Slashdot Mirror

This proposal is already on the table in the EU. You can find more information about it at European Digital Rights.

In the EU the proposal is to retain telephony data for a period of 6 to 48 months. Discussion is still on whether this includes unsuccesful calls and location data during the call.

Furthermore there is discussion on which data to retain with regards to Internet. There are some wishlists around, which generally seem to entail email traffic logs, radius logs, and quite often wo sent whom or received from whom anything at an IP-level and to which TCP port. The most outrageous proposal is from Lithuania, which also wants all the geographical locations of all intermediate routers. For all recent documents on this go to this European Union site The lithuanian proposal is there as well http://register.consilium.eu.int/pdf/en/05/st08/st 08004.en05.pdf
Interesting is that there is no data in the EU on whether or not this data is useful to law enforcement. For instance, what is the value of knowing all IP-level connections and their port numbers in a world of DNS, spyware, peer2peer technology and dynamic port numbers. Word is that in The Netherlands research is being done on this and that it will be sent to their parliament in the coming months.
The European Parliament has been very critical, but is of no influence, since it is not a party in this. The member states can decide amongst themselves. Funny is that France and Denmark already have data retention laws, but cannot put them into effect, since they have no clue on what to retain for the internet.

Can't we have a groklaw like site on these kinds of proposals? Collaborative burning of these kinds of proposals?

This proposal is already on the table in the EU. You can find more information about it at European Digital Rights.

In the EU the proposal is to retain telephony data for a period of 6 to 48 months. Discussion is still on whether this includes unsuccesful calls and location data during the call.

Furthermore there is discussion on which data to retain with regards to Internet. There are some wishlists around, which generally seem to entail email traffic logs, radius logs, and quite often wo sent whom or received from whom anything at an IP-level and to which TCP port. The most outrageous proposal is from Lithuania, which also wants all the geographical locations of all intermediate routers. For all recent documents on this go to this European Union site The lithuanian proposal is there as well http://register.consilium.eu.int/pdf/en/05/st08/st 08004.en05.pdf
Interesting is that there is no data in the EU on whether or not this data is useful to law enforcement. For instance, what is the value of knowing all IP-level connections and their port numbers in a world of DNS, spyware, peer2peer technology and dynamic port numbers. Word is that in The Netherlands research is being done on this and that it will be sent to their parliament in the coming months.
The European Parliament has been very critical, but is of no influence, since it is not a party in this. The member states can decide amongst themselves. Funny is that France and Denmark already have data retention laws, but cannot put them into effect, since they have no clue on what to retain for the internet.

Can't we have a groklaw like site on these kinds of proposals? Collaborative burning of these kinds of proposals?

Can someone who is informed about these matters please indicate how concerned citizens can help in getting the directive turned back into a B-item?

The FFII are the main source of this kind of information. Consider joining the FFII and subscribing to a mailing list for your European government.

The most important point is convincing people in all areas that more discussion is needed. Read the unilateral statement from Poland regarding the Council text: http://register.consilium.eu.int/pdf/en/04/st16/st 16120-ad02.en04.pdf

Getting replies from even supportive MEP's takes time - but MEP's won't be making this decision.

The people to contact now are MPs and ministers (and heads of party etc.) in your local European government and get them to issue public statements. We have to show that adopting an A-item (i.e., a non-discussion point) on 7 March at the Competition Council is not an option.

The Swedish liberals are asking for a B-item in the Council
http://wiki.ffii.org/Selib0502En.
We need to get a similar request from the Liberal Democrats or possibly even some Labour or Conservative MPs in the UK. If you live outside the UK (but within Europe) other European politicians should also be persuaded to allow discussion on the directive.

This is about the EU Council of Ministers. The story summary has it wrong.

Here's the Link to my post (for more info).

Link 1 - in English

To 'Link 2', there doesn't seem to be a corresponding English-version - from my vauge german skills, but mostly deductive skills - I'd say the document is some sort of addmendment to this org. Link 2 - in English

But maybe someone could translate 'Link 2'? ... it's only 5 (five) lines.

PS. Linux ppl, use Acrobat's reader ... the native PDF readers seem to have trouble with these PDF's...

Link 1 - in English

To 'Link 2', there doesn't seem to be a corresponding English-version - from my vauge german skills, but mostly deductive skills - I'd say the document is some sort of addmendment to this org. Link 2 - in English

But maybe someone could translate 'Link 2'? ... it's only 5 (five) lines.

PS. Linux ppl, use Acrobat's reader ... the native PDF readers seem to have trouble with these PDF's...

Link 1 - in English

To 'Link 2', there doesn't seem to be a corresponding English-version - from my vauge german skills, but mostly deductive skills - I'd say the document is some sort of addmendment to this org. Link 2 - in English

But maybe someone could translate 'Link 2'? ... it's only 5 (five) lines.

PS. Linux ppl, use Acrobat's reader ... the native PDF readers seem to have trouble with these PDF's...

Link 1 - in English

To 'Link 2', there doesn't seem to be a corresponding English-version - from my vauge german skills, but mostly deductive skills - I'd say the document is some sort of addmendment to this org. Link 2 - in English

But maybe someone could translate 'Link 2'? ... it's only 5 (five) lines.

PS. Linux ppl, use Acrobat's reader ... the native PDF readers seem to have trouble with these PDF's...

For the benefit of non-german-speaking Slashdotters, the first addendum to document 11979 can be found here (PDF) and the parent document here (PDF)

For the benefit of non-german-speaking Slashdotters, the first addendum to document 11979 can be found here (PDF) and the parent document here (PDF)

Heise (and Cohn-Bendit) are wrong on this. The delay is due to administrative reasons only ( translations into 20 languages are necessary!)

When I called the Council secretariat a few weeks ago to ask some questions about the procedure, the person responsible for this dossier told me they were just busy doing some final juridical-linguistic checking and then it was good to be approved. It would surprise me if this final formal checking would suddenly take two more months.

Heise (and Cohn-Bendit) are wrong on this. The delay is due to administrative reasons only ( translations into 20 languages are necessary!)

When I called the Council secretariat a few weeks ago to ask some questions about the procedure, the person responsible for this dossier told me they were just busy doing some final juridical-linguistic checking and then it was good to be approved. It would surprise me if this final formal checking would suddenly take two more months.

This proposal relates only to data generated as a consequence of a communication and does not relate to data that is the content of the information communicated.

So the ISP will have to keep log files of the mailserver you send/receive mail through and not the emails themselves. EDRI's statement mentiones traffic data, but some people here have been implying that all communication is subject to data retention...

at the moment the European Union is just as bad, if not worse.

For those who doubt imogthe's words, read this document (Acroread only, sorry) It's a draft decision by the EU council of ministers to require all telecommunications logged, and data stored for a year. Wish I was kidding...

In the netherlands somewhere in the nineties law was developed forcing isp`s to make their networks tappable. The first plan was based on the idea that this would be just as easy as with previously goverment owned telephone compnies wich always cooparated with police investigations. Internet providers howevery are many *many* small buisnesses that operate on much tighter margins and are owned by an entire diffren kind of people. And the goverment wanted to listen in on all of them. This became a big conflict. The conflict even gave rise to a very small group of people that figured that in order to meet these requirements cheaply, scaleable and securely an opensource implementation of the goverment proposed protocols should be made. The site is still alive and contains a world of information on goverment imposed eavesdropping in all sorts of networks. (read the cyberpunks collection of standards and documentation, Or better yet get the more recent docs for free at etsi.org and the osi sites. Goverment acces is developed into standards nowadays which is ofcourse much cheaper then adding it when networks are up and running. This was demonstrated when german celluar phone users where billed for having their phones listened into ;-). This also includes some information on the biometric/rfid passport ideas that politicians think are a great idea becouse... you know terrorist and stuff, let pump millions in this and get on our way kissing babies and doing TV interviews okey?)

Currently, most big providers (I think mostly the ones owned by kpn including XS4ALL???) have machines in their network permanently to sniff traffic when a warrant arrives. This can`t be that hard, people keep saying the netherlands taps more phones then the US but real numbers that are reliable are very hard to come by (dutch link). These machines then tunnel the sniffed traffic to central collection machines. For this the "ITO" is peering with all major isp`s. The dutch internet service provider association has a couple of the sniffing machines provider can borrow if they dont have their own. I havent actually read the current version of these laws but in preivous version webhosters to should sniff traffic when asked to.

Ofcourse noone knows when this network is used, but it is safe to guess that the title of the first internet connection litened in to life by goverment snoops goes to the "hacking at large 2001" event (Lots of tents in a field, big network, lots of visitors and speakers on many topics and a big internet pipe). The then public traffic graph of the ASN of the goverment collection facility spiked really high during the days of that event ;-). I dont recal if it was this event or another one like it where people found out the police claimed to be dealing with "subversive anachist". When people found out about this T-shirts where sold with the text "staatsgevaarlijke anarchist", these where quite populair. OFcourse If this was the event the police was looking at then it would make sense that visitors where called dangerous, there needed to be a reasing for listening in.... what better reason then being anarchist-ish, terrorist-ish or terrorist-ish people releated, with a bit of pirate flavour to finish the mix.

Ofcourse, we can all look ahead at another fantastic episode in this series. Unlike other epic sagas (starwars) these episodes get not only bigger but also better and more exciting every time ;-) You see the European union has been buzzing with the idea of mandating the storage of traffic data of not only telephone providers but also internet providers (and hosters?) for years. But a new proposol for this idea has recently been introduced by Britan, France, Ireland and Sweden... Imagene being forced to store terrabytes of logs on 99.999999

How long before the feds make it a requirement (via some law similiar to PATRTIOT) to keep logs?

If you are in the EU, the answer would be, they started about two years ago. (List with the status of "traffic data retention" laws in european countries) Europenan police forces have been telling politicians for years that they want to see who has been talking to who online. Apparantly they dont see why they can`t, afterall they can with the telephone networks.

So now that a new plan for mandatory traffic data retention for all telecomunication providers (including isp`s, voip providers and perhaps webhosters)is in the works it is importand to make sure where your representitives stand on this issue. Especiallly when you vote for the European Parliament election on june 10.

Imagene that providers where forced to store terrabytes of logs. (with every URL requested + every mail, even small providers must reach terrabytes in a few months, now add p2p,im,usenet). They would have to do so for years at their own expense. They are unlikely to create strong protection to these logs from leaking or worse *altering*. This is ofcourse if a way can even be found to turn millions of individual packets into something meaningfull again (in real-time, reliable, without allowing for people to confuse these systems by adding a few whacky bytes, say weird protocol numbers or port numbers). Ofcourse it is only after traffic has been reconstructed that the traffic data can be separated from the "normal" data. Ofcourse it would be likely that if this ever where to heapon that big providers would pull it of in a somewhat reliable way. small ones might either mess up and be in trouble once a court order arrives or go bankrupt getting systems halfway worthy of collecting evidence. But then these logging systems are not anywhere near reliable enough to end up with data trustworthy enough to be used in court. Do people/judges understand that? or do at least laywers understand this? Not likely for about a year, then people would learn that these systems can be fooled and are beeing fooled by the people they are supposed to target (terrorists, organised crime, political activists). Now providers were forced to pay for systems that are essentially useless becouse everyone knows how to beat them.

The fact this scheme is unfeasible which may sound like a good thing. But imagene what we end up with if all providers where to botch together a cheap and easy system without any security for logging their traffic? You might end up explaining to a judge that logs claiming you have been mailing UBL at hotmail.com are just files that suggest that either at some point traffic with an apparant e-mail containing that addres and some addres somehow associated with a computer or mail addres somewhat related to you flowed through their systems or that someone at your isp has pulled a prank on you and opened the logs and added some entries.

This discusion just brings up *another* interesting argument against these plans: Do we want every cop in the EU (data should be shared under this proposal) to have acces to the e-mailing and browsing contacts of docters, laywers, journalists, politicians and even priests?

We are the Dutch, all your traffic are belong to us

Absolutely right. If anyone would care to read the text of the proposal, (and maybe then you'll stop paniccing about it) A link for the latest version available dated 17-03-2004 Software directive [register.consileum.eu] There is a working document dated last week but not available.

for sake of completeness of information, could someone please post a link to the official position of the Council of the European Union on this issue?

This would allow people to see in detail which parts of the European Parliament's amendments to the Commission proposal's were rejected and on what grounds.