On 2002-04-05 11:41, avanutria wrote:
Slightly aside, out of curiosity, is there a way for a message board to be completely anonymous? Tony
[ … ]
Most likely not. The message board probably records our IP numbers, which I believe system admins are required to hand over if law enforcement has reason to need it. But on most dial up services, the IP is different every time you log on. Networked places like university campuses (and cable modems, I think) keep the IP address constant for a particular computer. Presumably the IP can be traced back to your provider and from there to your registration information.
Just about every web server I know of keeps an access log. These logs generally accumulate at least the IP address of the client machine ( That’s you. ), the date and time of the request, the actual request made, sometimes the page you were coming from, and sometimes the operating system and browser you are using. If the web daemon is configured to do it, the IP address ( e.g. 123.45.678.90 ) can be reverse-resolved into the associated regular address ( e.g. dialup.foo.bar.com ). These records get huge fast, and most sites do not keep them forever. The actual turnover rate will depend upon the size of the site and the traffic load. Sysops tend to treat this information as confidential, but can be forced to open their records if required by search warrant or subpoena – as avanutria pointed out. Obviously, records can’t be surrendered that have been removed from the system according to normal administrative practice.
In order to identify who had posted a particular piece to a mailing list or message board, investigators would have to identify the source IP of the message, and then take that to the service provider who owns the IP to see if their records preserve who was using it at the time. They’ll hit a dead-end if the message was posted from a machine offered to the public in a library or cyber-cafe, for instance, and it’s also possible that the account was purchased from the service provider with a false name and address. This is how many of the “3-months free access” offers sent out by some of the major service providers get used. These are throw-away accounts which are abused like crazy and then abandoned. It is still possible, if the user hasn’t disabled caller-ID, that the service provider may log the telephone number used to make a dial-up connection and the user may be traced by this means – unless, of course, they’ve lied to the phone company too.
There are new “dynamic” name-services being used nowadays, in which a computer is assigned an IP each time it is turned on while connected to the network. The idea here is that IP addresses are becoming scarce in some heavily-used domains, and this is a way of conserving them. Computers which are turned off therefore don’t hog an IP someone else could be using. At least some universities appear to be moving to this approach, and it adds a layer of complexity to figuring out whodoneit.
Add to this the possibility that source IPs might be spoofed, e-mail headers forged, and the like, and it can be precious difficult to trace something back to the source, if the source doesn’t want to be found and knows how to hide. That said, most of us don’t know how to do these things, and it’s better to depend on being held accountable for one’s actions – even Kevin Mitnick was eventually required to do that. I tell my people that when they sit down at a networked computer it’s not like being at home in the bathroom with the door locked. It’s rather more like standing on a streetcorner and shouting. You’re in a public place, where anyone can see what you’re doing, and one should behave accordingly.
Our network people here at NIU told me that a student made a comment on a message board which convinced at least one participant that she was about to commit suicide. This individual called our university police ( long-distance ) in the small hours of the morning, who got in touch with the ITS people, then at home in bed. There were no legal problems because the logs belong to the university, and there was an officer knocking on her dorm door within fifteen minutes of the time she posted the message. It turned out that she was depressed, but not actually suicidal.
The speed at which they were able to move is quite breathtaking.