[AusNOG] Metadata retention... it's now (almost) a thing

[thelionroars]

I'm surprised MAC address tracking is being taken seriously by anyone here.
A conviction based on it would never stand.
On 30 Oct 2014 13:52, "Paul Julian" <paul at oxygennetworks.com.au> wrote:

> They would only catch small time script kiddies with MAC address, anybody
> who knows what they are doing won't be using their machine or will be using
> different ones all the time, I mean seriously, busting somebody based on
> MAC address would be small time stuff surely, sure it might get the people
> pirating movies and porn etc but this bill is supposed to be to save the
> country from the terr0rists isn't it ?? I really can't see a person like
> this who would go to elaborate lengths to not get caught being busted by
> using the same MAC address multiple times.
>
> Paul
>
> -----Original Message-----
> From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Matt
> Palmer
> Sent: Thursday, 30 October 2014 1:33 PM
> To: ausnog at lists.ausnog.net
> Subject: Re: [AusNOG] Metadata retention... it's now (almost) a thing
>
> On Thu, Oct 30, 2014 at 01:00:00PM +1100, thelionroars wrote:
> > I would hope someone involved realises that identifying with a MAC
> > address is worse than useless.
>
> On the contrary, a MAC address identifies a device (to a reasonable
> degree).
> It may not help a *huge* amount with making an arrest[1], but it'll
> provide a solid piece of evidence to use towards gaining a conviction.  Or
> at least confirming that you're water-boarding the right dissident (if you
> worry about those things).
>
> - Matt
>
> [1] Although finding the same MAC address using multiple different
> networks at different times[2], you can get a good indication of movement
> patterns, which may then provide more data to aid in apprehension.
>
> [2] That's even *with* iOS 8's MAC address randomization on probes.  For
> any device that *doesn't* do randomization, I'd be amazed if law
> enforcement doesn't quickly gain the technology required to track that --
> if they aren't already doing it.
>
> --
> "You are capable, creative, competent, careful.  Prove it."
>                 -- Seen in a fortune cookie
>
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
>
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20141030/2d3dd95c/attachment.html>