How a quiet US home wound up with 600 million IP addresses and a world of trouble

By Travis M. Andrews

A digital mapping company choose the Arnold's house as the "default location" for IP addresses it couldn't accurately map. The couple is now suing after years of "digital hell" as a result. Photo / Getty Images
A digital mapping company choose the Arnold's house as the "default location" for IP addresses it couldn't accurately map. The couple is now suing after years of "digital hell" as a result. Photo / Getty Images

A two-hour drive from the geographic centre of the United States sits a quiet farmhouse near Potwin, Kansas. Joyce Vogelman Taylor's grandfather built the house in 1902, and her father spent 85 years living in it.

She remembered a moment in 1942 - the end of World War II not yet in sight - when he purchased a Delco electric generator, light bulbs and a toaster. It was a massive technological upgrade for the house.

More than 70 years later, technology made the 82-year-old's life - and those of her renters James and Theresa Arnold - a digital age horror story.

For reasons soon to be explained, the little house in the centre of the country became the crossroads of the Internet, with unimaginable consequences, also soon to be explained.

The discovery was made by Kashmir Hill of Fusion who broke the story in April.

Last week, the Arnold's filed a lawsuit in the US District Court for Kansas against MaxMind, a digital company that maps IP addresses and who the Arnold's claim is responsible for turning their pastoral home into a digital age horror story.

The first time Taylor realised something was amiss was when she received a call in 2011 from a small business owner who angrily blamed her for his customers' email problems.

The conversation shocked Taylor.

She owned a Gateway computer, which she used almost like a typewriter - for composing Sunday school lessons and letters. She barely browsed the Internet, much less used it to overload a small business's email servers.

"The first call I got was from Connecticut," Taylor told Fusion. "It was a man who was furious because his business Internet was overwhelmed with emails. His customers couldn't use their email. He said it was the fault of the address at the farm. That's when I became aware that something was going on."

After that initial strange call to Taylor, complaints started pouring in, often with distressing and sometimes criminal accusations aimed at the Arnold's, the Wichita Eagle reported.

In May 2011 police and sheriff's officers knocked on their door, looking for a stolen truck. "This scenario repeated itself countless times over the next five years," the lawsuit stated.

Officers would show up, accusing them of harbouring runaway children. Of keeping girls in the house to make pornographic films. Ambulances appeared, prepared to save suicidal persons. FBI agents, federal marshals and IRS collectors have all appeared on their doorstep. So have angry Internet users, who claimed they were ripped off by the Arnold's.

"Law enforcement officials came to the residence all hours of the day or night," the lawsuit stated. At least once, the Arnold's were doxxed, meaning hackers posted their names and personal details across the Internet, Fusion reported.

One day, a broken toilet was left in the driveway without explanation.

Neither the Arnold's nor Taylor had any idea of what was happening.

Law enforcement officials came to the residence all hours of the day or night.

The genesis of what actually happened was 2002, when a company called MaxMind was founded. It maps IP addresses, a notoriously unreliable practice. Many can't be directly linked to an address, only a state or even a country.

For its tech to work, MaxMind matched each IP address to a set of coordinates. This presented a problem when the company didn't have an exact location.

Sometimes, it could only determine that an IP address was in the US. In those cases, the company mapped that address to a specific set of coordinates: 38(degree)N 97(degree)W or, in the parlance of digital maps, 38.0000,-97.0000.

That just happens to be the front yard of the house where the Arnold's resided.

More than 600 million IP addresses were mapped to that yard.

And no one connected with the farmhouse knew this until Fusion's Hill, who had been investigating the practice of mapping IP addresses, searched through MaxMind's database, discovered the 600 million IP addresses at the Kansas location and gave Taylor, the owner, a call.

Mapping the digital world

To fully understand what happened, it's important to understand how Internet protocol addresses - colloquially IP addresses - work.

Most devices we use are connected to a network via Internet protocol. To do so, it requires an IP address. Thus every smartphone, computer, laptop, tablet and anything else that connects to the Internet has one.

The IP address' primary purpose is to allow these devices to interact with one another. But the IP address of your personal computer is generally not seen by other devices.

Instead, that IP address is used to connect to a router, which then uses its own specific IP address to connect to the Internet.

Sometimes, that can mean your IP address is linked to just you (e.g. If you live alone and use a personal, password-protected wireless router). It can also mean that your IP address is shared by many (e.g. every user connecting to the wireless Internet at a coffee shop or in an office likely displays the same IP address).

Since networks can span buildings, blocks or even cities (in the case of public WiFi), it's not always simple to pin down the exact geographical address of an IP address. (The term "address" in IP address is a bit of a misnomer in that regard.)

Add in the fact that there are readily available, free programs that can mask IP addresses, and mapping them becomes an even murkier proposition.

Sometimes, MaxMind could only get information linking an IP address to the country.

The reason why it chose the Arnold's' front yard as its "default location" in those instances is another can of worms. It was going to map them to the geographic centre of the US. That translates awkwardly into digital parlance, though, so the number was rounded off to 38(degree)N 97(degree)W.

One blogger created a heat map of Internet usage in the US according to MaxMind's data from April 2011. Most might be shocked to find that Potwin, Kansas, is responsible for more Web usage than even New York City or Silicon Valley.

"The default location in Kansas was chosen over 10 years ago when the company was started," MaxMind's co-founder Thomas Mather told Fusion.

"At that time, we picked a latitude and longitude that was in the centre of the country, and it didn't occur to us that people would use the database to attempt to locate people down to a household level. We have always advertised the database as determining the location down to a city or zip code level. To my knowledge, we have never claimed that our database could be used to locate a household."

Law enforcement and IP addresses

Though it's not always possible to perfectly locate IP addresses, they're often used (imperfectly) in different ways, from tracking analytics to advertising firms attempting to geotarget potential customers to record labels sending cease-and-desist letters to pirates.

Law enforcement also often uses IP addresses to link users to certain devices. A Montgomery County, school bus driver was dismissed in 2011 after authorities linked him to an IP address that had downloaded child pornography.

And, in February, a 12-year-old from Fairfax, was charged with threatening her school after posting an Instagram message of a gun, bomb and a knife.

Again, though, it's an inexact science. Many argue that IP addresses should not be used as any sort of evidence (particularly since adept digital criminals can mask them, which is likely what happened in more than of the cases that led police to the Arnold's' door).

Following Hill's extraordinary piece in Fusion, MaxMind shifted its default "United States" location to the centre of a lake, west of Wichita.

Users have to update their database for the shift to take effect, but the nightmare, in effect, was over for the Arnold's.

That wasn't quite enough for the family, though, who filed a lawsuit Friday seeking "compensatory and punitive damages in excess of $75,000," "plus their costs."

"My clients have been through digital hell," the Arnolds' attorney Randall Rathbun told The Guardian. "The most vile accusations have been made against them - such as that they've been involved in child pornography. What impact would it have on your life if someone accused you of being in child pornography? Obviously it's horrendous."

MaxMind has not commented on the lawsuit.

- Washington Post

Get the news delivered straight to your inbox

Receive the day’s news, sport and entertainment in our daily email newsletter

SIGN UP NOW

© Copyright 2017, NZME. Publishing Limited

Assembled by: (static) on production apcf03 at 25 Apr 2017 21:12:44 Processing Time: 17ms