DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
"There is no Geography on the Internet" and other Hyperbole
For Presentation at TPRC 2004
This paper is far from finished. Please excuse while I apply a few more layers of polish and prose.
Robert Cannon1 September 2005
Robert Cannon is Senior Counsel for Internet Policy at the Federal Communications Commission. He is also the Director of Cybertelecom, an open law project on federal Internet policy. Notes and background information for this paper can be found at Cybertelecom :: Notes :: Geolocation http://www.cybertelecom.org/notes/geolocation.htm. Views express do not represent those of the FCC, Cybertelecom, or my dogs. Special thanks goes to Richard Hovey who keeps enlightening me of my errant ways. Robert Cannon can be reached at [e-mail].
1
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
Table of Contents
INTRODUCTION ........................................................................................................................................ 3 THE HYPERBOLE OF GEOGRAPHY .................................................................................................... 3 WHAT THE COURTS THINK......................................................................................................................... 4 "Geography is Meaningless" ................................................................................................................ 4
Strike One: The Communications Decency Act................................................................................................ 5 Strike Two: Children's Online Protection Act................................................................................................... 6 Strike Three: American Libraries Ass'n v. Pataki ............................................................................................. 8
"You Are Here" ..................................................................................................................................... 9
France v. Yahoo!............................................................................................................................................... 9 iCraveTV ........................................................................................................................................................ 11 Sony Music ..................................................................................................................................................... 11 MaryCLE ........................................................................................................................................................ 11
Observations ....................................................................................................................................... 13 THE ILLUSIVE TRUTH ............................................................................................................................... 14 AVAILABLE TOYS..................................................................................................................................... 14 Projects ............................................................................................................................................... 15
IETF RFC 1876 DNS LOC............................................................................................................................. 15 CAIDA's NetGeo ............................................................................................................................................ 16 IETF GeoPriv.................................................................................................................................................. 18 IETF ECRIT.................................................................................................................................................... 18
Network Tools (Forensics).................................................................................................................. 19 On the Shelf......................................................................................................................................... 21 Other Possible Geolocation information Solutions............................................................................. 25 Geography in the Application Layer versus in the Network Layer ..................................................... 25 OBSTACLES TO GEOLOCATION................................................................................................................. 25 IMPLICATIONS........................................................................................................................................ 28 JURISDICTION ........................................................................................................................................... 28 SECURITY ................................................................................................................................................. 29 PRIVACY................................................................................................................................................... 29 SPAM ........................................................................................................................................................ 30 THE ABILITY TO REBUILD WALLS................................................................................................... 30
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
Introduction
It has been argued that an Internet service has no means of identifying the geographic location of a subscriber. The inability to determine the location of an individual on the Internet has direct legal consequences. This inability dictates which governments have jurisdiction over the Net, which laws apply, and whether local laws can have any bearing. But is the premise correct? Is it impossible to identify the geographic location of an individual on the Internet? Google "geolocation" and you will find a plethora of applications that can "identify the geographic location of" an individual online. These services analyze IP numbers and other data to produce an individual's location. On the other hand, Internet jurisprudence has long accepted that on the Net geography is meaningless. The First Amendment litigations of the Communications Decency Act and the Children's Online Protection Act both made much of the lack of geography and therefore an inability to determine "community standards" based on local standards. In time, however, this assumption has eroded. ICraveTV, a Canadian online rebroadcaster of TV shows, legal in Canada, was found in violation of US law when its server logs revealed that 45 percent of those accessing the service were from the United States. A spam litigation in Maryland was thrown out on the grounds that the IP number of the plaintiff revealed that he was actually in Virginia. France found that Yahoo! violated French laws prohibiting the sale of Nazi souvenirs, finding that Yahoo! knew it was serving individuals in France because advertisements on Yahoo! pages came up in French if a surfer was physically located in France. The VoIP industry is solving the E911 problem, providing location information of callers to emergency responders. Cyber-libertarians declared that the Internet was the death of distance and borders. In 2005, it is not clear that this is true. This paper will review legal precedent and how geolocation has been pivotal legal determinations. The paper will then review the current state of technology and services, and their ability to provide geolocation information. The proposed conclusion is that, while it is not true that "an Internet service has no means of identifying the geographic location" of an individual, it may generally be true that geolocation information is insufficiently reliable to alter jurisdictional analysis, online First Amendment jurisprudence, or other legal uses of network addressing information. Certain pressures may dramatically change the factual situation of the Internet, and thereby change the legal analysis. In the mean time, Geolocation tools may be fruitful for improving the relevancy of Internet advertising; this is not the same as the certainty necessary for legal analysis.
The Hyperbole of Geography
The Internet has been declared the death of distance and the death of borders. The Internet is proclaimed as a unified global (even interplanetary) network where all online individuals have access to everything online everywhere, where geography has no meaning and no relevance. Judges have taken note, noting that speakers have no ability to discern the location of listeners, and listeners have no ability to discern the location of
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. speakers. "cyberspace" [is] located in no particular geographical location but available to anyone, anywhere in the world, with access to the Internet.2 But is this true?
What the Courts Think
"Geography is Meaningless"
Traditional First Amendment jurisprudence for offensive content is premised on geography. Whether something is classified as indecent is determined by community standards, where community is defined geographically. If geography has no meaning, and if the confines of communities are illusive, First Amendment jurisprudence is befuddled. On a global Internet, it is argued a publisher publishes to everyone everywhere and has no ability to know about access or limit access by geography. In this scenario, either community standards can have no meaning, or, perhaps, content must be judged in all locations3 (which means the authors must create according to the standards of the community most likely to be offended4). Justices have wrestled with the notion of a community that has no there. An anxiety is revealed between extremes: either a community in Northern Virginia of fundamentalist druids becomes the gatekeepers of all permissible content in all of cyberspace, or any ability to identify offensive content to know it when we see it will be lost and anything goes. Justices have toiled to either resolve or evade this issue. But what if the premise was invalidated. What if geography had meaning on the Net? What ramifications might this have for First Amendment analysis?
Reno v. ACLU, S.Ct. http://supct.law.cornell.edu/supct/search/display.html?terms=aclu%20reno&url=/supct/html/historics/USS C_CR_0521_0844_ZO.html See ACLU v. Reno, District Court case J. Buckwalter Sec. III B http://www.pas.rochester.edu/~mbanks/CDA/decision/buckwalter.html (the Conference Report with regard to the CDA states that the Act is "intended to establish a uniform national standard of content regulation.") In other words, content producers seeking to avoid punishment for content judged offensive, must create content to comport with the standards of the most conservative jurisdiction online. If the Foo community is the most conservative jurisdiction, and if the Foo community has access to all content online, then all content online would have to comport with the standards of the Foo community in order to avoid arrest in the Foo jurisdiction. See ACLU v. Reno, District Court case J. Buckwalter Sec. III B http://www.pas.rochester.edu/~mbanks/CDA/decision/buckwalter.html (stating This conflict inevitably leaves the reader of the CDA unable to discern the relevant "community standard," and will undoubtedly cause Internet users to "steer far wider of the unlawful zone" than if the community standard to be applied were clearly defined.); ACLU v. Reno, District Court case J. Dalzell Sec. D.3 (Because the creation and posting of a Web site allows users anywhere in the country to see that site, many speakers will no doubt censor their speech so that it is palatable in every community. Other speakers will decline to enter the medium at all.)
4 3
2
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
Strike One: The Communications Decency Act
The Communications Decency Act (Sen. Exon, Sen. Dan Coats) marked both the lowest and the highest point in Internet jurisprudence. It is the lowest point as a Senator who reportedly had never been online drafted legislation which would have chilled free speech on the Internet, and was struck down by a unanimous Supreme Court. It was the highest point in that, as the Courts had their first impression of Internet communications, their idealistic review of the values of medium set the tone for all forthcoming Internet jurisprudence. The Internet was proclaimed a never ending market place of ideas for which the government had no business attempting censorship. In this clash of overreaching and uninformed censorship with utopian visions of a new era of democratic discourse came a single sentence in the Supreme Courts decision: Moreover, the "community standards" criterion as applied to the Internet means that any communication available to a nation wide audience will be judged by the standards of the community most likely to be offended by the message.5 This was premised on the factual finding that the Internet is a unique medium located in no particular geographical location but available to anyone, anywhere in the world, with access to the Internet.6 This was a minimal observation of the issue of geolocation,7 yet it would result in years of litigation and became an accepted premise for Internet policy.
5 6 7
Reno v. ACLU, S.Ct. Reno v. ACLU, S.Ct. Contrast it to the conclusions of the lower court:
ACLU v. Reno, 929 F. Supp. 824 (E.D. PA 1996) Unlike other media, there is no technologically feasible way for an Internet speaker to limit the geographical scope of his speech (even if he wanted to), or to "implement[] a system for screening the locale of incoming" requests. J Dalzell District Court ACLU v. Reno, District Court case J. Buckwalter Sec. III B http://www.pas.rochester.edu/~mbanks/CDA/decision/buckwalter.html (stating This conflict inevitably leaves the reader of the CDA unable to discern the relevant "community standard," and will undoubtedly cause Internet users to "steer far wider of the unlawful zone" than if the community standard to be applied were clearly defined.); ACLU v. Reno, District Court case J. Dalzell Sec. D.3 (Because the creation and posting of a Web site allows users anywhere in the country to see that site, many speakers will no doubt censor their speech so that it is palatable in every community. Other speakers will decline to enter the medium at all.) The Internet is not a physical or tangible entity ACLU v. Reno, District Court case, Finding of Facts II.1. Foreign content is otherwise indistinguishable from domestic content (as long as it is in English), since foreign speech is created, named, and posted in the same manner as domestic speech. There is no requirement that foreign speech contain a country code in its URL. It is undisputed that some foreign speech that travels over the Internet is sexually explicit. ACLU v. Reno, District Court case, Finding of Facts II.1.
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
Strike Two: Children's Online Protection Act
Believing that he knew where the CDA had gone awry, and not to be outdone by a unanimous Supreme Court, Sen. Dan Coats tried again. This time he passed the Childrens Online Protection Act, which focused on commercial speech on the web that was harmful to minors. Once again the ACLU sued. Once again the legislation fell within days; the district court imposed a preliminary injunction, barring enforcement of the Act. Upon review, the Third Circuit disregarded the decision of the lower court in granting the injunction, and instead based its review entirely upon that one sentence from the Supreme Courts CDA opinion:8 [T]he "community standards" criterion as applied to the Internet means that any communication available to a nation wide audience will be judged by the standards of the community most likely to be offended by the message. If true, then any attempt to censor the Internet would necessarily fail, concluded the Third Circuit. The lack of a definable community meant there could be no definable community standard. Lacking a community standard, there could be no analysis of what content is harmful to minors. In terms of geolocation, the Third Circuit noted that material posted on the Web is accessible by all Internet users worldwide9 and current technology does not permit a Web publisher to restrict access to its site based on the geographic locale of each particular Internet user10
In terms of First Amendment analysis, according to the Third Circuit, this meant that
See also COPA, 3rd Cir, Sec. II.A. slip at 21 (June 22, 2000) http://vls.law.vill.edu/locator/3d/Jun2000/991324.txt One concern noted by the Supreme Court was that, as a part of the wholly unprecedented broad coverage of the CDA, "the `community standards' criterion as applied to the Internet means that any communication available to a nationwide audience will be judged by the standards of the community most likely to be offended by the message." Reno II, 521 U.S. at 877-78.
9
8
See also COPA 3rd Cir. 2000 (Indeed, the Internet "negates geometry. . . it is fundamentally and profoundly anti-spatial. You cannot say where it is or describe its memorable shape and proportions or tell a stranger how to get there. But you can find things in it without knowing where they are. The [Internet] is ambient -- nowhere in particular and everywhere at once." Doe v. Roe, 955 P.2d 951, 956 (Ariz. 1998).)
10
See also COPA, 3rd Cir, Sec. I.C. slip at 13 (June 22, 2000) http://vls.law.vill.edu/locator/3d/Jun2000/991324.txt It is essential to note that under current technology, Web publishers cannot "prevent [their site's] content from entering any geographic community." Reno III, 31 F. Supp. 2d at 484. As such, Web publishers cannot prevent Internet users in certain geographic locales from accessing their site; and in fact the Web publisher will not even know the geographic location of visitors to its site. See American Libraries, 969 F. Supp. at 171. Similarly, a Web publisher cannot modify the content of its site so as to restrict different geographic communities to access of only certain portions of their site. Thus, once published on the Web, existing technology does not permit the published material to be restricted to particular states or jurisdictions.
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. COPA essentially requires that every Web publisher subject to the statute abide by the most restrictive and conservative state's community standards in order to avoid criminal liability. Thus, because the standard by which COPA gauges whether material is "harmful to minors" is based on identifying "contemporary community standards," the inability of Web publishers to restrict access to their Web sites based on the geographic locale of the site visitor, in and of itself, imposes an impermissible burden on constitutionally protected First Amendment speech.11 Based specifically on the lack of ability to determine geolocation, the Third Circuit concluded that community standards could not possibly be applied to the Internet. The reaction of the Supreme Court was Sure it can! The Supreme Court still accepted the premise that the Internet is without geography.12 However, it argued (perhaps a bit unconvincingly) that the inability to determine location is not fatal for this type of content.13 While not reversing the outcome (COPA remained enjoined), the Supreme Court remanded the case for further consideration. Being responsive to the Supreme Court, the Third Circuit reconsidered COPA and found, once again, that COPA was unconstitutional. This time the Third Circuit focused on the failure of COPA to utilize the least restrictive means for achieving a legitimate government interest. Nevertheless, the Third Circuit, could not resist another crack at the geolocation argument. As the Supreme Court has now explained, community standards by itself did not suffice to render COPA substantially overbroad. Justice Kennedys concurring opinion, however, explained that community standards, in conjunction with other provisions of the statute, might render the statute substantially overbroad. In the Third Circuit's mind, this geolocation void resulted in an unresolvable overbreadth problem.14 When COPA returned to the Supreme Court, the Supremes did not take the bait. The majority opinion affirmed the primary holding of the Third Circuit concerning least
11
12
COPA, 3rd Cir, Intro (June 22, 2000) http://vls.law.vill.edu/locator/3d/Jun2000/991324.txt
COPA S.Ct. I Sec. B (We noted that the community standards criterion as applied to the Internet means that any communication available to a nationwide audience will be judged by the standards of the community most likely to be offended by the message. Reno, 521 U.S., at 877878.)
13
COPA S.Ct. I Sec. C (When the scope of an obscenity statutes coverage is sufficiently narrowed by a serious value prong and a prurient interest prong, we have held that requiring a speaker disseminating material to a national audience to observe varying community standards does not violate the First Amendment.). Ashcroft v. ACLU, Sec. II.B.5. Community Standards (3rd Cir. Mar. 2003) (As we have just discussed earlier, the expansive definitions of material harmful to minors and for commercial purposes, as well as the burdensome affirmative defenses, likely render the statute substantially overbroad. COPAs application of community standards exacerbates these constitutional problems in that it further widens the spectrum of protected speech that COPA affects.)
14
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. restrictive means, and did not touch again on the issue of geolocation and community standards. Both courts assume that geography means nothing on the Internet. One court concluded this was fatal where the other concluded that it was incidental. However, the assumption is common to both.
Strike Three: American Libraries Ass'n v. Pataki
While the Federal courts reviewed Congressional attempts to muddle about the Internet, the state of New York got into the act. New York amended N.Y. Penal Law @ 235.21 to make it illegal to send offensive content to minors. The Federal Court in striking down this law took great note of the lack of ability to determine geolocation on the Internet. This analysis can be distinguished, however, from the CDA and COPA. Where one state passes a law that has the potential of impacting other states, this has the potential of running afoul of the Commerce Clause (as opposed to the First Amendment and community standards). The Federal Court struck down the new law on the grounds that it has extraterritorial application to transactions involving citizens of other states, it imposes a burden on interstate commerce, and the nature of the Internet necessitates uniform national treatment.15 As with the CDA and COPA, the Federal Court concludes that geography is meaningless on the Internet. The Internet is wholly insensitive to geographic distinctions. In almost every case, users of the Internet neither know nor care about the physical location of the Internet resources they access. Internet protocols were designed to ignore rather than document geographic location; while computers on the network do have "addresses," they are logical addresses on the network rather than geographic addresses in real space. The majority of Internet addresses contain no geographic clues and, even where an Internet address provides such a clue, it may be misleading.16 In terms of the New York law, this means that publishers on the Net could not know when they are interacting with someone from New York, nor could the publishers prohibit those alleged New Yorkers from interacting with the material. [T]here is no feasible way to preclude New Yorkers from accessing a Web site, receiving a mail exploder message or a newsgroup posting, or participating in a chat room.17 As such, the Court concluded that the New York law violated the Commerce Clause.
15
American Libraries Ass'n v. Pataki, 969 F. Supp. 160, Conclusion (S.D.N.Y. 1997) http://www.loundy.com/CASES/ALA_v_Pataki.html. American Libraries Ass'n v. Pataki, 969 F. Supp. 160, Discussion (S.D.N.Y. 1997) http://www.loundy.com/CASES/ALA_v_Pataki.html. American Libraries Ass'n v. Pataki, 969 F. Supp. 160, Discussion (S.D.N.Y. 1997) http://www.loundy.com/CASES/ALA_v_Pataki.html.
16
17
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
"You Are Here"
France v. Yahoo!
The case of LICRA v. Yahoo! marks a clear confrontation between content on the Internet being available to anyone anywhere, and local laws that demand local treatment. In LICRA v. Yahoo!, France brought suit against Yahoo! for violating a prohibition French law against the selling of Nazi paraphernalia.18 The paraphernalia in question was sold by third parties on Yahoo! auction sites. Yahoo! argued against the charges, arguing in part, that geography is meaningless on the Internet. Yahoo! argued that it is not possible for Yahoo! to be bound by the local laws of a local jurisdiction when content posted to the service is available to everyone everywhere on the globe without restriction. France, however, was unpersuaded. When individuals from France surfed the Yahoo! website, the Yahoo! website displayed advertisements in French. How could it possibly be true that Yahoo! cannot know from where an individual surfer comes when it is serving up language appropriate advertising. The answer, according to the French Court, was IP geolocation. The Court concluded that the use of IP numbers (as opposed, for example, to domain names) is the most reliable means of ascertaining geolocation, that there are several companies offering geolocation services, and that using these services, it would be possible to identify 70 percent of the IP addresses of individual residing in France as being in France. If these 70 percent can be identified, than they can be filtered and their access to the Nazi content can be blocked. The Court had some ideas about how to deal with the other 30 percent, for which IP geolocation would not work, but those methods (such as having those individuals certify that they are not from France) are not relevant to this paper. A part of the 30 percent failure rate, as noted by the Court, is what could be called the AOL-problem. The AOL-problem exists because AOL has a cluster of proxies located in Northern Virginia which serve individuals who subscribe to AOL around the world. If one logs onto AOL, one is assigned an IP number from these Virginian servers. Regardless of where the individual is in fact, the IP number will thereby suggest that the individual is located in Virginia.19 Based on available technology, the court concluded that Yahoo! could comply with French law by blocking access to individuals from France. The Court fined Yahoo! for violating the law and ordered Yahoo! to block access henceforth. The fines would accrue for ongoing violations of the French law.
Note that LICRA did not bring suit against yahoo.fr, the French subsidiary of Yahoo!, which itself did not display the content in question. Rather, the suit was against yahoo.com, which the court acknowledged is written in English and is designed primarily for an American audience. CHECK Get Court Citation. See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2.1 Fundamental Limitations Due to Proxies (n.d.) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf
19
18
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. This decision was not well received either by Yahoo! or by the Cyberlibertarian community. Yahoo! opted, instead of appealing the law in France, to challenge the law in the United States. Yahoo! argued that the French court order and the ongoing fines were an abridgement of Yahoo!s First Amendment rights. A locality in Europe was seeking to dictate what content an American company could display to Americans (and to the world). The Federal District Court agreed. After all, the Internet is available to everyone everywhere, reasoned this court. A restriction by France was a restriction of speech by a U.S. company in the United States. What is at issue here is whether it is consistent with the Constitution and laws of the United States for another nation to regulate speech by a United States resident within the United States on the basis that such speech can be accessed by Internet users in that nation. In a world in which ideas and infomration transcend borders and the Internet in particular renders the physical distance between speaker and audience virtually meaningless, the implications of this question go far beyond the facts of this case. The modern world is home to widely varied cultures with radically divergent value systems. There is little doubt that Internet users in the United States routinely engage in speech that violates, for example, China's laws against religious expression, the laws of various nations against advocacy of gender equality or homosexuality, or even the United Kingdom;s restrictions on freedom of the press. ..... In light of the Court's conclusion that enforcement of the French order by a United States court would be inconsistent with the First Amendment, the factual question of whether Yahoo! possesses the technology to comply with the order is immaterial. Even assuming for purposes of the present motion that Yahoo! does possess such technology, compliance still would involve an impermissible restriction on speech. 20 There was one problem with the Federal District Courts decision. No one had in fact tried to penalize or suppress Yahoo!s speech in the United States. What had happened, had happened in France. The LICRA had yet to seek enforcement of the order in the United States, and had stated that it would not. On these grounds, the Federal Appeals Court reversed the lower court (but then agreed to a rehearing en banc).21 This litigation is ongoing.
20
Yahoo! v. La Ligue Contre Le Racisme et L'Antisemitisme, Case Number C-00-21275, slip at 8 & 22 (NDCa Nov. 7, 2001). CITATION
21
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
iCraveTV
iCraveTV was an innovative web service that sought to rebroadcast television shows in Canada, an activity apparently legal in Canada but not in the United States. Twentieth Century Fox sued claiming that iCraveTV was engaged in unauthorized public performance of the shows in the United States. The Defendants argued that iCraveTV was a Canadian service and that they had no intention of serving viewers in the United States. Disregarding intention as irrelevant, the Court noted that, according to iCraveTV itself, 45 percent of viewers were based in the United States. This figure was determined after an examination of the IP numbers in the server log of the iCraveTV server, which recorded the IP number address of computers which accessed the iCraveTV server. The Court found for the plaintiffs, concluding that defendants are unlawfully publicly performing plaintiffs' copyrighted works in the United States.22
Sony Music
Having argued that geography is meaningless and therefore First Amendment "community standards" are dubious on the Internet,23 CITATION EFF made a fascinating about face in the P2P music wars. In the case Sony Music Entertainment v. Does 1-40, Sony Music had sued 40 John Does in New York District Court, serving subpoenas on their ISP in order to obtain their identities. Four of the defendants, and EFF through an amicus brief, moved to quash the subpoenas. Why? Because, according to EFF, there is geography in the Internet. According to EFF, based on the IP numbers that Sony had, 36 of the 40 defendants were "likely" not from New York. Without evaluating the reliability of the method EFF used to determine geolocation, the Court denied the motion to quash on the grounds that "likely" is not good enough for a determination of jurisdiction.24
MaryCLE
Seeking to protect its citizens from the slings and arrows of outrageous spam, the state of Maryland passed the Commercial Electronic Email Act, which, in its relevant part, made it illegal to transmit unsolicited, false, and misleading commercial email where the sender knows or should have known that the recipient is a resident of Maryland. Plaintiff MaryCLE sued First Choice Internet alleging a violation of the act. Plaintiff, employing a neat trick, argued that defendant knew or should have known that
Twentieth Century Fox Film Corporation, V. IcraveTV, 2000 WL 255989, 22 (W.D.Pa.). The Court granted a restraining order and the litigation did not proceed further. See Motion Picture Association of America, iCraveTV Signs Settlement Agreement that Shuts Down Website, Feb. 28, 2000, available at http://www.mpaa.org/Press/iCrave_Settlement.htm
23
22
EFF served as co-counsel with the ACLU in the challenge to COPA. See COPA ("CDA II") Legal Challenge Page, EFF (n.d.) (accessed April 8, 2005) http://www.eff.org/legal/cases/ACLU_v_Reno_II/; EFF Press Release, Supreme Court Supports Library Internet Blocking Law (June 23, 2003) http://www.eff.org/Censorship/Censorware/20030623_eff_cipapr.php
Sony Music Entertainment Inc. v. Does 1-40, 326 F.Supp.2d 556, 567-68 (S.D.N.Y. 2004).
24
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. MaryCLE was a Maryland resident on the grounds that the address used for the email was the domain name Maryland-state-resident.com.25 The Court, however, summarily rejected this argument, stating In order to determine the physical location where an email address is based, the most reliable technique is to plug the IP locator for the email address into an "IP Tracker" such as www.discoveryvip.com/ipaddress.htm, which will then provide the physical location of a computer using a particular email address. In the case of MarylandCLE, the IP address of the computer that was used when MarylandCLE "opted-in" was 66.171.38.224, which is located in Reston, Virginia, not Maryland.26 But than this Court does an apparent unacknowledged about face. Making the initial rejection of the utility of the cute domain name, the Maryland Court picks up on the jurisprudence of the ALA v. Pataki case, concluding that the Internet is wholly insensitive to geography, and therefore a state law restricting Internet communications violates the dormant Commerce Clause. On the one hand, the Maryland law cannot apply because the plaintiff was in Virginia, and on the other hand the Maryland law is unconstitutional because we cannot possibly know where the plaintiff was. But then the Court does yet another, not fully explained, change of direction. Instead of basing its argument on the lack of geography, the Maryland court ultimately concludes that the Maryland law is unconstitutional explicitly on the geographic grounds that we know where all the players to the transaction were, and none of them were in Maryland. The spam in question was sent from the defendants in New York, routed
25
Indeed a visit to the website of Maryland-state-resident.com reveals a declaration: Commercial Electronic Mail may not be sent to any address at Maryland-StateResident.com without the express, written, and affirmatively sealed or signed consent of the recipients. No permission to receive CEM is ever granted implicitly. All e-mail addresses at Maryland-State-Resident are held by legal entities incorporated in Maryland. The computers hosting the Maryland-State-Resident servers are owned by a Maryland Internet Service Provider ("ISP"). The domain registrar will show Maryland-State-Resident.com to be held by a Maryland individual or organization. The Maryland-State-Resident.com domain name or web servers may not be used for sending CEM of any kind or in any way. Violations of this policy are subject to suit under the State of Maryland's Commercial Electronic Mail Act ("CEMA"), which provides for damages of $500 for the recipient and $1000 for the ISP for each separate action. See Md. Code Ann., Com. Law. 14-3001 et seq.
Maryland State Resident.com (assessed April 1, 2005) http://maryland-state-resident.com/.
26
MarylandCLE, LLC v. First Choice Internet, Cv. No. 248514 (Circuit Court Montgomery County 2004) http://www.courts.state.md.us/businesstech/opinions/mdbt11_04_opinion.wpd. On April 1, 2005, Discoveryvip.com revealed that "maryland-state-resident.com (216.180.242.202) is located in Atlanta, Georgia, United States." Discoveryvip.com (assessed April 1, 2005) http://www.discoveryvip.com/ipaddress.htm.
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. through email servers in Virginia, and received at Plaintiffs primary place of business, Washington, D.C. The Court noted "Plaintiffs are asking the court to apply Maryland law to a situation which never occurred in Maryland." As the Maryland statute as written applies to transactions that can occur outside the state of Maryland, the Court concluded that Maryland spam law is an unconstitutional violation of the dormant Commerce Clause. It is fascinating to observe in this case the oscillation between knowledge of geography, and lack of knowledge of geography determining outcome in the same decision.
Observations
What do we make of all of this? It is clear that geolocation has been a part of some of the most contentious legal confrontations that have occurred in Internet law. Indeed, it is also clear that geolocation has been a linchpin to those decisions. Geolocation is a bit of a nuclear option in this jurisprudence, particularly in First Amendment analysis. Lower courts have relied upon the Community Standards problem to come down like a sledgehammer on attempts to censor the Internet. Perhaps recognizing the implications, the Supreme Court backed off of the community standards problem in order to permit a glimmer of a hope that some censorship provision might withstand constitutional muster but in doing so, the Supreme Courts analysis of how the community standards problem is resolved was anemic at best. Going further than the Supreme Court, other courts have discovered geography on the Internet. The implications are extreme. If geolocation cannot be determined, then there is no community standards, ICraveTV was decided incorrectly and there are significant implications for intellectual property, and other local ordinance on the Internet, at least in the United States, would likely violate the Commerce clause. If on the other hand, there is geolocation on the Internet, there is no problem with community standards, intellectual property owners can demand compliance with stricter intellectual property laws of stricter jurisdictions, and local authorities can pass whatever local ordinance they wish without being defeated by that pesky constitutional issue. The factual conclusion concerning geolocation has a great deal riding on it, and it is understandable why there is so much apparent anxiety surrounding it. Concluding one way means any significant dot com enterprise must comply with a lexicon of local ordinances, and miles of code to ensure automatic compliance. Concluding the other way means that the Barbarians have stormed the gates and we are powerless to protect the youth of America from reading offensive content such as Huckleberry Finn.27 One way other the other, the sky is falling.
See The 100 Most Frequently Challenged Books of 19902000, American Library Association http://www.ala.org/ala/oif/bannedbooksweek/bbwlinks/100mostfrequently.htm
27
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.
The Illusive Truth
As my engineering peers are quick to point out, simply because a court resolves a technical issue does not make it so. Although authorities of the highest legal caliber resolved at one time that the world was flat, dolphins continued to roam the seas free and in blatant violation of the flat-earth edict. Between one courts decision that geography is meaningless, and anothers surprising discovery that it was right here all along, where lies the truth? Every device (host) on the Internet is assigned an IP number Internet address. If a device has an IP number, it can be reached. If a device lacks an IP number, it is invisible to the network even if physically attached. Interactions on the Internet transpire through two devices communicating based on those IP numbers. Device A desires something and so contacts Device B. Device B responds, addressing the response with the IP number address provided by Device A. The two devices interact, with each interaction addressed with those IP numbers. It is normal for devices on the Internet to keep a log which records a history of the addresses of the devices that have interacted with it during that time frame. The entire set of IP numbers is managed by the Internet Assigned Number Authority (IANA).28 IANA distributes blocks of numbers to Regional Internet Registries (RIRs) for further distribution.29 RIRs distribute blocks of numbers to large ISPs, and to local Internet registries (LIRs) and national Internet registries (NIRs). Small ISPs, corporate networks, and individual users acquire numbers from large ISPs, LIRs, or NIRs. The architecture is topologically hierarchical without direct connection to geography. Nevertheless, there is a degree of geography to this design. A local ISP in Austin Texas may be assigned a small block of IP numbers. Those numbers may be assigned by a large ISP, a US Internet backbone. The US Internet backbone would have acquired its numbers from the American RIR, the American Registry for Internet Numbers (ARIN). This distribution is a regional distribution. The US Internet backbone would not receive numbers from the European RIR. In addition, the numbers in the block assigned to the Austin Texas ISP are associated with Austin Texas. If that number shows up in a server log, then it has some connection to the Austin ISP. In this manner, some degree of geography is suggested into the IP numbering structure.
Available Toys
Bring together a demand for better geographic information, and a knowledge of how the Internet works, and you have a potential business plan. There have been a number attempts to produce services responsive to this demand. Questions remain,
IANA is currently under the authority of the Internet Corporation for Assigned Names and Numbers (ICANN). There are currently five RIRs: ARIN, RIPE, APNic, AFRINIC, and LACNIC. See IANA IP Address Services http://www.iana.org/ipaddress/ip-addresses.htm (accessed April 14, 2005).
29
28
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. however, of how specific the geographic information provided is, how reliable it is, and how widely deployed the services are.
Projects
IETF RFC 1876 DNS LOC
IP numbers are bothersome things that are hard for human's to remember. In order for the Internet to accommodate stupid humans, the domain name system was created.30 Domain names can be any text or numeric string used to identify a device or resource on the network. Domain names are hierarchical with top level domains such as .com, .gov, .org, .us., .eu, and .tu; secondary domains such as cybertelecom.org or tcrc.net, and subdomains such as www.cybertelecom.org or mail.cybertelecom.org. To understand the domain name system is to understand that domain names are not addresses; they are tokens keys for access a database. In that database can be any type of information. Traditionally, when the DNS database is queried with the domain name "cybertelecom.org," the response is the IP number associated with that domain name. But it could be anything. It could be a phone number, enabling an interconnection between SIP telephony addresses and PSTN phone numbers.31 It could also be longitude, latitude and altitude information. A means of including location information was proposed at the IETF: RFC 1876, A Means for Expressing Location Information in the Domain Name System (Jan. 1996).32 Longitude, latitude, and altitude could be represented in resource records for devices (hosts), networks, and subnets. Included in the resource records can be information on how precise the location information is. Information is not provided in RFC 1876 on how individuals would interface with these records and how rapidly these records would be refreshed.33 Note that this method of inserting geographic location information into the DNS is constrained by the speed at which the DNS is refreshed. In other words, for stationary hosts, latency in the refreshing of DNS files would have minimal impact. But with mobile or portable hosts, latency in refreshing DNS files would mean that during the latency cycle, the geographic
See P. Mockepetris, RFC 1034, Domain Names Concepts and Facilities, IETF (Nov. 1987) http://www.ietf.org/rfc/rfc1034.txt; P. Mockepetris, RFC 1035, Domain Names Implementation and Specification, IETF (Nov. 1987) http://www.ietf.org/rfc/rfc1035.txt. See also Management of Internet Names and Addresses (White Paper), Department of Commerce (June 5, 1998) http://www.ntia.doc.gov/ntiahome/domainname/6_5_98dns.htm (recounting history of DNS).
31 32
30
ENUM
C. Davis, P. Vixie, T. Goodwin, and I. Dickinson, RFC 1876, A Means for Expressing Location Information in the Domain Name System (Jan. 1996) (Experimental RFC) http://www.ietf.org/rfc/rfc1876.txt.
The DNS is a distributed database. Copies of records are cached locally and then refreshed on a regular cycle. If a record is revised, there can be a latency while the revision is being propagated through out the system.
33
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. information would potentially be inaccurate. The IETF in proposing Location Resource Records had in mind network management and traffic monitoring as a primary use.34 The DNS software BIND supports RFC 1876 location resource records.35 However, as noted by CAIDA, RFC 1876 was experimental; LOC resource records are not required nor are they necessary for the DNS to work. This method places the burden on network administrators to enter location information for all records and presents no means of verifying the accuracy the of information in the database.36 The method of injecting location information into the DNS is rarely utilized.37
RFC 3825, J. Polk, J. Schnizlein, M. Linsner, Dynamic Host Configuration Protocol Option for Coordinate-based Location Configuration Information (July 2004) http://www.ietf.org/rfc/rfc3825.txt?number=3825 proposes using Dynamic Host Control Protocol to inform a device of its location at host configuration time, acquiring location information from the local network. This assumes of course, that the location of the ports in the local network is accurate. But see wifi location devices
CAIDA's NetGeo
Another notable attempt in experimenting with geographic information was CAIDAs NetGeo project.38 NetGeo sought to identify geographic information related to the Internet by accessing the WHOIS database for Autonomous System numbers, IP numbers, and domain names. NetGeo also took advantage of RFC 1876 DNS LOC information where available and utilized geographic hints that may be, for instance, in
34
C. Davis, P. Vixie, T. Goodwin, and I. Dickinson, RFC 1876, A Means for Expressing Location Information in the Domain Name System, Sec. 5.1 (Jan. 1996) (Experimental RFC) http://www.ietf.org/rfc/rfc1876.txt. See also Christopher Davis, Other Applications using DNS LOC (last modified Mar. 18, 2001) http://www.ckdhr.com/dns-loc/apps.html (listing network management programs) BIND Administrator Reference Manual, Internet Software Consortium (2001) p. 91 http://www.nominum.com/content/documents/bind9arm.pdf. See also Christopher Davis, Publishing your own location data, ckdhr.com (last modified Mar. 18, 2001) http://www.ckdhr.com/dns-loc/howto.html (indicating that BIND 4 and BIND 8 support DNS LOC).
36
35
See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2 (n.d.) (critiquing DNS LOC) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf See David Moore, Ram Periakaruppan, Jim Donohoe, Where in the World is netgeo.caida.org, CAIDA (2000) (In reality, because LOC resource records are not required to make DNS work, few network administrators support them) http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html; Andrew Turner, Geolocation by IP Address, Linux Journal (Oct. 24, 2004) http://www.linuxjournal.com/article/7856 (Several popular servers have employed this standard but not enough to be directly useful as of yet.). Compare Christopher Davis, DNS LOC: Geo-enabling the Domain Name System (last updated Mar. 18, 2001) http://www.ckdhr.com/dns-loc/ (a site dedicated to persuading people to use DNS LOC. However, site was last updated four years ago and author has moved his current work to a different website).
38 37
See CAIDA: NetGeo The Internet Geographic Database (last updated Jul. 31, 2003) http://www.caida.org/tools/utilities/netgeo/; David Moore, Ram Periakaruppan, Jim Donohoe, k claffy, Where in the World is netgeo.caida.org? CAIDA (2000) http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. domain names. Correlating data from varying sources, NetGeo would return a record containing: a location, the data source of the location, the granularity determining the location, and additional meta-data (date of query, date of last whois update, and server used). The location section contains fields for city, state/province/administrative-unit, country, latitude, and longitude.39 An example of a result is shown below:
NAME: NUMBER: CITY: STATE: COUNTRY: LAT: LONG: LAT_LONG_GRAN: LAST_UPDATED: NIC: LOOKUP_TYPE: RATING: DOMAIN_GUESS: STATUS: CAIDA.ORG LA JOLLA CALIFORNIA US 32.85 -117.25 City 11-Jul-98 INTERNIC Domain Name OK40
Notice that the data returned in the example is broad, at a granularity level of a city. There are several self acknowledged limitations of this effort. First, WHOIS databases41 produce location information for the registrant, not necessarily for the computer hosting for which the IP number or domain name is assigned.42 Assuming that the location of the entity responsible for the internet resource is useful information, this information may be specific for small entities on the edge of the network, but vague for large entities. In other words, all of IBMs resources may be managed by a single administrative office and location; while that administrative office identified on all of the WHOIS records is in one place, IBMs resources are spread across the globe. In addition, as time transpires, the information in the records may become stale and inaccurate.43 Finally, CAIDA notes that WHOIS DNS records are not standard. As new registrars come online with arbitrary WHOIS formats, anyone who systematically seeks to utilize WHOIS databases will have a great deal of work.
David Moore, Ram Periakaruppan, Jim Donohoe, k claffy, Where in the World is netgeo.caida.org? CAIDA, Section: Overview (2000) http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html David Moore, Ram Periakaruppan, Jim Donohoe, k claffy, Where in the World is netgeo.caida.org? CAIDA, Figure 1 (2000) http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html WHOIS records are records created when domain names are created and registered. There reveal contact information about the registrant of the domain name. See K. Harrenstien, M. Stahl, E. Feinler, RFC 954, Nickname/WHOIS (Oct. 1985) http://www.ietf.org/rfc/rfc0954.txt.
42 41 40
39
For example, my address in WHOIS is in Arlington, Virginia but my website is hosted on a machine in Wyoming. See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2 (n.d.) (critiquing reliance on WHOIS data) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf
43
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. CAIDAs NetGeo project attempted to compensate for these limitations by looking for clues. The hostnames of some large networks include geographic references, at times, utilizing the standard three letter airport codes to identify the location of, for example, backbone routers. Where RFC 1876 DNS LOC is used, NetGeo takes advantage of that information. NetGeo was a CAIDA research project and is no longer supported. The technology was licensed to IXIA, but use of the NetGeo technology in the form of a product is not readily apparent from the IXIA website.44 CAIDAs purpose in exploring the capabilities of NetGeo was in support of its ongoing efforts to measure and study the Internet and Internet traffic patterns. In other words, CAIDAs purposes like DNS LOC was infrastructure management.
IETF GeoPriv
A more recent endeavor to grapple with geography and the Internet is the IETFs Geographic Location/Privacy (GeoPriv) Working Group.45 This project stands apart from the other projects in several ways. First, GeoPriv is not a means of generating location information for network devices; it assumes that geolocation has been provided somehow. GeoPriv is a protocol for how that information should be handled. Second, unlike DNS LOC which sought geographic information for network infrastructure, GeoPriv is aimed more at the application layer, attempting to be responsive to the needs of emergency services, navigation services, and other location based services.46 While GeoPriv is fascinating for its work on handling geolocation information, it turns out not to be relevant to the task at hand. In terms of GeoPriv, this paper is all about and only about the first step, "Location Generation."47 GeoPriv is expressly not about that but rather deals with the next step; having generated location, who is that information exposed to, under what conditions, and how is it exposed.
IETF ECRIT
The IETF recently established a working group known as Emergency Context Resolution with Internet Technologies (ECRIT). The purpose of this working group is to
44
The link from the CAIDA NetGeo website to Ixia ---- produces a Resource Not Found website. See CAIDA, NetGeo The Internet Geographic Database (last updated July 31, 2003) ; Ixia Leader of IP Network Testing (n.d.) http://www.ixiacom.com/products/paa/netops/IxMapping.php. A search of the Ixia website produces no results for netgeo.
45
IETF Geographic Location/Privacy (geopriv) Chater http://www.ietf.org/html.charters/geoprivcharter.html (accessed April 21, 2005). See also M. Danley, D. Mulligan, J. Morris, J. Peterson, Threat Analysis of the Geopriv Protocol, IETF RFC 3694 (Feb. 2004) http://www.ietf.org/rfc/rfc3694.txt. J. Cuellar, J. Morris, D. Mulligan, J. Peterson, J. Polk, Geopriv Requirements IETF RFC 3693, Sec. Abstract (Feb. 2004) (Location-based services, navigation applications, emergency services, management of equipment in the field, and other location-dependent services need geographic location information about a Target (such as a user, resource or other entity)).
47
46
GeoPriv RFC 3693, Sec. 4.
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. show how the availability of location data and call routing information at different steps in session setup would enable communication between a user and a relevant emergency response center.48 Like GeoPriv, this working group is focused on information handling and delivery, as opposed to information generation. The assumption is that location information will be generated or provided by some outside-the-network means. ECRIT released in May 2005 a draft for discussion Requirements for Emergency Context Resolution with Internet Technologies.49 In discussing how the location of a caller will be identified, the draft anticipates that the location will be inserted or referenced. UA-inserted: The caller's user agent inserts the location information, derived from sources such as GPS, DHCP or link-layer announcements (LLDP). UA-referenced: The caller's user agent provides a reference, via a permanent or temporary identifier, to the location which is stored by a location service somewhere else and then retrieved by the PSAP.50 While this draft cites the GeoPriv effort, it does not reference DNS LOC. This working group expands upon GeoPriv, constructing a clear framework for 911 calling requirements. With the framework maturing for 911 location information handling, this begs the opportunity for a location identification solution to step forward, although the issue of location generation has not be resolved, and ECRIT is not about resolving that part of the problem.
Network Tools (Forensics)
Several Internet tools facilitate acquiring geographic information. To walk through these tools, let us assume that the bad people at Cybertelecom.org did something abominable. What could we learn about Cybertelecom.org? A WHOIS record is the registration record of the domain name.51 The WHOIS record for Cybertelecom.org would reveal that it is owned by Robert Cannon with the listed address in Arlington, Virginia. However, the technical point of contact is listed in Wyoming, and the DNS servers for this record are listed as NS2.WYOMING.COM and CENTRAL.WYOMING.COM.52 We learn that www.cybertelecom.org is hosted on a webserver with the address 216.67.146.101. This is part of an IP number block held by Wyoming.com.53 WHOIS is able to distinguish between and identify the location of the
48
Emergency Context Resolution with Internet Technologies Working Group Charter (accessed May 10, 2005) http://www.ietf.org/html.charters/ecrit-charter.html.
H. Schulzrinne & R. Marshall, Requirements for Emergency Context Resolution with Internet Technologies, IETF Internet Draft (May 5, 2005) http://www.ietf.org/internet-drafts/draft-schulzrinne-ecritrequirements-00.txt
50 51
49
Id., Sec. 5.
Internic | FAQs on the Domain Names, Registrars, and Registration (last updated Sept. 25, 2003) http://www.internic.net/faqs/domain-names.html. WHOIS, Network Solutions (2005) http://www.networksolutions.com/en_US/whois/index.jhtml. ARIN WHOIS http://www.arin.net/.
52 53
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. individual who owns the resource and the location of the facility that hosts the resource. WHOIS is highly dependant upon the accuracy of the information provided in the record.54 Traceroute is a tool that reveals the route through the network a packet might take, reporting back the hops traversed and the time lapse of the hops.55 Traceroute shows that the traffic to 216.67.146.101 is carried over the Broadwing backbone. The last hop on Broadwing is p0-0-0.a1.slkc.broadwing.net.56 The SLKC is a convention for networks, offering a clue as to geographic location of the router in its name.57 SLKC in this case refers to Salt Lake City. Different traceroutes may provide slightly different results. Traceroute also reveals that as the traffic nears, Cybertelecom.org (hosted at Wyoming.com), it traverses CHYNWYQCORTR3-FE0-0.CONTACTCOM.NET. Contact Communications (Contactcom.net) is the CLEC of Wyoming.com.58 Note in this routers name the geographical reference to Cheyenne, Wyoming. The administrative address of Contact Communications is 937 W Main St, Riverton, WY 82501,59 which is the same as the administrative address of Wyoming.com.60 Using Traceroute to determine location assumes the accuracy of the reported location of hosts. Similar to Traceroute is referred to by some as GeoPing is based on the speed of light. If you have a site but dont know its location, you have through traceroute a nearby host and you know its location, and you have the delay between the two, it is possible to produce a guess as to the distance between the known and the unknown host. Given the limits of the speed of light,61 the time between hops62 means that the site in question can
54
The accuracy of WHOIS information is currently a significant issue. See, e.g., Final Report of the GNSO Council's WHOIS Task Force Accuracy and Bulk Access, ICANN (Feb. 6, 2003) http://www.icann.org/gnso/whois-tf/report-19feb03.htm.
Traceroute, Wikipedia (last updated April 20, 2005) http://en.wikipedia.org/wiki/Traceroute. See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2 (n.d.) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf (listing traceroute as a tool to map traffic paths, noting geographic locations of routers and hosts in path).
55
The Traceroute from DNSStuff.com at this point fails, providing the explanation that it may have hit a fire wall that blocks pings. Tracert to 216.67.146.101 Generated by www.DNSstuff.com at 20:40:07 GMT on 16 May 2005.
57
56
Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 4 (n.d.) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf Contact Communications http://www.contactcom.net/ (accessed May 16, 2005).
58 59
Contact Communications: Contact Us http://www.contactcom.net/contactus.htm (accessed May 16, 2005).
60 61 62
Wyoming.com (accessed May 16, 2005). Speed of Light, Wikipedia (last updated May 16, 2005) http://en.wikipedia.org/wiki/speed_of_light
In order to compensate for network congestion, several Traceroutes may be necessary where the calculation uses the smallest delay between hosts. CITE
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. only be so far away from the last geographically identified hop (speed-of-light * time = maximum possible distance). If the last known hop is Wyoming.com in Riverton, Wyoming, and if the maximum possible calculated distance is 100 miles, these give some idea of where the device in question might be.63 GeoClustering is a technique suggested by Venkata Padmanabhan, at Microsoft Research, and Lakshminarayanan Subramanian, at the University of California at Berkeley.64 To understand GeoClustering, one must understand IP number delegations.65 `The assumption is that IP numbers are utilized or distributed by an Internet network in given geographic location. If the addresses of a few of the IP numbers is known, that it can be assumed that any other number in that IP number block is also in that location (Geoclustering has a mechanism for being IP number blocks down into sub blocks until either the location is known or the location is determined to be not knowable). So how does Geoclustering get the location of the IP addresses? Individuals constantly provide their location when they sign up for services such as Hotmail, website registrations, or TV program guides.66 The proposers of GeoClustering suggest that with reasonable samples, a database can be satisfactorily created to provide for the location of IP numbers.67
On the Shelf
There is geography in the Net. The above referenced techniques establish that it was possible and predecessors have pursued the prize. If an advertising service wishing to improve the targeting of advertisements, so that Boston advertisements are shown to people in Boston, and advertisements in French are shown to people in France, these services may prove useful.68 A site may have a different appearance and display different
63
Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 4 (n.d.) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 6 (n.d.) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf. See discussion of IP numbers, footnotes 28 and accompanying text.
64
65 66
These examples were used by Padmanabhan and Subramanian for their database connecting IP numbers to locations. Sec. 3.5. The authors conclude
67
Our findings suggest that GeoCluster is the most promising one of the IP2Geo techniques. The median error distance for GeoCluster varies from 28 km for well-connected university hosts to a few hundred kilometers for a more heterogeneous set of clients. Importantly, however, GeoCluster is self-calibrating in that the dispersion metric offers an indication of how accurate a location estimate is likely to be. Furthermore, the sub-clustering technique is often able to infer more finegrained (geographic) structure in Internet address ranges than is present in BGP routing data. Id., Sec. 7. See Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005) http://news.bbc.co.uk/1/hi/technology/4665351.stm (noting the desire of advertisers to have geographic location in order to make advertisements more relevant)
68
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. content depending on where the site believes a visitor is from. They also may prove useful for fraud detection.69 If, for example, the individual logging on claims to be from Florida but the services database indicates the individual is in Australia, there could be a fraud issue. Geolocation can be used for legal compliance70 and to avoid hostile jurisdictions. If online gambling, for example, is illegal in a nation, geolocation could improve a casinos chances of avoiding that jurisdiction. These services are about probabilities, not certainty. In terms of advertising, it is not necessary for all ads to reach the targeted audience with 100 percent certainty. However, if the targeted audience can be improved from 50 percent to 70 percent, then the value of those advertisements will increase. Advertisers would have an incentive to use these products simply to improve the probability of knowing where someone is from, without achieving certainty of knowing where someone is from. There are a large number of services on the market.71 A few of the better known include Akamais Edgescape and Quovas GeoPoint. Most telling perhaps is how the services are marketed. Akamai markets Edgescape as an ecommerce tool designed to better capture, retain, and convert online customers through targeted marketing strategies. Akamai promotes the service as making web content more relevant and presented in a means more agreeable to the individual visitor. Akamai also suggests that Edgescape could be used to Reduce risk of fraud and misuse by validating every end-user location and delivering only to authorized users/geographies.72 Akamai claims that it is able to achieve an effective solution by leveraging its massive server deployment and relationships with networks throughout the world [in order to] enable optimal collection of geography and bandwidth-sensing information.73 Of note, the narrowest range that Akamai represents that it could target geographically is on a zip code basis.74 Quova is a widely regarded company that markets its GeoPoint service as a solution for marketing, fraud, compliance, and security. Quova claims 180 customers including Major League Baseball,75 VeriSign, and Absolute Vodka.76 The service is
See Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005) http://news.bbc.co.uk/1/hi/technology/4665351.stm ("A study by credit scoring firm Experian has found evidence of fraud in 68% of orders where the IP address was in a different state from a customer's listed billing address.") Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005) http://news.bbc.co.uk/1/hi/technology/4665351.stm ("Stringent compliance regulations increasingly force firms to know who they are trading with") See Cybertelecom :: Notes :: Geolocation http://www.cybertelecom.org/notes/geolocation.htm for a more complete list of services.
72 73 71 70 69
Akamai: Edgescape (accessed May 23, 2005) http://www.akamai.com/en/html/services/edgescape.html.
Akamai: How It Works (accessed May 23, 2005) http://www.akamai.com/en/html/services/edge_how_it_works.html.
74 75
Id.
MLB streams video of games in compliance with traditional broadcast blackout rules. See http://mlb.mlb.com/NASApp/mlb/mlb/video/mlb_tv.jsp
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. marketed as offering geographic location down to the city level.77 News reports indicate the Quova has been able to solve the AOL Problem, as referenced above in the France v. Yahoo! case.78 An alternative product has been released promising to use wifi access points. Skyhook Wireless has proposed a triangulation solution which uses known access points and their mapped out locations to triangulate the location of an individual.79 Intel is likewise reported to be testing this type of technology.80 Other solutions may simply know the location of the access point in question and use that location information for anyone connecting through that access point. The limitation of such systems is, as always, that the location is only as reliable as the information in the database. Where the creators of the information have no obligation to be accurate or to maintain the information, the information in the database could have a relative margin of error and could become corrupted. Other limitations include noisy data and locations where only one access point is within reach (or for that matter no access points within reach that are in the service's database). Other limitations include moved and reconfigured networks corrupting the data used to generate geographic location. Sample of Location Services Conducted on a WiFi Net in Arlington, VA September 3, 2005
76
Geolocation Solutions by Quova: Factsheet (accessed May 23, 2005) http://www.quova.com/company/quova-factsheet.shtml. Id.
77
Stefanie Olsen, Quova upgrade pins down AOL users, CNET (Feb. 13, 2002) http://news.com.com/2100-1023-836138.html.
79
78
See Marguerite Reardon, Wi-Fi used for location service, CNET (Jun. 20, 2005) http://news.com.com/Wi-Fi+used+for+location+services/2100-7351_3-5754288.html The way it works is that the company has compiled a database of every wireless access point in a given a city. It did this by having people literally drive the streets "listening" for 802.11 signals. Using the unique identifier of the wireless router, it notes in the database where the access point is located. When a mobile user running the Skyhook client pops up in a neighborhood, the software scans for access points. It then calculates a user's location by selecting several signals and comparing them to the reference database. The more densely populated the area is with Wi-Fi signals, the more accurate the software is at locating the device. See Skyhook Wireless http://www.skyhookwireless.com/; Skyhook Wireless Press Release, TeleCommunications Systems & Skyhook Wireless Collaborate for E-911 July 7, 2005 http://www.skyhookwireless.com/news/press_rel_8.pdf.
80
Michael Kanellos, Intel Experiments with Wi-Fi as GPS substitute, CNET (July 12, 2005) http://news.com.com/Intel+experiments+with+Wi-Fi+as+GPS+substitute/2100-7351_35785565.html?tag=st.rc.targ_mb
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. Service DOTS GeoPinpoint81 Location Arlington Virginia United States Longitude: -77.1078 Latitude: 38.8783 Certainty: 99% Comment 2 miles off82
Akamai Edgescape83 Digital Envoy84 Discoveryvip.com85 IP2Location86
No Online Demo No Online Demo cannot be located. Va, ARLINGTON 38.8783 LATITUDE 77.1078 LONGITUDE United States Virginia Arlington Certainty 99% Longitude: -77.1078 Latitude: 38.8783 You at are located in Lat, Lon: (0.000000, 0.000000) Cherry Hill, NJ 2 miles off
GeoBytes87
2 miles off
High Earth Orbit88
After my input, reflected locations as Arlington, VA IP number had to be manually entered No Online Demo No Online Demo
Jgsoft Associates89 MaxMind90 Quova91
81 82
Service Objects DOTS GeoPinpoint http://www.serviceobjects.com/demos/geopinpointdemo.asp
According to Mapquest, this longitude and latitude is 2 miles away from where I was sitting at the time I did this survey. Akamai Edgescape http://www.akamai.com/en/html/services/edgescape.html Digital Envoy http://www.digitalenvoy.net/ Discoveryvip.com IP Checker http://www.discoveryvip.com/ipaddress.htm IP2Location http://www.ip-to-location.com/ GeoBytes IP Address Locator http://www.geobytes.com/IpLocator.htm High Earth Orbit http://highearthorbit.com/projects/geolocation/index.php IP Address Finder, Jgsoft Associates http://www.analysespider.com/ip2country/lookup.php MaxMind http://www.maxmind.com/ Quova http://www.quova.com/index.shtml
83 84 85 86 87 88 89 90 91
DRAFT
DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite. Verifia NetGeo92 No Online Demo
Other Possible Geolocation information Solutions
Wireless Geolocation GPS
Geography in the Application Layer versus in the Network Layer
Many of the geolocation solutions above attempt to detect location from information within the Internet network (layer 3&4). Another solution is to maintain location information at the application layer, and to maintain the location information not with the user but in some off network database. The only time that the location information would be relevant is when the application is in use. When the application in not in use, there is no connection to the location information. When the application is in use, the individual using the end application is assigned a data token. When the database is queried with that data token, the database will respond to an authorized query with the geographic location. In other words, simply because the individual in on-net, and simply because the individual is using that application, does not mean that the location of that individual can be derived from the individual's existence on net. The data token that the individual carries is meaningless unless access is gained to the location database. For example, in the case above, the geolocation tools determined that the IP number XXXX was in Northern Virginia. Likewise, on the telephone network, if I make a case, caller ID reveals an area code of 703, which indicates tha...