What should I request from a hotel or public Wi-Fi operator?¶
title: "What should I request from a hotel or public Wi-Fi operator?" card_id: "IP-108" status: "complete" source_document: "https://docs.google.com/document/d/1ZpVPupccqzmfYEVu5XChm8txJsdNd8c__FYMTKX8_g4/edit?usp=drivesdk"
What should I request from a hotel or public Wi-Fi operator?¶
An internet-provider result leads to a hotel, café, transport hub or public Wi-Fi service. The venue name is only the start.
Give the operator the exact public IP address, date, time, time zone, source port and protocol where available. Explain the event you’re trying to trace. Without precise connection details, a busy shared network may be unable to distinguish one user from hundreds.
Ask what system provided the internet access and who operated it at the relevant time. The venue, a managed Wi-Fi company and an upstream provider may hold different parts of the record.
The technical route may require translation, firewall or gateway logs that map the public connection to a private address or device identifier. Wi-Fi controller records may associate that device with a particular access point and time. Authentication or captive-portal records may contain an access code, email address, telephone number or account used to join the network.
Venue records can provide further context. In a hotel, that might include which booking received an access code, room occupancy or payment details. Elsewhere, it might include ticketing, membership or purchase records. CCTV may assist where it covers the relevant area and time and its collection is justified.
Don’t assume these records exist, are accurate or are all held by the same organisation. Guest Wi-Fi may allow anonymous access. People can provide false registration details, share access codes or use privacy features that change how a device appears. Logs may be retained briefly, so consider preservation promptly where there’s a realistic evidential opportunity.
Keep the request proportionate. Ask for records that answer the specific attribution question rather than a broad list of every guest or device at the venue.
Finally, separate the result from the conclusion. A log may associate the connection with a device identifier, access code, booking or area of the venue. That can narrow the enquiry and support other evidence. It doesn’t, by itself, establish who was holding the device or who was responsible for the online activity.