Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Privacy

German Court Rules That Websites Can't Retain Logged IPs 176

Posted by CmdrTaco from the well-this-is-interesting dept.
tmk writes "The local court of the Berlin district of Mitte has barred the Federal Ministry of Justice from logging IP adresses of the visitors of its website. German law prohibits storing personal data for a longer time — if not needed for accounting. German privacy activists have started a campaign Wir speichern nicht, ("we don't log your data!") which provides manuals how to turn off the IP logging on your server."
This discussion has been archived. No new comments can be posted.

German Court Rules That Websites Can't Retain Logged IPs More

German Court Rules That Websites Can't Retain Logged IPs

Comments Filter:
  • Wir wissen, daß Sie Adressen, Slashdot loggen. Dies heißt Krieg. Hans, bereiten das Virus vor! Widerstand ist vergeblich!

    The Germans were dismayed to report that an 'unfortunate' side effect of this ruling is that they would have to invade Poland & France to 'liberate' their servers.

    But in all seriousness, good for them. I personally think it should be left up to the administrator of the server (or whoever 'owns' the content). If you do keep it, it's evident that the government m
    • I'm no expert on German law, but it doesn't sound like they've made IP logging illegal. It sounds like the ruling states that the government can not retain IP info.

      the local court of the Berlin district of Mitte has barred the Federal Ministry of Justice from retaining personal data acquired via its website beyond the periods associated with the specific instances of use of the site.

      It sounds kinda like free speech in the US. The Constitution hasn't outlawed censorship, it only bars the government from censoring(err... to some extent). So I would guess the big question is how does German's legal system work, and how does this ruling? apply to non-state actors.

      -Rick

      • Re:Illegal? Or government limitation? (Score:4, Informative)

        by Josef Meixner ( 1020161 ) on Wednesday October 03, 2007 @01:22PM (#20839793) Homepage

        It is a bit complicated. In principle the law states you are not allowed to store privacy related data without a clear cause. Just storing because you can store is not enough. Every citizen has the right to ask what data you store about him and can even ask you to delete it. Failure to do so can result in a law suite and if you store information you don't need for the agreed upon cause you will loose. That has happened to the Ministry of Justice. As German law is not based on precedent it doesn't mean anything for anybody else directly. But it can mean, you are next on the list and will face a similar law suite.

        One of the problems is, I don't see, how the IP address is a privacy related data, as a normal webmaster will not be able to connect an IP of an anonymous user with the users identity. This also is only the lowest instance of the court system, but the Ministry has not appealed (for whatever reasons).

        I am personally undecided about it, in principle it is correct, why does a website I once visit have to store my IP forever? Also the next target of the group which started the Ministry of Justice case is now going after the BKA (federal police), they put up an information page about an extremist group not much is known about called mg (for "militante gruppe"). Everyone who visits that page is logged and they try to connect your IP with the data they have to identify you. It seems they try to somehow find the "terrorists" that way. Don't laugh, they seem to actually believe that could work.

        • Re: (Score:3, Informative)

          by vidarh ( 309115 )
          In principle the law states you are not allowed to store privacy related data without a clear cause. Just storing because you can store is not enough. Every citizen has the right to ask what data you store about him and can even ask you to delete it. Failure to do so can result in a law suite and if you store information you don't need for the agreed upon cause you will loose.

          And for those who don't know: This is the case in all EU (and EEA) countries. It is a result of the implementation of the EU Data

        • Hmmm....I'm not sure I agree that "in principle it [the ruling prohibiting the storage of IP addresses] is correct." As a web server administrator, both professionally and at home as a hobby, I have used the logging function on my web server (and e-mail server) to either file complaints with the ISP that owns the IP address used by someone who was behaving poorly on my server or to filter IP addresses used by those who behave poorly. In my logs, I have seen people trying to run exploitable PHP s

      • Re: (Score:2)

        by tmk ( 712144 )

        It sounds like the ruling states that the government can not retain IP info.
        The law is the same for the government as for everyone else.

        The bis question is: are IP adresses personal data? The court confirmed this as a fact, but The Federal Ministry and even the Bureaus for data protection have a different opinion.

        If the Federal Ministry is not allowed to log IP adresses, nobody in Germany is.

        • Re: (Score:2)

          by RingDev ( 879105 )
          Ahh, thanks for the clarification. If I am understanding you correctly, the ruling, specifically applied to the ministry, was stating that IP's were covered under the existing law. So the ruling did not ban anything, it just clarified was what included in the existing ban.

          -Rick
  • The local court also opposed the view espoused by operators and some data privacy watchdogs that security reasons justify a recording regime that over short periods of time maps the behavior of all Net users and allows individual users to be picked out. Are these the same security groups and watchdogs that shout "We want TOR... We want TOR" ... Funny thing is, they can use TOR which pseudo-anonymizes their identities, then cry foul... Mapping IP addresses means nothing when it comes to tracking users:

    xxx

    • Re: (Score:2)

      by emj ( 15659 )
      Lets say you log all connections done in bittorent and then match them against the people logging in on your government site looking for jobs.
      • Irrelevant... Unless you have a static address there is no way to differentiate who was behind that address. Even WITH a static address there is nothing to say it was you behind a machine
        • Not just address. You get things like browser id, accept formats, OS, and a bunch of other stuff that, taken together, is pretty unique to the system. It could be simple things such as email traffic, or those 5 tabs that auto-load all at once whenever you start your browser.

          If you are not a super-secretive computer freak, then just by looking at your TCPIP traffic in toto I can tell exactly who you are. And even if you are a paranoid privacy nut, I still can tell who you are based on how you are probably th

        • Re: (Score:2)

          by Bert64 ( 520050 )
          Even with a dynamic address, you can track it to a particular customer of the ISP...
          Most ISP user agreements hold the customer liable if they let someone else use their connection, willingly or not.

  • Conflict with logging laws? (Score:5, Insightful)

    by SmallFurryCreature ( 593017 ) on Wednesday October 03, 2007 @10:15AM (#20836727) Journal

    There has been a movement to INCREASE the amount of logging going and to force ISP's to maintain detailed records for long periods of their users actions. That is WAY more intrusive then a website logging your ip. You do NOT have to go to a website, you are bound to use an ISP.

    Before all the privacy loonies wake up, remember that it is perfectly normal for ALL your phone calls to be logged and it is standard practive for the police to check them, with court order, if they suspect something.

    The most common example of this is a bomb threath. The police will have a record of where the call was made from.

    This ruling makes this impossible to do the same with a bomb threath send over the internet. Wouldn't this ruling make even the most basic web policing, the blocking of ip adresses, impossible?

    This seems like an overly broad ruling that leaves a lot of web admins in trouble because they can no longer effectively manage their servers.

    Yes it is a nice counter to the european wide move to log EVERYTHING but there is such a thing as balance. Logging everything is wrong, but not being able to log anything can lead to just as much trouble.

    For all the slashdot privacy nutters I ask you this. How often have you sniggered when some scumbag was traced by online activists and had his private information published on slashdot?

    • Before all the privacy loonies wake up, remember that it is perfectly normal for ALL your phone calls to be logged and it is standard practive for the police to check them, with court order, if they suspect something.

      Do you do your banking by phone? How about your shopping? Do you search for answers about private medical conditions by phone? Are your sexual preferences revealed by your phone record? Are your sexual curiosities? How about your political leanings and affiliations?

      I'm sure you can answer

      • Re: (Score:2)

        by sploxx ( 622853 )
        Well, I think you gave the reasons why it is so much more important to stop the "Vorratsdatenspeicherung" (data retention).

        This ruling won't stop all hosts from logging your data (the evil and foreign servers will do that anyway and won't tell anyone), and only looks like a 'privacy wins' case which can be given to the media to produce the appearence that there is progress in privacy issues in germany.

        Without the mapping of IP address to a particular user, which only the ISP can do and which is -in most cas

    • Re: (Score:2)

      by mxs ( 42717 )
      To sum up ... Will somebody PLEASE think of the children ? :P

      An argument can be made that IP addresses you use during surfing are data that can be tied to you personally, and as such fall under the strict privacy laws we have here. Don't like it ? Change the law, or work within it. (of course next to nobody actually cares about that law -- the logging you refer to at the ISP level is just as illegal, but has nonetheless been happening for years. DTAG, the biggest German ISP, logs customer IP addresses in vi

  • Freedom? or Anarchy? (Score:3, Insightful)

    by El Lobo ( 994537 ) on Wednesday October 03, 2007 @10:19AM (#20836787)
    People seem to cheer everytime a law helps "liberty" on the web. But is it really liberty they are promoting? Or is it anarchy? I have sympathy for those who think that not keeping the logs is good , and not having a log at all is better. I don't like either that somebody will missuse MY data (whatever that is) in this way. BUT, does it work in the real world?

    What if some users are uploading/downlöoading child pornography or other illegal material? How do I track down the motherfucker? Yes, some people will say, let everyone do whatever they want... But no, laws are laws and log files are an effective (yet, imperfect) way of keeping things in order, at a minimum. Is like having a law that says that all door locks are ilegal...

    • But is it really liberty they are promoting? Or is it anarchy?

      I dunno. Maybe because the last German leader who kept telling them to follow his will or suffer anarchy turned out to be a big douche. Some of them are old enough to remember what it was like to have no privacy (especially the East Germans).
  • I am not proficient at German but I think "Wir speichern nicht" means "We save not" or we don't save.
    Corrections?
    • No no no. It means "We don't speak." It was obviously said by a group of mutes.
      • That would be "Wir sprechen nicht"....

        * the reason for this comment is that I actually read it as such initially
        and thought that not speaking about something may not be the best way of
        advocating anything, as for "Wir speichern nicht" wouldn't the closest
        translation be we don't store? Although without specifying what.. - By the way did I
        miss a joke?
    • You're correct: "We don't save." "Speichern" is the verb German computer games use when you want to "save the game."

      (OT: Many translations "overdo" what is contained in the original statement. "L'etat, c'est moi" is usually translated as "I am the state", but it should really be "The state, it's me." That would carry over Louis XIV's, and the French's acceptance of, sentence fragments and the use of the accusative with "to be". Of course, he didn't actually say that, or believe it, but whatever.)

  • Enforcement (Score:2, Interesting)

    by bostons1337 ( 1025584 )
    It doesn't sound like this is an easy law to enforce. I mean how are you going to know if someone is logging ips on their site by seeing what the server variables are set to? But then again you can always use another tool that doesn't show up so easily. This whole thing just sounds to hard to enforce to the point where it would be effective to have the law. Its not like enforcing a parking ban or anything.

    • Re: (Score:2)

      by fbjon ( 692006 )
      That's perhaps not the point. The law can be enforced when needed, for example if it surfaces during an investigation for some other issue.

  • Knock Knock (Score:5, Funny)

    by SuperCharlie ( 1068072 ) on Wednesday October 03, 2007 @10:25AM (#20836887)
    Who's there?

    Denial Of Service Attack

    Denial Of Service Attack Who?

    We dont know.. we dont log that stuff..

    • Re: (Score:2)

      by mxs ( 42717 )
      Funny, if only it were true. The law forbids the general collection of all traffic data without due cause. It does not forbid personally identifiable logging on a case-by-case basis to resolve problems and issues.

  • Banlists are now illegal? (Score:3, Insightful)

    by siDDis ( 961791 ) on Wednesday October 03, 2007 @10:30AM (#20836953)
    As I understand this law is that my private server in Germany is now open for brute force attackers because I can't ban their ip address after 3 login failures? Heck I can't even break that law since everyone can easily tell that I'm using a ban list and just call the police.

    I think someone in the German government should google brute force attacks and why ban lists are good.
    • No, but you can claim that you arbitrarily disallow the access of your resources. That's allowed. It just happens to be your IP address. Or the feds'.

    • Re: (Score:2)

      by Ajehals ( 947354 )
      If your private server hosts the Federal Ministry of Justice website and is holding data beyond legal retention limits then yeah you may have an issue. Personally the servers I have sat in Germany will continue to use IP addresses where necessary and for everything else I will continue to use anonymised data, (i.e. for trend analysis) that way I shouldn't breach either German, UK or EU privacy laws.

    • Hash the addresses.

      unsigned int randomness[5][256] = { Random Numbers };
      unsigned int salt = rand() & 0xFF;
      unsigned int hash = randomness[0][ip[0]] ^ randomness[1][ip[1] ^ randomness[2][ip[2]] ^ randomness[3][ip[3]] ^ randomness[4][salt];

      Now "hash" contains a value derived from the address, but the address cannot be recovered from the value. If you're concerned about collisions, use 64-bit quantities.

      The salt is probably not necessary.

    • I have another concern about banlists. What if I'm running a site, and I have to ban "Imma Troll" for being an @$$? I don't really give a damn who Imma is IRL, but I DO care if "Imma Nice Guy Honest", who registered 5 minutes after I banned the Troll, happens to have the same IP as the banned Troll.
  • are NOT belong to us

  • This isn't going to last (Score:3, Insightful)

    by Cleon ( 471197 ) <cleon42 AT yahoo DOT com> on Wednesday October 03, 2007 @10:36AM (#20837023) Homepage
    I really doubt this is going to last, and nobody outside of Germany is going to take it seriously. Too many servers log IP addresses, if nothing else just because IIS and Apache do that by default.

    Then there is the issue of competing laws. In the US, for example, federal encryption laws require IP addresses to be logged when certain pieces of software are downloaded.

    • Re: (Score:3, Insightful)

      by Bert64 ( 520050 )
      US laws don't apply to people living in Germany, despite what a large number of americans seem to believe nowadays.
      Similarly, German laws don't apply elsewhere, so you could simply host your website in another country, but you might have to go to the extent of having a foreign entity actually "owning" the site.
      Hosting in Germany is expensive anyway, many German companies and individuals host their sites elsewhere already.

  • What about TOR? (Score:2, Insightful)

    by Luke Dawson ( 956412 )

    So, you can't store people's IPs on your web server, but if you operate a TOR node, you do? Or only if you are ordered to by a court?

    I think I'm confused.

  • In Deutschland, we do not log IPs.
    • You're just trolling for the obligatory "In Soviet Russia, IPs log you!" post, aren't you? I know your game. Well, I ain't gonna do it ;-)
  • I think some people here got confused with the translation. It is ok to have IP's in theserver logfiles. It is not ok to store/save the logfiles with the IP's for a longer period of time.

    • No, they weren't wrong.

      "Longer period of time" means "longer than absolutely necessary to provide the service". If the visitor's browser closes the HTTP connection, you no longer need the IP address. In effect, this means no logging. netstat is ok, though.

      • Re: (Score:2)

        by Guspaz ( 556486 )
        Except if you run netstat, hey look, that IP is now stored in memory until you clear the console buffer. Wups, can't keep the IP around, better not run netstat anymore.

  • Uh oh (Score:2, Interesting)

    by Acecoolco ( 1012419 )
    My servers are in Germany, but I will continue to log.. I am hosted on Hosteurope which is actually currently under investigation by the FBI for allowing a hole to persist in their infrastructure that allows anyone to get into any server on their network...

    I already know the guy that got into my server lives in Romania, registered the domain name in Canada (Toronto), using a New York Address, with a fake credit card, and the fake business is !located in Sweden...

    So, I will continue to log for security purpo
    • Heh. That chain reminds me of a hacking attempt from a couple of weeks back.
      I saw entries from Bulgarian, American and Swedish IPs. The funny thing was
      the Swedish IP was a possible source/bot controller, and it was hosted in
      the same server farm as mine :)

      Yeah, logging is something I won't stop doing, either. Not logging IPs when
      you run a server is just stupid. I thought Germany was becoming a nanny state
      that wanted full control over their citizens, but now it seems the lawmakers
      are simply clueless, making t
  • If you haven't done so yet, reading and laughing about German politics is a great idea to spend some boring office hours. American Slashdot readers may already know what it's like to have a moron [wikipedia.org] rule your country, but in everything privacy-related Germany's totally unbeatable.

    April 2007. A new law about data retention has just passed the german government[1]. Called "Vorratsdatenspeicherung"[2] it forces communication providers to introduce an identification liability. As an example this means no more a

    • Re: (Score:2)

      by KDR_11k ( 778916 )
      The legislative and the judicative are not the same entity. There's a reason for that. Laws can be struck down by a court if they violate other laws.

    • Re: (Score:2)

      by leenks ( 906881 )

      IP addresses of anyone sending and accessing their E-Mail accounts must be stored and retained for a few months (6 IIRC).

      A german court decides to outlaw storing of IP addresses by web pages.

      So... webmail?

  • There is good and bad to this.

    On the one hand, it is great to see courts telling companies that they can't store every little tidbit of information about you. Too many companies (globally) retain customer credit card numbers, addresses, etc. for longer than is required for the transaction. I just got a letter from my credit card company saying that my card may have been stolen, and they issued me a new card. But they won't tell me how they know. Most likely, one of the gzillion places that retain my CC#

  • heh (Score:3, Interesting)

    by Random832 ( 694525 ) on Wednesday October 03, 2007 @11:13AM (#20837605)
    That "Wir speichern nicht" site makes the argument (or, appears to, based on google translation) that keeping IP addresses for a ban list isn't useful because an IP address isn't necessarily associated with a single person - yet, if you accept that argument, an IP address isn't "personal data" of any kind at all!
    • an IP address isn't useful on it's own, but with a time stamp it could be used to identify at least a users home address. It's still not useful for identifying the person because there pc could be hacked, but try telling that to the police when they come banging on your door asking you about kiddie porn or terrorist activities.

    • Re: (Score:3, Insightful)

      by mxs ( 42717 )
      Your logic is fallacious.

      A single IP address is not necessarily associated with a single person. Correct. A -> B. This does not imply B->A in any way, shape or form.

      The site actually doesn't make that argument, however. It makes the argument that an IP address is not permanently associated with a single person and easily changed for most (most ISPs here assign you a different IP on each login, out of a pool of millions; and most ISPs here do not allow connections to stay connected for longer than 24 h
  • I beg to differ. I have it from a reliable source that the Nazi's didn't log IPs either! The German government is *clearly* evil.

  • Don't mess up with the context. (Score:3, Informative)

    by burni ( 930725 ) on Wednesday October 03, 2007 @11:32AM (#20837963)
    The context is that the http://www.bmj.bund.de/ ( german version of the DOJ )
    started to log ip-addresses of people who had accessed public information dealing with
    a terrorist group called "millitante Gruppe".

    (
    "Militante Gruppe" / ('militant group')

    - german leftist/communist/(anarchist?)
    - anti-global

    terror group

    till now no human causalties were recorded, terrorist actions mostly targeted unmanned police cars, or cars of right winged politicans in the city of Hamburg, using molotow cocktails,

    The BKA ( german version of the FBI ) is investigating the incidents since 2001,
    and they lack in information.
    )

    The information was placed intended to inform the public about the signs of identification the
    group has been used in the past, to engage whistleblowers who may have recognized suspicious things helping the police to identify the persons behind this terrorist group.

    But in contrast the visitors ip's were logged and further investigation was done by the 'BKA',
    this includes identify the persons which accessed the page using their ip addresses,
    with no further evidence such as visiting a governmental public information site,
    such actions probably are illegal.

    From the judgement were some non-offical guidancelines derived,
    I will try to translate them as properly as I can.

    The judgement deals not with IPs in detail, there is a term
    "Internet-Nutzungsdaten" this can also be a profile of use,
    and the german privacy laws try to protect the people from
    being tracked, and so profiled.

    GER Leits&#228;tze (nicht amtlich):
    ENG guidancelines ( non offical ):

    a.)
    GER Anbieter von Telemedien im Internet d&#252;rfen nicht systematisch die Kennungen (IP-Adressen) GER der Nutzer ihrer Dienste protokollieren.

    ENG Provider of internet content and service shall not log signs of identification (ip-addresses)
    ENG of users systematically.

    b.)
    GER Zur Entscheidung von Streitigkeiten &#252;ber die Verarbeitung von Internet-Nutzungsdaten durch GER eine &#246;ffentliche Stelle ist die ordentliche Gerichtsbarkeit berufen.

    ENG Anytime an offical judge must decide in disputes concerning the processing of
    ENG  ?InternetUserProfilingData? through a governmental organisation

    c.)
    GER Kann zwar nicht die speichernde Stelle, aber ein Dritter eine Angabe der Person des
    GER Betroffenen zuordnen, so ist das Datum personenbezogen.

    ENG If the Content Provider (logger) is not able to resolve the person of interest through the IP
    ENG but a third person (ISP) is able to do so, the date is also to be recognized as personal data

    NONTRANSLATIONJUSTMYSAYING  .. and so shall not be logged at all.

    GER Die von einem Internet-Zugangsanbieter tempor&#228;r zugewiesene Internetkennung (dynamische IP-GER Adresse) stellt nicht nur f&#252;r den Internet-Zugangsanbieter, sondern auch f&#252;r Anbieter von GER Telemedien im Internet ein personenbezogenes Datum dar.

    ENG The dynamic IP address assigned by the ISP, is to be treated as personal data,
    ENG for both the ISP and the content provider,

    ????? it can be seen as a personalised private date/datum.

    From my point of view - I'm not a lawyer - but I understand a.) as if you recognize
    missuse you are allowed to log the data of the missusing parties,
    it's just not allowed to log and store every access over the
    period of use ('.. d&#252;rfen nicht systematisch ..')

  • like tracking someone who is trying to attach or hack your server, or DOS attacks. I don't see a problem with IP Address logging. I think it is necessary these days. If you want privacy, stay home.

  • No legal consequences for others... yet (Score:3, Interesting)

    by r3f4rd30n ( 1030822 ) on Wednesday October 03, 2007 @12:20PM (#20838787)
    It has to be noted that this decision does not necessariliy affect anyone apart from the parties involved in that particular case. German courts are not bound to decisions other courts made; there is no such thing as 'case law' in the german legal system. I'm pretty confident that 'regular' logging will continue to be alright; the analysis of user behavior is the critical fact here, at least that's how I read it. Still, every single law concerning the internet seems to be utter nonsense as of late; however, since noone in the government seems to understand how that whole computer-thingy works, that's hardly surprising. And on a sidenote: The Grundgesetz (*) states in article ten that "The privacy of correspondance, posts, and telecommunication shall be unviolable" - so far so good, however that does only affect the relationship between people and the state, not purely private relationships. I'm in law school, and I recently learned that the "Article 10 is not that important anymore since the Dt. Post and Dt. Telekom became private corperations and are not directly controlled by the state anymore." * http://www.bundestag.de/htdocs_e/parliament/function/legal/germanbasiclaw.pdf [bundestag.de]

    • Re: (Score:2)

      by mxs ( 42717 )
      You recently learned wrong, however. It doesn't matter whether DTAG or Deutsche Post are private enterprises or not; article 10 still applies. Without a law allowing it or a corresponding court order, government officials still cannot go to the Post, open your letters and read them. Article 10 still prevents them from doing that. The German state remains a substantial shareholder in both DTAG and Post, as well. Also, even the private enterprise Deutche Post (and its competitors) are bound by the Postgesetz
  • Torrentspy, welcome to your new home!
  • This is just the latest event in a long series of Germany's attempts to completely regulate any internet activity whatsoever. Germany, which is already not exactly the epicenter of CS innovation, is pushing itself further and further away from reality and relevance. This is following the decades-old scheme of legislating their citizens into submission by what you could call an eloborate undertaking to ensure that nobody can actually live a life that is fully in compliance with the myriad of provisions and l
  • Then the MPAA wouldn't be able to force them to turn on logging and capture the information (unless they are able to force changes in German privacy law that is)
  • This is the first time I've been angry at the Slashdot editors (so I'm kind of a newbie). The title of this article is not only misleading but a bald lie. A federal court barred its own ministry from violating your privacy.

    As an example of what other laws have to be followed by the government, but not by its citizens, look no further than website accessibility. Have you ever been told that your blog (or even your online shop) was violating the law because its horrendous HTML+Javascript doesn't even show up

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Close