Throughout the history of the internet, users have sought ways to conceal what they do online, primarily to safeguard their privacy from prying eyes. Over the years, these tools and mechanisms have evolved to protect sensitive personal information from cybercriminals and, more recently, to shield journalists and political protesters from surveillance by authoritarian regimes. These measures include adjusting browser cookie settings, using privacy-focused search engines, employing VPNs, using encrypted communications apps, and relying on anonymization tools like the Tor browser. While these advancements have significantly enhanced online consumer protection and global privacy, criminal groups have exploited this to hinder law enforcement’s authorized investigations.
In recent years, internet companies have started to implement changes intended to preserve user privacy while maintaining the ability to monetize user data. Some of the early efforts included thwarting passive fingerprinting (covert tracking through unique client attributes like user-agent, installed plugins, and version) and blocking third-party cookies.
In recent weeks, both Google/Chrome and Facebook/WhatsApp have made announcements involving ‘IP protection’. Currently, a user’s traffic, even when encrypted, can be cross-correlated using the client IP address. In both the Google and Facebook cases, the change will route browsing traffic through privacy proxy servers operated by the respective company, concealing the users’ IP addresses in the proxy’s outbound traffic. In both cases, the changes are opt-in (WhatsApp warns customers turning on the feature “will reduce call quality”). While Apple has already made similar changes to its Safari browser, Chrome’s global dominance in browsers and WhatsApp’s in messaging apps means law enforcement agencies now confront mounting challenges in their investigative efforts.
Diminished Visibility of Original IP Addresses
Proxy servers play a pivotal role in network security, serving as filters or blockers for outbound internet traffic or as a firewall for inbound traffic. At its core, a proxy server functions as an intermediary between a client and a server, making the server perceive the proxy as the source of the traffic, thereby shielding the client’s IP address. In cases of lawful interception, a search warrant or court order can compel the proxy operator to divulge the client’s IP address, allowing for the identification of the user. Nonetheless, to accurately pinpoint the correct user, law enforcement must meticulously identify the attributes of the communications in question. While identifying the subscriber is generally achievable, the process in this simple example is not without its challenges.
In the later stages of Google’s plan, however, communications may traverse multiple third-party proxies before reaching their intended destination, significantly complicating the identification of the subscriber. Whether dealing with a straightforward or complex scenario, law enforcement agencies will need to piece together the breadcrumbs left by these obfuscations to map the complete transmission path from the client to the server.
One substantial challenge in accessing these breadcrumbs is jurisdiction. The home country of the law enforcement agency may differ from the country hosting the proxy or obfuscation service. These host countries may resist sharing information with any law enforcement agency, foreign or domestic. Moreover, laws in the proxy-host country may prevent the proxy service from disclosing such information. While the CLOUD Act has improved this process, its utility is limited to countries participating in the program. Once the proxy logs and various intermediary records are provided, the real work begins.
Extending Lawful Intelligence Across Obfuscated Communications
When communication flows involve multiple parties, such as proxy and VPN providers, lawful intelligence must dynamically parse and correlate information from multiple sources to profile a subject of interest. This involves associating the source and destination IP addresses across proxy logs and various intermediary records to create a comprehensive view of an end-user’s online activity. For instance, an investigator may need to trace a specific IP address from a social media site back to a particular proxy server used by a specific end user at a precise time. This scenario necessitates collaboration from the providers of privacy technologies, such as Google’s privacy proxy service.
SS8’s MetaHub, a leading investigative analytics tool, offers a robust solution to these challenges that allows investigators to manage IP address obfuscation effectively. MetaHub helps piece together the breadcrumbs of obfuscation by tracking communication patterns, metadata, and traffic flows across various proxies. By providing a comprehensive view of an end-user’s online activity, investigators can attribute actions to specific individuals, even in scenarios involving multiple layers of obfuscation. MetaHub’s ease-of-use allows investigators to achieve this with just a few clicks, without needing to be a data expert.
As these services continue to evolve and gain traction, SS8 urges providers to acknowledge their social responsibility to strike a balance between user privacy and the needs of law enforcement. Companies implementing proxy services, for instance, should establish robust mechanisms to trace an IP address when requested by a law enforcement agency while still safeguarding the anonymity of other users.
The balance between personal privacy and the public good must continually be maintained and refreshed in the face of such technological developments. The legitimate role of IP address obfuscation carries with it a shared responsibility to support law enforcement in the defense of civil society.
About Kevin McTiernan
Kevin has over 20 years of extensive experience in the telecommunications and network security industries. At SS8, Kevin is the VP of Government Solutions and is responsible for leading the vision, design, and delivery of SS8’s government solutions, including the Xcipio® compliance portfolio. You can learn more about Kevin on his LinkedIn profile by clicking here.
About SS8 Networks
As a leader in Lawful and Location Intelligence, SS8 helps make societies safer. Our commitment is to extract, analyze, and visualize the critical intelligence that gives law enforcement, intelligence agencies, and emergency services the real-time insights that help save lives. Our high performance, flexible, and future-proof solutions also enable mobile network operators to achieve regulatory compliance with minimum disruption, time, and cost. SS8 is trusted by the largest government agencies, communications providers, and systems integrators globally.
Intellego® XT monitoring and data analytics portfolio is optimized for Law Enforcement Agencies to capture, analyze, and visualize complex data sets for real-time investigative intelligence.
LocationWise delivers the highest audited network location accuracy worldwide, providing active and passive location intelligence for emergency services, law enforcement, and mobile network operators.
Xcipio® mediation platform meets the demands of lawful intercept in any network type and provides the ability to transcode (convert) between lawful intercept handover versions and standard families.
To learn more, contact us at info@ss8.com.
