How can I request an ISP to disclose their customer&#39;s identity?
<p>As far as I know, breaking the law online in Germany (such as sharing copyrighted content) often results in a <a href="https://www.settle-in-berlin.com/illegal-file-sharing-germany-letter-cease-desist-warning/" rel="noreferrer">fine</a> from a private law firm which gets your personal data from your provider by sending them some sort of &quot;cease and desist&quot; letter mentioning the violation. I understand that this process doesn't involve an actual lawsuit. I wonder what kind of proof of the client's wrong-doing is actually required for the ISP to disclose their personal data.</p>
<p>For instance, I have an open SSH port in my home network, and there are regular attempts to login using default usernames/passwords, which AFAIK is just as illegal as sharing copyrighted files. If I see a German IP in the logs, what kind of proof do I have to send to the ISP in order to get the offender's identity from them?</p>

<p>Hacking into a computer owned by someone else and accessing the data stored on it without permission is a misdemeanor according to StGB 202a (<a href="https://dejure.org/gesetze/StGB/202a.html" rel="noreferrer">de</a>|<a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1875" rel="noreferrer">en</a>). But only if it's successful. So a failed attempt isn't a misdemeanor yet.</p>
<p>When you notice that someone might have committed a criminal offence (regardless of whether you are a victim or just a witness), then the usual procedure is to report it to the police. If they consider the crime serious enough to investigate, then <em>they</em> will request the identity from the ISP.</p>
<p>But the copyright lawsuits which are filed in bulk by law firms working with media companies are not crime reports. They are civil lawsuits. A civil lawsuit is when someone had a tangible damage because of something someone else did, and now they want money in compensation. When there is no damage, then there is nothing to sue for. So when you want a judge to file an injunction to force an ISP to give them the identity of one of their users, then you would first have to explain to them how much financial damage you had because of that person and that this is enough damage to make it worth everyone's time. That might be quite challenging for nothing but a failed SSH login attempt. But it might be possible if a single person made so many login attempts that it incurred you non-negligible bandwidth cost or even caused a denial-of-service.</p>

<p>This is how the private law firms get personal data of users in violation of copyright laws in Germany (slightly modified Google translation from <a href="https://www.e-anwalt.de/abmahnung-ip-daten.htm" rel="noreferrer">here</a>):</p>
<blockquote>
<p>Companies that monitor file sharing sites for legal violations give the IP addresses of the file sharing site users to specialized private law firms commissioned. Based on <a href="http://www.gesetze-im-internet.de/urhg/__101.html" rel="noreferrer">§ 101 UrhG</a> the private law firms are now obtaining an provisional injunction with the aim of obliging the Internet provider to store the data on the IP address until the final decision by a court and not to delete it already after a few days. With a further decision, the provider is then legally obliged to determine which subscriber had the IP address at the determined date and time. The private law firm therefore learns the address of the subscriber from the internet provider approved by court order.</p>
</blockquote>
<p>This is based on <strong>§ 101 UrhG</strong> &quot;Gesetz über Urheberrecht und verwandte Schutzrechte&quot; (translates as &quot;Law on Copyright and Related Rights&quot;).</p>
<p>Since this is about violating copyright, I don't think it applies to your case (where someone unauthorized tries to log in). The § 101 UrhG was created to stop people sharing illegally content, because generally the ISP is not allowed to give personal data related to IP addresses to private persons asking.</p>

privacy civil-law germany