[AusNOG] Victorian Police - internal assistance??

[Ross Wheeler]

On Wed, 30 Aug 2017, Brad Gould wrote:

> Seems like the only problem he had was that he interchanged the term "ISP number" with "IP address".
> But his concept (and base understanding) was sound - wifi users share an IP address.

Umm... sorry Brad, but no.
The users will typically have their own IP address on the "inside" of 
their network, so looking at what address another computer in the same 
house has.. is not going to tell you the IP address someone like lifeline 
would see a request from.

Also, "wifi" is a term frequently used interchangably with "wireless".
There are "wireless" providers in this area that the person MAY have been 
using instead of a "wifi router (in the house, connected via say ADSL)"

It also doesn't mean that connecting to the network and finding the 
internal IP, or indeed the EXTERNAL IP would tell him what the IP address 
of the user was at any point in the past - because most people are on 
dynamic IPs.

And even then, there's no guarantee that any of these will tell the 
officer what IP address may have been recorded at Lifeline.


> Also, he successfully chose to call someone with more experience and 
> tried to confirm his reasoning.

Yes, hence my question. Surely there's some internal police resource that 
could help him in an appropriate manner. To to it with evidenciary 
considerations, to explain perhaps how it works and what else he needs to 
do.

> So - well done to the officer for exceeding the average Jane/Joe in 
> basic internet knowledge (before the call), and for asking questions 
> rather than assuming.

Not sure I agree with you. He demonstrated more of a "dangerous level of 
ignorance" even if he did have the bright idea of "asking questions".


> What is the problem exactly?

Well, in no particular order:
* Why call me?
   1. I'm not the provider
   2. I'm not in any way involved
   3. I'm not even in the same state.
   4. I have no past history with this officer or station.

* With this level of aparant incompetence, I fear whatever investigation 
he's working on will be severely compromised.

* From a "doing the right thing" perspective, if I could find a suitable 
internal resource for him, I'd attempt to put him in contact.

He did say that he called me because, basically, he found my number as "a 
local internet provider and thought he'd call for some help".

Thanks also to the many who have contacted me off-list with your various 
war-stories of LEA-incompetence and ignorance. Seems it's widespread and 
probably incurable.