The Farm That 600 Million IP Addresses Called Home

Every GeoIP database has to answer the same question millions of times a day: where is this IP address?

Most of the time, it gives a reasonable answer. But sometimes it doesn't know. The IP address might be dynamically assigned, routed through a proxy, or too new to have been mapped. The database has no idea where the device actually is.

The problem: "I don't know" isn't a valid coordinate. The database has to return something. So it returns a default — coordinates that mean "somewhere in the United States."

For over a decade, that default pointed at a farmhouse in rural Kansas. The people who lived there paid the price for every unmappable IP address in America.

The Coordinates

In 2002, MaxMind needed a default location for IP addresses it could only resolve to the country level. The logical choice was the geographic center of the contiguous United States, determined by the U.S. Coast and Geodetic Survey in 1918 at 39°50′N 98°35′W, about two miles northwest of Lebanon, Kansas¹. MaxMind rounded to something cleaner: 38.0000, -97.0000².

That pair of numbers landed in the front yard of a two-story farmhouse near Potwin, Kansas. The house had been in the Vogelman family since 1902².

As far as the Internet was concerned, it was also the home of over 600 million IP addresses².

What Happens When a Database Points at Your House

The first visitors arrived within a week of the Arnolds moving in on May 1, 2011. Two deputies showed up looking for a stolen truck³. Then it kept happening, "countless times" over five years³:

• FBI agents investigating computer fraud
• Federal marshals serving warrants
• IRS collectors tracking down tax evaders
• Ambulances searching for suicidal veterans
• Police officers looking for runaway children
• Angry strangers who'd traced stolen devices or hacked accounts to this address

Strangers were found in the barn². Someone left a broken toilet on the property as a threat². Online, vigilantes published the family's names on YouTube, Reddit, and Facebook, accusing them of being identity thieves and scammers².

The Butler County Sheriff placed a warning sign at the farm's driveway². His deputies had standing instructions: the people who live here are not criminals.

The Gap Between "Country" and "House"

MaxMind's co-founder Thomas Mather later said it had never occurred to the company that people would use the database to track someone to a household².

MaxMind marketed its database as accurate to a city or zip code level. The coordinates were a programmatic convenience for rendering a dot on a map, never meant to represent a street address.

But law enforcement plugged IP addresses into lookup tools, got coordinates, dropped them into Google Maps, and drove to whatever building appeared. Victims of cybercrime searched for the IP address that hacked their account, found coordinates, and showed up in person.

The database said "somewhere in America." People heard "right here."

Every GeoIP coordinate carries an implicit claim of precision that the underlying data doesn't support. A result accurate to a 50-kilometer radius looks identical on a map to one accurate to 10 meters. Both are a dot. Neither comes with a warning label.

How It Was Discovered

For years, the Arnolds had no idea why their home kept attracting law enforcement and angry strangers. They had no connection to the technical infrastructure of the Internet. They lived on a farm.

It took journalist Kashmir Hill to connect the dots. Her 2016 piece for Fusion identified MaxMind's default coordinates as the root cause². The article revealed the same problem affected others too. Tony Pav in Ashburn, Virginia had over 17 million IP addresses mapped to his home and nearly had his door broken down by police searching for a stolen government laptop².

Only after the article was published did MaxMind respond.

The Fix

MaxMind moved its U.S. default to the center of Cheney Reservoir, a lake west of Wichita⁴. If "I don't know" has to point somewhere, it should point somewhere nobody lives.

The Arnolds filed a lawsuit against MaxMind in August 2016, seeking damages in excess of $75,000³. The case was settled in September 2017⁴.

Joyce Taylor, the 82-year-old owner whose family had worked the land for over a century, reportedly put up a sign in her yard:

"Go Jump in the Lake."

What This Teaches Us

Defaults are decisions. When MaxMind chose 38.0000, -97.0000, nobody thought of it as a decision that would affect a real person. It was a null value with geographic clothing. But every default lands somewhere, and "somewhere" is always somebody's reality.

Precision is not accuracy. Six decimal places of latitude and longitude imply a specific location within inches. But when the underlying data says "United States," those six decimal places are fiction. The coordinate is precise. The knowledge behind it is not.

Systems don't contain their own use. MaxMind built a database for city-level geolocation. People used it for household-level investigation. The database had no mechanism to say "this result is a guess, not an answer." So every guess was treated as an answer.

This is the human cost of the abstraction described in How GeoIP Works. GeoIP is a useful approximation, but approximations become dangerous the moment someone mistakes them for ground truth.

The Arnolds didn't need to understand IP geolocation. They needed IP geolocation to understand its own limits. It didn't. And for five years, every time the system said "I don't know," it pointed at their front door.