Slashdot Mirror
EU Still Looking at Mandatory Data Retention
An anonymous reader writes "Following up on a
previous Slashdot article,
European civil rights advocacy group
Statewatch
is detecting more rumbles of a possible
weakening of privacy rights in the EU. The
European council has been testing the waters
for a new policy mandating retention of
communications "traffic data" by all member states. The previous policy (adopted May 30) merely allowed an exception to EU privacy law for member states who wished to retain such data.
Under the leaked draft proposal, law enforcement is to be allowed access to "traffic data" (identifying source, destination, time, etc.), which is similar to current US law. However, much worse is the requirement that telco providers retain such data for 12-24 months.
Text of the
draft framework decision
is available.
Also
analysis
by Statewatch.
Backup link (in case of Slashdot effect)."
I suspect that the US and UK and other governments spy agencies already have access to whatever electronic communications they want to tap.
This is the case in the UK with regard to phones, however phone tap data is never used in court here because the state might then have to admit how they got it -- they would rather not convict people then admit their sources and the extent of the eve dropping that is going on.
I suspect that draft proposals like this are based on the old trick -- suggest something totally over the top and impossible to implement then let well meaning people water it down, claim that government cares and listens and at the end of the day still get away with yet another outrageous new law and yet more erosion of privacy and civil liberties.
But then again I'm probably not cynical enough, it's probably far worse than I can imagine already...
Check out MKDoc a mod_perl CMS
I know our benevolant, wise, and responsible US Federal Government would never enact such blantant acts of controll over its freedom-loving, tuned in, and watchful citizens. Oh, wait... /me packs his things and heads for Antarctica
This is exactly the information used by drug cartels to assassinate informants, as described in a previous Slashdot article.
If the information is being kept, unauthorized access will occur.
SKG
Just a minute /.
Flips on atari 800xl
pick up microphone and speak into it
"Computer, find me information on Anonymous Coward"
1030 (300 baud) modem dials out
short wait
Faster than you can read, the following appears, often in higher resolution than the computer can drive)
you got a C in gym class in 4th grade
Video of your at the office christmas party
Your rejection letter from MIT
(censered) communication from your bed last night, taken from microphone in your light
copy of your bare butt on the office copier
complete shower videos from 9th grade gym
Complete history of your postings to
At least that is how it would be in the movies.
Such a priori retention of data and access to this data constitutes an interference in the private life of the individual; however, such an interference does not violate the international rules applicable with regard to the right to privacy and the handling of personal data contained, in particular, in the European Convention on the Protection of Human Rights of 4 November 1950, the Convention of the Council of Europe no.108 on the protection of persons in respect of the automated handling of personal data of 28 January 1981, and the Directives 95/46/ce and 97/66/CE, where it is provided for by law and where it is necessary, in a democratic society, for the prosecution of criminal offences.
They admit it's a compromise of individual privacy rights, but say it's allowed under those conventions. I was just looking for the spots in those documents:
that allow mandatory storage of information in the absence of ongoing criminal investigation -- a priori.
The 1950 one includes a very general passage seeming to allow anything "preventive" if it might abridge the rights or freedoms of others. Doesn't make me feel safe. (Hey, someone might want to prevent me using my TiVo in naughty ways. That'd abridge Jack Valenti's right -- or is it a freedom? -- to rake in money.)
The 1981 thing's much more specific to the question, and opens up a world of hurt we could inflict on our various surveillance agencies:
Imagine the /. effect as we all demand access to the records being kept of all our packet traffic, all our phone calls... Hey, people ask for their credit reports. If the European agreement says it has to be "transparent" in this way, just start asking.
"Fundamentalism" isn't about divine morality. It's about human authority.
I think this would definately tempt me to put any websites I run onto https and leave http with a simple redirector. Be nice if other people would do the same. I wonder how much they'd enjoy trawling through a few terrabytes of session encrypted traffic...
Seriously though, the sheer data management problem this would pose would be extraordinary. For every 1mbps, you're talking ~4TB of traffic per year! Consider how much traffic there actually is going across the wires:
Just for the hell of it, 9,776.16TB is 48,881 200GB drives. Now, you can buy one of those from Western Digital for ~$400US (retail). You'd be buying a lot of drives, so lets say you get a discount, and can get one for $300 (I don't know how big a discount you'd really get). That's almost $15 million dollars in hard drives per year for an OC48. That's about three times as much as the actual cost of an OC48 (even worse for peering arrangements).
Of course, scale that kind of hard drive usage up across Europe, and I don't think there is the manafacturing capacity to supply that kind of demand. Oh well, I guess we've found holographic storage's killer app, eh?
Also, who records what? Does every router have to record everythign that passes through it? Or only the ISPs that serve end users? What about businesses? What about co-located servers? If you don't want to miss anything, you'll have to cover all of those, and end up grabbing 2-3x as much data as you really have to. Otherwise it'd be trivial to setup a colocated server at a company or a hosting provider, and tunnel an encrypted connection through to that.
On top of that, there's the problem of how you sift through ~10,000TB of data for something useful. We're talking raw data on a totally unmanageable scale.
Why not just record all voice communications too? I'm sure that'd be invaluable in any police investigations. Ah well, nothing to worry about since neither's going to happen. Both are totally infeasable.