The Evil Dragon Is Abandoned by Heaven
This is another exercise in comparing local Chinese-language media against local and western English-language media of a police shootout in Taiwan. The most wanted man in Taiwan, Chang Hsi-ming (nicknamed "Evil Dragon") was injured and captured after a shootout with more than 100 policemen. My interest here is specifically about how an Internet connection led the police to the subject. The situation is quite unclear since the police will not discuss the secrets of their trade for the edification of other criminals. The police will neither confirm or deny anything. Thus, rumors are rampant across the media, and this post will show you some of those reports which are wildly at odds with other.
First up, here are the western media reports:
(Reuters) Taiwan evening newspapers said Chang Hsi-ming, wanted for murder, illegal possession of weapons and multiple kidnappings, was found via his Internet protocol address after police found out he often played games online.
(The Inquirer) The task became easier when the police learnt that he had a passion for online gaming. They sniffed out his online persona, and tracked his IP address.
And here are the local English-language media reports:
(Taipei Times) In addition to following the alcohol trail, CIB Commissioner Hou You-yi said that Internet gaming also played a key role in locating Chang. "He played online games a lot. Although he always used a pseudonym, Taichung City Police Department Internet Squad Chief Chang Cheng-juei had already locked on to him, and was able to confirm his location through his IP address approximately one week ago," the CIB chief said.
(Taiwan Headlines) The CIB detectives and their counterparts based in different counties as well as city police departments collaborated to track Chang through a variety of means, including tracing his Internet protocol address after they learned of his obsession with playing online games with his accomplices.
(China Post) Chang, wanted for murder, multiple kidnappings, and illegal possession of weapons, was found via his Internet protocol address after police found out he often played games online.
So these reports provide only very brief mentions that online games had something to do with his arrest.
The following are the local Chinese-language media reports:
(Central News Agency via Yahoo! News) [translation] An Internet security expert say that there are many IP addresses so that it is impossible to find a particular person unless the police knew the IP address and then trace back to the physical location of that IP address. For example, if you have ADSL broadband installed at home, when you log on, the Internet Service Provider will assign you an IP address and that ISP will have a record of that action. Once the police know the account of the person, they may ask the ISP to use a sniffer to record the activity at that account and they can read any unencrypted message. But if the messages are encrypted, then it may take some time and effort to crack them.
(TVBS via Yahoo! News) [translation] Chang Hsi-ming was very cunning and no lnoger used land telephones or mobile telephones. Instead, he used the Internet or MSN instant messenger services to communicate. The police located 11 of his IP addresses and finally caught him.
On July 9, the police believed that Chang was at a temple in Taipei, but since there was only one access road up the hill, the police decided not to rush him.
On July 10, the police believed that Chang may be at a townhouse in Taichung. They had the manpower in place and they waited for him to get on the Internet to confirm his presence. But there was no Internet access that day, and so the police pulled back.
On July 12, Chang got on the Internet from a townhouse in Shalu town.
On July 13, Chang got on the Internet again from a townhouse in Shalu town. The police then decided to rush the place and caught the fugitive.(United Daily via Yahoo! News) [translation] On July 10, the police wanted to arrest Chang in Taichung. But police from another unit decided to download a trojan horse virus onto Chang's account. The attempt was rejrected by Chang's firewall, and Chang got alarmed and siwtched location immediately.
(TVBS via Yahoo! News) [translation] Chang Hsi-ming used the nickames The Loner (獨來獨往) and Plumber-Electrician (水電工) to play online role-playing games. Because online games are usually play at night and sleep during the day, the police did not assault the townhouse at night. Rather they waited until 9am when Chang was sound asleep.
(China Times via Yahoo! News) [translation] Chang Hsi-ming went on the Internet using WiFi access. He used the nickname The Loner (獨來獨往) to communicate with his colleagues but also to play the online game Heven (天堂). According to computer professionals, if Chang has a notebook computer, he can use the wireless modem card to locate access points at restaurants, coffee shops, Internet bars, college campuses. However, there may be occasional blind spots. According t the police, Chang has several nicknames, but he seemed to like The Loner. Since April this year, the police have been studying the identities of people who were accessing the Heaven game via WiFi and found that The Loner was suspect. [Comment: This is almost surely wrong because there is no way on the server end to tell if an access came from WiFi.]
(ETTV News via Yahoo! News) [translation] To avoid the police dragnet, Chang Hsi-ming did not use a mobile telehphone. Instead, he used MSN to communicate. But Chang did not realize that when he uses MSN, he leaves behind an IP address and that was how the police found him. A spokesperson for MSN in Taiwan was surprised because she said that MSN had not given any assistance to the police and she has no idea how the police could manage to catch Chng this way. But the police revealed in private that MSN did offer help. Ordinarily, in any investigation, the police will only request the operator to provide the account information as well as other related information such as IP addresses.
(Central News Agency via Yahoo! News) [translation] According to the special squad, Chang's colleague set up a WiFi network to send MSN instant messagse, but the police use high technology to identify the IP adress.
So you get the idea that it was not all that simple. The above stories are not consistent with each other. The most plausible scenario would be the police locking on the nicknames of The Loner and Plumber/Electrician. They asked the game operator to supply the IP addresses associated with these nicknames, of which there were 11 different IP addresses. These IP addresses are associated with specific Internet Service Providers, who were then contacted and asked about the account holders who had been assigned those IP addresses at the time when The Loner and Plumber/Electrician were playing the online games. The account holders can then lead to physical locations at which the Internet access nodes (either ADSL or cable) had been installed. From then, it is just persistent surveillance of those locations until Chang Hsi-ming showed up.
But if you think that you have a reasonable picture of what went on, cast all your ideas away. The Chinese-language media instead went with a sci-fi story about Geographical Positioning System (GPS) chips and GSM mobile telephone surveillance devices.
(Taipei Times) Although Chang (張錫銘) has been very cautious and has tried to stay low-profile during his flight from justice, police have "always" had an idea of his whereabouts, because he sent his henchmen to buy large quantities alcohol for him almost every day. "The police were able to maintain surveillance on his gang. But officers did not take action until [yesterday], because Chang is extremely cunning and knows how to take advantage of his surroundings to protect himself. The police did not do anything for fear of harming innocent people," Cho explained.
(China Post) In addition to the clues gathered from Chang's messages sent on the Internet to his followers as well as to a woman who bore him three children and his playing online computer games, a new breed of high-tech tracking microchips also helped a key role in helping police track down the serial kidnappers, according to the sources. The tiny microchips were developed abroad for intensified monitoring of international terrorists. Although local police are still unable to fully utilize the cutting-edge chips with satellites like in more advanced nations, the telecommunications vehicles of the police force were employed to monitor the chips hidden in the daily necessities, including foodstuff and lunch boxes, purchased by Chang's accomplices.
(Apple Daily) [translation] During the operation, the special squad located the vehicle of a colleague of Chang. While the colleague stepped out of the vehicle to make a purchase in a store, the detective placed number of GPS (Global Positioning System) chips on the vehicle and other items, together with a GSM mobile telephone surveillance device. The GPS chip has a resolution of more than 10 meters, so it will only point to an approximate area. Unless the subject was standing alone in an open area, it would be difficult to find him.
(ETTV News via Yahoo! News) [translation] The Tainan District Prosecutor's Office confirmed the placement of GPS chips into shopping merchandise for Chang and then the police followed the trail of those chips. Once the chips told them the neighborhood where Chang is, they used the known Internet account number to ask MSN and the online game company to find the IP adresses; then they ask the ISP to provide the telephone number of the ADSL line for that IP address for that time period; from the telephone number, they can find the exact house.
(Central News Agency via Yahoo! News) [translation] According to the police, the key to the case was the placement of a small chip among the daily objects used by Chang Hsi-ming. The police was able to locate the approximate area where Chang was, even though they did not have the exact location. But once they got an IP address, they found the exact townhouse.
(Taiwan Daily via Yahoo! News) [translation] The police have frankly admitted that they were able to follow the trail of Chang Hsi-ming because an informer was willing to take tremendous risk by entering Chang's residence to place a chip. Furthermore, the special sqaud also inserted chips on the merchandise at a supermarket that Chang's colleague ofen shops. When asked if the chip was placed inside Chang's favorite cigarette brand, the police declined to respond.
(United Daily via Yahoo! News) [translation] More than twenty days ago, the police sent someone to place a chip among Chang's possessions. While in hiding, Chang spent most of his time playing online games. The police then found 11 IP addresses for Chang, and then they sent someone who pretended to be a farmer and installed a GPS device on Chang's SUV.
(Taiwan Daily via Yahoo! News) [translation] The "Chip" theory surfaced after Chang Hsi-ming was arrested. The Tainan prosecutor claimed that the police sent an informer to place a chip that was capable of transmitting signals for one month. Another claim was that Chang's SUV had a GPS device installed. This has caused some discontent from the police team. The alternate version was that the Taichung police worked with more than 600 broadband service providers to sieve through several hundred nicknames of online game players before identifying The Loner and the Plumber/Electrician. From there, they found the IP addresses and the corresponding physical locations. The chips had nothing to do with it; if they did, the arrests would have been made a long time ago.
As I said at the start, the police will not discuss their trade secrets. At this point, we have to tell which (if any) of the above is the truth. Someday, all of this may come out of a trial in open court. In the meantime, just think about what English-language-only readers are missing.
