If I accidentally leaked my school's IP address and someone attempts a DDoS attack on my school am I at fault?

Question

I found my schools IP address and if it accidentally got out and my school got a DDoS attack am I liable for damages? (I'm in Colorado if that helps.)

Answer 1

tl;dr- I don't see how you can "leak" a large organization's IP addresses given that they seem to be very public information. However, misusing an organization's network services or/and somehow being complicit in an attack could probably get someone into touble.

---

Organization IP address allocations seem to be public information.

I Google'd "Colorado university IP address".

The first search result was this official webpage for the University of Colorado, Boulder. It says:

IP Ranges for Server Administrators

All public IP space for CU Boulder can be described by the following notation:

• 128.138.0.0/16

• 198.11.16.0/20

But, say that that university didn't publish its IP addresses online. Then this website shows them anyway.

Additionally, seems like anyone at your school can get an IP address by Google'ing "what's my ip". Or you can use Bing. Or WolframAlpha. Or, heck, this website doesn't seem to do anything but show your IP address.

Point being, I don't see how an organization's IP addresses could be considered information that could be "leaked".

---

There're other things that might get someone into trouble though.

However, this sounds like a potentially different matter:

well someone at our school got our IP address banned from editing on Wikipedia

Ideally that "someone" isn't you or a friend since such activities can easily be against an organization's acceptable-use policy (example) or/and the law.

Answer 2

The IP might be public knowledge but it's also one of billions of other IP addresses out there with no particular reason to pay it special attention. A DDoS attack doesn't typically target arbitrary IPs so if the school were to be the target of such an attack, I'd expect there to be an investigation into who performed it and why. I'm not a lawyer but I'm willing to bet that those responsible, if identified and within jurisdiction, would be in very serious legal trouble and I'd expect this could also include anyone who might have requested the attack or otherwise brought the school to the attention of those who attacked it.

My advice: just forget about it. Don't write the IP down or save it anywhere. Put it out of your mind. There is absolutely nothing beneficial to you about having this knowledge and if the school were to be targeted by an attack, you don't want to be suspected of having anything to do with it.

Answer 3

Answering as a technician, not a law expert.

Technically, the IP address in question could either be:

• A static IP address with DNS records pointing at it (or an equivalent dynamic-DNS based solution). That would definitely be the case if the school operates an email or web server on this IP address in addition to using it as an egress for web accesses originating from school computers.

• A provider-assigned dynamic IP address that is only used as an egress address, bundling web requests from school computers (usually via a technique called NAT/masquerading. Same would apply to the above). Same setup as a home DSL. This address can change without notice, eg when the router reconnects, since the provider manages it. Usually, that address will officially be associated with the PROVIDER, not with the school. However, it is still easy to find out for third parties (eg by asking someone using a school computer to open some web address on a server where you have access to the logs). Someone on a school computer can trivially find it out. Someone (email correspondent, web server operator, chat room operator, chat room member, in some cases forum member...) being communicated with from a school computer can find out in many cases.

That said, do not start any grief from a school computer (or ANY computer where the internet access isn't on your tab!!): If you, eg, approach, provoke or harass any group of people willing and capable to launch an attack on the school while using a school computer, this might put you in a bad light regardless of legality. Same applies to doing anything illegal which might implicate the school.