Retrieving a Stolen Laptop By IP Address Alone? 765
CorporalKlinger writes "My vehicle was recently burglarized while parked in a university parking lot in a midwestern state. My new Dell laptop was stolen from the car, along with several other items. I have no idea who might have done this, and the police say that without any idea of a suspect, the best they can do is enter the serial number from my laptop in a national stolen goods database in case it is ever pawned or recovered in another investigation. I had Thunderbird set up on the laptop, configured to check my Gmail through IMAP. Luckily, Gmail logs and displays the last 6 or 7 IP addresses that have logged into your account. I immediately stopped using that email account, cleared it out, and left the password unchanged — creating my own honeypot in case the criminal loaded Thunderbird on my laptop. Sure enough, last week Gmail reported 4 accesses via IMAP from the same IP address in a state just to the east of mine. I know that this must be the criminal who took my property, since I've disabled IMAP access to the account on all of my own computers. The municipal police say they can't intervene in the case since university police have jurisdiction over crimes that take place on their land. The university police department — about 10 officers and 2 detectives — don't even know what an IP address is. I even contacted the local FBI office and they said they're 'not interested' in the case despite it now crossing state lines. Am I chasing my own tail here? How can I get someone to pay attention to the fact that all the police need to do is file some RIAA-style paperwork to find the name associated with this IP address and knock on the right door to nab a criminal and recover my property? How can I get my laptop back — and more importantly — stop this criminal in his tracks?"
Report it to the Univeristy's judicial board... (Score:5, Insightful)
University cops do the bidding of the school... they're more into securing physical spaces and crowd control than anything in the tech sphere. But there's some part of the school that handles the misbehaving students, and they're the ones to contact. You've got your $1000 laptop missing, they get to threaten his $30,000-$120,000 investment in education.
This is the threat the RIAA/MPAA loves to use, they don't have the school police raid the computer, they just get the school admins to hammer the kid.
This is what pisses me off about police (Score:5, Insightful)
Use your email (Score:5, Insightful)
Obviously they've launched Thunderbird, so they are possibly interested in gleaning whatever information they can in that way. You could try sending a trojan to your account in the hopes that they run it, in order to open some remote access to your machine. Perhaps based on their web browsing history, etc, you can determine more specifically who they are.
Also note that the person may have purchased your laptop unaware that it was stolen.
Re:Report it to the Univeristy's judicial board... (Score:3, Insightful)
Let us take care of it (Score:3, Insightful)
Sometimes you just have to let the system work.
Re:Replevin (Score:4, Insightful)
Re:Report it to the Univeristy's judicial board... (Score:5, Insightful)
As I read it, it was stolen FROM a university, and is now located one state away.
So neither the local Muni's or the local Uni's are the right jurisdiction.
Where the machine is NOW is what matters. Those are the only cops who can go knocking on doors in that jurisdiction.
go go go (Score:1, Insightful)
(1) WTF cops refuse to arrest the thief when you can give them a direct address to him? Sue them for the cost of the laptop. Take it to small claims, dereliction of duty?
(2) Get the IP and reverse DNS to the ISP name. Then just get your lawyer to write a letter to the ISP demanding the identity on grounds that you need to identify the thief to sue him in civil court. (Since police refuse to make it criminal. Remmeber even OJ Simpson was taken for murder to civil court?) Then sue the police also for all your lawyer expenses, expenses you only had cause the cunts refused to do their jobs.
Wrong Tree (Score:2, Insightful)
Lucky! (Score:2, Insightful)
Change the nature of the action (Score:5, Insightful)
It's not just theft of the laptop,
They have illegally used Thunderbird to gain access to your e-mail account.
That means they have gained access to both the laptop and your e-mail account without authorization.
Maybe you don't need to stop with the police. File a suitable civil action, and get a court order to compel the ISP to reveal the information.
Not just theft of property, but gaining access to 2 computer systems without authorization, aka 2 accounts of computer fraud and abuse, AND 1 count of theft/conversion.
You just need to be more interesting (Score:3, Insightful)
Re:Report it to the Univeristy's judicial board... (Score:2, Insightful)
Re:This is why you have insurance. (Score:4, Insightful)
Maybe it's his insurance company he should be contacting anyway. They may do their own investigation based on your evidence because they don't want to have to pay a claim. They may have a little more clout than the average citizen too.
Re:I have cases like this a lot (Score:5, Insightful)
If he's getting into the person's gmail account, it most certainly is. It's called "computer trespass" in my state.
But hey, don't take my word for it. I just do it 40 hours per week...
Re:mod parent UP (Score:3, Insightful)
Not this -- The thief will simply sell the laptop making it harder to track, you're better off not tipping your hand until you have your hands around them.
Re:Civil action (Score:3, Insightful)
Btw, the police doing something is not always the best option. Half the time they will try to nail YOU for something you did on that laptop, be that having some hacked software or pornography. It's an unfortunate state of affairs in this country.
Re:Post the IP address (Score:2, Insightful)
Here's the IP: 208.102 (DOT) 223.137
So you've done a WHOIS and found it's an ISP. What did you expect to happen? If you had a telephone number, would you expect the telephone company to voluntarily give up the account holder's info, as in "Yeah, that's Bob's number. Here's where he lives."? Several years ago, ATT used to publish the account holder's name. If Fuse happened to be doing that, you would have been one step (out of many) ahead of where you are now. But that's not the case, is it?
And then, have you considered that the person in possession of the laptop may not be the one who stole it? It could be he bought off eBay and for whatever reason, is examing what's on the hard drive.
Quite frankly, I don't think you can do much, and the sooner you put this sorry episode behind you the better. Restore from backups and call it a day.
Re:Report it to the Univeristy's judicial board... (Score:5, Insightful)
Talk to the dean of your college. Call up and setup a meeting. Remember HIS time is important. So make it quick.
"I recently had my laptop stolen. The police say it is the campus police jurisdiction. They refuse to help. I have an IP which uniquely identifies who it is. However I need their help getting the proper warrants to find my laptop. Please help me I need my laptop to continue my education here.'
You would be amazed the reaction you get. The campus police have people *THEY* answer to. The dean will pick up a phone and make it happen.
If the dean refuses to help. Your next stop should be your local college newspaper and the local city newspaper laying out the story. Embarrass them into helping you. However, remember you are now flaming out a bridge over a 1k laptop. Be prepared for that.
Now another response is to go back to the local campus police and lay it out for them. What is an IP? How to get an search warrant for an address. Make it STUPID easy for them, (in many cases you are dealing with ex jocks/military grunts who really couldnt cut it at any other job). I used this approach a few times with other stolen items over the years. Cops can be lazy. Remember you are dealing with basically babysitters here. They are not exactly having rocking cases and have been relegated to babysitting the 'rich brats'. A hard night for them is when there is a major game on. So lay the whole case out for them. Show them how for a few hours of work they can do the good thing. Be personable. 'hey hows it goin' 'looks like you had a rough night last night...' etc... Its cheesy but it works. It shows you are not looking for them to run forms for you but want help and hey they can help right? If you go in with phone numbers and address instead of an IP that could help too. It shows you are interested in getting your property back and have run into legal black holes that only they can help with. Show them you are willing to help them out. Cops are notoriously 'you scratch my back I scratch yours'.
Another place you could go is the mayor of the city you live in. "The police are giving me the run around in recovering my property even though we have enough information to find the criminal". The MAYOR runs the police... You can also get a civil judgment to compel them to help you. This could make your life really uncomfortable in the future MAKE SURE YOU ARE WILLING to do it. You need to ask yourself what are you willing to do to recover your property?
Re:Report it to the Univeristy's judicial board... (Score:3, Insightful)
The current user may not be the criminal, just some guy who bought a computer second hand. When I bought mine through ebay it came with plenty of files and apps installed, people don't bother to clean that up, so he may not have realized he bought a stolen computer.
Re:Change the nature of the action (Score:5, Insightful)
Re:This is what pisses me off about police (Score:5, Insightful)
You don't know the half of it.
A couple years back, I worked at a place once that dealt in video games and consoles and an older customer came in and stole an X-Box. This guy was about 6ft 8 inches and pretty big. We let him get away cause hell, we had his name, we had his phone number, we had witnesses, and we even had him on camera. You can't get more open and shut than that.
Well, I was calling the cops once every couple of days after I reported him to see if they had got started on it. After about 2 weeks, they told me that they weren't going to do anything about it. They said that unless he stole over a thousand dollars worth of stuff it wasn't even worth it to assign it to an officer regardless of how much information we had. I actually did a reverse phone number search of his cell phone number and told them the provider so they could use it for his address if the fact we had his name, description and photo wasn't enough.
After that, from that point on, the cops became the last people I call unless I can get the media involved. I call friends and family first now otherwise, street justice is about the only justice you can get without having cash or influence.
Re:Post the IP address (Score:5, Insightful)
And then, have you considered that the person in possession of the laptop may not be the one who stole it? It could be he bought off eBay and for whatever reason, is examing what's on the hard drive.
So? It's still the poster's laptop, and he has a right to try to get it back. The person who bought it, if that's what they did, bought stolen property, and will have to take that issue up with the seller. Of course, the seller will be busy dealing with the police.
Just because another innocent person may have gotten involved, doesn't mean the poster shouldn't attempt to regain his rightful property and bring the criminal to justice.
"Kind of deserved it"??! (Score:4, Insightful)
I think CorporalKlinger needs to learn the first rule of owning tech devices - don't leave them unattended in a car. If you can't observe basic security of your own devices then you kind of deserve to have it stolen.
Never leave anything in the car unattended. Hmmm. So, by that logic you can then never leave the car itself unattended, because you are asking to have it stolen?
You forgot to remind them that they shouldn't dress in any way that another person might find sexy, because then they "kind of deserve to" be raped.
(not sure if CorporalKlinger is female or just wears women's clothes)
What does the university have to do with this? (Score:5, Insightful)
OK, so the laptop was stolen on school grounds. But the problem is now to locate and recover it from another state. The school cops have jurisdiction on school grounds and keep the peace there. So if the laptop turns out to be on another campus you could try the cops in THAT school (though it seems unlikely, since the person holding the laptop is using a service). Don't expect the cops at the school where it was lifted to go out of their way to chase down stolen property in another state, outside their jurisdiction. Once you have a specific thing to ask for (like trying to get the location from the ISP and forward that info to the cops of local jurisdiction there) maybe they'll do it - and maybe not.
Got the report number? You (or a lawyer) might be able to get the ISP to cough up the info with that, or get started on getting a court order if they're reticent.
(You might also try the county sheriff. In some states they have overriding jurisdiction on school grounds. File a crime report with them, too.)
= = = =
The laptop is phoning home from an apparently static IP address - or a long-duration connection. Can you remotely log into it? If so you might be able to do things like turn on the microphone, look at files the new user is taking notes in, or follow his browsing. Does it have a built-in camera? Does it have any remote administration or monitoring software installed - or could you install some remotely?
Does it have built-in WiFi and if so do you have the MAC address of it? (You could probably get it by that hypothetical remote login if you don't have it recorded.) If the WiFi is on or can be turned on and if you can get the neighborhood information you could then sniff the location when nearby. (That would also help the cops with jurisdiction in the area if you go along with them to sniff it when they want to bust it. Gives 'em probable cause.)
Note that IANAL. So I could be talking through my Stetson.
Check with a lawyer if you can find one with the appropriate specialization. If you're a student at that university you might have legal advice resources available through them. Or if they have a law school ask who among the faculty is expert on this and talk to that prof. Academics sometimes like to help, especially where the law is squishy. B-)
Forget About It (Score:2, Insightful)
Learn your lessons from this. Backup your files regularly. Get good insurance on your car and your laptop. Secure your laptop as well as possible anytime you leave it somewhere out of reach.
Re:Report it to the Univeristy's judicial board... (Score:5, Insightful)
Until you got to the issue of suggesting that you are going to head off to that particular jurisdiction with a gun, this is a fairly sound letter: Short, simple, and to the point.
I wouldn't suggest that I'm bringing a gun, even if I had a legal concealed weapons permit or a federal firearms permit. Police and Sheriff's offices tend to get real jumpy if you hint that you have a gun, particularly if you explicitly mention it in some form of communications. In this case the implication is that you are exasperated and want to take the law into your own hands... again something no law enforcement agent would look on favorably for many reasons (some valid and others not).
If you do say that you are hiring a private investigator, make sure that you do. Again, this is something unnecessary in the letter of this nature, at least for an initial letter and perhaps is better left out. Don't lie or even stretch the truth as that can and will come back to bite you hard.
Remember, it is easier to attract flies with honey than with vinegar. Doing all of the leg work for a felony arrest and having that land on an officer's desk is a godsend, and something most officers really don't mind. Police love to brag about arrests of that nature. Odds are high that the thief stole much more than the simple laptop too, and it gives probable cause to search the house with the information that you could provide in this situation.
Saying that you would like to personally visit the county (and actually do so) also helps, as it shows you are serious about the issue and would like to get some resolution. Again, that is a big plus, as long as you avoid the stuff that would make a law-enforcement officer's skin crawl. It is also not strictly necessary, but suggesting that you would like a phone conversation with that department to confirm receipt of the letter and to see what is happening with the investigation could be useful too.
Laptops aren't worth enough money (Score:3, Insightful)
Frankly, the cops have better things to do.
Buy a new laptop and move on. And don't leave it in your car, which is *unbelievably* stupid. Consider it a lesson.
Re:If they're dumb enough to use your email accoun (Score:3, Insightful)
Re:Post the IP address (Score:3, Insightful)
Re:Post the IP address (Score:3, Insightful)
Don't do this. I know of a few chans that could definitely get dox on that guy: I've seen them social engineer contact, even billing, information out of ISPs. Heck, during the opening days of the Anon vs Scientology thing, before the protesters took over, I saw people obtain secret Scientology documents through a combination of hacking and social engineering. They could definitely get that info. However, in your case, you want something that's permissible in a court of law. So you can't go with any illegal methods of information gathering. Compulawyer has the right idea below. [slashdot.org]
The Broken Window Principle (Score:3, Insightful)
Re:"Kind of deserved it"??! (Score:4, Insightful)
heya,
Yeah, I have to say, sortius_nod that you are being a bit of a tool here, mate.
Look, while I normally advocate that people need to take responsibility for their actions - this isn't like he left his house unlocked or something. He locked his car, it just so happened they probably smashed the window and got in and started searching for things.
I have absolutely no respect for people like that, and I really hope he does find them, and they have to face a court and explain why they stole.
The victim here is obviously happy to do legwork to get his belongings back, and it's not like he came here to whine about how unfair it was - he simply came here for advice, so the nice thing to do is to offer him whatever help we can.
Cheers,
Victor
Re:Post the IP address (Score:2, Insightful)
My $1000 laptop got "lost" in an unexpected eviction process (everything was removed in my absence.) The cops had no jurisdiction in my case, and I did get all my other stuff thanks to a court visit and paying the private moving/storage company as accorded by the law. The marshall witnessing the eviction and signing the inventory had noted my laptop among my other items, but the movers claimed nobody reopened my boxes, meaning the movers probably took it.
A high court stated that to pursue this legally would not be worth it: lawyers would cost more than my 1000 bucks. I have recently seen papers setting generic lawyer assistance around $200 per visit, and that sky-rockets if you include an actual court case. Just take it to the police. Apparently there is no urgency for criminal justice when a theft involves no weapons. Unless you are talking Intellectual Property, of course.
Re:Post the IP address (Score:3, Insightful)
heya,
You realise that buying stolen property is err...a crime? Lol. Saying, "but officer, I bought it off this guy in the back of a van, he looked legit, I swear!" is not an admissible defense. As an above (more knowledgeable) posted, you've just made yourself an accessory to a crime.
So yeah, say he somehow didn't know it's a stolen box - the onus is on him to provide a paper trail to the police and prove he didn't. I mean, you buy a laptop from BestBuy - you get a receipt. You buy it from a pawnshop - you also get a receipt. And pawn-shops are required by law to take down details and photo-id for who they buy things from. If they don't, they go to jail. You buy it from some shifty looking guy on a street corner, gee, I wonder if you get a tax invoice...
The whole point is to discourage people from trading in fenced goods - which is a good thing. Thieves don't really add much to society (this isn't Ankh Morpork), so anything that discourages people from dealing with them is good.
Worst case scenario, the police go over, the guy says, I don't know where it came from, I swear, I just found it on a benchtop or something, the GP still gets his laptop back.
Cheers,
Victor
Re:Report it to the Univeristy's judicial board... (Score:3, Insightful)
Call your local news network. It'll be a nice feel good story about the internet if they can get your laptop back
Re:Report it to the Univeristy's judicial board... (Score:3, Insightful)
Are the condescending 'you should have had insurance' comments necessary?
Insurance is a really fucking good idea if you drive and could face effectively unlimited liability if you kill or, worse, injure someone. It's also a good idea in some other situations where $replacement_cost >> $personal_liquidity.
This doesn't look like one of those situations. It sounds more like this guy wants to catch the criminal than that he wants reimbursement for his $1000 laptop.
Re:Report it to the Univeristy's judicial board... (Score:4, Insightful)
Re:Report it to the Univeristy's judicial board... (Score:4, Insightful)
Lastly, but certainly not leastly, post the IP address to 4chan. They have more than enough unscrupulous individuals that could find the person for you. If nothing else, they will at least DDOS the IP for you.
That is the last thing you should ever do for a number of reasons. DDOS violates the computer crimes act here in the US (and using an illegal method to regain your property is never a good idea as you will end up in court charged with a crime yourself).
Filing a claim in your local state court is not all that expensive (and with the help of the local free law association, you might actually get it done properly).
One rule to remember when going up the 'food chain" at your University: always be nice. explain your situation in a clear and logical form and request that they help you. if they can't, get referred further up the chain. you will eventually get to someone who can say yes or take action (usually at the university presidents level). also, do follow up with the local police and send a certified letter to the local FBI office asking for help (send a fax and an e-mail as well). If you need to, get the local news media involved (beauracracies don't like negative public exposure). In all these cases, BE NICE! Stick to the point and don't embellish.
The more of a paper trail you can establish, the better your chances of regaining your property expeditiously.
Just make sure police/FBI has records (Score:3, Insightful)
This is for all portable stuff with connectivity getting stolen: Make sure the device serial number/IMEI (cell phones) is recorded somewhere officially.
Those guys who doesn't have a slightest clue about IP address can get really smart if a crime (worse than stealing) takes place with that particular device.
I know some people doesn't take their time reporting and it is like a time bomb waiting to happen. For example, what happens if that unreported cheap cell phone is used by a major drug dealer? It would really take time and money to explain the situation in that case.
Actually, that's NOT what insurance is good for. (Score:5, Insightful)
Actually, if you do something to be liable for killing or seriously injuring someone, it's pretty damn likely that insurance won't help you.
Get out your policy. Go ahead, I'll wait. Now read it carefully. Somewhere buried in there is the maximum amount of money the insurance company will pay for such a claim. Now go look up how much plaintiffs win when you're held liable for someone dying or getting maimed, and compare it to the first number. If you kill or main someone, you're pretty much going to declare bankruptcy unless you're Bill Gates, pure and simple, and there's not a damn thing having insurance will do for you.
What insurance is good for is one thing and one thing only: To handle things between minor fender benders up to totaling a car and/or covering relatively minor injuries to others or major ones to yourself. Anything past that and you're screwed. Anything less than that, and you're better off simply paying out of your own pocket because of how much higher your premiums will be.
In case you don't know this yet, insurance is a scam. It sounds nice in theory, but it's legalized gambling with a twist--you're betting money on something bad happening instead of something good. Just like in a casino, in which the house always comes out ahead, the insurance companies will always come out ahead, too. There's actually a special word for people who make sure this stays true, they're called actuaries [wiktionary.org]. Add up all of the money you--and your employer, on your behalf--have paid over the years for insurance, and imagine how far that money would have gone had you paid it into, I dunno, a mutual fund or something instead of paying for actuaries and marble-halled buildings. You might actually be able to pay off a large liability claim if you had.
And now, a lot of states have mandatory automobile insurance laws on the books. Do you live in one? I do, and I remember when it went into effect. If you do, have your premiums gone down because so many more people are now paying into the system and because there are so fewer uninsured motorists on the roads now? Yeah, mine haven't either. Funny how that works, isn't it? Again, it sounds nice in theory, but in reality, these laws are just a blatant money grab by insurance companies to use police power to force you to pay them money. Like I said, the industry as a whole is a scam.
Re:This is what pisses me off about police (Score:3, Insightful)
I once worked somewhere that we had the networks attacked, phone lines cut, and other kinds of harassment by a competitor. The local cops said they wouldn't do anything because it involved technology. The FBI said they wouldn't do anything because the damages weren't over a million dollars.
Re:google maps for: Lat 39.0972 -84.1225 (Score:1, Insightful)
is it just me or is seeing this come through just really downright scary? as much as I'd like to see the laptop back in the right hands, now I want to also know how to gain some privacy on my IP... as ironic as that might be.
Re:This is what pisses me off about police (Score:3, Insightful)
If the police don't do anything when given all the info needed to bust someone, they're not going to do anything at all, ever. If you ask them why, they answer you that they're "too busy". As a result, cases go unsolved. The crooks know it; so they get away with it. As a result, crime rises, and the police are now *even busier*. So basically the police are simply letting crime spiral out of control.
We seriously need Batman to do something about this.
Re:Report it to the Univeristy's judicial board... (Score:3, Insightful)
Yes, because it's the victim's fault. Thanks for that.
Re:If you do most of the work... (Score:3, Insightful)
Someone mod this up.
It's a slightly complicated attack but has a real chance of working: Setup a web page that uses browser geolocation features (and saves the locations somewhere), send the url as email to the thief with a good enough story, hope the thief uses a new Firefox and bingo: you have the coordinates from Google Geolocation service. This may be just IP based location but it could be wifi location as well -- it should be easy enough to test which it is.
Re:Actually, that's NOT what insurance is good for (Score:3, Insightful)
Like I said, the industry as a whole is a scam.
Same thing with the surge in DUI arrests in the past decade (or a little more). The insurance companies pressured the police into actually charging people with DUIs instead of making them walk home or dropping them off in the drunk tank because they realized that they can charge otherwise very safe drivers who had a little too much at a cocktail party with insane premiums.
Re:google maps for: Lat 39.0972 -84.1225 (Score:3, Insightful)
You can safely assume that it isn't. Just try entering your own IP address and see what it finds. It's likely to get the state right, but that's about it.
(Or, if you can't be bothered, remember all the targeted ads you've seen online that seem to think you live in Lustville, when in reality you live in Lackawanna).
In my case, it misses by about half the state, and no, it doesn't guess anywhere near where the ISP is either. My guess is that it's the address of the first sucker on the subnet who signed up for a "service" that gave the Geo/Info guys both an IP and physical address and the right to use them.
Re:Actually, that's NOT what insurance is good for (Score:1, Insightful)
You say that like it's a bad thing.