over to us in order to get help on the way.

Thank you, John G.

P.S. I am not up on all the acronyms

Addendum: When I receive a "consult" from a responder it is because the chatter is threatening, or in the act of, suicide, or threatening another. It is exigent..."happening now". We are a 24/365 operation. We need to locate/ID the chatter ASAP to dispatch Police/EMS. Would contacting google give us any advantage over what we do now...looking up the IP address for the ISP and asking that ISP for subscriber info to give to police? What I am trying to learn is 2 fold: What more can/should I do when an ISP says it cant be traced and; be able to determine (understand why) what circumstances/ criteria to look for to assess those untraceable IPs so as not to waste vauble time on a lost cause and move to the next rescue. (we recieve about 1000 calls a day and do about 36 rescues. Some can take several hours)

  • Was it that they couldn't trace the IP at all, or that they wouldn't trace without a court order?
    – cpast
    Feb 1 '15 at 21:43
  • A court order is never need in an exigent circumstance, just an admin. subpoena, so no, it was a case where the tech was baffled and coudn't trace it.
    – John G.
    Feb 1 '15 at 22:04
  • Static corporate ips are the responsibility of the actual company, which company would help a state investigation with the similar loyality as an ISP.
    – peterh
    Feb 1 '15 at 22:23
  • ARIN showed that it was assigned to AT&T and we couldnt find any other company name for it.
    – John G.
    Feb 1 '15 at 22:31
  • That is common. One idea—one which I am wholeheartedly against for most purposes, but might endorse in limited use for crisis situations—is to take advantage of certain Internet giants' willingness to cooperate with government requests. Have you contacted e.g. Google or Facebook to see what information may be available given the position of your operation? These are the services most likely to have identifying information in file for particular IP addresses, and they might be able and willing to provide you with limited query access on a need-to-know basis. Not familiar with policies.
    – AJAr
    Feb 1 '15 at 23:12

An ISP should be able to identify the accountholder details (including address on file where applicable) and at least the street address corresponding to the IP at a given time when dealing with wired residential connections, but there is not much more. There are some circumstances under which it is simply not possible to identify a person based on their IP address alone, e.g. public hotspots might give you the name of some McDonald's franchisee who operates several locations under the same Verizon account while controlling his own IP addresses (although a hotspot IP address might be better information than many other cases in practice).

If you intend to track down clients who come in via chat, it ought to be made explicit right off the bat. If it is not hidden from the user that the outcome may be a rescue team being dispatched, then they should have no issue sharing their location from the browser. Add a disclaimer that if the location is not correct to some reasonable accuracy, you will not be able to help them effectively.

Do what you can. If a user on chat is using their phone, the location shared should be GPS coordinates. If they are tethering or have disabled location services, you can compare against ranges of IP addresses used for wireless Internet service if lists may be provided to you by the major carriers (this way, you do not need to consistently query them; you know what's what from in-house data). In this case, you can ask the user to specify their address (and provide a very decent auto-suggest, maybe a map with quick zone options for rapid pinpointing). If they are not willing to do so out of fear that they may be tracked and visited, they are entitled to that information anyway. Tell them very clearly how the service operates, enable quick manual entry when it is not possible to derive location automatically (if it is, ask to verify), and just do what you can.

As for IP addresses, if you are working under a government-sponsored operation then you may be able to acquire access to certain details on a need-to-know basis with guaranteed accuracy to the ISPs' fullest abilities. You should not be questioning whether or not the operator is competent enough to provide the information required, and if you are then you need to push for better facilities.

  • Im not sure you understand what we do here. First, our operation is not sponsored by the government, I am a u.s Government employee as our all my coworkers and we work out of a goverment faciclity. Our protocol is set by Washington and telling a suicial caller/ chatter that if they dont reveal their address we cant help them is not an option. also I never questioned the tech competency she used the phrase "baffled".
    – John G.
    Feb 1 '15 at 22:38
  • I assumed you meant either government-sponsored or government-operated, so I mentioned the situation that would fit the lowest abilities/permissions likely to be enjoyed by either of the two. It was the former, and the latter likely includes the abilities of the former and then some.
    – AJAr
    Feb 1 '15 at 22:43
  • I can understand that. Apologies for the assumptions; I should have read more clearly and did not realize you were talking about mental health crises (assumed crises where one would call 911 if possible or use your service if not).
    – AJAr
    Feb 1 '15 at 22:43

IP addresses are assigned to Internet Service Providers who assign them to customers. (Sometimes, but less frequently, a block of addresses may be assigned directly to a customer, such as IBM.)

Sometimes IP addresses assigned to ISPs may be used for the ISP's internal operations, and not assigned to customers at all. Example: The IP address of an AT&T mail server, operated by AT&T for its customers, or even for its own employees.

The registered (with ARIN) owner of an IP address should know who's using it at any given instant. Whether they will tell you is another question entirely. I was once responsible for a very small block of IP addresses and there is no chance I would tell an anonymous voice on the phone who was using one of them at any given moment. There is not very much chance I'd give it out upon receipt of a faxed administrative subpoena until I'd talked to our lawyer.

I know that's not what you want to hear, but the urgency of your need does not outweigh the privacy of my customers.

Edited to add: About that "baffled" tech. If I were AT&T and I did not want my technical staff giving out information about certain IP addresses, I'd simply not have them in the database to which the techs have access. The tech cannot screw up, and cannot leak information by saying something like, "that's a blocked address."

  • All of the major ISPs and the majority of the smaller ones have 24hr compliance staff who routinely give us info on a faxed admin subpoena. It is only ocassionally they cant trace an IP. Technically, according to the law they dont have to give out any info at all but they routinely do so I dont think they are cherry picking the info. as to my need vs. privacy whats a life of a confused teen worth? But thanks for the answer.
    – John G.
    Feb 2 '15 at 2:48
  • I'm shocked i think there is no more privacy in the U.S so good i don't live it here
    – Freedo
    Feb 2 '15 at 12:06
  • 1
    The life of a confused teen is worth no more than that of (e.g.) an anonymous whistleblower. Bypassing one civilian's right to privacy for protection of one civilian's right to live will net you a zero benefit to society at best. Now realize that one civilian here is hypothetical (the person to be rescued may not even exist) while each successful query still infringes on the right to privacy of at least one real civilian. Your access can be abused by authorized personnel to reveal sensitive information under the guise of a boy who cried wolf. Understand that this can cost lives too.
    – AJAr
    Feb 2 '15 at 20:15
  • I am a student of the U.S. Constitution and as such let me say there is no guarantee with regards to privacy. Even if there were, no right is absolute. I do however agree that peoples privacy should be safeguarded. However, when loss of life is eminent the callers privacy is second to saving their life. ALL requests for information are done by a legal process that comes with those safguards legislated in the law. I cant say the same for an insurance company or potential employer that checks you out through lexus nexsus or trans union TLOxp. Thanks for your response.
    – John G.
    Feb 2 '15 at 21:50

There are not enough IP addresses for everyone to have one permanently assigned (at least in the legacy v4 system, and its replacement is only slowly gathering momentum). There are 2 solutions to this:

  • share a public IP address
  • only assign an IP address temporarily

A consequence of the first method is that there is another entity (or entities) behind whoever is known to be associated with the ip address you see and the end user. I mentioned ipv6 before - this is an entire seperate internet which uses such shared (ipv4) addresses to access the legacy internet.

A consequence of the second is that the provider must maintain detailled records in a suitable form for reverse indexing in order to resolve an ip address (and a time) to a specific subscriber. Not all do.

A further consideration is that there are many people who want to protect their privacy; sometimes this is for reasons you might find morally justifiable, and sometimes not. But there is a growing market of tools and services catering to this population.

It is not uncommon for large corporations to funnel traffic from their employees in disperse geographic locations back through a central location in order to ensure confidentiality, protect users against attacks and simplify access to protected resources using VPNs.

Also, a lot of the information made public about a network is done so on a voluntary basis. Only the organisations with a direct cable connection to the network in question actually need to the details of where it is / who pays the bill.

Something that might add value, if your chat is via a web browser is to implement geolocation on the web page - but this can be intrusive. You should probably get some expert advice and carry out market research before adopting it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.