Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Privacy Your Rights Online

EU Still Looking at Mandatory Data Retention 102

Posted by michael from the look-but-dont-touch dept.
An anonymous reader writes "Following up on a previous Slashdot article, European civil rights advocacy group Statewatch is detecting more rumbles of a possible weakening of privacy rights in the EU. The European council has been testing the waters for a new policy mandating retention of communications "traffic data" by all member states. The previous policy (adopted May 30) merely allowed an exception to EU privacy law for member states who wished to retain such data. Under the leaked draft proposal, law enforcement is to be allowed access to "traffic data" (identifying source, destination, time, etc.), which is similar to current US law. However, much worse is the requirement that telco providers retain such data for 12-24 months. Text of the draft framework decision is available. Also analysis by Statewatch. Backup link (in case of Slashdot effect)."
This discussion has been archived. No new comments can be posted.

EU Still Looking at Mandatory Data Retention More

EU Still Looking at Mandatory Data Retention

Comments Filter:

  • Sounds like... (Score:3, Funny)

    by cez ( 539085 ) <info@hist[ ]star ... m ['ory' in gap]> on Tuesday August 20, 2002 @11:54AM (#4105701) Homepage
    Someone has mad equity in the databackup / storage market out there
    • If it wasn't for the requirement that the data be accessible to law enforcement, there wouldn't be a problem; WOM (Write-Only Memory) with capacities in the high exabyte range has been around for decades, and could be expanded to zettabyte and yottabyte ranges with very little research expenditure or manufacturing cost.

  • How? (Score:2)

    by dattaway ( 3088 )
    This sounds like a great service from Big Brother, but how are they going to pull this one off? At taxpayer expense?

    I see the need to ping eachother with random terrabytes of data. Who's going to pay for this expensive archiving?

    • Re:How? (Score:1, Funny)

      by cez ( 539085 )
      exactly, someone will pay, and someone will definately produce a nice proffit...whos that again?

    • Re:How? (Score:3, Insightful)

      by JCCyC ( 179760 )
      "Gee, officer, our server just had a fatal crash last week."

      Or:

      "Gee, officer, the warehouse where we hold our pile of DVD-Rs with traffic logs just caught fire!"

      Or:

      "What the...? Someone seems to have demagnetized our entire pile of backup HDs! I'm shocked, just shocked!"

      What now? Mandatory data reliability? Or will you just have to hand your logs to the Gestapo every Tuesday?

      • What now? Mandatory data reliability?

        I guess you are not familiar with the RIP bill in UK. Soon, it will be your responsibility to prove that you didn't destroy the logs on purpose.

    • we're all taxpayers around here, and somebody has to pay for the data to be stored shit, so a taxpayer(s) pay it.

      on the other news, i thought they've had access to connection logs(connections from what to where,including time 'n stuff, but not what was in that connection) since ages, and i'd figure most/all isp's store those logs already, they sure had access for this kinda data couple of years ago(in finland. i know.).

  • Bad for the echonomy (Score:3, Insightful)

    by oliverthered ( 187439 ) <oliverthered@ho[ ]il.com ['tma' in gap]> on Tuesday August 20, 2002 @12:00PM (#4105742) Journal
    There's no way this will get through (he says!)

    It will cost too much and with have an impact of inflation which no one in the EU wants to see at the moment. There will be bandwidth implications because of the storage and processing overheads and investment and development in new infrastructure and technologies will be hit.

    And who gains, well if the police can actually filter the data and find out what you up to then maybe a few people who have had criminals take away there liberties will feel better.

    Who looses, everyone else.

  • How would this effect the European ISP community? Would the governments subsidize it, or would the costs be dumped on the consumer, increasing the cost of net access in Europe even higher then it already is?

    I suppose that in many regions where broadband has not been widely adopted (Britain?), this could work very well, but what about places where it has been?

    • Re:Prices? (Score:3, Insightful)

      by Tackhead ( 54550 )
      > Would the governments subsidize it, or would the costs be dumped on the consumer, increasing the cost of net access in Europe even higher then it already is?

      Where, pray tell, do you think governments get the money they then distribute for "subsidies"?

    • How would this effect the European ISP community?

      One way it would affect the Europeans is to create a big incentive for individuals to adopt internet telephony. B-)

  • The spooks have access already... (Score:5, Interesting)

    by Chris Croome ( 24340 ) on Tuesday August 20, 2002 @12:04PM (#4105780) Journal

    I suspect that the US and UK and other governments spy agencies already have access to whatever electronic communications they want to tap.

    This is the case in the UK with regard to phones, however phone tap data is never used in court here because the state might then have to admit how they got it -- they would rather not convict people then admit their sources and the extent of the eve dropping that is going on.

    I suspect that draft proposals like this are based on the old trick -- suggest something totally over the top and impossible to implement then let well meaning people water it down, claim that government cares and listens and at the end of the day still get away with yet another outrageous new law and yet more erosion of privacy and civil liberties.

    But then again I'm probably not cynical enough, it's probably far worse than I can imagine already...

    • hehe...
      But then again I'm probably not cynical enough, it's probably far worse than I can imagine already...
      How much more cynical can you get? I hope that was intentional...

  • One good thing... (Score:2, Informative)

    by Teknogeek ( 542311 )
    Given how much storage space two years of ISP logs could take up, the amount of storage hard drives can hold is quite likely to go up VERY fast.

    Of course, whether or not that's so good a thing when you take into consideration the privacy concerns can be a rather complex debate.

    At least we'll have more room for pr0n! :)

  • I'm sure glad I don't live in Europe... (Score:5, Funny)

    by bsDaemon ( 87307 ) on Tuesday August 20, 2002 @12:07PM (#4105801)
    I know our benevolant, wise, and responsible US Federal Government would never enact such blantant acts of controll over its freedom-loving, tuned in, and watchful citizens. Oh, wait... /me packs his things and heads for Antarctica

  • What about global communcations? (Score:3, Interesting)

    by Auridel ( 602278 ) on Tuesday August 20, 2002 @12:10PM (#4105816)
    From the draft:

    a) Data necessary to follow and identify the source of a communication;

    b) Data necessary to identify the destination of a communication;

    c) Data necessary to identify the time of a communication;

    d) Data necessary to identify the subscriber;

    e) Data necessary to identify the communication device.

    And:

    These types of data shall not concern the content of the exchanged correspondence or the consulted information, in any form...

    So, they couldn't read my e-mail, but they could get a complete list of everyone I've exchanged e-mail with in the last 12-24 months?

    What I really wanna know is how this will affect communications between parties outside the EU that just happen to pass through EU routers. I couldn't find any specific mention of this (granted, I didn't comb through the draft too carefully.)
    • How is this going to affect the vast community of ad-hoc wireless links that sprout up overnight? Are they going to police them too? Are they going to try and track the people who bounce microwaves off buildings, the sky, and such?
    • What I really wanna know is how this will affect communications between parties outside the EU that just happen to pass through EU routers.

      My read is that unless the communication involves at least one EU telecom subscriber, nothing will be recorded. [Insert big handwave icon] The bits are just passing through the backbone from Quito to Tashkent.

      From the draft...

      The data that the draft framework seems to want to have retained looks, in principle at least, no more than the equivalent of telephone logs. In many police procedurals, the detectives "check the phone logs". ("Hey, Gordo called Magdeburg six times last week. Wasn't Icepick Johann rumoured to be hanging out there?") Investigators of all kinds track leads and pull threads. With this kind of data, they might be able to find different kinds of patterns. ("Wow! Gordo started hitting flycheap.com two minutes after he got that last call from Barcelona. Wonder what scared him?")
    • Cool. I can imagine 90% of all stored data being spam. The government will become the chief authority on spam, knowing who sends it, to him and on what machine they did it. :)
  • The story mentions the existance of a US law requiring data rentention. I have not heard of this. What are the US requirements??

  • Information used by Drug Cartels.. (Score:4, Informative)

    by sadr ( 88903 ) <skg@sadr.com> on Tuesday August 20, 2002 @12:15PM (#4105848)
    This is exactly the information used by drug cartels to assassinate informants, as described in a previous Slashdot article.

    If the information is being kept, unauthorized access will occur.

    SKG

  • Hacktivism (Score:2, Interesting)

    by return 42 ( 459012 )
    This strikes me as an area where Declan McCullough's position [com.com] makes sense. We already have PGP and friends to protect email. Projects like Infranet [slashdot.org], Anonymizer and Freenet can protect surfing and file-sharing. Laws to criminalize such tools, or mandate key escrow, will lag behind and won't be very effective, particularly if the tools are widely used.

    Not that political action won't help too, but it's easier to get a law defeated or repealed if it doesn't work anyway.

  • are belong to EU.
  • In the UK, under the Data Protection Act 1998, it is illegal to retain data for longer than necessary. 12-24 months may well be considered to be longer than necessary for many types of data.

    So, my question is: Would this European Directive (or whatever) override the Data Protection Act?

    • More fundamentally, it is my understanding that (and I may well be wrong) that the 1998 Data Protection Act was revised from the original act to generally be updated where appropriate and become compliant with the relevant EU directive on Data Protection. So any new EU directive concerning data retention would not only be fudged at the UK level (kinda surpassable) but would also conflict with an earlier EU directive, which would be a bit messy.

      Not that it really matters - this whole process is massively unfeasible. To put it in context, my flatmates and I have easily downloaded over a quarter of a terabyte of data over the last year over our ADSL line - the figure probably reaches much higher. Scale this up across the continent and the figures are going to get unrealistically enormous. Even just logging e-mail and dns activity is going to burn a heck of a lot of storage capacity.

      What are the EU going to do? Spend many billions of euros on implementing the required software and (more fundamentally) hardward changes across the continent, money they could be spending on, for example flood relief? Or will they just tell the ISPs to get on with it, leaving them fundamentally crippled with the cost of internet access skyrocketing as ISPs drop like flies?

      • the point is not to log all _data_, but connections. so they can see if you did connect for example, on everyday of your life to this a little too teenysexx site.

        • But like I said, even logging 'transactional' traffic, like what e-mails you've sent, what sites you've been to, what irc channels you lurk in, etc is *still* going to burn far too much storage space. Plus the overhead of archiving this information in any kind of usable fashion is going to require extra procesing burden and suchlike.

          Anyway, if you didn't log all data, then the whole system could blow back in the faces of investigators. Imagine someone being in e-mail contact with a terrorist suspect, say, who just happens to be a friend from school. The police might accuse them of conspiracy, citing the e-mail transactions. But if the content of that e-mail isn't logged then the police can't prove squat - said person could claim that they were merely catching up on old times. If both parties were sensible enough to delete and shred their copies of the e-mails at the time, then two years later after constant abuse of the disk sectors those e-mails occupied will have (very likely) irretrievably destroyed that data, and the police are left asking the politicians why they didn't enforce a stricter achiving scheme :-)

    • Re:Does it trump the Data Protection Act? (Score:1, Informative)

      by Anonymous Coward
      and the answer is, YES, as that's what EU directives do : they override national legislation.

      I think the general problem is that there is no public debate over any issue of IP and data privacy. I personnaly believe that these are the two mot important topics that may affect citizens in this century, and that these discussion should become central at any level of democracy, which inludes the EU. Citizens should stop whining with their national governments since these are helpless anyway, and should concentrate on pressuring the EU, through European Parliement elections and by closely monitoring the stance of their national governments in the Council. That's what corporate lobbies, which know better, do.
  • Is the EU council going to give me funds to buy an extra NAS to store 24 months of communications on?
  • and if you tell anyone you've given us your passwords, you'll be jailed" laws and London "Every square inch is under 24/7 video surveillance", it really seems like our friends across the pond are giving us a run for the money in the "Who'll completely destroy the notion of privacy and/or civil liberty first" contest. Good thing we've still got TIPS.

  • Worried? Just ask for your file... (Score:4, Interesting)

    by ianscot ( 591483 ) on Tuesday August 20, 2002 @12:50PM (#4106076)
    Point nine of this draft gets to our privacy worry:

    Such a priori retention of data and access to this data constitutes an interference in the private life of the individual; however, such an interference does not violate the international rules applicable with regard to the right to privacy and the handling of personal data contained, in particular, in the European Convention on the Protection of Human Rights of 4 November 1950, the Convention of the Council of Europe no.108 on the protection of persons in respect of the automated handling of personal data of 28 January 1981, and the Directives 95/46/ce and 97/66/CE, where it is provided for by law and where it is necessary, in a democratic society, for the prosecution of criminal offences.

    They admit it's a compromise of individual privacy rights, but say it's allowed under those conventions. I was just looking for the spots in those documents:

    that allow mandatory storage of information in the absence of ongoing criminal investigation -- a priori.

    The 1950 one includes a very general passage seeming to allow anything "preventive" if it might abridge the rights or freedoms of others. Doesn't make me feel safe. (Hey, someone might want to prevent me using my TiVo in naughty ways. That'd abridge Jack Valenti's right -- or is it a freedom? -- to rake in money.)

    The 1981 thing's much more specific to the question, and opens up a world of hurt we could inflict on our various surveillance agencies:

    The purpose of this convention is to secure in the territory of each Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him ("data protection").
    ...
    Any person shall be enabled:

    a) to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;

    b) to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;

    Imagine the /. effect as we all demand access to the records being kept of all our packet traffic, all our phone calls... Hey, people ask for their credit reports. If the European agreement says it has to be "transparent" in this way, just start asking.

  • Peer to Peer email flooding? (Score:3, Interesting)

    by Contact ( 109819 ) on Tuesday August 20, 2002 @01:00PM (#4106148)
    There are two possibilities. Either this will work by simply archiving the information from the ISP mail server (in which case, just use a mailserver in another country...) or they're going to have to sniff all traffic to check whether it's SMTP / POP / IMAP etc.

    So, for a little civil disobedience:

    1. Option 1. If you're using an external mail server, you're not using the ISP mail server, right? So that gives you a "junk" email box. Why not set up a peer to peer system along the lines of SETI@home, which uses idle cycles to exchange email at the rate of a few hundred a minute.

    2. Option 2 - if they're sniffing all traffic, even better - write something similar, but do all the inter-client communication using SMTP. You should be able to simulate a few hundred messages per second. Get enough people on board (using SETI like marketing tactics - email chain letters encouraging people to "fight the spies" etc) and you could utterly dwarf "real" email under a storm of junk data. Even if they can somehow parse out the "real" data, the cost of storing the information has risen exponentially - and all you have to do after that is work out a way to embed real messages in the "fakes", and you've got unmonitored communications again!

    PGP only helps hide content, which this legislation doesn't ask for. Remailers would work, of course, but would look "suspicious"....

  • NO NO NO NO NO! (Score:1, Interesting)

    by Anonymous Coward
    I will NOT live within a community that supports this flagrent disregard for my human right to privacy. Whilst I realise this information is probably already accessable to see this type of legistation even REACHING the stage of open discussion is disquieting.
    This is nothing to do with the 'war on terrorism' it is nothing less than control.

    knowledge == power

    and power corrupts.
    QED
    • I agree completely. This is *exactly* the same as keeping records on our own "real lives" (where we drive, who we speak to, what we read, watch, and listen to) It's just because it's so much easier (relatively) to watch us online that they think it's okay.

  • For all the Europeans .. (Score:3, Funny)

    by i_want_you_to_throw_ ( 559379 ) on Tuesday August 20, 2002 @01:14PM (#4106229) Journal
    that rightfully thought the US was backwards with Fritz Holling, DMCA, etc: Welcome!

    I got karma to burn. Mod me down if you must.

  • Who is responsible for this logging? (Score:1, Insightful)

    by Anonymous Coward
    If I SSH in to a development machine at an ISP that I don't use for dial-up, and E-Mail somebody from it with a question - who is responsible for logging that E-Mail?

    This really is a concern, because small co-location facilities, etc, really don't have the facilities to do this. It's OK for large ISPs, but a nightmare for smaller ones.

  • What if you encrypted and lost the key? (Score:1, Interesting)

    by Anonymous Coward
    I might run a home brew system which is designed to not leave the keys anywhere in the ned. All they keep is complete bollocks for anyone, including me.

    Or what happens if someone transfers something illegal, can you prosecute the telecom company for having illegal documents/child pornography etc? What if they stole it/produced it in the first place, is it all of a sudden legal then, or what?

    This is like making thoughts illegal because I might be thinking up a masterplan to steal the gold at fort knox and produce an elite army of terrorists...

  • Completely infeasable (Score:4, Informative)

    by jpmorgan ( 517966 ) on Tuesday August 20, 2002 @01:37PM (#4106357) Homepage

    I think this would definately tempt me to put any websites I run onto https and leave http with a simple redirector. Be nice if other people would do the same. I wonder how much they'd enjoy trawling through a few terrabytes of session encrypted traffic...

    Seriously though, the sheer data management problem this would pose would be extraordinary. For every 1mbps, you're talking ~4TB of traffic per year! Consider how much traffic there actually is going across the wires:

    T1 (1.54mbps): 6.07TB

    DS3 (45mbps) : 177.39TB
    OC3 (155mbps) : 611.01TB
    OC48(2.48gbps): 9,776.16TB

    Just for the hell of it, 9,776.16TB is 48,881 200GB drives. Now, you can buy one of those from Western Digital for ~$400US (retail). You'd be buying a lot of drives, so lets say you get a discount, and can get one for $300 (I don't know how big a discount you'd really get). That's almost $15 million dollars in hard drives per year for an OC48. That's about three times as much as the actual cost of an OC48 (even worse for peering arrangements).

    Of course, scale that kind of hard drive usage up across Europe, and I don't think there is the manafacturing capacity to supply that kind of demand. Oh well, I guess we've found holographic storage's killer app, eh?

    Also, who records what? Does every router have to record everythign that passes through it? Or only the ISPs that serve end users? What about businesses? What about co-located servers? If you don't want to miss anything, you'll have to cover all of those, and end up grabbing 2-3x as much data as you really have to. Otherwise it'd be trivial to setup a colocated server at a company or a hosting provider, and tunnel an encrypted connection through to that.

    On top of that, there's the problem of how you sift through ~10,000TB of data for something useful. We're talking raw data on a totally unmanageable scale.

    Why not just record all voice communications too? I'm sure that'd be invaluable in any police investigations. Ah well, nothing to worry about since neither's going to happen. Both are totally infeasable.

    • I don't think they're going to retain the actual data that was transferred, they want to keep track of who (not just xxx.xxx.xxx.xxx but Joe Smith from Sometown), sent to who (again a site or another person, not just IP), how they sent it (FTP, HTTP, SMTP), and when they sent it. They're not retaining the actual content that was sent. But still the amount of data to be sifted through is enormous.
    • All those hard drive platters, ~50K drives per OC48, times all the OC48s (and fractions as appropriate to the lesser pipes) will add up to enormous amounts of spinning matter.

      If properly mounted in line with the Earth's axis, maybe we could make a teensy-tiny little adjustment to the revolution speed when they spin 'em all up and get us a 25 hour day to match our 25 hour biological clock. I tell you, I could use an extra hour per day, and I really wouldn't mind having 15.2 less days per year.

    • What nutter voted this down as offtopic? It is totally relevant to subject at hand. I was thinking exactly the same thing and scanned down to see if someone had already covered it before posting the same comments myself.

      The volume of data this would generate is enormous and just who do the egg heads in the EU think is going to foot the bill for all this extra hardware? The Telcos? They already have their backs against the wall cash flow wise and many are up their eyeballs in debt.

      This proposal is sheer stupidity.

  • three-step solution to terrorism (Score:3, Funny)

    by Anonymous Coward on Tuesday August 20, 2002 @01:37PM (#4106358)
    1. Deny rights.

    2. ???

    3. Security!

    Seriously, what is needed is some civil disobedience. Set up weird accounts like yarafat@hamas-resistance.il, exchange suspicious e-mails with your friends (in case they don't retain the body, make sure they get to read the subject), get as many people as possible to do it. The more false positives, the more impossible the system will be to maintain.

    Remember, they're trying to make you f33r. When only one person stands up, he has a damn good reason to be afraid. When 10,000 stand up, the opposition has a damn good reason to be afraid.

    Oh, and in case it needs to be said.. use PGP as much as possible, and try to run your own mailserver.

    Just for the record: Osama Project Iraq Desert Storm Hailstorm Bush GWB kill maim murder torture Mossad oil Kuwait Iraq Iran Saudi Arabia we have the assassination plans praise Allah one hundred virgins FBI CIA Hoover Dyson MI5 MI6 James Bond Dr Evil one million pounds safety deposit box Switzerland Nazi gold bank account launch code RSA DSA NSA BSA

  • "...Mandatory Data Retention..."

    Sounds like somebody's being "retentive" alright.

  • privacy nowhere you can run but can not hide oops, wrong discussion
  • Especially if you own stock in any of several large corporate entites currently pushing SAN data centers. And of course, since this will have to be government subsidized (ISPs balk at the cost), they can lock in contracts with only "government approved" vendors.

    This is not a story about rights or law enforcement. Do you seriously think that volume of data can actually be useful? Oh, such and such person sent an e-mail around the beginning of January, maybe after bouncing through a SSH tunnel. Oh, and the e-mail was encrypted with 2048-bit RSA encryption.

    If you can't solve that problem, this "exploitation" of privacy is nothing more than writing some giants check to several government members and corporate bigwigs. Folks, this is why the stock market was invented!
  • Imagine seeing a list of old surfing habits from BBS systems of the past?

    I would be afraid to see some of the filenames of pictures that I downloaded from old BBS systems come back to haunt me. Oh the days of youthful curiosity and innocence. Goatse.gif? ...hmm I bet that picture would go good with my show and tell on farm animals......downloads with X-modem......opens picture.... Oh my God! My eyes! They are burning! Then somewhere along the line the shock and horror turns into "I had to see this garbage, so I'm making sure everybody else has to as well".

    I don't think I could ever recreate the shock or the look on my face the first time I saw it...but I enjoy the look on a coworkers face the first time they see it.

    Wow I really have become a warped little bastard haven't I. Damn those addictive BBS systems!
  • Some readers have dismissed the threat to privacy on the basis that it would be impractical to retain all internet data for a period of 24 months. To clarify the situation: the decision only covers the retention of "traffic data", defined as "all data processed which relate to the routing of a communication by an electronic communications network" (emphasis added). In theory this could mean the retention of every IP header, but consider the requirements of law enforcement agencies: they want to know who communicated with whom, and when. They don't need to know the exact route taken by each packet in order to identify the parties involved, or the web page that was seen. So what is a more realistic set of traffic data?

    Minimal set:

    • Telephone calls and faxes: caller, recipient, time, duration. Already retained by telephone companies for billing purposes. Possible means of circumvention: use a prepaid international calling card to route your calls through a call centre outside the EU. Could be expensive.
    • Emails: sender, recipient, time. Require every SMTP server to log the RCPT and FROM fields. Possible means of circumvention: use POP and SMTP servers outside the EU. Use an anonymous remailer (effectively hiding traffic data inside the body of the message).
    • Websites: user, domain name, time. Unlikely to rely on webserver logs. Instead, require every DNS server to log every request. Of course this doesn't prove that the user actually looked at the content of the site, but try explaining that to a jury. Possible means of circumvention: use a DNS server outside the EU.
    More effective set:
    • Emails: in addition to logging connections to the ISP's mail server, monitor all traffic on TCP port 25. Parse the traffic as SMTP, extract RCPT and FROM lines. Small performance penalty for users. Possible means of circumvention: find a mail server outside the EU that operates on a non-standard port (unlikely) or uses a non-standard mail protocol (unlikely).
    • Websites: user, URL, time. In addition to DNS logs, monitor all traffic on TCP port 80. Parse the traffic as HTTP, extract GET string, use a reverse DNS lookup to complete the URL. Serious performance penalty for users. Illicit websites will simply use non-standard ports or HTTPS.
    Paranoid set:
    • In addition to all of the above, traffic on IRC and IM ports will be monitored and parsed to extract user identities. All TCP SYN packets will be logged. Anyone using a mail or DNS server outside the EU in order to protect their privacy will be assumed to be hiding something. All their traffic will be monitored and examined for known protocols. Man-in-the-middle attacks will be used to decrypt SSL connections in order to extract "traffic data".

Slashdot Top Deals

The herd instinct among economists makes sheep look like independent thinkers.

Close