Europol wants ISPs to aid law enforcement by dropping CGN technologies

Europol is urging ISPs to stop using Carrier Grade Network Address Translation technologies, because they make identifying and tracking criminals a lot harder.

What is Carrier Grade Network Address Translation?

CGN (or CGNAT) allows up to several thousands Internet users to share the same IPv4 address.

CGN was meant to be a temporary workaround for the problem arising from the slow transition from IPv4 to IPv6. But, according to Europol, for some operators it has become a substitute for the IPv6 transition, which requires Internet access and content providers to update software and hardware.

“Despite IPv6 being available for more than 5 years the internet access industry increasingly uses CGN technologies (90% for mobile internet and 50% for fixed line) instead of adopting the new standard,” they pointed out.

Why is CGN a problem for law enforcement?

“The inability to identify internet subscribers on the basis of an IP address has put the European judiciary and law enforcement communities in a difficult and complex situation, creating a public safety gap and putting the privacy of citizens at risk because it forces judiciary and law enforcement authorities to investigate many more individuals than would normally be necessary,” the EU law enforcement agency explained.

In criminal investigations, an IP address is often the only information that can link a crime to an individual, they noted.

According to Europol’s Executive Director Rob Wainwright, “it is particularly alarming that individuals who are using mobile phones to connect to the internet to facilitate criminal activities cannot be identified because 90% of mobile internet access providers have adopted a technology which prevents them from complying with their legal obligations to identify individual subscribers.”

In short, law enforcement agencies are spending their limited time, manpower and resources investigating and clearing persons that, without CGN use, wouldn’t even register on their radar regarding specific investigations.

Potential solutions

While there is still no wider legislative consensus on whether an IP address could be considered proof of identity, there is no doubt that that piece of information can be of great aid in many investigations.

During a workshop attended by EU policy-makers, law enforcement officials and industry experts, existing technical and policy solutions that could be adopted at European level were discussed.

These included steps Internet access providers can take, such as reducing the use of CGN and/or the number of subscribers behind each IP address, and legislative efforts that would push for increased IPv6 deployment.

“The EU and its Member States have started to address the online capability gap created by CGN technologies,” Europol noted, but most of these initiatives have been limited to awareness raising about the problem.