The IP belongs to a hotel, café or public Wi-Fi service—what changes?¶
title: "The IP belongs to a hotel, café or public Wi-Fi service—what changes?" card_id: "IP-065" status: "complete" source_document: "https://docs.google.com/document/d/1tLZ34jyiS2PuiL2atjysHJdXfXYjhRoJywFXd6S6x7Q/edit?usp=drivesdk"
The IP belongs to a hotel, café or public Wi-Fi service—what changes?¶
The IP belongs to a hotel, café or public Wi-Fi service—what changes?¶
An IP address appears to belong to a hotel, café, airport or public Wi-Fi provider.
That doesn't normally mean the venue itself performed the activity.
The address may represent an internet connection shared by staff, customers, guests and numerous connected devices.
The internet provider may be able to associate the public address with the venue or Wi-Fi operator.
But that result usually identifies the shared service—not the individual who used it.
Whether the enquiry can go further depends on how the network was operated and what records were retained.
Some public Wi-Fi services require a user to enter an email address, telephone number, room number or voucher code through a captive portal.
Others allow anybody nearby to connect without providing any identifying information.
The network may record when a device connected, which access point it used, the private address it received and a MAC address associated with its network interface.
Those records can help distinguish connections, but they don't automatically identify a person.
Modern devices may use randomised MAC addresses, and the information entered into a captive portal may be false, shared or belong to somebody else.
Hotels may hold booking and room-allocation information. A café may have payment records or CCTV. An airport may have several independently operated networks covering a very large area.
Those sources can provide context, but their timestamps and coverage must be understood before they are linked to the network activity.
Time is especially important because public Wi-Fi addresses and private allocations are reused.
An imprecise timestamp could leave many possible devices connected through the same public address.
Relevant records may also be retained for only a short period—or not created at all.
A public-Wi-Fi IP address can lead to a venue, network operator or connection record.
Sometimes additional records can narrow the activity to a device, booking or account.
Sometimes the available evidence will go no further than showing that the activity passed through a shared public connection.