Web Insecurity

Are IP Addresses Personal Information?

This is some what of a ramble today based upon an Outlaw News article that was posted today: http://www.out-law.com//default.aspx?page=9505

A German court has ruled that website operators are allowed to store the internet protocol (IP) addresses of their visitors without violating data protection legislation. Without additional information, IP addresses do not count as personal data, it said.

This is interested because server logs almost always contain IP addresses. Would they be violating data protection legislation if they had a record of the hosts who accessed the web server? That would be ridiculous. I have mixed feelings about this, most of me personally do not see the problem with this, if a website wants to track when an IP address visits their site, and then correlate that data to user accounts then why is it a problem? Is it a problem if they geocode the IP address and store data related to accounts or geographic areas or demographics? Does that violate personal data since it is not targeted to a specific user?

While the document says that: “In practice, it is difficult to use IP addresses to build up personalised profiles,” said the guidance. “Many IP addresses, particularly those allocated to individuals, are ‘dynamic’. This means that each time a user connects to their internet service provider (ISP), they are given an IP address, and this will be different each time.”
I beg to differ. In practice I do not think it is particularly difficult to scan through server logs and/or customized event logs to get information on clients. Take a look at ARIN.NET whois page: http://ws.arin.net/whois/
then take a look at: http://www.maxmind.com/app/locate_ip
Does storing the IP address sound like private data now, or just the reports that can be automatically generated from this information. Any opinions thoughts or responses are always welcomed.

Add comment October 14th, 2008

Kernell Faces Possible Jail Time

So, it appears that Kernell, has a trial date for December 16th. If he is guilty like I said, he should be punished. What may have seemed like an elite hack for him (but was far from it) now has him facing a possible five years in years in prison, a possible quarter million fine, and three years of supervised release if convicted. While these will be negotiated down, I doubt he will do the full five years. While these terms may seem harsh the five year maximum term seems to be what others are getting for petty larceny. He is lucky that the penalties are not even greater.

I feel bad for Kernell in the way that one bad decision may count as a felony. He isn’t allowed a computer, but can apparently access e-mail and the internet for class work. How exactly this is going to be monitored and implemented would be interesting to know. Are they going to print his e-mails out and have supervised web-browsing?. How is he ever going to live without the web?
This also brings up the question is he allowed a cell phone? Mobile browsers or even SMS can be very powerful tools. I’ve put Dec 16th in my calendar, I’m interested in what the verdict will be for this one.

Add comment October 9th, 2008

Server Outage, Lost Posts

Hey, just writing a quick note to inform you that my server suffered from a hard drive failure. Although mostly everything was recovered from backups I seem to have lost a couple of posts from October. While this isn’t a big deal for me because I have other means of recovering the lost content (if it works), but it makes me wonder how others deal with disasters. The site was down for a lot longer than I would have liked but it was out of my control, so there was nothing I could really do. Once everything was restored I still had to reset all the database passwords as the backups did not save these. It is something that I will think about and hopefully implement a fix for before the next disaster.

Add comment October 5th, 2008