Tracing IP Addresses

[garethedmondson]

Morning Guys,

We need to trace an IP address from a Virgin Media account - would anyone have advice on how to do this? I very much doubt Virgin Media will give us the details under the DPA but I thought I'd ask anyway.

A pupil has written some nasty stuff on Wikipedia about another pupil. We have the IP address from the Edit History (and the text they wrote) and it maps back to Gorseinon but from there we cannot trace any further.

The offending material has been removed but we have a very upset pupil here.

Cheers

Gareth

[FN-GM]

Even if you found the student, what could the school do? It was outside of school time...

[garethedmondson]

There is slander of a teacher there as well. Can we take this further?

Gareth

[Geoff]

It's libel, not slander. It's a civil offence and therefore nothing to do with the school so the people who believe they have been the victim of libel should go talk to a lawyer and go to civil court if there's sufficient grounds for a successful prosecution. The school could get dragged into court if such a thing went ahead though.

The school could act on its own if this falls under the remit of your anti bullying policy. However as you've already said, you don't have sufficient evidence to point fingers. Plus Virgin probably wont tell you anything about that IP without a court order.

On a more technical note, do you have any internet facing services uses by your staff/pupils that requires login and records ips? Such as a web server or email system? You might already know who was behind that IP at the time and not realise it?

[garethedmondson]

Thanks Geoff - got my terms mixed up there.

And regarding your last point - yes we do.

Gareth

[pcstru]

On a more technical note, do you have any internet facing services uses by your staff/pupils that requires login and records ips? Such as a web server or email system? You might already know who was behind that IP at the time and not realise it?

I was going to suggest this but great care is needed. Virgin operate IP leasing so there is no grantee that an IP address is associated with a login other than at the time the login was done. This could be a minor risk (in terms of accusing the wrong person) or if several pupils live next door to each other on the same network segment, a huge risk. The only sure way is records from the ISP - "this IP was designated to this device on this specific date and time", and you will only get that with a court order.

[Geoff]

It depends what level you are dealing with. The times would have to match (plus some records either side too for good measure) for it to stack up in court (although civil courts requirements are less than a criminal court). Preferably with an independent expert backing up the methodology and conclusions (I offer reasonable rates btw. )

To chase the issue internally (anti bullying policy) as long as you are satisfied yourself with the reliability of the information I don't think there would be an issue. No doubt you could ask for a second opinion from your LEA.

[januttall]

A pupil has written some nasty stuff on Wikipedia about another pupil. We have the IP address from the Edit History (and the text they wrote).

Gareth

Just a small but good point are you definite that it was another student, that wrote the comments (If you don't know who). the other way round is to hold your ear to the floor and see if there are any murmurings somebody must know who did this if in your school and are likely talking about it (long shot but easier than a court order).

and virgin IP addresses do change but not normally any where near as regular as bt or any provider that i know off, unless there are problems of course.

you could also try a tracert to see the ip of the nearest routing device it might narrow it down a little further than just the town and this sometimes gives you device names also. use it like a ping so [tracert 127.0.0.1] and it will map it through 30 hops.

hope this helps a little

[X-13]

I was going to suggest this but great care is needed. Virgin operate IP leasing so there is no grantee that an IP address is associated with a login other than at the time the login was done. This could be a minor risk (in terms of accusing the wrong person) or if several pupils live next door to each other on the same network segment, a huge risk. The only sure way is records from the ISP - "this IP was designated to this device on this specific date and time", and you will only get that with a court order.

However, while it's possible to know the IP [and by extension the owner] you still have no idea WHO did it.

If they're using unsecured WiFi the edit could have come from anyone. [Though, reasonably, it would only be someone who knows both the teacher and pupil.]

Plus, visitors to the home, other students for example, could also be to blame.


There was a story a while back, about a man being arrested/investigated for things he had viewed online, which turned out to be false.

It ended up being that a friend/relation was using his internet to do it.

I would link to it, but it's being flagged by our filtering... I'm also being semi-vague because I don't want Edugeek blocked.

[GrumbleDook]

Also contact the police as libel can slip into harassment, which is a criminal offence.

[Geoff]

In my experience the police do not have the time, expertise or will to investigate on-line harassment.

[garethedmondson]

Hi All,

Thank you for all your comments regarding this. We did look at the logs to see who had accessed one of our sites and from 4 IP addresses we came up with 3 names. The 4th name actually made the edit with his Wikipedia username :-)

Anyhow we got them in and without accusing them of anything asked them if they had anything to do with it. Believe it or not all 3 confessed to what they had done. One boy was actually amazed that we could trace his anonymity through an IP address.

The matter now moves onto the next stage with parental involvement.

So thanks everyone for your help with this. Case closed.

Gareth