Your IP is PI, Private Information
January 23, 2008 7:04 pmIP addresses, string of numbers that identify computers on the Internet, should generally be regarded as personal information.
This quote comes from Peter Scharr, who leads an EU report preparation on how well privacy policies of search engines comply with EU privacy law. On monday, he told the EU parliament in a hearing on online data protection that when someone is identified by an IP, or Internet protocol, address “then it has to be regarded as personal data.“
That means that every single log file that is generated by any form of server that cointains IP addresses becomes “protected information” and has to be stored in accordance with EU privacy directives.
Although I understand _why_ an IP is regarded as personal information - AOL publishing it’s users search histories and the stories build with these are telling enough - it somehow feels as ‘over the top’ to me. But then again, I must admit, I’m rather not-carefull as it comes to personal data and the internet.
Oh, and girls, guys and avies, did you know when connecting to a media or audio stream in Second Life, the server those files are hosted on can easily - and probably will - log your IP address? Or that this blogs logs IP addresses with comments, so if you’ve left a few comments and did not use a proxy server, I can take a wild but rather correct shot at where on planet earth your human resides?
What do you think? Will you stop logging IP addresses of commenters on your blogs? Do you already use a proxy whenever surfing the web? Is an IP address private data and should it fall under and thus be protected by Privacy Laws? Or is an IP just a random gathering of numbers and dots? ;)
|
|



13 Responses to “Your IP is PI, Private Information”
Yes, my wordpress is logging all our IP’s. No, I am not going to do anything with that data. Before write some privacy policy you’ll have to trust me about that. Actually, you’ll have to trust me after that too. I might do something about not logging those numbers if someone find me a plugin.
No, I am not using proxy. I hate condoms, is it absolutely necessary to have this one too?
And if someone’s life will be easier, I do have a footfetish, no need to put all those numbers together.
But, yes, IP is kind of data we want to keep our own control of. I am sick of those that watch me all the time to “answer my needs as a customer better”. Screw you and your answers. I know my needs and I know how to search the internet myself.
Definitely ridiculous, as for example all webserver statistics are based on IP addresses and so they show up in every damn statistic tool that’s out there and available for most people who run their own website.
I’m currently responsible for eight webservers, hosting about 100 different websites which produce tons of logfiles containing IP addresses every day … and do I feel guilty now? Not at all, cause it’s a standard procedure on all webservers all over the world!
Besides that, most people use dynamic IP addresses assigned to them on every dialup, so there’s no direct connection between you and your IP address most of the time, at least not without accessing the provider’s connection data (and that SHOULD only be accessible for legal actions against criminals … but that’s another story).
I know when I was an admin for an ISP we had to keep logs of what IPs were assigned to what account holder (for both dialup and cablemodem ISPs- both dynamically assigned) in case of subpoena (which happened once in the 3 years I was there). I’m not sure if that was a legal requirement (be it county, state, or country) or not. Fortunately, for my sanity, I just did technical stuff- paperwork beyond documentation gave me hives.
I’ve always known that whenever I go anywhere on the Internets my IP address is logged (websites and email sent and everything) and while someone can use that to find my general location from it (Or currently- the location of my headend.), I could point you to an easier way to obtain a direct address/phone, etc for me.
Is it private information? I personally do not see it as private information and treat it as such *when dealing with my own* IP address. However, if someone asked for info from my website, blog, or clients I’d require them to get a subpoena. Hell, if they really want the info they can work for it.
The AOL publishing their user searches was a ridiculous mistake. Those people at AOL should have known better not to release that database to a public accessible host. One thing I never do is enter my social security number in a search engine or any personal information that is meant for ME alone (mother’s maiden name is another example I know of). I’m familiar enough w/ how google *may* store my searches for data mining as well (not confirmed but a rumor I read).
*all the above junk is US centric b/c I am familiar with that- but I’m sure other countries have personally identifiable info similar to SSN*
I think it’s good that EU classified IP as personal information, in Sweden we have some private “cops” following up people basen on there IP address and tracked that into stuff they did on the net and used that to take people into “strange” legal actions. They where stopped from working with ip-addresses temporary when the Swedish government organisation (Data Inspektionen) decided that they needed special permission to used personal information.
Given what you can do if you spread ip-addresses between different services it’s good that it have some legal protection, phone numers are protected, ip-addresses are no different.
I think in the UK ISPs also record each persons IP address via the RADIUS logs. The police can ask for information on these records under the law.
I’ve seen requests to know who put up a website 5 years ago, and who linked to it. We got asked a few times to find out about a mailserver at 192.168.0.1 or in that IP range. (yes seriously)
ROFL Shockwave
About the question, I don’t care myself really.
Tor is damn easy to install, so if I really want to be anonymous for a quick surfing trip, I just log into that. Only problem is that’s it’s slow as fuck, but then again, it’s not like I need that kind of protection 24/7.
Except for that, my own blog probably logs IPs. Don’t think I can see those though. Maybe I can *shrugs* As if I care, the time that an IP-ban mattered died when dynamic IPs popped up.
Sure you can see… if it is written in database you can see it.
It is not about if anonymity can be achieved via tools and proxies. It can but question is what relationship an individual and state have. We also know that even if there is law against collecting data, some establishment services can go doing that. But it is good to state some rules of conduct.
Geeh, even I know that ‘192.168.0.1′ is ’self’. (Or smth like that. :d)
Indeed Dandellion. Imho, as a citizen, you should not worry about giving out your addresses, cell phone numbers, etc… as companies and governmental services you give those to, should not be allowed to pass them on, share them or process them over and over.
Vint, Not really self, private network, addresses used inside firewalls.
Self is 127.0.0.1. 192.168.0.1 is often used as the inside address of private firewall, router boxes and stuff like that.
:oopz:
/me blushes and crawls under the desk in shame. Did I say something? :D
Vint,
As usuall what you say is worth listening to.
The IP accounting idea is a bit strange, as it would have to be someone who has both bits of data. The ISP who assigns the IP address, and then they would have to obtain the IP logs from the sites.
So it woud be Police or a Govt agency
As far as I know, this didn’t happen with the child porn investigation ( known as Operation Ore in the UK ) or there would have been more arrests.
Confession time..I was once rather bored at an ISP i worked. One day I saved the proxy logs, and decided to have a look what people where looking at.. so I ran grep for the word sex…and the result was about a third the size of the log.
I could also see the proxy logs and the people on the system in real time and see what they looked at.
In Windows 2000 there is a hidden file called MM256.dat, this has something to do with IE, and it has a copy of what you have been visiting, and who is logged in to the PC. I’m not sure it’s in XP, I’ve not looked, or have I needed to use it for any reason.
A fine example:
- Someone changed the wiki entry on SLart recently.
- Although I agreed with what was posted, I think the more neutral text was better.
- I checked the IP address of the person that changed the entry.
- I ran that against the IP address of the people comment here. (I was curious if it was one of my readers.)
- I found an almost match (same provider, same city).
- Dropped an e-mail to that person, asking if it was them who changed it.
- Got a reply ‘euhm… lolz… do you want me to change it back?’
- A few minutes later, the original entry was reinstated.
:D
Whas that invading my commenter’s privacy? Probably. But I felt justified, as I thought the SLart article should stay ‘neutral’. But then the question is, what justifies, and what does not, and where do you draw the line? (Neat use of IP for instance, is that here on the poll, you can see where the people that voted yes or no are from. Under that privacy law, that could not be possible anymore? On the other hand, nobody links the IP to a person, just to a ‘no’, ‘yes’ or indifferent question.)
I’d say it all boils down to how sensitive you are of being identified in your internet activities. Only to speak of me, I am cursed with what my pet techie calls a « fixed IP », which he kindly pointed out to me is more or less equivalent to handing out my visiting card to any site or blog I happen to visit.
Now, RL me is not worried about companies, government agencies or such getting hold of said visiting card. The matter is completely different when it is Rheta (SL me) doing the surfing. Having her linked to RL would rapidly entail an avalanche of trouble, a busted marriage probably only counting as the first diffuse rumblings. (@Vint I admire the way you link your SL persona to your RL identity, but not everybody is in a situation to easily do so). And while I do not mind services I have subscribed to being able to pinpoint me (like Linden Lab, who hold my RL identity anyway), I am somewhat (and hopefully understandably) wary of having my RL identity easily trackable through every single comment I happen to leave on a blog.
Which makes me use Tor, courtesy of same pet techie, which is indeed a disgracefully slow experience (oh, by the by, @Daman if you think slow and fuck only go together in the negative, I am sure I do not want to ever share my bed with you ;) ).
So, yes, I absolutely agree IP addresses allowing to identify people should be considered personal data, because same people might not want to be identified every time they surf the web :).
Care to comment?