EU Approves Data Retention

submanifold writes "The EU have ratified rules that will force ISP's and other telecommunication companies to retain data for two years. This data includes the time, date and locations of both mobile and landline calls (as well as whether or not they were answered) along with logs of internet activity and email. Apparently the content itself would not be accessible, merely the data concerning it. However, despite being touted as an anti-terrorist measure, the record industry has already admitted interest in aquiring such data."

Comments

I am going to be rich!

[Nichotin]

Heh, I guess buying stocks in storage related companies would be a good idea now :)

Re:I am going to be rich!

[burnetd]

I'm off to patent the use of random RIAA artist names, and MPAA movie names in email signatures.

Re:I am going to be rich!

[dgatwood]

This is, quite possibly, the most privacy-invading law I've seen in my lifetime. That said, there are at least a couple of nice solutions to this problem that technically comply with the law without contributing willingly to the police state. Call it... uh... civil disobedience.... While I haven't read the bill, nowhere in the descriptions I've seen does it say the data must be retained electronically, nor does it say that the person retaining the data must provide reasonable means to access it, only that the data must be retained.

Solution 1: The Mountain of Paperwork Method

Set up your system logging to pipe all that data to a line printer. When the authorities ask for your records, point them to a room in which there are a few hundred thousand pounds of unsorted stacks of fanfold paper. If you can convince all the ISPs out there to do this, the law will quickly be abandoned as not useful.

Solution 2: The Law of Information (a.k.a. Thermodynamics/Quantum Electrodynamics) Method

Send the data into a black hole. When they attempt to sue you for failing to retain the data, insist that they prove conclusively that the black hole did not, in fact, retain said data.

Solution 3: The One-Time Pad Method

Using an alpha emitter, generate a one-time pad. Make an offer to allow to use your OTP generator for a reasonable fee. Use this encrypted data stream to encrypt the log data. According to the rules of OTP encryption, destroy the pad immediately after encryption. Insist that if the police state wanted access to the data, they should have been paying for access to your OTP's data stream for the past several months. Hand them a hard drive containing random bytes.

Solution 4: The Laser Beam Into Space method

Encode the data by modulating a laser beam and bouncing the beam off of a planet orbiting a star that is at least three light years away. Upon questioning, insist that if the police state really needed that data, they should have launched a deep space probe centuries ago. Give them the opportunity to launch one now, but remind them that the Alpha Centaurians need the data, too, so if they hurry, they might be able to get the information by the year 2600.

two years?

[backslashdot]

Retain for two, retain forever.

Re:two years?

[wheany]

Stay a while. STAY FOREVER!

Destroy him, my robots!

Re:two years?

[cayenne8]

"As the saying goes, there is nothing as permanent as a temporary government program."

Yeah...I think about that ever time I go across the damned toll bridge down here. Was supposed to be toll only as long a period till it was paid for, which by now is way overly paid for.

I think now...the only operating cost is the actual toll booths they have to pay to maintain and man....

As for actual laws being repealed...about the only one I can think of in the US is the amendments for prohibition. Anything else repealed since then?

Volumes of Data

[qw(name)]

There had better be some incentives for housing that kind data. For a busy ISP, that would mean GBs and GBs of data. Where's it going to be stored and who's going to pay for it?

Re:Volumes of Data

[qw(name)]

that would mean GBs and GBs of data

I should have said TBs and TBs of data.

Re:Volumes of Data

[castoridae]

And how's it going to be protected? This is another ChoicePoint leak just waiting to happen.

Re:Volumes of Data

[LilWolf]

At least in Finland the government is going to be paying for it. Though I believe it varies by member state, so in some countries the costs would actually fall on the ISPs and other such operators.

Re:Volumes of Data

[Maxo-Texas]

And where is finland going to be getting the money to pay for this?

And where are the ISP's going to get the money to pay for this?

So for 50 bonus mod points, ... who's going to be paying for this again?

Re:Volumes of Data

[Wilson_6500]

who's going to pay for it

EU ISP customers. One way or the other.

Re:Volumes of Data

[malkavian]

Just as in the UK, the Government will probably be paying for it.
And as the government's expenses have just risen, and it's workload increased, there will:

a) Be a tax hike to cover the cost that is given to the ISPs to retain the data.
b) Be a tax hike to cover the salaries of the extra bureaucrats required to fill in the paperwork to support the new directive.
c) Be a tax hike to cover the cost of the consultants to work out a way of actually sifting the signal from the noise (or pay for extra M.O.D. staff to do the work).

Part of that tax hike may be applied to the ISPs, so they'll end up paying more, so to recoup costs, they'll have to raise prices.
All of which comes back to bite the basic guy in the street right in the ass.

Lots of cost, no appreciable gain.
One day, the governments will learn that just because you can do something doesn't mean you should. They'll end up with so much noise, they just can't pick out the signal.

Re:Volumes of Data

[Tom]

For a busy ISP, that would mean GBs and GBs of data. Where's it going to be stored

EMC, for example, offers mass storage devices capable of coping with that.
I know a major ISP in Europe who has an EMC storage with several TB of capacity.

and who's going to pay for it?

The ISP. Which in the end means you, the customer. Nice, isn't it? Not only are you now under constant surveilance, you also pay for it yourself.

Re:Volumes of Data

[digitaldc]

that would mean GBs and GBs of data

I should have said TBs and TBs of data.

You mean YBs and YBs of data.

(http://en.wikipedia.org/wiki/Byte)

Re:Volumes of Data

[MooCows]

The Dutch government has made it clear that they won't be paying ISP's for it.
The Dutch ISP xs4all is actively campaigning against this law.
They give the realistic argument that this law will commercially cripple European ISPs, and the government paying for the storage is unrealistic.

Re:Volumes of Data

[91degrees]

Western governments have failed to stop major terrorist attacks in the US, Spain, the UK and elsewhere, despite having later found numerous clues that might have tipped them off to some of these attacks. I'd say we're already at the point where the signal-to-noise ratio is beyond their ability to handle reliably.

What about the attempted bomb plant on the New York underground last week? Didn't hear about it? That's because the suspected perpetrators were arrested a year ago before they even considered planning it. Or maybe they wouldn't.

But I would like a requirement that this law is repealed unless there is an increase in prosecutions of terrorists or at least one attack is foiled as a direct result of this legislation.

Re:Volumes of Data

[bleckywelcky]

One day, the governments will learn that just because you can do something doesn't mean you should.

I doubt it.

Re:Volumes of Data

[KiloByte]

Wrong. No matter what marketing departments of disk manufacturers say, a kilobyte is still 1024 bytes.

Any attempts to make my /. nick ugly will be punished with extreme prejudice.

This story belongs in "Your Rights Online"

[o'reor]

not in the "Hardware" section, dammit !

Re:This story belongs in "Your Rights Online"

[Volanin]

With this amount of information to be stored?
You might change your mind after a few months...

encrypted proxies

[brontus3927]

I guess thats a good reason to start using encrypted proxies.

Re:encrypted proxies

[Elixon]

They are trying to steel the right to live and not be watched by government... Do you think that the next rules will not follow?

1. Retain data for two years - IS HERE
Will come:
2. Retain content of e-mails and other content for 2 years.
3. Encrypted transmition is forbidden.
4. IPv6 will identify you securely - no anonymous proxies anymore!

I hope that smart brains that will be one step in front of BigBrotherGoverning eye will survive.

Re:encrypted proxies

[legirons]

"I guess thats a good reason to start using encrypted proxies."

Or to make 50 connections per second to random addresses

"store that, fuckers!"

Make it popular enough, then we can send BT offline as they realise they'll need 500TB/day of storage.

The solution to the Recording Industry

[Anonymous Coward]

...is to publish the surfing habits and email of their executives over the past two years. If they have things like Porn, Payola, and Prostitutes showing up in public view, and they might lobby for Privacy.

Why this is not ok

[Nichotin]

Seeing that many people have been harassed by the FBI and similar entitys just because they belong in a certain group (peace protestor, black, etc.), I really do not want the government to find out that I from time to time engage in peaceful marches agianst the man. As noted, the record industry wants to have a look at the data, and that is just another pen stroke to accomplish after the money has passed under the table.

Re:Why this is not ok

[IAmTheDave]

Seeing that many people have been harassed by the FBI and similar entitys just because they belong in a certain group (peace protestor, black, etc.), I really do not want the government to find out that I from time to time engage in peaceful marches agianst the man.

People often joke that George Orwell was a mere 20 years or so off the mark, such delay perhaps caused by the very fear his book invoked in the hearts of those who would fall victim to such surveillance.

But the scary truth is, this is not a joke. As a majority of communications moves online, even as phone calls are now almost all routed at some point over an IP network, this is perhaps the single largest surveillance undertaking and law that I have ever seen pass. I cannot imagine that any citizen would accept this as representing their beliefs or desires. This is, in fact, one of the scariest things to happen in a long time.

What concerns me further is the reach this has. This is all data that passes over any EU country's network, meaning that any time I visit a website hosted in Europe, my data will be tracked. Any time I email someone in Germany or France, my information will be tracked. This is in no way just surveillance of the EU's citizenry, but of the entire world's.

I for one am off to fashion a tin foil hat.

Well, what about SMTP?

[Pieroxy]

My mail comes to me through SMTP directly. I am wondering how they will keep track of my incoming mail... The mail I send, however, goes through their SMTP proxy, which is a bit of a pain but necessary because most properly configured mail servers will reject anything incoming from a DSL IP.

So how can they keep track of my gmail account? That is unless they log all the throughput of data coming in and out of my computer, of course. Now I see a legal and proper use of eDonkey: keep on downloading and uploading free software!!! That way they have LOADS of data to log.

With a bit of luck, the next DMCA will also make that illegal! What a relief for the ISPs. ;(

Re:Well, what about SMTP?

[Tom]

So how can they keep track of my gmail account?

GMail will have to provide the data.
Yes, they thought about webmail. I had a copy of the specifications for the whole thing in my hands once. Everything passing through an ISP or other service provider (such as GMail) will be captured. The only way to be safe is to run your own mailserver and use TLS. And even then, your mails will be logged on the "other end", i.e. the guy you talk to, unless he's also running his own mailserver.

Re:Well, what about SMTP?

[PhilHibbs]

Google has assets in the UK, and does business in the UK. We can tell them to "obey UK law or go home and stop doing business here". China did it, and so can we.

Hang on - did I just compare my country to China? 8-O

Who doubts the endgame?

[dada21]

These are likely the same parties behind the push for UN control of ICANN's business.

If you think they're merely out for fair sharing, think again. I may hate the rights I've lost through Bush and Clinton's wars and social programs, but I see no real difference in Europe. In some ways I see fewer freedom and more tyranny.

Open WiFi access points make these rules useless.

Re:Who doubts the endgame?

[dada21]

Couple times per year.

A friend is visiting the States with us right now, her first visit. 23, female, college degree in economics. After converting from metric, she's blown away at how cheap electronics, food, gas, and even liquor is.

I'm starting a business right now in Europe (acrylics) and the pay vs taxes vs cost of living saddens me.

Good point

[Anonymous Coward]

FTA: "At the end of the day ISPs are not law enforcement agencies so they should not have to pay for it all"

Time to pack up?

[mccalli]

I run a co-lo webserver as a sideline to my limited company. It's based in the UK, and houses around sixteen low traffic sites. It generates no money - I really just wanted a raw server out in the wild and sold space on it to known friends who felt the same - we exactly cover our hosting costs and no more.

Am I caught by this? It sounds like I am. Am I now expected to keep mail logs for two years and be legally liable if I don't? If so, I am almost certainly out of the business. Just not worth the risk to me.

Cheers,
Ian

Re:Time to pack up?

[LilWolf]

No, the way I've understood it this only applies to registered telecommunication companies(ie. internet service providers, telephone companies and such). So you should be safe from any obligations to keep such logs.

Now, the place hosting your servers/providing the net connection might be a different story..

Phew, that's a relief

[slushbat]

Now we should be able to round up all of the terrorists within a few minutes, and all will be well in the garden again. I am so lucky to be looked after by such wise leaders. Seriously, I bet you will be able to count the number of terrorists caught by this on the fingers of one foot.

Of COURSE they're interested in gaining access

[Tim C]

That's fine, and is their right.

It only becomes a problem when the authorities grant them access. They ask all they like, as long as they don't get it. If they do get it, then it's the authorities that should be blamed.

Time to get off the grid

[gasmonso]

Having every aspect of my life recorded just scares the hell out of me. We have countried collecting Internet and phone usage. Many cities are putting cameras up to monitor your travel. All your purchases made via credit card are recorded. At work, your company probably monitors your email. Even companies like Tivo monitor your tv viewing habits. What else is left?? Governments/corporations will know damn near everything about you and what you do. I say to hell with this... I'm buying an island in the Pacific and starting my own country.

http://religiousfreaks.com/

Re:Gimme a break

[meisenst]

Yet another ploy for the record industry to put fear into individuals. I hope one day the record industry burns and dies.

In order for this to happen, you have to stop supporting them. Don't buy (or download) their products. Don't listen to their mass marketed drivel. Tell your friends, your family, and everyone else you think will listen that every time you support these companies, you are chipping away at your freedoms.

As long as the majority of us continute to pay the record industries money, they will simply continue in their quest to make sure that we all pay them more money. If we stand up for our rights, stop buying their products, and make sure that they realize that they are here to sell entertainment to us, and that we do not exist to buy entertainment from them, then that will be a start.

All this talk of "screw them" and "I hope they die off" and whatever else will do nothing to protect our rights, especially when governments are making it easier and easier for these corrupt and greedy companies to infringe on our privacy.

Re:Basic IT Knowledge

[Pxtl]

Afaik, it's specifically logging info they want - this ip connects to that ip on such and such port, this dynamic ip is that user, this email header was sent to that address. I doubt they want the ISP to store every packet that comes through.

Yes, it will still be an expensive PITA, but probably no worse than running a Usenet service.

Of course...

[omeg]

Of course the music industry is interested in that data. But that doesn't mean they can just obtain it like that. As long as this is kept an anti-terrorist measure, they have no foot to stand on.

Keep in mind that data will be kept for UP TO two years; most will opt for the minimum of half a year instead.

Exemptions for individuals

[adnonsense]

European individuals can gain exemptions from having their data retentioned if they sign a waiver giving away all rights to their first-born to the audio-video retail industry.

Those without children may instead put their signature at the bottom of a blank terrorist confession sheet and mail it to their local secret service. This will also automatically enter them into a free prize draw with many chances to win free flights to a European location of the CIA's choice.

--
I for one welcome our new data-retentive overlords

Re:Gimme a break

[jawtheshark]

Sure, that's nice in theory... Problem is: if their revenues fall, they will blame it on piracy. If the revenues soar, they will say that their copy protection schemes (and other measures like the logging of ISP) work and that those should thus be mandatory.

Either way, the customer is screwed.

Own mail server

[SigILL]

I run my own mail server. Will I be asked to log my own email usage? Or will my ISP simply be forced to snoop all the SMTP traffic I generate? And what if I start using TLS for SMTP connections? I really wonder (and dread) how this is going to be enforced.

I thought you guys in the US had it bad, but it looks like the EU is the current record holder in totalitarian tendencies.

Re:Own mail server

[Stephen Williams]

Or will my ISP simply be forced to snoop all the SMTP traffic I generate? And what if I start using TLS for SMTP connections?

Either:
1/ they'll block outgoing port 25, forcing you to smarthost through their server. Their server won't support TLS.
Or:
2/ they'll just turn a blind eye. The law doesn't compel end users to send data through ISPs' servers, and they can't be subpoenaed for data that they don't have.

-Stephen

Damn UK

[pubjames]

The UK opposes a lot of the good proposals of the EU (for instance, having completely free markets with respect to alcohol in Europe, so I would be able to order a crate of beer direct from Germany or a case of wine direct from Italy), and push through crap like this. And then the Brits all whine about the EU.

Encryption

[MikeBabcock]

It seems nobody has said the obvious yet ...

Encrypt your private communications.

Use anonymous remailers.

If you actually get charged, they'll require you to give up your keys, but they won't be snooping at your E-mails behind your back.

pgp.com
gnupg.org

Re:Gimme a break

[MBGMorden]

Let them blame it on piracy then. They can whine all they want to, but whining will buy them but so much. If they use piracy as an excuse to DRM stuff, then we don't buy the DRM products, and they go out of business. Companies who avoid DRM will survive and eventually they'll all get the hint.

Hardware?

[NtroP]

I'd have put this under YRO.

I run a small startup telco in the UK

[tezza]

I'm a little shocked by all the posters thinking that this is a change of what is already happening. all this data is already collected.

Any arguments from telcos who complain about the volumes of data are only using it so that they are not liable if someone arse deletes it.

Under UK privacy laws you have to delete the data identifying the particular person after you're done with the connection and the billing thereof.

Almost all transaction data is anonymised by a one way hash. Say md5sum. All the keys are done this way. Hashing removes the particular identification, and satisfies this. Almost always this hash uses more space than the original data anyways.

telcos use the hashed equivalents to evaluate aggregate data.

The law could ask for a tap and require you to retain those records anyway. These new laws just put into legislation what was already happening, and creating an offence for not doing it properly.

Re:I run a small startup telco in the UK

[^Case^]

the specific laws will be drawn up with consultation of larger ISPs

Funny you should mention that. Here in Denmark several of the major ISP's have comlained about this legislation, stating it would lead to massive expences for no apparent gain. And yet the governtment doesn't seem to take any notice whatsoever.

ISPs make money now

Some ISPs make money now. But there's a lot of smaller ISPs say f.ex. residential networks setup by local communities which does not make very much if any money. These networks will have a hard time surviving if this legislation is implemented to it's fullest extent.

Press release from FFII

[Christian Engstrom]

FFII, Foundation for a Free Information Infrastructure, has issued the following press release today regarding this matter:

PRESS RELEASE FFII -- [ Europe / ICT / Information Society ]

EU adopts Big Brother directive, ignores industry and civil society

14 December 2005 (Strasbourg, France) The European Parliament today adopted a directive that will create the largest monitoring database in the world, tracking all communications within the EU. "From today, all EU citizens are to be tracked and monitored like common criminals," says Pieter Hintjens, president of the FFII.

The Data Retention Directive was passed by 378 votes to 197, following deals between the Council and the leaders of the two largest parties in Parliament, the EPP-ED (Conservatives) and the PSE (Socialists). The Rapporteur for the directive, Alexander Alvaro (Liberals) had his name removed from the report in protest.

Jonas Maebe of the FFII says: "Among other harsh measures, the directive mandates recording of the source and destination of all emails you send and every call you make, and your location and movement during mobile phone calls. Additionally, the directive says nothing about who has to pay for all this logging, which will significantly distort the internal telecommunications market."

"Moreover, the directive disregards how Internet protocols work. For example, tracking Internet telephony calls is generally impossible without closely watching the content of all data packets. The reason is that such connections are not necessarily set up via a central server which can perform the necessary logging. On top of that you have techniques like tunneling (VPN's) which make it simply impossible to look at the content", he adds.

The gathered data can be made available without special warrants, and without limit to certain types of crime. There will be no independent evaluation, and no extra privacy and no specific security safeguards. The data will be retained for periods ranging from 6 months up to any duration a member state can convince the Commission of.

Hartmut Pilch of the FFII says: "This outcome proves that we have to remain vigilant at all times and work on every relevant directive from the start. Even now, the planned IPRED2 directive, also unanimously condemned by industry and civil society, threatens to turn everyone caught by a patent into a criminal."

Background Information

* Two-page overview of the effects of the most important amendments
http://www.ffii.org/~jmaebe/dataret/plen1/summary. pdf

* English video stream of today's plenary session
http://media.vrijschrift.org/ep_vote_datared_05121 4_en.wmv

* Original language video stream of today's plenary session
http://media.vrijschrift.org/ep_vote_datared_05121 4_or.wmv

* Data retention: legislative sausage machine in overdrive
http://wiki.ffii.org/DataRet0512En

* News, position papers on and analysis of the directive
http://wiki.dataretentionisnosolution.com

* Permanent link to this press release
http://wiki.ffii.org/DataRetPr051214En

About the FFII -- http://www.ffii.org

The Foundation for a Free Information Infrastructure (FFII) is a non-profit association registered in several European countries, which is dedicated to the spread of data processing literacy. FFII supports the development of public information goods based on copyright, free competition, open standards. More than 850 members, 3,000 companies and 90,000 supporters h

Re:Press release from FFII

[pieterh]

The Directive will be rubber-stamped by the Council. It will be challenged in several national courts and possibly the European Court of Human Rights, for it breaks article 8 of this convention quite flagrantly.

But there appears to be no process for overturning the directive. EU directives override national law. This is a great success for the UK government which tried and failed to have this law passed in the UK.

Ironically, a report by the Commission just 4 years ago on the Echelon surveillance system stated quite clearly that "Only in a 'police state' is the unrestricted interception of
communications permitted by government authorities."

The EU is now officially a 'police state', by the Commission's own words.

Make the records publically available.

[Anonymous Coward]

You may think it, um, counterintuitive.

But the _reason_ they want these is to maintain social/political power over people. An elite with privileged access to all that information can control society. In a free society, either everyone should have the communications metadata, or no-one: It's unbalanced information availability that would give the police power to become the classic Big Brother. I'm a lot safer if everyone knows I have a particular embarassing sexual inclination or whatever than if only a small, powerful subset knows.

See David Brin's book "The Transparent Society: Will Technology force use to choose between privacy and freedom?"

New Market

[jafiwam]

Finally a new market for all of those "limited lifespan" drives IBM made a few years ago.

"ServStor" 36 GB drive! Guaranteed to die within 10 months!

Seriously though, how is the law going to deal with the inevitable but accidental data loss of that stuff? Criminal charges for obstructing justice just for being unlucky enough to choose equipment that turns out to be flakey?

The last man in Europe

[Anonymous Coward]

There is no way to stop this now. We're on our way to an Orwellian state.
This is the fundamental step. From here on, it's let's add this crime, let's give access to that organisation, let's extend it to this data, let's save it for 100 years instead.
And when there's a war, the occupier will have the ultimate oppressive weapon pre-installed.
And what are you people babbling about? What protocols will be included, ways to obfuscate yourself, the costs of storing this data? There's a bigger picture, people!

Say what you will about the US, atleast they don't have a back door for legislation that would never get by a national parliament. Make room, I'm hopping the pond.

specs?

[naelurec]

It seems like there are so many zombie computers, tunneling methods, insecure wireless access points, public terminals, cypto methods in a sea of trillions of packets of data/connections and ports that would render these logs useless for all but the most technophobe/idiot terrorist (which I'm guessing there are other more effective ways to nab this "low hanging fruit")

Anyone more familiar with the system know how it will help the "good guys" nab the "bad guys"? Seems like there would be a higher degree of success hanging out in a hay field and search for a needle.

Re:Filesharing and this law

[Oersoep]

"logs with ports and IPs"

No ports, no IP's. The folks who came up with this don't think that far.

They think that:
- e-mail is just like phone
- spam does not exist
- ISP's only handle private traffic
- ISP's handle ALL traffic, and have full access to it
- Only EU citizens use ISPs in Europe
- Encryption does not exist
- No-one has his own mailserver
- No-one is going to try to make money by offering tunneling services to non-EU countries
- Terrorists are dumber than they are

It's not that they want every ISP to scan all packets. They're just thinking like lusers. They think internet is managable.

Their plan sucks. It doesn't work, it's leaking like a raincloud, it's unconstitutional for a lot of member states, and they bombard ISPs with costs, work and responsibilities they never asked for and they KNOW is bullcrap.

It's absurd.

Madness

[steveo777]

While this may help, it's going to cost millions for every ISP to log everything, even if they're only storing it for a couple years. We're talking at least one new tech for every system. One system for every 2 - 5 thousand users. One user may not produce a great deal of work, but what about people who recieve hundreds of SPAM messages a month, send forwards to all their friends, and surf for 2-3 hours a day. There are tens of thousands of these people out there.

Counter-terrorism vs. privacy invasion? I doubt any government cares whether or not you're browsing porn all night. Seems to me they're increasing their workload too, but only if they're actively sifting. Seems to me they should just have a system of flags set up. Like they most likely already do.

Expect your high-speed and dial up rates to hike up if this goes through. Of course then there's the bells. They already keep a pretty decent record of your calling logs, so that wouldn't be that big of a deal.

Background

[D4C5CE]

The European Parliament (which would have had a power of veto in the procedure) approved the draconian directive on first reading without much of a fight - putting 450 million people under massive surveillance with no justification whatsoever (other than the Four Horsemen of the Infocalypse).

According to their own Press Service: Deal on EU data retention law; more comprehensive version in German: Ja zur Vorratsdatenspeicherung bis zu zwei Jahren - Keine Speicherung der Kommunikationsinhalte. Incidentally, even the latter "limitation" (allegedly no storage of the contents of communications) is void in particular with respect to URLs - these being identifiers for the contents transmitted anyway.

Loopholes aplenty have already triggered plans e.g. in Poland to extend the storage even further, to a staggering 15 years (!), and remaining safeguards (if any) are not expected to last: The media industry wants access to that data, too (and a further directive is in the works, cf. the EU Legislative Observatory).

Re:Gimme a break

[jawtheshark]

Well, sure, but how many are really going to boycott the music industries. You, see, my sister is a big pirate in the sense she has copied a lot of CDs. Not your average teeny bopper music, no, she's serious about music. Why? Well, she was a student and she had not enough disposable money.

She finished her studies as a sound engineer and tomorrow she starts at a (non-music) job. She already said that she's going to blow her first salary on music CDs: replacing (as much as possible) copied CDs with originals.

Don't underestimate the priorities of people. Personally, I've been in CD shops and found music I'd like (non mainstream!) and I always check for the "Audio CD" logo. None of them had it anymore and all of them indicated some kind of DRM. I put them back, but I'm not passionate about music.

My sister *is* going to buy these kind of CDs, and I can be sure she'll need me to defeat the DRM and put it on her computer (she loves the fact that iTunes is able to share over network, and with multiple computers on the network she does).

I know this is anecdotical evidence, so you can file my ideas in the bit bucket if you want to.

The music industries are not going to go broke anytime soon because most people have other priorities than DRM in their lives. As long as there is a loss in revenues (or only a perceived loss) they will push DRM, more and more draconian DRM. To the point that you will have a live internet connection on your CD player to play a simple "Audio CD" (and probably linked to one single player) It's only at that point that people will revolt, but then it will be too late.

I don't see a way out as long as only people posting on slashdot know about DRM.

Re:Not for webhosting

[mccalli]

You do not fall under the new regulatory framework, unless you do a public offering, route your own traffic (multi-homed) etc etc.

Interesting. I have 32 IP addresses assigned to the one box, and this has all been handled through my limited company so I suppose you could argue that it's a public offering. The boxes run apache instances but also Postfix, so there is a public mail server out there.

I think from your description that I'm outside of the framework, but can't exactly put my finger on why. Does what I've said come under the 'no routing' bit? Or is having the multiple IP addreesses (all on the same subnet of course) classed as diong routing?

Cheers,
Ian

How soon we forget...

[hpa]

20 years ago, it was explained to me that the reason European telephone companies didn't issue itemized bills except by explicit customer request was that telephone billing records had been used by Gestapo after invading other countries to figure out who to eliminate as possible "security threats" -- if X was suspected of being involved with the resistance, and Y had called X some time before the invasion, X and Y would both find themselves in a box car pretty soon.

It wasn't just that the data wasn't retained, the data was never even collected unless you requested it -- otherwise the only billing information that would be kept was a running counter.

Today, the supposedly-democratic countries want to use surveillance that would have given Gestapo and Stasi wet dreams; it's probably no coincidence that the prime ministers in the countries that have pushed the most (UK and Sweden) have been ones acting like power is a God-given right to them personally.

Re:Encryption

[Stephen Williams]

Use anonymous remailers.

I'm in two minds about those things. On the one hand, anonymity is very, very good; on the other hand, one of my users was getting harrassed by some jerk, and when I blocked his incoming emails, he took to using anonymous remailers instead. I ended up blocking the remailers he was using by blocking any address matching "mixmaster@*".

So, as a user, I love freely available anonymity; but as a sysadmin, I demand that people be accountable for what they want to say if they want to send mail to my users.

-Stephen

William Burroughs said it Best

[gilgongo]

"Control can never be a means to any practical end... It can never be a means to anything but more control..."

Re:Numbers

[grimJester]

Actually, you have a right to get access to all the info a private company has stored on you. Write them a snail mail and they'll have to send you everything. As others have pointed out, only headers and phone records would be stored, but it would be a nice act of civil disobedience to DDoS them via snail mail. If thousands of customers want records kept in a huge pile of plain text logs somewhere, it'll bog the average ISP down pretty well.

A scenario

[Syberghost]

Ok, assume the following scenario:

We catch a terrorist. I'm not talking about somebody we just think might maybe be a terrorist, I mean we yank him out from behind the wheel of the van bomb in the basement of the skyscraper, or the other passengers monkey-stomp him unconscious as he tries to break into the cockpit of the airplane.

We search his home, and find a computer. On it, we find an email from Ayman Al-Zawahiri, saying "Abdullah will email you the instructions for where to pick up the anthrax." We don't find a copy of the email from Abdullah, and Thunderbird is configured to always prompt him for his Earthlink IMAP password. When we ask him for his password, he says "your mother sews socks that smell". After we type that in, we find out that it's not actually his password, it's just an insult.

Are you saying that you don't think it would be a good thing if we could go ask Earthlink for a list of everybody that's emailed him in the last two years, and cross-reference that with emails received by other known terrorists? Maybe go talk to anybody with the address "abdullah1987@hotmail.com" who emailed him?

If what people are objecting to is a feared misuse of this information, then oversight and legal protections are a better answer than throwing the smoking baby out with the bathwater.

If you honestly think it's not safe for a private company to have this information sitting where a court-granted search warrant could retrieve it, then you probably need to be lobbying to replace your local landfill and garbage trucks with curbside incineration service, too; but don't imply, as the submitter did, that it's not an anti-terrorism effort just because it could also be misused.

This is akin to deciding that a school isn't being honest when they say they're buying new computers for educational purposes just because some kid says he's going to install Quake on one of them.

Re:A scenario

[Todd Knarr]

There's one major problem with your scenario. It's actually fairly obvious: when you go looking through the e-mail, the only stuff identifiable as coming from an Abdullah won't have anything to do with the anthrax. Do you think the real Abdullah will be stupid enough to use an e-mail address clearly matching his name? No, his e-mail will come from something like hot18yo84172@hotmail.com or somesuch, and it'll be buried in the mountain of sex-spam e-mails your target receives and discards every day just like the rest of us. Now, if you have Abdullah and want to find out who he's been talking to, then this kind of retention might be useful. Unfortunately it's also unneccesary, since if you've already got enough to nail Abdullah you've got enough to go into court, get a warrant and tap his computer directly without having to mess with his ISP.

There's also the side-effects that've already been noted. While the retention may not be useful for tracking terrorists (it's purported justification), it'll be very useful to people whose investigations have nothing to do with terrorism and who've been unable to get anything like this on their own merits. That makes me thing the whole thing's an end-run, and "terrorism" is just an excuse.

Re:A scenario

[Hektor_Troy]

You're looking at it from the wrong direction. What good can come from it is of little consequence. After all - if EVEYRONE were forced to wear $surveilancethingie, allowing $government to see where they are, who they talk to and about what, we wouldn't have much to fear from terrorists would we? After all - they talk, we know about it.

What you need to do instead is look at the opposite situation - what bad can come from it? Why stop at just the ones you talk to directly? Maybe you're talking through secrect codes on mailing lists, so we need to up the net to the ones you've talked to AND the ones that the ones you've talked to have talked to. Two degrees of seperation. Then we'll be getting somewhere. And we can then get a much clearer picture.

Of course, the terrorists know this, so they'll be very elaborate and set up systems with three degrees of seperation. Might even get brilliant and go to four.

Then what? Even with two degrees of seperation, just how many people do you think will come under suspicion (which of late seems to equate with guilty until proven innocent - but we won't give you that chance)? Me, I have maybe 50 people I talk to directly in any given month. Two degrees of seperation that's at LEAST 2,500 people suspected of whatever I am. Go to three, and it's 125,000.

You'll be throwing out nets so far, you'll drown in useless data. So now you have information you can't use AND you've incriminated 125,000 people because you suspect one guy. They're now on your watch list - just in case.

Me - I'd rather we said "fuck the best case scenario" and concentrate on the worst case scenario. And by that I don't mean me barely surviving being near $explosion. I mean me getting assraped by $government_agency for no aparent reason and no way of redeeming myself - after all, I wouldn't be on their list if I hadn't done something bad, would I?

It's like torture. Sure, the upside is "suppose we know for a fact, 100% irrefutable, that $person knows what we need to do to prevent $bad_thing" - do we torture him to get the information? That's not an interesting question - the interesting question is - "we are fairly confident that YOU (yes, you, Syberghost) know what we need to do to prevent $bad_thing. You refuse to tell us (because you are innocent), but we are even more confident that we can break your spirit and make you tell us what we want to know - how to stop $bad_thing from happening." Do we torture you?

THAT is the question you need to ask. Best case scenarios are like dreaming of getting blowjobs from beautiful women while being served great food prepared by the best chefs in the world - not very useful.

So what about me?

[Anonymous Coward]

Sorry to be so selfish here, but what about me? Am I an ISP under this law

I have a very good broadband connection because of the work I do, but I am a BIG believer in sharing.... I piggyback a lot of open WAPS when I am out and about, and to return the karma, I share mine. I have a separate, public WAP, firewalled off of my home network by a linux box and Novel BorderManager. Any unrecognized MAC address is fed a DHCP config that will send all port 80 requests to my CGI that asks them to agree to my terms (i,e, no illegal stuff, under age porn, copyright violations, etc., and warns them that my usage is a higher priority, and they will be throttled when I am using the b/w) and when they agree, it adds their MAC addy to the table that allows them to get through the router. I even have the router congifured so they can do BT is they know how to follow the instructions on my consent page.

Since I've had this setup (almost 2 years)I've only banned 1 MAC because he was just a leach, 24 hours a day.

I don't keep logs more than a few days... so now I have to keep 2 years of logs? Not bloody likely. I don't even know who the users are.... just their MAC address (which of course can be spoofed).

Send in your data voluntarily in protest

[lordholm]

Go to http://www.stoppaovervakningen.nu/ (stop the monitoring) and type in your name, after "Jag heter", a number of webpages that you have visited, telephone numbers after "telefonnummer" an optional comment in the big textbox and finally your e-mail address.

When you click on the "Skicka"-button, the information will be sent to the Swedish minister of justice (the guy on the picture), so that he has access to the data immediatelly instead of having to look through the ISPs.

Now, the point with this protest is to make mr. Bodström realise how much data that is going to be stored. So, slashdot-people, you can do it. :)

Poisoning the logs

[Ilex]

I'm surprised no ones mentioned this already.

What if someone created a screensaver that continually accessed thousands of websites, IP addresses. Basically create as much junk data as possible to pollute their logs.

A similar technique was used to poison the databases of spammers who used web bots to harvest e-mail addresses.

Re:Poisoning the logs

[Maljin Jolt]

What if someone created a screensaver that continually accessed thousands of websites, IP addresses. Basically create as much junk data as possible to pollute their logs.

Real geeks do not run screenasvers.

wget --background --spider --mirror --limitrate=2k http://www.google.com/search?hl=en&q=sex&btnG=Goog le+Search --output-file=/dev/null

Bot for making massive data amounts.

[pdjohe]

If this is the case, what if there was some sort of bot that would simply go around the Internet visiting random sites. If everybody had this installed, then the noise ratio would be too high for accurate data retention, right? After all, you don't pay for the usage of bandwidth generally, you pay per month. Just use all the bandwidth you can on useless stuff. In the end, it will push the amount of storage the ISP's have to use and their bandwidth usage through the roof.

Back to repeat earlier mistakes?

[Isao]

This is interesting. Many years ago (in the 1930's) European countries did in fact used to maintain call records. This was primarily for business purposes.

Then came World War Two. As the German Army overcame and occupied Allied countries, they immediately headed for the Post & Telecommunications (or Telegraph) offices. This was to sieze the call records maintained there. They then looked up call records for known Allied agents and sympathizers, Jews and other groups. They used these call records to discover who was talking to whom and went to investigate and/or arrest people who might also be agents/Jews/Etc., or collaborators. These people were then sent to prison, or worse.

After the war, Western European countries decided not to keep call records any longer and instead moved to a metered system. This prevented a reccurance of the bad situation they found themselves in while occupied.

Now these records have been reinstated, in a blatent case of not learning from earlier mistakes. It seems the phrase "Those who cannot learn from history are doomed to repeat it" has once again been demonstrated.

Re:Gimme a break

[KDR_11k]

You're lucky. I can't stand the kind of music that's on the radio. Internet radio works, though. Combine that with a ripping program (recording stuff off a broadcast is legal so I don't se a problem here) and you can get some passable music together.