GeoIP database issues and the real world consequences

Interesting article.

http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/

An hour’s drive from Wichita, Kansas, in a little town called Potwin,
there is a 360-acre piece of land with a very big problem.

The plot has been owned by the Vogelman family for more than a hundred
years, though the current owner, Joyce Taylor née Vogelman, 82, now
rents it out. The acreage is quiet and remote: a farm, a pasture, an old
orchard, two barns, some hog shacks and a two-story house. It’s the kind
of place you move to if you want to get away from it all. The nearest
neighbor is a mile away, and the closest big town has just 13,000
people. It is real, rural America; in fact, it’s a two-hour drive from
the exact geographical center of the United States.

But instead of being a place of respite, the people who live on Joyce
Taylor’s land find themselves in a technological horror story.

For the last decade, Taylor and her renters have been visited by all
kinds of mysterious trouble. They’ve been accused of being identity
thieves, spammers, scammers and fraudsters. They’ve gotten visited by
FBI agents, federal marshals, IRS collectors, ambulances searching for
suicidal veterans, and police officers searching for runaway children.
They’ve found people scrounging around in their barn. The renters have
been doxxed, their names and addresses posted on the internet by
vigilantes. Once, someone left a broken toilet in the driveway as a
strange, indefinite threat.

--Chris

TL;DR: GeoIP put unknown IP location mappings to the 'center of the country'
but then rounded off the lat long so it points at this farm.

Cant believe law enforcement is using this kind of info to execute searches.
Wouldnt that undermine the credibility of any evidence brought up in trials
for any geoip locates?

Seems to me locating unknowns somewhere in the middle of a big lake or park in
the center of the country might be a better idea.

/kc

Cant believe law enforcement is using this kind of info to execute searches.
Wouldnt that undermine the credibility of any evidence brought up in trials
for any geoip locates?

What overworked and underpaid public defender is going to know enough to challenge the “evidence?” What judge is going to know enough to call BS on the search warrant affidavit? A good number of the judges in Oregon used to work for one of the DA’s offices, you think they question law enforcement affidavits very aggressively?

TL;DR: GeoIP put unknown IP location mappings to the 'center of the country'
but then rounded off the lat long so it points at this farm.

Cant believe law enforcement is using this kind of info to execute searches.
Wouldnt that undermine the credibility of any evidence brought up in trials
for any geoip locates?

Seems to me locating unknowns somewhere in the middle of a big lake or park in
the center of the country might be a better idea.

...how about actually marking an unknown as...oh, I dunno: "unknown"? Is there no analogue in the GeoIP lookups for a 404?

Or 0,0, send the FBI to Africa on a boating trip. that would probably be
easier than "unknown" or "null".

Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

Has happened in Atlanta, too, due to (what I think) was a lookup on the
ASN's whois, which wasn't specific:
http://fusion.net/story/214995/find-my-phone-apps-lead-to-wrong-home/

Well they DO know the IP location is within the USA - many apps use the GeoIP
API and require a lat/long returned, and some need one that lands within a
country border (thus my suggestion of middle of a remote wilderness park - let
the cops search some desolate remote desert in nevada amirite?)

MaxMind might not want the quality hit for a 0,0 answer (as funny as that would be).

(my 'middle of a lake in the middle of the country' retains some of that mischievous
win however.)

/kc

It's not unknown - it's (according to the DB, anyway, which has a bunch of flaws) "in the US somewhere".

The problem with MaxMind (and other geoip databases I've seen that do Lat/Long as well as Country / State / Town) is that the data doesn't include uncertainty, so it returns "38.0/-97.0" rather than "somewhere in a 3000 mile radius circle centered on 38.0/-97.0".

Someone should show them RFC 1876 as an example of better practice.

Cheers,
  Steve

Just so everyone is clear, Maxmind is changing their default locations.

" Now that I’ve made MaxMind aware of the consequences of the default locations it’s chosen, Mather says they’re going to change them. They are picking new default locations for the U.S. and Ashburn, Virginia that are in the middle of bodies of water, rather than people’s homes."

So they launch exhaustive and expensive searches of lakes instead? :slight_smile:

The middle of lake superior and hudson bay would be good choices for the US and Canada.

Quick, run a commercial diving team with on-call at the nearest ports.

- Jared

I imagine it might look something like this http://i.imgur.com/HlpOXP0.jpg

In article <90136824.12309.1460396310889.JavaMail.mhammett@ThunderFuck> you write:

So they launch exhaustive and expensive searches of lakes instead? :slight_smile:

I'm starting a new chain of kiosks that rent wet suits and snorkels.

R's,
John

The problem with MaxMind (and other geoip databases I've seen that do Lat/Long as well as Country / State / Town) is that the
data doesn't include uncertainty, so it returns "38.0/-97.0" rather than "somewhere in a 3000 mile radius circle centered on
38.0/-97.0".

Someone should show them RFC 1876 as an example of better practice.

Oh, heck, you know better than that. You can put in all the flags and
warnings you want, but if it returns an address, nitwits will show up
at the address with guns.

Bodies of water probably are the least bad alternative. I wonder if
they're going to hydrolocate all of the unknown addresses, or only the
ones where they get publically shamed.

R's,
John

Why not use the locations of their own homes? They're indirectly sending mobs to randomly chosen locations. There's enough middle men involved so they can all say they're doing nothing wrong, but wrong is being done.

-Laszlo

I imagine some consumers of the data will 'correct' the position to fall on the nearest road in front of the nearest house.

-Laszlo

They should stop giving out coordinates on houses period. Move the
coordinate to the nearest street intersection if you need to be that
precise (I would prefer nearest town square). Anything more than that
should be illegal.

Regards,

Baldur

If GeoIP insists on giving a specific lon/lat, instead of an uncertaintity how about using locations such as the followign as the "default I don't know where it is"

United States: 38.8899 N, 77.0091 W (U.S. Capital Building)
Missouri: 38.5792 N, 92.1729 W (Missouri State Capital Building)

After the legislators get tired of the police raiding the capital buildings, they will probably do something to fix it.

* baldur.norddahl@gmail.com (Baldur Norddahl) [Mon 11 Apr 2016, 21:02 CEST]:

They should stop giving out coordinates on houses period. Move the
coordinate to the nearest street intersection if you need to be that
precise (I would prefer nearest town square). Anything more than that
should be illegal.

That's going to make USPS's and FedEx's lives a lot harder.

  -- Niels.

Are they in the habit of delivering to a location identified by an IP
address? I've never managed to get either one to deliver to anything
other than a street address (and in fact, we recently had to assign street
addresses to all the buildings on campus because too many GPS-based programs
only work on street addresses, not building names).