As the old joke says, On the Internet no one knows you're a dog. But they can get a very good idea of where your kennel is, and perhaps even work out where you go for walkies.
That's because everywhere you go on the Net you leave a unique scent behind you ' your IP address. Every time you send an email or browse a website, there it is, and even if you are savvy enough to conceal it by routing your traffic through a proxy server, you are only as safe as your proxy is willing and able to make you.
Type an IP address taken from the headers of an incoming email into geoiptool.com, for instance, and this mash-up site will pull up the relevant data and merge it with a Google map, giving you an idea of where your correspondent is based.
Most services of that kind - called geolocation - rely on proprietary databases, but assuming you don't use a proxy, then a basic level of IP location is possible simply using the data in the Internet's domain name service (DNS) databases. This data is usually only accurate to city level, though, and sometimes not even that. That's partly because entering this data - which is also what you get back if you do a reverse-DNS or WHOIS look-up - into the DNS databases is voluntary, and partly because most IP addresses are owned by Internet service providers (ISPs) and other companies, so your IP address will be listed as at your host's location.
Commercial geolocation specialists such as Digital Element, IP2Location, MaxMind and Quova, whose databases may list up to two billion IP addresses around the world, therefore have to dig rather deeper in order to augment the DNS data with other information.
'Google spiders the Net, we're kind of doing the same thing but crawling the router traffic all the way down to the endpoints, such as a DSLAM, cable point or PoP,' says Frank Bobo, vice president at Digital Element. 'We are seeing how traffic crosses the Net. It's active trace-routing of the Net, remapped once a month - or daily for more frequently active addresses. The Internet changes quite rapidly: 2-5 per cent of IPs change every month, so your data can get stale really quickly if you don't stay on top of it.'
He adds: 'Partners are providing us with user-supplied data down to postcode level, anonymised by truncating the IP to C-class. We are already receiving millions of postcodes a month, and we verify against our existing database, for example for when you order something for delivery elsewhere.'
Other sources of information used in geolocation may include internal network maps volunteered, sold or traded by ISPs and other companies, and location data given up by users, for instance when you type in your nearest city in order to get a local weather forecast.
'The way you have to gather data - and know how to use it - is a huge operation, it's not something you can do off your own traffic,' says Marie Alexander, Quova's CEO. 'In most IT areas, given enough cash and engineers you can build a system and get in, but that's not true with data-based applications and services.'
Sometimes the structure of the Internet can make geolocation difficult or even impossible without help. While an Internet-facing server or corporate connection will need a static IP address - one that does not change - most Internet users will have a dynamic address that is reassigned when they log off. And while some ISPs assign specific blocks of dynamic IPs to specific areas - your closest DSL or cable access point, say - others have national or even international address pools instead. For example, two geolocation services correctly placed a sample dynamic IP address in London, but two others placed it in Portsmouth and Cornwall.
'We are always aiming to increase the granularity. It varies by geographical region: it's 10-20 miles in some, 50in others,' says Alexander. 'In the United Arab Emirates for instance, 55 per cent [of addresses] you can't target, as the infrastructure is on satellite, behind proxies and so on.
'If anyone's saying you can target at postcode level in the UK, I'd say don't believe it. IPs change too fast, plus BT has more of a national IP pool, so an IP can change from one city to another. You need to know how categories of IP perform, and understand the rates of change within groups of IPs.'
So who would want to geolocate an IP address? The main motivations are monetary, either making more through e-commerce, or not losing it, by fighting fraud and other crimes. Somewhere in the middle is the dark art of Web analytics - understanding where your visitors come from and how they use your website, for example how often they visit, where they go and how long they stay there.
On the commercial side, the ability to tailor your website or target your adverts to an individual is highly prized by many of the companies who have tried it. Even something as simple as offering each visitor a version of the site in their own language can dramatically increase click-through rates, says Ken Penny, director for Internet planning and general manager at Continental Airlines.
He says that Continental, which has 56 versions of its website in eight languages, has doubled its conversion rate - that's the number of visitors who go on past the landing page - by using a geolocation service from Quova to customise both the landing page and its banner ads.
Another convert is Satish Jayakumar, co-founder and director of online advertising exchange AdJug. He reckons that response levels to online adverts are 50 per cent higher when he uses an IP intelligence service called NetAcuity from Digital Element. AdJug clients making use of geolocation have included a hotel advertising vacancies in different areas, a newspaper delivering local ads across a number of sites, and the government targeting 'quit smoking' and 'healthy heart' public-service campaigns in areas with high rates of smokers and heart disease, he says.
On the anti-fraud side, banks may use geolocation to check for online banking users logging in from unusual places, while Web shops might want to check if a customer really is logging in from where they say they are. Even individuals might find it useful to know that the message purporting to be from their bank manager was actually sent from Nigeria.
Other uses of geolocation include broadcast licensing, where the technique provides the infrastructure to enable content owners to licence broadcasters to show programmes in specific places. This is part of the reason why the BBC limits overseas access to its iPlayer TV-on-demand service, though this logic is of little comfort to those who have paid for a British TV licence - the revenue from which funds the BBC - but are blocked from watching its programming online when abroad.
Other uses of geolocation include restricting the availability of certain online content, as dictated by local laws. For example, the French are blocked from seeing Nazi memorabilia on auction websites, and German users cannot access Google's gmail.com website, because in Germany, the Gmail trademark is owned by another company.
Being where you're not
One of the most effective ways to hide both your identity and your location on the Internet is an anonymising proxy server, or open proxy, which acts as a store-and-forward gateway and replaces your IP address with its own.
Concealing your identity via a proxy may work well for whistle-blowers wishing to hide from their employers, or Web users worried about being tracked online. However, it can be less effective for dissidents trying to avoid the attentions of repressive regimes, say, or for terrorists and other criminals, as security services may have the resources to obtain users' real IP addresses, whether by tapping connections (as in mainland China) or through court orders.
The disadvantage of proxies is that they are abused by hackers, spammers, and virus distributors. Many systems and servers will therefore try to detect proxies and refuse them service, so it is little surprise that Digital Element's Frank Bobo claims that 'Only 0.01 per cent of traffic is transnational proxies.'
If all you need to do is access geographically restricted content, a simpler option is just to change your apparent location. A virtual private network can do this by making it look as if you are logged in at home or the office, even though you are actually abroad. Then there are place-shifting systems such as Slingbox and Sony's LocationFree, and software such as CyberLink Live, Orb Networks and the open-source MythTV, all of which can forward a video stream for remote viewing to anywhere that has a fast enough connection. Even PCAnywhere-type remote control software can conceal your real location, although not that of your proxy, of course.