[LINK] RFI: Accuracy of Geo-Location Based on IP-Address

Roger Clarke Roger.Clarke at xamax.com.au
Wed Nov 28 14:31:52 AEDT 2007

Following recent discussions, I've become concerned about how 
IP-Address Look-Up works, and how accurate and how precise it is.

Inaccuracy and imprecision lead to misunderstandings, and perhaps 
shortly to erroneous decision-making - with inevitable harm to the 
less powerful (e.g. consumers, citizens, employees).

Accuracy and precision bring with them very substantial 
privacy-invasiveness and the risk of quite frightening power for the 
State and for corporations.

I did some experimentation, and have drawn some inferences.  Details below.

I'd greatly appreciate review, corrections, enhancements, and 
pointers to authoritative materials.


Summary of Results

My assumption had been that IP-Location services depended on IANA 
tables, the regional NICs - in our case APNIC, and reverse-DNS 
entries.  (Details on relevant URLs that I'm aware of are at the 
bottom of this message).

That set only gets down to IAP level.  The recent fracas about 
government departments amending Wikipedia entries showed how there 
was plenty of room for debate about which organisation was actually 
using which IP-addresses.

I did a test using my own IP-address (details below).  Two services 
produced nonsense, but two others are a matter of serious concern.

They disclosed the Latitude and Longitude of my street-address 
accurately and at a level of precision of 3 decimals of Lat/Long 
(about 100 metres).

By comparison, street-address lookup appears to use that 3-decimal 
data, but also 5 decimals of Lat/Long (about 1 metre precision).

One apparent way in which those IP-Location Services could work are:

(1)  get access to the address of the customer's registration.
      A reasonable assumption would be the records held by my ADSL-
      provider (TPG) or by the telephone-line provider (Telstra);  and

(2)  use the G-NAF scheme at http://www.psma.com.au/g-naf
      to extract Lat and Long that corresponds to the street-address

Is that likely to be the mechanism?

If that's the case, how do I frame a complaint about the divulging of 
the address by TPG or Telstra?  (One is an overseas corporation, and 
the other an overseas company registered in Australia).


Experimentation with my own IP-Address and Street-Address

My SOHO router says it has the IP-address

The Reverse-DNS / arpa entry is:

Service 1 got foxed by the TPG proxy, and doesn't seem to be sure 
where it is anyway:  http://ip-lookup.net/

Service 2 put me adjacent to Queanbeyan hospital (20km out):

But Service 3 is chilling:  http://www.ip2location.com/
delivering -35.283 LATITUDE, 149.217 LONGITUDE

And Service 4 is similar:  http://www.geobytes.com/IpLocator.htm
delivering -35.2830 and 149.2170

I did more detailed testing using Service 3.

http://www.ip2location.com/ gives:

>IP Address:
>Latitude / Longitude: -35.283 LATITUDE, 149.217 LONGITUDE
>Connecting through: TPG INTERNET PTY LTD
>Time Zone: UTC +10:00
>You're using proxy server in
>Proxy IP Address:
>Latitude / Longitude: -33.917 LATITUDE, 147.217 LONGITUDE
>Connecting through: TPG INTERNET PTY LTD
>Time Zone: UTC +10:00
>Net Speed: DSL

[The Time Zone is wrong (should be UT+11)
[The proxy-server has me mystified, particularly in West Wyalong
[This service also mistakes the proxy for the visitor, and (probably) 
mistakes the location of the proxy: http://freeipservices.com/

Using Multimap.com.au on 78 Sidaway St, Chapman ACT 2611 delivers an 
accurate map, and the coordinates:


So the Multimap lookup on street-address provides the identical 
coords to those delivered by IP-Address Look-up on that service.


IP2Location.com is a subsidiary of Hexasoft Development Sdn. Bhd. 
("HDSB"), an Internet R&D company based in Penang, Malaysia.

The site appears to provide no street-address and no phone-number.
The ARBN is shown as 091 652 961.
The Business Entry Point look-up at http://www.abr.business.gov.au/ gives:
Geobytes Inc. QLD 4503
ASIC shows it as a registered foreign business since 18/02/2000, at 
Griffin QLD 4503.  Griffin is in the Pine Rivers area on the northern 
outskirts of Brisbane (adjacent to Redcliffe).


At first, I was mystified by the following:

At my latitude, 1 degree = 111,000 metres;  so 1/1000th of a degree 
is still 111 metres:  http://www.mysundial.ca/tsp/lat_long.html.

So how does the Lat and Long measure pin down a point on my property 
boundary, and distinguish my block from the other 20 or so within a 
111m radius?

I then saw that the Multimap data carries two sets of data.  The 
additional set is loc=AU:-35.35577:149.03423:17

That's Lat and Long in a form 100 times more precise, i.e. to c. 1 
metre.  But the two differ:
-   -35.35577   :   149.03423:17
-   -35.283     :   149.217

Interestingly, MapQuest using the 3-decimal coords first gave me a 
location on a rural property just north of Canberra Airport:

Then on repeating the request it gave me identical results to the 
rather different location indicated by the more precise coordinates:

[Do these services get flushed through the NSA en route, in order to 
deliver US Administration-approved false results??

Maybe not:

Using this value-added service over Google
and keying the street-address, I get the coords:

And using the 3-decimal coords, I get the property north of the airport.

The difference between the two is 7km N-S and 18km E-W, and that 
cross-checks with my local knowledge of about 24km driving-distance.

So the more precise measure also appears to be the accurate one.


My original assumption had been that IP-Location services depended on:

1.  IANA tables

2.  the regional NICs - in our case APNIC:

3.  reverse-DNS entries:

See especially:


Roger Clarke                  http://www.anu.edu.au/people/Roger.Clarke/
Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
                    Tel: +61 2 6288 1472, and 6288 6916
mailto:Roger.Clarke at xamax.com.au                http://www.xamax.com.au/

Visiting Professor in Info Science & Eng  Australian National University
Visiting Professor in the eCommerce Program      University of Hong Kong
Visiting Professor in the Cyberspace Law & Policy Centre      Uni of NSW

More information about the Link mailing list