Tracing an IP address

One of the problems with trying to promote means to achieve privacy in relation to the Internet is that you are seen as wanting to promote wrong doing which privacy facilitates (copyright infringement, terrorism, etc). Some of us realise there is a right to privacy and a very real concern that without people fighting for privacy we could find ourselves in a big brother style police state.

So, I had an idea. It is relatively simple, and I am tempted to implement it as it would have almost no cost. I do need to try and get confirmation that it is legally sound, obviously.

The plan would be to offer a new "PPP service" to customers. Anyone buying this is, and this is probably crucial here, not buying an Internet Access service from us. They are buying a PPP connection only. The service has initial proxy LCP and authentication (done by a BT proxy) but after that it is raw PPP to a pre-defined endpoint. There would be no requirement to run IP (either IPv4 or IPv6) over it even. It could carry any PPP protocol following standards or not, encrypted or not. We would provide a choice of endpoints to which this PPP connection is made via L2TP. These endpoints need not even be in the UK, but it probably makes sense for one such endpoint to be a box in our rack (but not owned, operated, or controlled by us). When making the L2TP connection we would not pass on the circuit ID.

The far endpoint will typically be an LNS (i.e. something that handles PPP over L2TP and connects to the Internet, allocating an IP address dynamically). This LNS would not be ours, and the owners of this endpoint would have no details of our customers or any contract with them. Indeed, they may have no contract with us either, if that helps.

So what would this mean exactly?

Well, we would not be an ISP in this case, and would have no IP address to log under the Data Retention Directive. We would not be subject to the Digital Economy Act as we would not be providing Internet Access, and even if a judge decided we were, we could not process a Copyright Infringement Report as we would not have a record of any IP being used. We would have contact details for our customer, of course. The plan would be that this would be like our Home::1 tariff.

The operator of the LNS would be providing Internet Access and so be an ISP, in many ways. However, for the Digital Economy Act they would not be as they have no contract with the subscribers. They have no details of the end users. This also means that they have no details to give up if they were to receive a Norwich Pharmacal Order (court order to hand over customer details). They would have no circuit ID either, so even if they were to give up that the connection came from us, we would not be able to identify which customer it is. As we would not be an ISP we would not even have logs of times of connections. This is even more complex if the LNS provider is not even in the UK.

Some of the daft things proposed, like filtering adult content would be thwarted too. We would not be an ISP so not liable to do anything. The ISP would have no contact details for end users so could not ask them if they want filtering or not. Depending on definitions in the legislation they may not be covered - e.g. the Digital Economy Act requires an ISP to have a contract with subscribers to be applicable, so laws like that fall flat on their face.

What would it not change?

Anyone with access to routers in the Internet would still be able to dump or intercept traffic for an IP address, and would do so if subject to a court order. In theory, as an ISP, we could be required to dump traffic for a customer connection, which would then allow the current dynamic IP to be found (if there is one). Obviously use of encryption on the PPP link helps, as does end to end encryption and the LNS being in a different country. It means that various laws can still be used actively to track crime to some extent. It is only really retrospective tracking that would be made difficult, and copyright trolls, and so on.

Who pays?

One issue is who pays the LNS provider. This is where renting rack space to an LNS provider in our rack would be handy as traffic would still use our transit. We can charge for the service in the same way as usual. The commercial arrangement with the LNS provider can be cost neutral. Though, even if the LNS provider was in a separate location we could, in theory, pay them for transit which matches what they pay for their Internet back-haul. That way the LNS provider has no contract with the end users.

Will we do this?

I don't know yet. It depends a bit on some of the crazy legislation being proposed. If this sort of thing thwarts that legislation, then maybe. It would clearly thwart the DEA and NPOs (legal advice on that appreciated). The idea of a company like ours offering a service which is not Internet Access would thwart a lot of things as the laws are not designed around that. If they were, then they cover a lot of other things too and have unwanted side effects. I suppose, at the end of the day, it depends no whether there is a lot of demand for this type of service. In some ways, stupid new laws could be useful in creating demand, but personally I would rather that was not the case.