Authors: Pavol Sokol, Laura Rózenfeldová, Katarína Lučivjanská, Jakub Harašta
Abstract
Use of IP addresses by courts in their decisions is one of the issues with growing importance. This applies especially at the time of the increased use of the internet as a mean to violate legal provisions of both civil and criminal law. This paper focuses predominantly on two issues: (1) the use of IP addresses as digital evidence in criminal and civil proceedings and possible mistakes in courts‘ approach to this specific evidence, and (2) the anonymisation of IP addresses in cases when IP addresses are to be considered as personal data. This paper analyses the relevant judicial decisions of the Slovak Republic spanning the time period from 2008 to 2019, in which the relevant courts used the IP address as evidence. On this basis, the authors formulate their conclusions on the current state and developing trends in the use of digital evidence in judicial proceedings. The authors demonstrate the common errors that occur in the courts’ decisions as regards the use of IP addresses as evidence in the cases of the IP addresses anonymisation, usage of the in dubio pro reo principle in criminal proceedings, and the relationship between IP addresses and devices and persons.
Introduction
Digital forensics aims to answer the ’what’, ’why’, ’how’, ’who’, ’where’ and ’when’ type of questions (Montasari, 2017). In some cases, these answers are later presented to the court. This process engages many stakeholders with different interests, different level of knowledge and different roles (Stahl et al., 2012). As demonstrated by Brungs and Jamieson (2005) and Liles et al. (2009), members of these groups often disagree on the importance of specific legal issues related to digital forensics. These results extrapolate to the area of general issues as well, as digital forensics experts, members of law enforcement agencies, attorneys and judges focus on different issues and face different challenges.
Additionally, these stakeholders‘ groups have a different level of influence over existing forensics practices. Forensic experts are required to satisfy legal requirements. This led to a surge in development of tools aiming to ease the communication of basic concepts to the audience with legal background. On the side of forensic experts, standard operating procedures are developed, such as the procedure for router examination at the scene presented by Horsman et al. (2019). Standard operating procedures and similar tools ensure ’the validity, legitimacy and reliability of digital evidence’ (Slay et al., 2009) as these are the core values behind any forensic process (Vincze, 2016). Development of those procedures leads to standardisation across the investigation to ensure ’that work is done consistently by all persons who are required to do the same task’ (Manghani, 2011). The ability to seize digital evidence and to do so legally is often followed by the challenge of making lawyers understand the evidence. Lawyers and judges must be able to grasp the basic concepts in order to use the information provided to them by forensic experts efficiently. Education is often discussed, as a mean to allow lawyers to understand what they can expect from digital forensic experts and even what questions should lawyers ask them (Wong, 2013) (Oparnica, 2016) (Henseler and van Loenhout, 2018). In the past, limited education of lawyers was quoted as one of the reasons for underuse of digital evidence in the USA (Rogers et al., 2007).
The issue of ’how’ to conduct the digital forensics investigation is shaped by the legal requirements. These requirements may be difficult to pinpoint, as they are shaped by legal acts and by the practice of courts. These are understandably prone to change and development. Analyzing court decisions can lead to the identification of legal requirements for seizing and handling digital evidence. Additionally, in the case of the absence of a unified courts‘ practice, analysis can lead to the identification of gaps in the use of digital evidence, which can, in turn, lead to legislative action clarifying the requirements. Such analyses depend largely on the availability of courts’ decisions for further analysis. In our research, we conduct a quantitative analysis of the use of IP addresses as a special type of digital evidence by Slovak courts. Our goal is to find out how IP addresses are represented as evidence in court decisions and how various issues (identifiability, multiple users using the same device, the difference between IPv4 and IPv6 etc.) are represented in these decisions.
The main goal of this paper is to analyse different parameters that impact the courts’ final decision when using the IP address as evidence. To achieve this goal, we aim to answer the two research questions.
- What attributes are important for court when it needs to rely on IP address as evidence? What are attributes important to the court’s decision? In particular, what evidence with respect to IP addresses is relevant?
- How courts approach the anonymisation of IP addresses in their activities?”
The second aim of this paper is to consider the courts approach to the IP addresses’ anonymisation, specifically when considering IP address as an online identifier. In this regard, we refer to the relevant judgements of the CJEU, especially to the case C-582/14 Breyer and the subjective approach it formulated to answer the question of whether IP addresses are able to identify a natural person.
This paper is organized into five sections. Section 2 focuses on the review of the published research related to the research questions. Section 3 provides details on the research methodology and outlines the data set and methods used for the analysis. Section 4 describes the results of the analysis and discusses key takeaways obtained from the analysis. The last section contains conclusions and our suggestions for future research.
