10

As far as I know, breaking the law online in Germany (such as sharing copyrighted content) often results in a fine from a private law firm which gets your personal data from your provider by sending them some sort of "cease and desist" letter mentioning the violation. I understand that this process doesn't involve an actual lawsuit. I wonder what kind of proof of the client's wrong-doing is actually required for the ISP to disclose their personal data.

For instance, I have an open SSH port in my home network, and there are regular attempts to login using default usernames/passwords, which AFAIK is just as illegal as sharing copyrighted files. If I see a German IP in the logs, what kind of proof do I have to send to the ISP in order to get the offender's identity from them?

Improve this question
7
  • 11
    Keep in mind, that in case you would actually find a german IP in the logs, most likely it's the IP of another victim (i.e. one whose computer/server was taken over by a botnet). The operators themselves are most likely located in other countries or hidden behind several layers of anonymization.
    – dunni
    Commented Jan 20, 2021 at 17:29
  • 2
    Does not answer your question directly, but the normal (technical, not judicial) procedure is to send a report to the abuse contact of the ISP listing the IP, date and time, and the issue. Some ISPs (mostly web hosts) are very proactive about this and will follow up with the owner of said IP (including possibly blocking the IP if the issue is not resolved promptly), especially if you show numerous attempts. Others have an alias abuse: /dev/null. And of course you need to find the relevant abuse contact (check whois for the given IP).
    – jcaron
    Commented Jan 20, 2021 at 17:54
  • 1
    I suspect you'd need a court order or subpoena.
    – ohwilleke
    Commented Jan 20, 2021 at 21:37
  • 3
    You sure have a lot of AFAIKs and "under the impression"s. Maybe you should get clear on each of those assumptions first.
    – Harper - Reinstate Monica
    Commented Jan 20, 2021 at 22:23
  • @jcaron I have tried contacting ISPs a couple of times long time ago, never got a reply and gave up. Those ISPs were not German though.
    – Dmitry Grigoryev
    Commented Jan 21, 2021 at 12:14

2 Answers 2

Reset to default
14

Hacking into a computer owned by someone else and accessing the data stored on it without permission is a misdemeanor according to StGB 202a (de|en). But only if it's successful. So a failed attempt isn't a misdemeanor yet.

When you notice that someone might have committed a criminal offence (regardless of whether you are a victim or just a witness), then the usual procedure is to report it to the police. If they consider the crime serious enough to investigate, then they will request the identity from the ISP.

But the copyright lawsuits which are filed in bulk by law firms working with media companies are not crime reports. They are civil lawsuits. A civil lawsuit is when someone had a tangible damage because of something someone else did, and now they want money in compensation. When there is no damage, then there is nothing to sue for. So when you want a judge to file an injunction to force an ISP to give them the identity of one of their users, then you would first have to explain to them how much financial damage you had because of that person and that this is enough damage to make it worth everyone's time. That might be quite challenging for nothing but a failed SSH login attempt. But it might be possible if a single person made so many login attempts that it incurred you non-negligible bandwidth cost or even caused a denial-of-service.

Improve this answer
8
  • 7
    I was under the impression that trying to guess a password for a system you don't have rights to access is illegal by itself, regardless of success. Is that not the case in German law?
    – Dmitry Grigoryev
    Commented Jan 20, 2021 at 14:34
  • 4
    @DmitryGrigoryev Doesn't seem so. StGB 202a has no clause regarding attempts while many other criminal laws explicitly say that an attempt is punishable. In fact it does not even punish just logging into the system. You have to actually access data. But if you want to know for sure, feel free to ask a new question.
    – Philipp
    Commented Jan 20, 2021 at 17:30
  • 1
    If the attempts are logged, would that constitute an unauthorized change of data?
    – JCRM
    Commented Jan 21, 2021 at 4:25
  • 5
    Since you dug up STGB 202a, you might also mention the (infamous) 202c that makes the preparation of an attack (acquiring the means) illegal. Owning and using particular "hacking" tools (probing tools) is typically considered to be part of this definition. So if a pattern would emerge that makes it likely such tools are used, a good lawyer/attorney might construct a case against the attacker. I.e. the password list they try could perhaps also be construed to fall under the paragraph.
    – Frank Hopkins
    Commented Jan 21, 2021 at 4:36
  • 2
    Frank beat me by 5 minutes - 202c would almost certainly apply to repeated attempts to gain access as preparation, as it is intentionally left broad.
    – corsiKa
    Commented Jan 21, 2021 at 4:42
8

This is how the private law firms get personal data of users in violation of copyright laws in Germany (slightly modified Google translation from here):

Companies that monitor file sharing sites for legal violations give the IP addresses of the file sharing site users to specialized private law firms commissioned. Based on § 101 UrhG the private law firms are now obtaining an provisional injunction with the aim of obliging the Internet provider to store the data on the IP address until the final decision by a court and not to delete it already after a few days. With a further decision, the provider is then legally obliged to determine which subscriber had the IP address at the determined date and time. The private law firm therefore learns the address of the subscriber from the internet provider approved by court order.

This is based on § 101 UrhG "Gesetz über Urheberrecht und verwandte Schutzrechte" (translates as "Law on Copyright and Related Rights").

Since this is about violating copyright, I don't think it applies to your case (where someone unauthorized tries to log in). The § 101 UrhG was created to stop people sharing illegally content, because generally the ISP is not allowed to give personal data related to IP addresses to private persons asking.

Improve this answer
5
  • 4
    I find it counter-intuitive that copyright violations are apparently considered more serious than attempts of illegal data access, so that there is a special law which facilitates finding pirates, but not botnet operators. An analogy of shoplifters vs. burglars comes to mind.
    – Dmitry Grigoryev
    Commented Jan 20, 2021 at 14:46
  • 11
    That's the result of successful lobbying of a strong industry (here the creative industries like music and video).
    – dunni
    Commented Jan 20, 2021 at 17:28
  • 7
    @DmitryGrigoryev the first thing my divorce lawyer told me is to not apply logic and intuition to the law. She was right...
    – RonJohn
    Commented Jan 20, 2021 at 17:53
  • 5
    @RonJohn: actually, logic and intuition work well enough, you just have to use the right (i.e. political / economic) intuition. Like "who might have paid/lobbied for this law"? jstor.org/stable/1059016
    – Looking for loopholes
    Commented Jan 21, 2021 at 7:08
  • @DmitryGrigoryev Copyright law covers much more than on-line copyright violations, and it existed for hundreds of years before computers.
    – alephzero
    Commented Jan 21, 2021 at 17:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .