Lycos Germany to No Longer Store IP Data

quaker5567 writes "The Register is carrying the story that Lycos Germany says it will no longer store dynamic IP addresses of its customers. According to the German Tele Services Data Protection and Telecommunications Act, ISPs are only allowed to store communications data for accounting purposes. Apparently, there is no requirement for German ISPs to keep a record of IP addresses. A decision by German ISPs not to keep logs on IP addresses would be extremely controversial as the entertainment industry is increasingly demanding that ISPs disclose the names of suspected file sharers."

Comments

Options

[panxerox]

This has always been an option for ISPs. I can see keeping IP info for a week or so in case there was an incursion but after that the only thing that it could be used for is informing (whether it was coerced or otherwise) on your customers ! As customers we must demand that our ISPs no keep long term IP records. There are plenty of options to connect to the internet and we as consumers must tell our ISPs that we will make this an important part of our bandwidth purchasing decision.

Re:Options

[Gregg Alan]

So what's your opinion of Morgan Stanley being fined over 1 billion for not keeping email around? It seems like the same sort of case, yet the sentiment there was they were probably guilty, so it was ok. With copyright infringement, the sentiment is, the users are probably guilty, but they should be protected anyway.

That's a great point. IMO, the fine is wrong. Here's why: Assuming Morgan Stanley IS guilty of whatever the hell they are accused of doing, keeping records to prove your own guilt is nearly a violation of the 5th amendment. Or, at least, preventing such self-incriminating evidence to come to light could be considered exercising ones right to plead the fifth.

On the other hand, Morgan Stanley is not a person so these rights do not (should not) exist for them so fuck 'em.

In conclusion, my opinion is that ISPs should be required to destroy that data as soon as it's only purpose is to inform against their own customers. I think that because I constantly see advertisements for high speed internet access telling me that I can download music and movies faster that freaking ever. It's almost as if these ISPs are enticing me to download movies and music that I would otherwise not download because I would not have able to because my internet connection would not allow it to be possible. That's close enough to entrapment for me to *form my opinion*.

So, that is my opinion.

Re:Options

[eric76]

So what's your opinion of Morgan Stanley being fined over 1 billion for not keeping email around? It seems like the same sort of case,

Nonsense. There is nothing at all similar about the two.

Morgan Stanley was trashing e-mails, likely so that they could not be used against them in court, at least to some extent. It might be argued that if it weren't for the possibility that they could be used against them, it would be something that might be valuable for them to keep.

There is nothing valuable about the IP data for the ISP after some reasonable period of time. It has a very short shelf life. Neither is there anything in it to use against the ISP. There is no reason to keep it longer than necessary. Any ISP who was concerned about the privacy of their customers would dump it once it was clear they had no need of it.

My ISP doesn't keep the information long term. There is no intention to create problems for anyone. It's just that once the data is no longer necessary, it is dumped.

Just to play devil's advocate....

[Ninwa]

What happens when somebody does something more serious than steal music, are they just going to look the law enforcement trying to get information and shrug? I hope this does not mean that people will feel even more anonymous and get the gull to do things they wouldnt've otherwise.

Re:Just to play devil's advocate....

[ergo98]

Any person with less-than honorable intentions won't do so from the comforts of their own home.

They're going to haul their laptop, equiped with Wi-Fi, to some random unsecured access point on the far side of town and do it there. In a situation like that, logs are almost entirely useless.

And here it is. Of course this explanation would appear, despite the fact that if this was the case then this story wouldn't be an issue at all. All of the file sharers could just grab their laptops and head to a wifi location.

Of course we know that is nonsense - criminals generally are dumb, and the police endlessly bust child-porn rings, as well as find people who communicate with children through IM services, via trusty IP logs and warrants. Even outside of this, though, forcing a criminal to go to a specific wifi point, itself easily identifiable, is vastly more of a lead to go on than "somebody in the state of New York". If you know that somebody sent a serious death threat from Joe's Coffee Shop at 2 in the afternoon, you can connect the dots and build some evidence.

Re:In other news...

[merreborn]

In other news... crackers have obsessively moved to Germany, and signed up for accounts with dynamic IP addresses.

Obsessively? You'd think moving to Germany once would be enough.

I for one...

[PyWiz]

...think this is a good move on the part of ISPs to quit doing the government's dirty work for tracking down criminals. It's not a company's job to keep tabs on their customers for the sole purpose of turning them over to law enforcement.

On the minus side, it is very likely some kind of political backlash will occur and a law will be passed requiring ISPs to keep much more detailed records than they do even now...

Sad state of affairs

[philovivero]

From the article:

A decision by German ISPs not to keep logs on IP addresses would be extremely controversial as the entertainment industry is increasingly demanding that ISPs disclose the names of suspected file sharers.

It is quite a sad state of affairs when a company does something that is popular with the people, and yet there is controversy because another company doesn't want it to be done.

This is the most artificial sense of the word "controversy," because it is completely artificial.

Sad, sad state of affairs.

Re:Sad state of affairs

[slashdot.org]

I personally appreciate the fact that a child-porn sharer, for instance, can easily be, as are regularly, tracked down because ISPs keep logs that can be used to track back from networks

Can we PLEASE for once keep the kiddie porn stuff out of an argument? I'm really getting sick and tired of the 'me too - I'm on the right side of the fence - I'm against kiddie porn' crap.

You know, it's pretty easy to win any argument on the planet by pulling out the child pornography card. If anyone challenges you, all you have to do is say that your challenger supports child pornography.

How about this. We do the following:
- make cars illegal. It has turned out that nearly 99.5% of all kiddie porn is at some point transported by a car, therefore if we make cars illegal we can illiminate child pornography.
- make incandescent light illegal. 99.5% of all kiddie porn is at one time or another observed by incandescent light. If we illegalize incandescent light, that should take care of that problem.
- require the Postal Office to keep a perfect log of every piece of mail that they sent. 99.5% of hard-copy kiddie porn is being handled by good ole USPS, better keep track of that.
- do I need to go on?

Now, everybody point at me and scream 'OOOHHH!!!'.

Entertainment?

[Mensa Babe]

"A decision by German ISPs not to keep logs on IP addresses would be extremely controversial as the entertainment industry is increasingly demanding that ISPs disclose the names of suspected file sharers."

Entertainment industry be damned. What we should worry about is network and systems security, DDoS, botnets, zombies, and of course SPAM and PORN. I hope we will not have to block *.de on our SMTP relays and TCP/IP firewalls like we had with *.cn and *.ne. Hopefully Germans will know how to be responsible with their privacy and lack of control. Only time will tell.

Privacy and copyright in German law

[Peter Eckersley]

Unlike most other nations' legal systems, human dignity and therefore privacy is central to the German constitution (this was a result of its being drafted in the wake of second world war). It follows that German copyright law does not trump privacy concerns; this was one of the reasons why Germany invented the levy-funded private copying system.

Re:Privacy and copyright in German law

[henni16]

Well that _was_ once true.
People like Gestapo-minister Otto Schily and his lackey Brigitte Zypries as minister of justice
don't give a flying f... about the constitiuon and everybody applauds.
Besides from DMCA-like plans to give "Copyright holders" the right to request customer data from ISPs,
they are pushing laws to require ISPs to not only store IPs but also all communication data including visited URLs. email header info, IM data, SMSes, telephone connection data and much more stuff.
The only thing they aren't sure about is how many years ISPs and telcos will be required to store all that information and who pays for it.

Btw. they are also pushing to build nationwide DNA- and fingerprint databases.

The East-German STASI and the Gestapo would have had wet dreams about the infrastructure that is going to be created.
I think it isn't necessary to point out that all this is done "to fight islamistic terrorism"
and to "protect our freedom".
Apropos: because of their severeness the anti-terror laws passed after 9/11 were limited in time and to be reevaluated after five years.
Since they were such a success (not proven), now minster Schiliy and others suggest to keep them forever without a mandatory reevaluation and even extend their scope/power.


Do I even have to conclude this rant by saying that I am much more worried about
the actions of our politicans than about terrorist attacks?
But hey, as long as you have nothing to hide..

Loss of Internal Audit Trail

[PhoenixRising]

While it's nice to know that this will make it more difficult for the **AA to come knocking on your door, this removes one of the three big A's in security: auditing. If a machine with a dynamic IP address is engaging in malicious behavior, this makes it much more difficult for the ISP to identify the account associated with the behavior. This is a real problem if you want to disable machines that are compromised and are being used for spamming/DDOS/whatever. I hope that there are provisions for the ISP to keep the data for a short period of time and/or keep interesting data available for investigative purposes.

This is complying with German law, FWIH

[WoodstockJeff]

There have been several German PHPBB users asking how to disable the storage of IPs with messages on their boards, because saving that information is a violation of German law. Personally, I think it is ridiculous, but they're very serious about it.

These actions would just be extending that to the ISPs themselves. If they have no need for the data, it must be disposed of, or not collected in the first place.

Of course, given that this means there is no accountability through the ISP for the actions of users, I know I won't be allowing random IPs from Germany to connect to my email servers!

Yeah, but what if...

[Anonymous Coward]

<flame>

I can't believe all this crap I'm hearing about "what if somebody does something bad and the ip address isn't logged" shit.

What fucking country did you grow up in where monitoring your every move IN CASE you MIGHT break a law was tolerated. When did we let our privacy and freedom get JACKED from us?

Real IDs, IP monitoring, etc... This kind of shit was UNTHINKABLE here in the US before the 1980's, and now, because we believe everything we're told about bad things happening if we don't do it, we've given away all of our freedoms and tolerate monitoring and intrusion that was considered science fiction material 20 years ago.

Other countries are NOT following our example- Spain didn't turn itself into a police state after the train bombings, politicians there went as far as to say "we are NOT at war", whereas, hear in the US, politicians say just the opposite, and we buy that shit!!!

Land of the Free, my ass....

</flame>

Re:Yeah, but what if...

[tamrood]

THIS IS THE CENTRAL SCRUTINIZER...

Your lack of docility has been noted, along with your IP address. Please be advised that to continue to disagree with the State is an abomination in the sight of God, and is prohibited under the same law that requires approved identification for airplane travel.

You are ill. For your safety and convenience, please take increased doses of the low-level neurotoxins we have been marketing as artificial sweeteners, right away.

The Constitution is only an historical document, it is not relevant to your life. Ignore it. This is in the interest of National Security, Democracy and Freedom.

Calm down. Have another diet cola. Watch Fox News.

Sleeeep...

It will be almot as bad as the real world!!!!

[Ricardo]

The other day I was able to walk down the street, go into a shop and buy some milk - get this - WITHOUT ONE PERSON ASKING ME TO IDENTIFY MYSELF!.
Can you imagine all the possible marketing information I squandered selfishly by not informing a central database about this action (this report not included). The cash I used was totally UNTRACEABLE!!! it could have come from anywhere. Not only that, but the person behind the counter was happy to undertake the transaction without me identifying myself (obviously some kind of terrorist).
I could have been going to use the milk for a BOMB!, would the authorities have had any way to check this? NO!!!!
When did everything become like this?
Oh wait - it has always been like this in Democracies.

No ISP is"guilty"if there's no user to incriminate

[D4C5CE]

Not to log the IP address (...) will cost them zillions!!!

If the ISP is not logging the IP address, then he is responsibly of the illegal use of that IP.

When any crime is committed using a computer trough a network, the operator of the network must prove that he is not accountable of that crime. The only way of proving this is pointing out the actual identity of the crime author, showing the pertinent documentation and logs.

Your proposition is ridiculous. If there is no record incriminating anyone, nobody can be held responsible. In all but the most dysfunctional legal systems there has to be a burden of proof when alleging liability, and a presumption of innocence regarding criminal prosecution. There is probably not even one single (legitimate) court on earth which, failing to find anyone responsible, sentences the nearest innocent bystander instead.

BTW, bear in mind that data protection is nothing less than part of a constitutional civil/human right in most civilized societies, making it illegal (even for the state to tolerate) that unnecessary records are being kept on anyone by public officials or private entities. Thus creating (let alone preserving) traffic logs by flat-fee ISPs (other than for very short-term performance/quality assurance or intrusion detection) that can only be used for spying on users or clandestine gathering of data for unsolicited commercial exploitation have no legitimate purpose whatsoever.