Literal crossed wires sent cops after innocent neighbors in child abuse case Details have emerged of a troubling case in which a basic engineering mistake wrecked a digital evidence investigation and led to wrongful accusations. An open judgment [PDF] published by the UK's Investigatory Powers Tribunal, which is responsible for investigating claims of British authorities illegally abusing their powers …
Had a client a few years ago with voice/data(dsl) into their house suddenly stop working properly.
On my investigation, I found their phone number was now a different one - the pair had been swapped with another.
I contacted the ISP, and their view was "what do you want us to do? You're getting free calls now, as someone else is being billed for your calls, isn't that a good thing?"
I'm sure a few people will guess which UK ISP might have had that sort of view....
Years ago, our phoneline died (It gave a quick "chirp" as it expired), I had to wait 3 days for BT to fix it (Despite having seen the guy working in the local box earlier that day).
Day 4 roles around, still nothing, I dig out my DVM no line voltage, ring up BT....
It's been resolved!
No it hasn't, there's no line Voltage
There then followed a short discussion of how I ascertained that fact as subscribers were prohibited from interfering\connecting anything to their phone network (I bullshitted a bit by saying I had PABX\Network line testing kit) which I countered with well clearly I haven't as the Master socket isn't connected to anything as there's no line voltage.
A "Humph" of damn he's got me there.... followed by my next question of.
Who marked it as resolved?
The engineer, he traced your line, reconnected it & rang it, a fax machine answered so he closed the ticket.
Well.....I haven't got a fax.
Oh, well it will be another 3 days for a tech to go back to site as its a domestic line & a new ticket!
Really?
Nothing that you can do to expediate that.
No
I know something that might expediate that.....How about I go to the Young Farmers Offices directly at the back of my house & ask them if they are getting fax's, presumably they could log a ticket that might get their fax line restored & my line reconnected to my house instead of their fax machine.
Hmmm it may not be until tomorrow now....
Some curt goodbyes followed & 20 mins later a new chirp was heard from our phone as it returned to life.
I got lucky. I was at home putting packets in to the tubes when they stopped working. I looked out the window and saw a van parked outside with Openreach written on the side. Walked outside and saw the cabinet was open with a bloke in high-viz, so went up to him.
"Hi, My internet just went down, is that something to do with whatever you are doing?"
"No, shouldn't be... Unless... I did just rewire a spare line, but it wasn't an active one because there was no dial tone"
VDSL/G.Fast have the internet delivered by the cabinet, but the line continues back to the exchange for POTS service. It would appear I had no POTS service for an unknown amount of time, hence no dial tone on the line...
Engineer reconnected my internet then and there, I had to raise a fault report with my provider to get a dial tone reinstated to prevent it happening again.
If I had not seen the openreach van and taken immediate action then not only would it have taken days for an engineer but when they did come out and find my line disconnected they would have been unable to fix it. There were no more spare lines to the building... (The customer he was "borrowing" my line to hook up had to wait a month or so for someone else to come out and run some extra lines)
A friend of mine had only just had their line connected for a few days when they found it dead on getting home.
They called BT and a few days later a BT technician (engineer?) came out.
They found that the contractor saw there were no possible connections and just cut there's and installed the one they had been told to. Job done.
The likelihood of BT messing up a specific connection on a specific day is very low*, the likelihood of BT messing up a whole lot of connections on any given day is very high.
* Unless it's the day the connection is set up or in the six weeks following that, where in my experience it tends towards an absolute certainty.
No, it's the responsibility of the police to verify evidence. That's literally the core part of their job. If prosecutions were launched on the back of unverified evidence, you'd be able to get someone into a lot of trouble by simply selling the police a tall story.
If they had got as far as pressing charges, and in the court case the defence said "not our chap's IP address", they'd have had serious egg on face for not having verified that simple, basic fact, and likely be up on a purjury charge (having sworn an oath as to the correctness of their evidence).
BT screwing up is bad too, but hey they do that all the time.
This could now be a problem for previous cases. If it turns out that the police as a matter of routine have not been verifying an accused person's IP address really was what the police said it was, there could be hell to pay. In cases where other evidence was found, no problem. But if a case had come down to nothing more than "the traffic came from or went to your property", that could be a problem.
If they had got as far as pressing charges, and in the court case the defence said "not our chap's IP address", they'd have had serious egg on face for not having verified that simple, basic fact, and likely be up on a purjury charge (having sworn an oath as to the correctness of their evidence).
How do you prove to the court the evidence wasn’t verified?
Police used a tool which said a crime was committed by ip x belonging to isp y.
Police check with isp y who confirm name & address of subscriber who used ip x at the stipulated dates & times.
Why would the court not accept that as evidence? How do you challenge that? Do you know what your public ip is today? Do you know when it last changed? Do you know what the public ip your isp thinks is assigned to your address & does it match what you actually have?
Took the police many months to challenge that evidence during which time the innocent parties had their lives turned upside down due to the investigation.
Hindsight shows it was trivial to confirm if the ip at the address was what the isp thought it was.
I suspect the police further investigated once they had the router in their possession and their tool told them further offences occurred & they knew for sure there was no internet connection at the address which made it obvious there was an issue which then prompted openreach to do a physical audit that revealed the true issue resulting in the guilty party being apprehended.
I see you've never had experience with real police investigations, because "verification of evidence" is not really that high up their list of job duties. Find a likely culprit, find evidence, send evidence to prosecutor. The TV show CSI is science fiction.
An accusation of possible IIOC leads to serious (and frequently irreversible) consequences for almost anyone who is so accused, especially if IP address lookups from BT's system say "it's coming from this house". This is why innocent people need solicitors/lawyers [insert appropriate representation] before agreeing to any 'voluntary interview' with ANY police anywhere.
Society (and legislative bodies) decided that making the police pay for misdirected investigations isn't usually required, so as bad as this is from the standpoint of the victims of the misplaced investigation... they're stuck going after BT for improper record keeping or something. Most police departments aren't even required to make good on damage caused during a search that finds nothing of interest.
The trio brought the case as they argued their Article 8 rights (right to a private family life) under the RIPA were infringed. These claims largely hinged on the idea that the police's RIPA requests for communications data from BT were unlawful because they could have made other lines of inquiry before issuing them.
This doesn't seem like the right track to claim damages. Considering the all three suffered actions amounting to being assumed guilty (employer informed, job offer lost, CHILDREN REMOVED) - shouldn't they be suing for real damages from those actions? The police could have made the RIPA request and made their two searches and seizures without executing those injurious actions on those people.
It's so easy to spoof a MAC address...
There's even commands in every router and many computer to change it... on a per interface or vlan basis...
The only way to be sure is to follow the wires from the DSL cabinet in the exchange (since it obviously was a DSL line) to the house going through each and every roadside cabinet.
A MAC address is an Ethernet concept. If the connection is PPP over something serial (which, often, your internet connection is that), there's no MAC address for your end.
Same for dial-up; you're making a call from phone number, not a MAC address, and spoofing the phone number requires fiddling about with wiring not with the content of some register on a modem.
There is a problem here. To "prove" that an IP address is associated with a property, you ideally need to be on the network in the property pinging out to a "what's my IP address" service. I'm not really sure of a way of determining for sure from outside the property that an IP is at a physical location. You might have to tap the wire at the property boundary (or nearest equivalent place) to be totally sure.
Otherwise you'd have to audit thoroughly the wiring from the property to the computer on the ISP's network that's issuing the home with an IP address, which is what they had to do in this case to find the actual culprit.
You can also spoof a phone number... It's part and parcel of every PBX (virtual or now)
Now it's harder to do than spoof a MAC as it requires a PBX (virtual or not) and an ISDN line.
And even if the A-Number (the caller) is spoofed, the PSTN will know better and use the real phone number for the billing.
As for the PPP that doesn't have any MAC. Most of the ISP use PPPOE (which obviously is Point to Point Protocol Over Ethernet) so there's a MAC address involved at the Ethernet layer.
quite trivial to check the IP & MAC of the router corresponds to what the carrier thinks it is.
if the suspect doesn't reveal the wifi password then a cable plugged into the router and a laptop with a quick look google for whats my ip would suffice.
shows how close we can be to a major problem due to an un disclosed mistake that non of us can actually verify for ourselves before hand.
They did check with the ISP. That's how they got the address in the first place. But the ISP was working with faulty data because an engineer had swapped a couple of pairs in the cab. I have deep insights into the case. I just read the article. All of it.
How so? OpenReach just list "this line connects to this address". According to the article the police then raided the address and found 3 people inside who they identified - they didn't get the name(s) of the occupant or line subscriber from OR.
"what the carrier thinks it is"
What MAC address do you think my ISP thinks my router doing PPPoE should be?
Because the only infromation they have is that that router is connecting to their systems. They didn't supply it, they have no idea what it's MACs will be.
Now, on my line, yes, the connection has a username and password.
But on say, BTB, where every router normally uses greenlight@btbroadband.com or the like as it's PPP username, and the actual access is granted by which port on the DSLAM you are connected too, yes, if you swap 2 BT lines, the routers DGAS.
Exactly this, the sheep shagging dandylions should have been and will probably sued in civil court and will probably settle out of court for fear of being branded feckless fckwits.
Wh the trio didnt also go down this route at the same time, shows that their legal representation with also feckless.
Taking court action in the UK is expensive, difficult and time consuming, with very little chance of redress and the likelihood of a big bill. Most Brits simply don't have the available cash to do this and any litigation would be on-going trauma and time you would need to ask for off work.
It is less expensive to make a complaint with a regulator, but most are crap and will side with the authorities.
You just have to take it on the chin and accept that you will get treated like dirt if you are unfortunate enough to be in such a position.
All three submitted to voluntary interviews and were fully compliant with officers, as you would be if you were entirely innocent of such serious offences.
The article author clearly subscribes to the erronious "if you are innocent, you have nothing to hide" mentality.
I don't know how the legal system works in the U.K., but in the U.S., your best course of action is to drink a steaming-hot, 32-ounce mug of "shut the fuck up" and get a lawyer -- especially if you are innocent.
Here's why, according to a U.S. attorney, and according to a police detective:
https://m.youtube.com/watch?v=d-7o9xYp7eE&pp=ygUnd2h5IHlvdSBzaG91bGQgbmV2ZXIgdGFsayB0byB0aGUgcG9saWNl
You should always lawyer up, but be aware that in the UK courts may take inference from your refusal to testify to the police. This is a crucial difference between US law where you can plead the fifth and a court cannot (legally) use that to determine your guilt. Of course, if you're in front of the twelve angry men, it may not matter - people form judgements whether or not the constitution tells them to.
Speaking with some experience in the matter of working with police and the courts as an expert witness.
It's not so much a legal issue (e.g., the fact that your defence may be harmed by your silence) but rather a human factors issue.
It all hinges primarily on the degree of professionalism, skills, dedication, and motivation of the people (generally police) doing the investigation. It is perhaps not common, but it is also not unknown, for investigators to take the path of least resistance, and if they can pin something on someone who would make a convenient suspect, some of them, some of the time, will.
It is therefore not advisable to be overly cooperative unless you know exactly who you're dealing with.
To be clear, in my experience most people try to be fair and do their job properly but things like burnout, management pressure, and prejudice acquired over the years are a factor to be reckoned with.
My understanding is that you should not voluntarily allow yourself to be interviewed by the police, if innocent. Obviously, if you are guilty, you should 'fess up - it will go better for you in court, when it comes to sentencing. If you are arrested, you should do nothing more than confirm your identity, and give "no comment" answers to any further questions. Answering some, but not others, can be seen as an admission of guilt, or that you have something to hide, even if that thing you want to hide is perfectly innocent, and nothing to do with the charges being brought.
The job of the police is to gather evidence, to provide enough indication that a suspect may be guilty of a crime, so that they can then get a charging decision from the CPS. They don't actually care if the person is guilty or not, although it reflects well on them to get the right person, their job is to get enough evidence to get a suspect to court. Once a case is in court, the only involvement the police have is as witnesses if a case goes to trial because the person didn't plead guilty.
The thing is, if you're being interviewed, even voluntarily and not under caution, you literally don't know what other evidence the police might have gathered, and how that fits, by pure coincidence, to things you might, in all innocence, say. If they put 2 and 2 together and get 5, and decide that they might get a charging decision from the CPS, they'll go ahead and arrest you whether you're guilty or not. It's literally their job to do so.
" If they put 2 and 2 together and get 5, and decide that they might get a charging decision from the CPS, they'll go ahead and arrest you whether you're guilty or not. It's literally their job to do so"
Indeed, they are never to be trusted. The only person that's looking at for you, is you.
Obviously, if you are guilty, you should 'fess up - it will go better for you in court, when it comes to sentencing.
this one plead guilty and got remand & then 31 months for a media post she deleted a few hours later
https://www.bbc.co.uk/news/articles/ce83pj1ggmeo
this one pleaded not guilty, was not remanded, jury deliberated for 30 minutes before finding him not guilty, video evidence widely shared of his actions
https://www.bbc.co.uk/news/articles/cjeykklwn7vo
using those 2 as examples it looks like there are different interpretations of fessing up & going better for you in court.
looks like its better to have a trial by peer instead of by judiciary.
https://www.theguardian.com/world/2016/nov/16/ethnic-minorities-more-likely-to-be-jailed-for-some-crimes-report-finds
One of the most frequent explanations for differential outcomes is that distrust of the justice system encourages ethnic minority defendants to opt for jury trial rather than pleading guilty at magistrates court, where they might receive a lower sentence.
The report confirmed that BAME defendants are more likely than their white counterparts to be tried at crown court: for every 100 young white defendants opting to have a jury trial, 156 young black men choose to do the same. The report also found 152 BAME men pleaded not guilty at crown court for every 100 white men.
Another of the inquiry’s panel members is Shaun Bailey, a Conservative London assembly member. Asked whether he thought there is bias in the justice system, he said: “The institutional figures would suggest that … If you had gone to the black community in the past they would have given this feeling. But these reports are backed up by statistics.
“Because they have less trust in the system, black people think they should trust the public [ie the jury]. It shows they still have trust in the British public. [Outcomes in] the rest of the system would suggest there’s bias.” By opting for a jury trial, Bailey said, black people were trying to redress perceived prejudice.
https://www.theguardian.com/law/2017/mar/28/ethnic-minorities-get-tougher-sentences-due-to-distrust-in-courts
Black and minority-ethnic defendants may be given more severe sentences at magistrate and crown courts because they distrust the criminal justice system and are reluctant to plead guilty, according to a legal thinktank.
While judges reduce punishments by up to a third if offenders plead guilty at the earliest opportunity, a report by the Centre for Justice Innovation (CJI) suggests that a belief that courts treat black, Asian and minority ethnic (BAME) people unfairly prevents them from taking advantage of such reductions and reinforces unequal outcomes.
A finding here is that your best off being judged by your peers than by a judge, especially if your a minority.
I'd suggest they judiciary is not in lockstep with the citizens.
Whilst there is obviously an element of chancing your arm (if you are actually guilty), if a jury finds a perron not guilty, that means that there wasn't evidence that proved them guilty.
Clearly, if you are guilty of a crime, and there is insufficient evidence to send you down for it, you *can* plead not guilty and go to trial. There's a lot of people doing this, as indicated by the huge backlog of trials. You might be found not guilty and get off scot-free, and in the end, only you will know whether you did it or not (and have to live with that knowledge). However, my point was that if you are guilty, and clearly guilty, and there is overwhelming evidence to show that, as is the case in many, many trials, then you'd be a fool to plead not guilty, it's in your interests to plead guilty, and take it on the chin, because it will affect sentencing if you don't show remorse.
As for trial by your peers, you really are rolling the dice on that one. As someone who has done jury service, I can tell you that those twelve jurors are going to be a real mixed bag. Obviously I can't discuss what went on in the jury room, as it's still sub judice, and will remain so, but you are going to have a microcosm of society in there, and twelve is a small enough sample to have a non-zero risk of picking a majority of really dumb people.
If you're working as an expert witness, you generally won't be involved with police at their worst. In the UK things are a bit different, I'm sure... but US police? Shut up and get a lawyer the first chance you get. There's jurisprudence here that police actually can't use your statements that would be in your favor. ("Statement against interest" being an exemption to "hearsay", but "Statement in favor of interest" is not exempt from the hearsay rule).
Different system.
The US system assume you're guilty, and it's up to you to prove you're innocent.
The UK system (and most of the EU systems) assumes you're innocent until judged guilty.
Here in France you are assumed to be innocent until you're judged guilty by a judge/jury.
And you end up in front of a judge/jury only if there's enough facts collected during the investigation that prove that you may be guilty.
The Investigations performed by the cops are to get the facts, just the fact and only the facts. Then it's up to the Judge and an eventual jury to determine if you are guilty or not.
There's no secondary investigation, there's no discovery, and all the stuff found in US courts. (now the judge may request further investigation [again performed by the cops in charge] to clarify details or dig further) to help him reach a decision.
"The US system assume you're guilty, and it's up to you to prove you're innocent."
Incorrect. All the countries you name have the same presumption of innocence as legal doctrine. They have different protection, some of which will be stronger and some weaker. Let's take those rights suspects get read on arrest. The statement in England and Wales includes "You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court.", but the version from the US is more similar to that in Scotland which does not. What's the difference? The difference is that you're not required to state your defense up front in either location. That's a stronger protection. Part of the reason is that the England and Wales requirements on police procedure include some restrictions the US does not have, which is a stronger protection there. The differences are smaller details and nothing so obviously wrong as what you've claimed.
It's US policing that assumes you are guilty; the UK (nominally) has "policing by consent," which technically means you don't have to cooperate with the police unless arrested. In the US, you have to cooperate with whatever the police say, or they'll (possibly) shoot you. Especially if you're black.
> The UK system (and most of the EU systems) assumes you're innocent until judged guilty.
Sadly in the UK it seem that with IIOC you are presumed guilty until you can prove your innocence.
In cases like this there should be automatic compensation (and the first thing they should have checked was that the IP address matched - hell that is such a basic check!) so that you can continue your life as if nothing had happened, although how you compensate for a lost job (or offer in this case) I have no idea.
This stuff needs stamping out but not at the cost of innocent people having their lives messed up or in some cases literally destroyed.
The solution here would be anonymity for anyone charged with a crime until they are found guilty, not just for children. The people involved were found by the police to not actually be involved in IIOC but the fact that their names were published whilst they were being investigated was the problem that led to the various harms they suffered. There will have to be exceptions to this of course, like where children or safeguarding is concerned, or national security, but in general people accused of crimes shouldn't be identified until found guilty IMO.
Yep was gonna post about this but you beat me to it.
There is NO WAY I could be "fully compliant" if the police showed up accusing me of child porn. Since I know I'm innocent that my first thought wouldn't be "oh somebody's innocent technical error I'll just cooperate fully and they'll soon be on their way". I would assume I was being framed for some unknown reason, and I would be as UN FUCKING COOPERATIVE as you can imagine!
I would not say a word, I would contact a lawyer, and my first thought would be preservation of evidence I would MOST DEFINITELY be using when I sued the police (and anyone else whose incompetence or malfeasance was to blame) for millions of dollars. So I would want to be recording them, though them taking away my phone would be a problem so hopefully I could get one of my neighbors who would no doubt be curious about all the police cars outside my house to do it for me!
"There is NO WAY I could be "fully compliant" if the police showed up accusing me of child porn."
Ditto. This is an extremely damaging allegation that needs a competent lawyer onhand BEFORE anything else happens.
It's the kind of accusation that needs severe disciplinary action in the event of screwing up
It's the kind of accusation that needs severe disciplinary action in the event of screwing up
And how do you do that in this case? The police are not to blame as they followed process, they relied on evidence provided by BT/OR until it turned out that there was a mistake, at which point the police dropped the investigation, as they should.
The BT/OR engineer is to blame for crossing the wires, but the outcome of a group of people being accused of IIOC possession is not a reasonable or proportionate outcome which could be forseen or planned for by OR when they assess the risk of their engineers making a mistake in working with wiring. The process which the engineer followed to do and check their work should absolutely be checked out to make sure it's fit for purpose, and that the engineer was following it properly, and if they weren't then they should face appropriate discipline for this, but the eventual outcome shouldn't factor into this disciplinary process because it's not a forseen or likely outcome of the mistake.
The person who should bear ultimate responsibility is the actual possessor of the IIOC - if they weren't breaking the law in such a horrific and vile way then none of this would ever have happened.
the evidence should have been challenged & verified at every opportunity.
BT says address x & customer y, how to confirm that's accurate? Electoral roll, council tax payments would confirm who lives at the address and for how long. would have shown the discrepancy & helped the police locate the real address quite quick.
It could have been a VERY SMART pedophile!
It isn't as though those telco cabinets are well protected from "end user modification", shall we say. It would be easy to verify whether swapping your wire for someone else's changes your IP address, if it does then everything you do will be in their name. Though it would be smarter to regularly swap between neighbors, so by the time the alarm is raised on one of them you've already moved on to doing your evil deeds in the name of another and it would be impossible to trace back to you unless they staked out the cabinet and caught you in the act.
Most of those that distribute "IIOC" are incredibly stupid - being caught with evidence by totally incompetent police (after given ample time and notice to destroy any evidence due to their incompetence), confirms another such case.
Most likely the internet connection installer, installed the wires swapped without noticing, or realized only after the long configuration, but didn't care as it was typical for the plan costs to match.
The convicted individual was most likely not a pedophile, as ~80% of convicted predators are not pedophiles.
It seems likely that most that distribute "IIOC" would match that statistic and would mostly not be pedophiles and rather would not have any particular attraction to prepubescent minors and know it's wrong, but do it anyway.
"the court said what happened was normal"
A correct ruling then...
Something many in the UK IT industry either know from experience, or should be aware of if they somehow managed to stay ignorant: If you are one of those evil criminals who runs one of those "hosting companies" you will not be compensated when the police take every server in the building because one of your customers is suspected of being naughty. You don't need compensation, because they will return [most of] the servers [in 12+months time], so no damage done.
So all of this sophisticated software tracking IIOC sharing is then completely reliant on Service provider's databases being correct, and the ability for engineers to wire correctly on a cold day, low lighting and within a cabinet which is a wire tumbleweed. There's definitely a weak link there...
>> All three submitted to voluntary interviews and were fully compliant with officers, as you would be if you were entirely innocent of such serious offences.
This is nonsense. If you are accused of anything you should never cooperate with the police. Talk to your lawyer. Let them decide how to help you.
The police are not your friends, they are there to prosecute you. It says it in the words "anything you say may be used against you". Not to help or assist you.
The right to silence is there to protect the innocent.
That's just mind tricks the police play on people. You should never talk to the police. They are not there to help you. Talk to your lawyer and take their advice.
Do not forget that many (most?) police forces in the UK have been deemed to be institutionally racist, institutionally sexist, institutionally homophobic, and institutionally corrupt. None of them have been found to be institutionally free of the aforementioned. None.
The problem is they are never held to account. The courts let them get away with it.
It's a concept I fundamentally disagree with because it disproportionately favours the police but the legal term is Adverse Inference. Definitely worth reading up on so that you're properly aware of your actual rights (or, rather, the limits of them).
Adverse Inference
After a change in the law in 1994, the right to silence under English law was amended because the court and jury were allowed to draw adverse inference from such a silence.[5] Under English law, the police, cautioning someone, say, "You do not have to say anything. But it may harm your defence if you do not mention, when questioned, something which you later rely on in court". Under English law, the court and the jury may draw an adverse inference from fact that someone did not mention a defence when given the chance to do so if charged with an offence.[5][6]
https://en.wikipedia.org/wiki/Adverse_inference
"Do not forget that many (most?) police forces in the UK have been deemed to be institutionally racist, institutionally sexist, institutionally homophobic, and institutionally corrupt.
I would like to see the evidence to that claim.
You're always asking for bulletproof evidence when China and Russia is implicated, surely you set the same standards to yourself. No?
"None of them have been found to be institutionally free of the aforementioned. None."
Proven innocent? In which country is that the norm?
"I would like to see the evidence to that claim."
I have no idea what the tankie you're (apparently) talking to normally defends, but that's a batshit crazy request. Are you seriously unaware that this is the case? There's endless coverage of the issues. Just for example:
https://www.theguardian.com/uk-news/2024/jan/05/head-of-britains-police-chiefs-says-force-is-institutionally-racist-gavin-stephens
It depends on the offence committed. Sometimes talking with the police openly works out to be the cheaper and more efficient option in the real world. For example: If you’re caught with a small amount of cannabis for the first time, just be honest, allow confiscation and take your non-record cannabis caution.
If it was as serious as this though, I’d want a solicitor (not a lawyer) from the get-go, with no voluntary interviews agreed to whatsoever. This is a situation where they should be forced to make an arrest and then be forced to divulge everything they will later rely on in court (in the UK, it works both ways, they can’t hide anything you could reasonably explain away if they later want to use it as part of a prosecution) and while police can technically lie in some specific ways, they can’t falsify evidence without being prosecuted themselves, so having a solicitor immediately puts them at a disadvantage when questioning people.
There was a remote property that had a landline installed (about 1934 iirc).
One quarter, many years later (2000s somewhere), the phonebill showed active use on the line when there was definitely no-one at the property; coincidentally the call was 30 minutes after it had been secured for winter. One of the numbers called was AOL... interesting, we thought, as there was no electricity or, indeed, electircal equipment at the property at all.
When challenged on the veracity bill, BT claimed that their billing was world leading and never made mistakes. Our position was that we weren't denying the calls were made on BTs network but that they definitley were not made from our line.
Further digging (thanks to fully itemised billing) revealed that another number dialled turned out to be a builder in Radnor, someone we had no dealings with.
The builder was contacted and asked if he had a client in the area, which he did.
BT eventually conceeded defeat, without prejudice, refunding the invoice but maintaining their innocence.
That line has now been ceased owing to the lack of electricity available to run an ONT.
This story aside, it has always amazed me how BT ever got the reputation for being a source of truth.
The police are supposed to be able to trace all evidence back to where it came from, and control everything that has happened to it in the interim.
In this case, it seems that they have mistaken "BT says that" for "it is a fact that", and treated that piece of information as having a proper chain of custody back to a demonstrable fact.
Now, this is no reflection on BT (although in this case they were at fault), that this should be done. The police should have done due diligence and established that what BT were telling them about the assignment of IP addresses was in fact true, by verifying it.
Accidents, mistakes, and human error do occur, and rather than finger-pointing, it is the job of the police to eliminate these from their enquiries. The seriousness of the alleged crime should not change whether proper processes should be followed, and I'd suggest that the investigating officers were at fault in this case, in their over-eagerness to "catch a nonce," they took short-cuts and not only caused material harm to innocent people, but allowed the actual offender to continue causing harm to children. I would hope that the IOPC are on this case, and that investigating officers have all been made aware that this sort of information from ISPs is not 100% reliable, and should not be solely relied upon to identify addresses or devices. I won't be holding my breath, though.
Up to a point I agree. However, looking at it from the police PoV they would, quite reasonably I think, Have regarded the information from BT as fact and expected to get a proper witness statement of that in due course. However it sounds as if there was accumulating evidence (in the general rather than forensic sense) that something was amiss and that this was disregarded. "What if this is wrong?" is a difficult question to keep asking oneself in the course of an investigation but it is an important one, not only to avoid harm like this but also to avoid failing to find the real culprit.
The really significant failure here, however, is, on realising that harm had been done to innocent people, that nobody felt it their responsibility to be proactive in doing what they could to repair that harm. That it more important than allocating blame.
The steps you're talking about need to be done to prepare a watertight prosecution case, sure, however it is NOT necessary to do it early in an investigation. There is always a balance in investigations between getting evidence secured correctly and making sure it's completely watertight, and moving fast so that further evidence you haven't collected yet is lost because someone destroys something or goes on the run or dies etc.
So in the initial stages of an investigation the police need to move fast to secure all available evidence, which is why the standards required to get a warrant to search a property is much lower than that to prove guilt in a court. This is what happened in this case - the police gathered sufficient evidence to convince a magistrate to sign a warrant to search the property in question, they did the search, and secured further evidence for analysis. They they continued the case, found a mistake had been made, and stopped investigating the original people and found where the issue was, and investigated the right person, which led to a prosecution and conviction.
The system may be ugly at points but it works, and whilst improvements can be made I'm not sure in this case what could have been done better without risking the potential of evidence being lost or destroyed so that a prosecution never happens.
About 10 years ago I wrote to my then MP telling him that I would not be prepared to support his party because they seemed to be celebrating the 800th anniversary of Magna Carta by removing the due process of law, the consequence introducing short cuts in whatever was the version of investigatory powers at that time. This is the sort of outcome I envisaged.
Allegations are easily made but they're not necessarily true and this really needs to be kept in mind by anyone investigating crime. An incorrect allegation against an individual is damaging and the fact that one wrong has been committed does not justify or excuse a second one being committed by an investigator. My daily fear as a forensic scientist was that I might find myself in the middle of a miscarriage of justice. Even now I find myself being stressed by recalling those days although they were many decades ago.
We've seen too many instances in recent years of the victims of miscarriages being shoddily treated even if they have suffered for years and this seems to be yet another example. It's true that the police had been mislead by an error on BT's part but those wrongly suspected should be treated and respected as being as much victims as abused children.
There are no short cuts to investigating crime if this sort of thing is to be avoided and yet the Home Office persists in trying to get Parliament to give it more.
The removal of children from innocent parents is in itself an act of abuse, "for their protection" as a justification need's a high level of proof which could be obtained by having experts interviewing the children at home*. Social services staff know full well that the 'better safe than sorry' line is only pertaining to their personal future - better 100 innocents taken into care then returned rather than one left with 'suspects' while a complete lack of evidence exists - BT line information isn't evidence.
* this is where the system fails, instead they're interviewing probably terrified children at a strange location having been removed from their parents.
Letting the utility in question just ignore questions is, frankly, weak. I understand monopolistic utilities on either side of the pond not wanting to answer to their (ahem) customers. But this was a government tribunal. A US court could have issued subpoenas for said utility to give testimony in writing and/or in court as to what/why/how these events happened. The answers might be incomplete or insufficient, for which the company can be found in contempt of court and fined, hopefully (hah!) with the fines going straight to these unintentional victims.
I had an incident once, many years ago, before HTTPS was prevalent and way before GDPR, where HR formally asked me to monitor a particular staff member's web browser use as there had been allegations of browsing inappropriate websites at work. I looked up the IP address associated with the person, started some tcpdumps running on the firewall with suitable filters to log URLs being accessed via unencrypted HTTP. Sure enough the next afternoon I saw evidence that such browsing was ongoing and flagged to HR who sprinted across, only to find lights off and nobody in.
After a couple of days of this sort of thing, I finally realised that I was watching the web traffic of another member of staff with the same first name, having just pulled the wrong IP from the database, who just happened to also be browsing porn at his desk in an open plan office he shared with three women.
The US cops gave the UK cops IP addresses with the strict warning they were not necessarily linked to individuals.
UK plod knew better and raided a score of innocent people (thus alerting the real crims) and had to do a lot of apologising. And explaining why the US no longer shared data so freely.
Rings a bell.
Oh no one could have known that the data might not be perfect.
Oh no one told us about operational deviance.
Oh no one asked if the law was technically feasible.
Oh no one cared if the law was right
Oh no think of the children
Oh just add a budget item for removal of the tar and feathers after the trial finds them innocent.
We've done enough.
The crossed wire thing has happened at least three times to me, people I know, on one occasion a partner's line was disconnected in the exchange because an engineer needed a "spare" pair and the line was marked as unused. Despite us having broadband and making/receiving phone calls on it to the number we were being billed for.
I guess it's only sheer luck and the low numbers of actual illegal content sharers that stop the Welsh story being a daily occurrence
> has happened ...to me
Long long ago (even before dial-up) the large local church transposed some digits and published our number as the church's number, in a newsletter. We were getting church-stuff calls at all hours. Telling callers it was a wrong number didn't get through. The telco was no help. Calling the church only slowed the flood. What did work was a letter (yes! On paper!) to the pastor saying what a problem it was . Somehow the flood stopped that Sunday.
Had a phone tech just show up. We had two pairs and he wanted to swap them. He did on the pole, then he wanted to come in and swap them in the cellar. OK, but what really changed? If it was a paperwork error (super plausible), why not pencil the records instead of sending a truck? Over the years many problems here have been diagnosed as "wet (buried) wires", but we had no problem at the time and I have never measured leakage once the two ends of our underground line were disconnected.
When I worked for a telco it was drilled into us to CHECK before pulling jumpers on "unused" pairs
Mind you several years later this was the same telco that charged me for one end of several leased lines I'd ceased (leased lines have a circuit designation at each end and both of them are supposed to be erased. Whoever did it had just done one end and hadn't been told there were two ends to deal with or didn't bother looking)
You clearly didn't work for Kelley Communications then - they're known for stealing wire pairs where needed
just the investigation of this caused great harm to the innocent people caught up in this.
crossed lines is no where near as rare as it is being made out to be!
The tribunal ultimately dismissed all of the trio's arguments, ruling in favor of the police on all matters, despite acknowledging the "highly distressing and far-reaching consequences" of the investigation.
It concluded that the RIPA requests were lawful and were necessary and proportionate to the severity of the alleged crime. There was no other way of confirming the identity of the user, the tribunal said.
The tribunal concurred with the police in that the error was not theirs, but that of BT and its response to the RIPA requests. The ruling states efforts to "seek further information from BT... yielded no meaningful response."
The police could not have reasonably anticipated that the "rare occurrence" of crossed wires at a cabinet could have derailed their investigation so substantially, the judgement adds.
the tribunal should have sided with the complainants here.
Yes it was a nasty job that the police had to investigate but a little extra effort could have reduced the impact on the innocent people caught up in this.
Lessons should have been learnt & the police should be made to incorporate those lessons in their investigations.
The most important lesson should be to confirm that the broadband router MAC & IP addresses match the ones the ISP see.
if it is no match then likely the wrong address.
Could even just turn it off, & phone the ISP and ask if they still see it & is passing traffic.
Police relied on records of the ISP which turned out to be wrong instead of confirming those records where actually factual themselves by confirming the router details matched what the ISP where seeing.
These individuals have had their lives wrecked through no fault of their own.
They seem to take the alternative position, wherein, if there's a possibility that harm is coming to children, take them away just in case & return them if it proves to be a false alarm.
Both paths are susceptible to causing immense harm, & both are capable of stopping ongoing harm.
Personally I'm extremely glad that I'll never be in a position to make calls like that.
Yep, when I worked for NBN (Australia) I got sent out on a Fault escalation where the customer was complaining of no service, although the Service was up, and ISP said everything was fine.
Long story short, their VDSL service had been connected to another house, and they weren't connected anywhere.
The Larger Telco's (Telstra, Optus, etc) just use DHCP so connect to anything making a DHCP request and off you go.
The smaller Telco's (TPG, IINET, Iprimus etc) use PPPOE so would at least theoretically pick up a connection to the wrong Residential Gateway/router
It seems to me that both the police and the Tribunal need to brush up on risk assessment principles.
The most important principle is that risk is the probability of something happening times the damage that may occur if/when it happens. I can understand that the answer to "What is the probability that the IP-to-address resolution provided by BT is in error?" can indeed be "Very low". However, the answer to "What are the risks if the IP-to-address resolution is in fact in error?" must be "ENORMOUS". This pair of questions should have been asked and answered by the police at least after the initial search of the residents' devices turned up no evidence of wrongdoing, and extra caution should have been exercised.
The above should have been considered by the Tribunal, and they should have taken into account that the police failed to perform adequate risk assessment or management, causing horrible damage in the process.
On the face of it, even though the technical error was made by BT, BT probably did not have enough information about the investigation for proper risk assessment, i.e., they could not estimate the damage resulting from the error occurring.
No one involved should have assumed that the probability of error was zero.
About 15 years ago my nephew lived in a older urban area. The kind of place where they take a large house and split it up in to three rental units and rent to young couples. This was back before a lot of people put passwords on their WiFI.
Cops raided him at 6am when he was leaving for work. Gave him 30 seconds to alert his wife and they were coming in, warrant in hand. Searching for CSAM. Searched his computers, etc, and found nothing. It was then that they started looking at his network and realized the WiFi was wide open.
The cops pivoted immediately. The started saucing my nephew up as an aspiring young guy who should be working for them, etc. Really laid the compliments on thick. Then they asked if they could put a snooping device on his router, to which my nephew happily agreed. They also told him not to talk to anyone about what had happened, and both he and his wife agreed.
No court gag order. Just a plea to not tell anyone, to which my nephew willingly agreed. IMHO, he should have run straight to the local news and reported the raid. Nope, he kept quiet for 9 months. The cops eventually found the perp.
Follow me through... The cops were smart enough to use the Telco to trace the location of the network drop to a street address. The judge was smart enough to know what that meant when issuing a warrant. Why didn't the cops check to see if the WiFi was open?? There were dozens of residences within range - remember this was an urban area. Why didn't the judge ask the cops if they could access the network from their car at the street?
Pure laziness on the part of the cops & the judge. They had the tech skills to find the location, but didn't make any effort to check if the WiFi was open or not.
As to whether the ends justified the means... Violating an innocent citizen's 4th Amendment rights is NEVER justified by sloppy police work.
Noting the Wifi is open should have happened before knocking, but that doesn't preclude the knock and search. Most criminals aren't particularly smart, which is why they're criminals in the first place (the money is better in honest work, even if you're a bank robber)
"The police could not have reasonably anticipated that the "rare occurrence" of crossed wires at a cabinet could have derailed their investigation so substantially, the judgement adds."
It happens regularly and a physical trace is DEFINITELY in order when following up on crimes of this magnitude. Simply being mistakenly investigated has massive fallout that must be contained long before third parties become involved.
It's not just a case of techs mistakenly swapping wires. Street cabinets aren't overly secure and a malicous actor could be deliberately doing things. Phreakers referred to this kind of thing as gold boxing
Gross negligence/dereliction of duty is on full display here and the "We have investigated ourselves and found we did nothing wrong" mentality is also on full display
I would assume that BT can easily tell where a phone ought to be according to their records, enough for the police to get a warrant.
But then when the police doesn’t find anything in their search, BT should also be able to verify 100% whether traffic went to this place or not. Like BT engineer presses a button, some message is sent to the router that received the porn wherever it is, and police standing at the family‘s router and detecting whether it received that message or not.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
