A post to Hacker News pointed to this useful summary page of the various arcs of interest in IP geolocation. I’ve touched on this topic before and, in fact, there is a tag in the APNIC Blog for geolocation.
It would be lovely to imagine a world where this was a solved problem, and it really is now that RFC 8805 “A Format for Self-Published IP Geolocation Feeds” is published.
RFC 8805 presents a method to share accurate geolocation data with all users who depend on it.
… a format whereby a network operator can publish a mapping of IP address prefixes to simplified geolocation information, colloquially termed a “geolocation feed”. Interested parties can poll and parse these feeds to update or merge with other geolocation data sources and procedures. This format intentionally only allows specifying coarse-level location.
RFC 8805
Suppose you drill down into many of the non-self-asserted geolocation sources, such as Maxmind. In that case, they recognize RFC 8805’s resource format and if you point them to it, will consider it in their calculation of IP address location. Add to this that the draft discussed in the post on shepherding is now published, and the problem should be solved.
But it’s important to remember that for some uses, misleading geolocation data is normal. It might be for circumventing restrictions on Intellectual Property Rights (for example, watching Dr Who from outside the UK) or it might be for some kind of preferential processing (for example, targeted differential pricing for hotel and flight bookings).
While self-asserted (by the ISP) geolocation is one of the best sources we have, it isn’t by any means all that people use. Triangulation by Border Gateway Policy (BGP) and path inspection are also heavily used.
The status of Internet addresses as Personally Identifying Information (PII) is complicated. Originally, the community at large had a strong sense that addresses were not PII, but increasingly, IP addresses used to access a service online are being used alongside other information to ‘triangulate’ to a specific person using an address at a specific time.
IPv4 and IPv6 may not be PII but they are part of the information that can be used to ‘locate’ users online. Geolocation is only part of the problem, but having a better understanding of how geolocation works, and what sources of geolocation exist is beneficial. For that reason, if no other, the IP geolocation resources web page is a good read!
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.
IP-as-PII is not up for debate anymore. EU GDPR explicitkly says it is PII, as do most other regulations modeled on it.
The geoloc resources you link to are very superficial. As someone who’s had to implement geoblocking for US trade sanctions on Iran, Syria, Cuba, North Korea and the Russian-occupied parts of Ukraine, the specific details matter, like the nuances of how the Russians take over ISPs in areas they occupied and reassign their IP address assignments from Ukraine to Russia. So do policy and legal issues around VPNs or Tor used as a circumvention tool. Doing it incorrectly could expose yourself to significant liability.
It’s fascinating to see the evolution of IP geolocation summarized in one place. The existence of a dedicated tag for geolocation on the APNIC Blog shows the ongoing interest and importance of this topic.
The publication of RFC 8805 certainly marks a significant milestone in addressing the challenges of IP geolocation. It provides a standardized format for self-published IP geolocation feeds, which could greatly enhance accuracy and reliability in this field.
While it’s tempting to envision a world where IP geolocation is a completely solved problem, the reality is likely more nuanced. Nevertheless, RFC 8805 is a step in the right direction and holds promise for improving geolocation services for all users who rely on them.