DOJ Seeks Mandatory Data Retention For ISPs

Hugh Pickens writes "Computerworld reports that in testimony before Congress the US Department of Justice renewed its call for legislation mandating Internet Service Providers (ISP) retain customer usage data for up to two years because law enforcement authorities are coming up empty-handed in their efforts to go after online predators and other criminals because of the unavailability of data relating to their online activities. 'There is no doubt among public safety officials that the gaps between providers' retention policies and law enforcement agencies' needs, can be extremely harmful to the agencies' investigations,' says Jason Weinstein, deputy assistant attorney general at the Justice Department, adding that data retention is crucial to fighting Internet crimes (PDF), especially online child pornography. Weinstein admits that a data retention policy raises valid privacy concerns however, saying such concerns need to be addressed and balanced against the need for law enforcement to have access to the data. 'Denying law enforcement that evidence prevents law enforcement from identifying those who victimize others online,' concludes Weinstein." Think about how much evidence is denied to law enforcement by envelopes, opaque concrete, and criminals' failure to shout.

Another unfunded mandate

[snobody]

So, now ISPs all have to buy terabytes of hard disk space to store all of those log files just in case some nosy prosecutor comes a callin'? ISPs might be better off threatening to just shut down operations and leave their customers disconnected to get the point across to the lawyers in congress that they need to consult with the people they're trying to regulate before throwing impractical solutions at them.

OK. You can record me if I can record you.

[h00manist]

If records of my activities are recorded and available for investigation, and I have equal rights, those of all people should be too. Given that home users are directly linked to an ISP and all their activities can be directly monitored with a very high likelyhood of locating and monitoring the proper suspect in an investigation, they are at a distinct disadvantage when compared to others who can mix their activities with many other users in a large office or government division by hiding behind a corporate firewall, who can then respond to investigators with strong legal and technical protections as well. So all government offices and corporations should have their records kept by third parties as well, installed on equipment directly linked to their switches within their environments, and revealed to the public under FOIA and/or judicial order. In fact, for certain positions requiring high public confidence, such as public representatives, publicly traded companies, or groups managing public resources, connection of their own computers and that of their staff should be monitored and records kept for possible future breach of public trust investigations.

Re:Another unfunded mandate

[Anonymous Coward]

As an unfunded mandate it would effectively be a stealth tax. Either the firm eats the cost and lowers returns or they raise prices. No matter what the firm does someone will pay (either investors or customers). I doubt the politicians will support an effective tax increase in the current environment, especially given that it would not help with the deficit.

Yes, let's collect evidence of crime at all levels

[h00manist]

The public has a right to have evidence of crime collected and available for investigation in Washington.

Re:Warrant?

[characterZer0]

I have a problem with it. The want to demand that my ISP increases their costs (which naturally will be passed on to me) to store data to be used against me, despite that I have done nothing illegal. And it will do nothing to catch criminals, because they can just pass all their data through an encrypted tunnel to a VPN provider in another country. Waste of my money.

Re:Warrant?

[Anonymous Coward]

I think as long as they have strict rules for the burden of evidence for a warrant to see these records, I wouldn't be opposed to it. I don't think that police should have free range over all of this data though. I think this data should be used to help convict people, not discover them in the first place.

Do you honestly think law enforcement would use that kind of restraint? I know that some prosecutor, looking to build his political career (think gubernatorial "law and order" candidate ), will troll the logs after getting them for some vague "tracking down a 'predator'" reason and he'll be looking at anything and everything.

Oh, read an article about pot. Gotta look at him closer!

Ooooooo! This guy looked at "teen porn"! Let's see if any of that "teen" porn went below 18....

And this guy looking up guns that have magazines larger than the state law allows, let's have a look around his house.

And THIS guy is buying Halide lights supposedly for his reef tank. I wonder if his reef tank is really a reefer garden in his basement.

It goes on. It has happened. Whenever law enforcement gets powers or gadgets (infrared cameras for example) they'll abuse it. And if they find nothing, Oh well! Move along citizen or "you'll be in BIG trouble!"

The good old "child porn" excuse

[dkleinsc]

especially online child pornography

There are 3 targets for every government intrusion on civil liberties:
1. Terrorists
2. Child porn
3. Drugs

The law enforcement agencies have determined that those are the issues that can be used to push absolutely anything through. For instance, trying to catch terrorists allows them to grope everybody with absolutely no suspicion of wrongdoing. Drugs allow them to break down your door at 2 AM, guns drawn, without identifying themselves as the government, and in some cases killing people. And of course child porn and terrorism allows them to watch absolutely everything you do online. That these are plainly illegal doesn't matter, because anybody who disagrees with them must be a terrorist, child pornographer, or junkie.

That doesn't mean those threats don't exist, but if they were serious about addressing the real risks around us they'd be focused on more mundane issues like traffic violations.

Requiring warrants are not a guarantee of anything

[h00manist]

Requiring warrants doesn't make conditions equal. Once data exists, it leaks, via legal, semi-legal, and extra-legal routes. There's no denying it happens. So if data exists on the public, data should exist on the officials. More so perhaps, as their positions require us to trust them for our basic rights to exist, but they don't need to trust us for their rights to exist. Records on citizens are usually used to prosecute criminals and/or abuse citizens rights. Records on public officials can be manipulated and forged to fake legitimacy. It'll be rare to have it leaked or released for evidence of abusive behavior. So the balance of power the records will supply has to be equalized somehow.

Re:OK. You can record me if I can record you.

[dkleinsc]

See, you don't understand the rules right now. In the post-9/11 world, you have to remember that any attempt by the government to record you is justified until the crisis is over because it is needed to defend your freedom, and any attempt of you to record the government is serious espionage that will result in being locked up for months in solitary confinement without trial [wikipedia.org] until you turn on somebody else that the government wants to prosecute but doesn't have any evidence on.

Now, please show us your papers.

Re:Another unfunded mandate

[stonewallred]

How about passing a law that states no one may sweep, mop, dust or clean any building because of possible evidence? And don't forget to make it illegal to wash or destroy any clothing because it may contain evidence to a possible crime. Not to be an ass, but catch them in the act, catch them through stings or give the fuck up. Ain't no business of the government what I am looking at on line, and the fact they want to hold those records, forcing the ISPs to pay for it (which in turn forces me to pay for it) is fucking retarded just like GWB and Obama's love child would be.

publicly traded companies?

[tacokill]

You do realize that publicly traded companies aren't "public" like the government, right?

Despite the misnomer, publicly traded companies are still private entities owned by individuals (or groups of individuals). What the heck gives you the right to see ANYTHING they are doing, aside from normal regulatory compliance?

Re:Warrant?

[Anonymous Coward]

That would never happen here in the US!

(In the US, the family would have been forced to watch as the police killed the guina-pig (because it tried to bite one of the officers), and then been forced to stand outside in the cold while the police tore the house apart looking for anything illegal. And when it was all over, there would definitely not have been any apology, and the family would be left needing a new door.)

Re:The good old "child porn" excuse

[inthealpine]

You may have a point. I always found it interesting how the government flips shit about child porn pictures, yet we hear very little of actually catching the people who make the child pornography. I mean, how many people have the feds arrested for having child pornography where the result of that arrest ended with the subject child being rescued from whomever was taking the pictures? It's not like I feel bad for the scum bags being arrested, but if we are doing this ''for the children'', are we actually directly saving any children?

Stop "Cooperating" With Law Enforcement

[chill]

Provide the information they seek ONLY when they provide a valid warrant. ISPs should not "informally" cooperate with law enforcement. If there is reasonable suspicion of a crime, the law enforcement agency should be able to convince a judge of that and obtain a warrant. Checks and balances.

Wow ....

[gstoddart]

So, we should monitor everybody so that if in the future we need to monitor a specific person, we'll already have the data. Brilliant!

Welcome to the surveillance society. Wouldn't this run afoul of the whole "unreasonable search and seizure"? Hell, keep everybody's web history long enough and you'll likely find something you could use against them.

I completely disagree that ISPs should just track everything in case law-enforcement wants it at some point. It's a little Orwellian, and I fear that it is only going to get worse -- in their zeal, governments are really going overboard. This is just depressing.

Re:Warrant?

[commodore6502]

>>>Move along citizen or "you'll be in BIG trouble!"

Just because a cop orders you to do something, does not mean you have to comply:

"Open your trunk!"
No.
"Let us in your house!"
No.
"Stop camcording me!"
No.
"Let me search your bags and stick my hand on your breast!"
No.

Learn to say no to unconstitutional orders from the jackbooted officers. And if the cops lose control and beat you, well you just won a multi-million dollar lottery. Celebrate.

Re:Requiring warrants are not a guarantee of anyth

[Anonymous Coward]

It's not going to be just the police. If the data is there it will be available to civil suits. Things like showing your ex-spouse visits porn sites and is clearly not a suitable parent.

Re:Wow ....

[gstoddart]

All they're asking for is for ISPs to retain DHCP logs longer.

For now. But this snippet from the linked PDF is kind of scary:

Federal law permits the government only to request that providers preserve particular records relevant to a particular case while investigators work on getting the proper court order, subpoena, or search warrant to obtain those records.

This approach has had its limitations.

Basically, "we find it inconvenient that by law we're only allowed to ask for specific information based on an on-going investigation, we would like some blanket powers so we don't need to bother with this".

Hell, in my book, anybody who is quoting Alberto Gonzales is not to be trusted ... Gonzales routinely made awful decisions like "it's legal because we say so" and "who needs habeus corpus?". From the PDF again ... "Former Attorney General Gonzales similarly testified about “investigations where the evidence is no longer available because there's no requirement to retain the data.”"

Looking at this section:

In some ways, the problem of investigations being stymied by a lack of data retention is growing worse. One mid-size cell phone company does not retain any records, and others are moving in that direction. A cable Internet provider does not keep track of the Internet protocol addresses it assigns to customers, at all. Another keeps them for only seven days—often, citizens don’t even bring an Internet crime to law enforcement’s attention that quickly. These practices thwart law enforcement’s ability to protect the public. When investigators need records to investigate a drug dealer’s communications, or to investigate a harassing phone call, records are simply unavailable.

they're pulling out pretty much all of the bogey-men to say "we need to be able to monitor everything just in case". They cite child abuse, drugs, terrorism ... harassing calls. While these are legitimate law enforcement targets, it's definitely stating the case that they'd really like to be able to monitor everything.

Hell, even the wording they use is charged "Most responsible providers are already collecting the data that is most relevant to criminal and national security-related investigations." ... meaning those who aren't actively helping the government monitor everything are irresponsible and therefore evil.

This just sets them up for way too many fishing trips as far as I'm concerned. You can't just simply apply surveillance and monitoring against an entire society "just in case". This is just plain bad, and it's more like something Iran or Stalinist Russia would do.

How about law enforcement prioritization?

[swb]

My sense is that the "need" for ISPs to do their work for them indicates that law enforcement could better utilize their limited resources.

Maybe spend fewer resources on enforcing, say, drug laws, marijuana specifically, and more time and resources on other crimes that actually hurt people?

And I don't necessarily mean physical crimes (assault, murder) -- how about simple burglary or breaking and entering?

A neighbor's house got broken into; the daughter's laptop was stolen and the window to her room was damaged beyond repair. She needed a laptop for school and, obviously, the window needed replacement. So they're out $3k they don't necessarily have and/or she falls behind in school or they can't close the window to her room, none of which are very palatable choices, especially in a Minnesota winter.

Yet, when they called the cops they got two nice guys who gave them a case number and took the laptop S/N "on the very slim chance it turns up."

So, basically there's no resources to do extra patrols or extra investigators but plenty of guys to take down pot dealers. Yay.

Re:Another unfunded mandate

[Anonymous Coward]

You seem to be laboring under the delusion that politicians' support depends on the economic effects of a proposed measure, rather than on popular perception.

Most people will see this as "Yay, gonna get them child pronoguffers now!" and completely ignore the economic effects, so politicians will either stand for it, or use such excuses as "keepin' tha gubbermint out of your damn bizness" to oppose it. Nobody will talk about the economic impact, because most voters don't want to hear about it.

Mandatory data retention for bars and restaurants

[Animats]

We need mandatory data retention for bars and restaurants. Bars and restaurants should be required to retain audio and video surveillance data for six months, in case it's needed by law enforcement.

Implementation should begin with Washington, D.C., to retain evidence of political corruption.