Rapid advances in technology have made information systems themselves the subject matter of offences, and the acts committed through these systems have grown more varied. Correctly identifying the perpetrator is of great importance in investigations in this field, since punishment depends on establishing beyond doubt who committed the act. Where that certainty cannot be achieved, the presumption of innocence comes into play and the person has the benefit of the doubt. In practice, one of the tools most frequently resorted to in order to reach the perpetrator is the IP address. Although there are various types of such address, two stand out for our purposes: the dynamic IP and the static IP. However, as their reliability is open to debate, whether this data may be regarded as sufficient in itself to identify the perpetrator must be assessed separately.
Whether the address is dynamic or static in nature is decisive both for establishing the act and for identifying the perpetrator. Since a dynamic address is variable, the same address may be used by more than one person or device. A static address, by contrast, is a type that is used by particular devices or persons and does not change; in this respect it makes the identification process easier. Naturally, before any enquiry can begin, the judicial authorities must first be informed of the situation. For details of the application procedure, our note entitled How Is a Complaint Made in Respect of Cybercrime? may be consulted.
What Is an IP Address?
The internet protocol address, to give it its full name, is the address used by devices exchanging data over the internet or another computer network. It is by this means that devices are able to determine one another’s access addresses. Beyond this, certain data concerning the user may also be reached by working from the IP address; foremost among these are the location of the device using the address and a listing of the sites the user has visited. By applying various methods to these listings it is even possible to carry out a character analysis of the user.
The Distinction Between Dynamic and Static IP
An IP address may be dynamic or static. With a dynamic address, an address that happens to be free at that moment is allocated temporarily to the requesting device by the service provider; this may be likened to giving the device a kind of visitor’s pass. A static address, by contrast, is fixed; the IP information of the computer holding that address always remains the same and, in a sense, functions as the identity card of the internet subscriber concerned.
With a dynamic structure, the same address may be used by different devices at different periods of time. The converse is also possible: a single device may connect through different addresses at different times. Indeed, every time a router such as a modem is switched off and on, the address allocated changes. This variability creates a serious difficulty in identifying the perpetrator.
Although a static address makes identification easier because it does not change, it is not sufficient to dispel certain uncertainties. This is because a static IP points not directly to a device but to a subscription entitled to connect to the internet. All the devices making use of the wireless connection of the same modem, for example, connect through the same address; in other words, the IP information of every device connected to that modem at the same time will be identical. It is therefore not possible to determine, merely by looking at the IP data, which device an internet connection made through that address belonged to.
Is IP Data Alone Sufficient to Identify the Perpetrator?
Under the contracts signed with internet service providers, the addresses allocated to the router are recorded in the name of the party to the contract. Even though every transaction carried out through that address is presumed to belong to that person, it is clear that there may be persons who commit offences through the same router by unlawful means.
It is by now a widely known fact that IP addresses can be manipulated, that is to say altered, by various techniques. For this reason, unless it is supported by the opinion of an expert and a court-appointed expert that the addresses are reliable and have not been interfered with, they cannot be used as evidence on their own. What is more, it is more likely that the person carrying out the act will unlawfully seize an address belonging to someone else and not registered in their own name and turn it into an instrument of the offence. For this reason, in most cases there will be no question of punishing the person who appears in the records as the holder of the address, in accordance with the principle that the accused has the benefit of the doubt. That said, where the data obtained through the IP is supported by ancillary elements and other evidence, it may become possible to identify the perpetrator.
The 8th Criminal Chamber of the Court of Cassation, in its decision no. E.2016/12634, K.2017/4967 of 03.05.2017,
“…In the face of the accused’s defence, in which he did not accept the accusation and stated that, since a wireless modem was used, his line might have been accessed and used by others; whereas the legal position of the accused should have been assessed and determined by requesting information from the relevant internet provider with a view to determining what kind of modem was used on the internet line to which the reported IP numbers belong, whether it was wired or wireless, whether it was password-protected, and whether users other than the accused connected to the internet through the modem, and by obtaining the computer belonging to the accused and having the LOG records examined by an expert court-appointed expert, and, according to the result, by taking into account that if the e-mail address belonging to the intervening party was rendered inaccessible, entry into the e-mail address falls under Art. 244(2) of the Turkish Penal Code, whereas if access to that address was not blocked and it is established that the intervening party continued to remain in his e-mail address, the offence within the scope of Article 243(1) of the same law will be constituted, judgment was instead given in the manner written on the basis of an incomplete investigation, which is contrary to the Law, and the accused’s grounds of appeal on points of law having therefore been found well-founded, it was decided unanimously on 03.05.2017 that the judgment be QUASHED for this reason pursuant to Article 321 of the Code of Criminal Procedure No. 1412, applicable by virtue of Article 8/1 of Law No. 5320.”
Such was the judgment given. As is apparent from the decision, an IP address has not been regarded as sufficient in itself for establishing the offence and the perpetrator.
Today individuals spend a considerable part of their daily lives online, from working life to education, from shopping to social media, and from communication to accessing the news. The offences that may be committed over the internet grow more varied by the day and occupy an ever greater share of the judiciary’s workload; violation of the privacy of private life, insult, threat, aggravated fraud, obscenity and the unlawful recording of personal data are but a few of them. For this reason it is possible for anyone who has contact with the internet to find themselves in the position of a suspect in, or the victim of, certain offences, even without any connection to the incident. In conclusion, since IP addresses do not point directly to a particular person, they will not be sufficient to identify the perpetrator unless they are supported by other evidence.
Related notes: The Offence of Insult Through Social Media and the Internet; Insult Through Fake Accounts; The Offence of Threat Through Social Media and the Internet; Threats Made by Telephone; The Offence of Recording and Disseminating Personal Data by Means of the Internet.
Independent Legal Assessment
In information technology files the IP record is the starting point of the investigation; it is not the sole basis of the judgment. The picture frequently seen in practice is that the person named in the subscription record is placed directly in the position of suspect, while technical questions such as whether the modem was password-protected and what the LOG records show are left unanswered. The Court of Cassation’s grounds for quashing were likewise directed at that incomplete investigation. For this reason, gathering in full the technical evidence surrounding the IP data is decisive both for the suspect and for the victim:
- Asking the service provider whether the registered address is dynamic or static
- Enquiring whether the connection was wireless, whether it was password-protected, and what other devices used the same line
- Having the LOG records of the devices belonging to the suspect examined by an expert court-appointed expert
- Assessing, by way of a technical opinion, the possibility that the address data has been manipulated
- Supporting the IP finding with ancillary evidence such as the content, the time stamp and witness statements
Independent Legal provides services in the assessment of technical evidence and in representing the parties in investigations and prosecutions relating to cybercrime.