Slashdot Mirror
German ISP Forced To Delete IP Logs
An anonymous reader writes "A German federal court decided today that T-Online, one of the largest ISPs in Germany, was obligated to delete all IP logs of a customer upon request to guarantee their privacy. From the article: 'The decision (German) does not mean that T-Online is now obliged to delete all their IP-logs, the customers first need to complain. But, if they ask T-Online to delete their IP-logs, the ISP has no other choice than to comply. A lawyer from Frankfurt already sketched a sample letter (German) to make this process easier.'"
There's not a chance in hell that anything like this would ever happen in the United States. I hope it works for the Germans. This is the way privacy should be treated. The people have rights.
The article is vague. Are these the logs of connections made, or are they the logs of when an address was assigned to them by DHCP, or what?
☠
Requests to delete server logs, however, will be logged.
I wonder why the average American (or Brit) doesn't demand the same level of privacy that many of the mainland Europeans now have? While some other freedoms (e.g. speech,press) are more limited in countries like Germany, there appears to be a strong right-to-privacy movement backed up by the government.
Sure, our media and government pay lip service to privacy issues, but the reality is that our government wants to increase monitoring in the name of fighting terror. Compare this story of Germany forcing the ISP to delete logs for a customer to this one outlining yet another argument by US officials to require ISPs to maintain even more user data.
I'd hate to see us to become a 'surveillance society' like Britain has. Unfortunately, we seem to be quickly heading down that path, particularly since our citizens haven't yet raised up to demand greater freedom.
Crack - Free with every butt and set of boobs
I'm not an admin, and never have been so I'm working on ignorance here. But my question is, why bother with long term logs anyway? I understand a need to keep logs of activity for a week or so to deal with various attacks, zombie machines, etc, but why not set the logs to automatically wipe anything past that point? I can see maybe going nasty and selling it to advertisers, but other than stuff like that is there a use?
"Mission Accomplished" -- George W. Bush May 1, 2003
Is there someone who is a lawyer and is able to make a version for us Canadians/Americans?
It should work in Australia. Privacy laws here state that:
- If I ask a company operating in Australia what information they have about me, they are obliged to tell me
- If I ask where they got this information, again they must answer
- If I ask the same company to remove such records, AFAIK they must, though there are reasonable exceptions to this one. (e.g. if i've done business with them, they have to keep financial records. if it's my bank, they might have to cancel the mortgage to comply..)
- Companies operating here are not supposed to pass on private information without consent, which is why so many competitions and things have clauses in tiny writing to get your consent.
-- All your bass are below two Hz
Isn't there an EU Directive regarding data retention that went through in response to "the terrorist threat"? How does that gel with this ruling?
...but what happens when the user logs on again, after the IP log purge? Are they back in the records from that point on?
Slashdot: Playing Favorites Since 1997
Not /exactly/ true. The sample letter speaks of a complaint, but T-Online has every choice not to comply.
The linked webpage then recommends sueing T-Online in that case. If/Once you win that lawsuit, T-Online has no choice but to comply. This is a tad different from what the blurb here would have you believe.
(All this is based on rather strict privacy laws that require a provider not to collect any data not relevant to accounting; since IP addresses and data volume is not needed for accounting on plans with a flat fee per month, T-Online has no right to do so; they, however, save that data for 80 days.)
The A in AT&T stands for American.... You don't exactly see GT&T do you?
After deleting the logs, does the ISP have to delete the letter that requested the logs be deleted?
-David
Othertimes though...
Machine translation just isn't up to task.
Orationem pulchram non habens, scribo ista linea in lingua Latina
Thanks Diebold!
As with any other business you deal with, the difference between "monitoring customers" and "keeping business records" gets a bit blurry. A plumber keeps a "log" of whose house he visits, what he does in each house, what materials he uses, and how much he charges each householder. He probably calls this log a "receipt book". Obviously this book is unlikely to contain evidence of a crime, but that's due to the different nature of the plumber's business, not the fact that he keeps logs.
The main problem, as I see it, is that a huge load of users will be infected by malware, which is used to spam. If these same users have requested that all their IP logs should be deleted after disconnect - things get rather tricky.
.. waits .. and then starts spamming? Pretty damn difficult to track down if a lot of users have requested that their IPs should not be logged.
.. and so forth).
Also, what if a spammer signs up, requests all logs to be deleted
On the other hand, I hate that the spam problem should be solved by violating privacy. It was all okay for me when ISPs logged what they wanted, but didn't hand it over to anyone except when they found it necessary to investigate something themselves - due to complaints which would hurt the ISP itself (i.e spammers.. RBL's
So you are saying that it is a valid and reasonable argument that we should give up privacy because someone COULD commit a crime? I think this is the root of the problem many folks see with monitoring today. People like you, who are presumably good folks, think that it's cool if the gov't looks over your shoulder and watches everything you do. Others, presumably good folks too, want to have a private and less-observed life away from the cameras, recorders, logs, biometric-scanners, and databased-identities of your Orwellian dream. Monitoring never directly prevented crime, it has only been used to established that a crime was committed. If you want to prevent crime by monitoring, I hope you have no problem with the gov't putting GPS in your car to make sure you drive the speed limit, then mailing you a ticket when you do. If you want to prevent crime by monitoring, you better hope that camera on your street corner jumps in the way of the bullet before it hits you in the chest, cause all it's likely to do is tell them a person in a hoodie blasted you. (Not a threat on you at all, i don't even know you...)
Does that clear up how monitoring goes afoul? Does that show you how monitoring isn't going to HELP you? If not... Then I guess I have failed here.
America is all about speed. Hot, nasty, badass speed. -Eleanor Roosevelt, 1936
99 luftballoons?
The original article points out that keeping logs is incompatible with existing German law. But the law will soon be changed, because Germany will have to comply with an EU directive mandating that logs be kept for at least 6 months. Germany has already asked for an extension of the deadline to comply with this, but the strong likelihood is that the German privacy laws will be changed to comply with the EU-mandated snooping.
EU pols and bureaucrats are as hostile to personal privacy as US pols and bureaucrats.
You should have a send a letter to request being logged.
Spoon not. Fork, or fork not. There is no spoon.
"some people commit actual crimes (like, the kind with victims) on the internet" Like what?
>a) some people commit actual crimes (like, the kind with victims) on the internet,
Yet in almost no country does the post office keep track and logs of who mail who despite crimes both in the past and present probably occur thorugh mail. Further, many countries does not have any law requiring ISPs to keep logs, yet they do it anyway.
>b) there are good technical reasons, ie statistical data used for load-balancing purposes,
>network expansion, upgrade scheduling etc, for keeping logs (although obviously, stripping
>out identifying data ought to be done wherever this doesn't interfere with that purpose);
Which would be about every time or almost every time.
>(c) to some extent, keeping "logs" as such is an unavoidable consequence of doing what an
>ISP does. Functions like billing depend on logs. If they didn't keep logs, what recourse
>do you have if they bill you for 100GB over-quota usage during the month?
Which would only ever be important if you are billed by ammount of traffic which, at least in my country is almost non existant. Further, it requires no point in logging the IP number for example, you only need to keep track of ammount of data used (like electricity companies do for example).
And no, I have no idea how that tangent ended up the way it did. Good or bad, I had to follow it. My muse isn't very talented, but she's mine, and I love her.
Now here's the interesting bit: The entity that owns most of Telekom's shares is - the Bundesrepublik Deutschland, the German gouvernment. The "Innenminister", the guy responsible for the justice system, police etc. was one of the kind of politicians who'd like to know everything about everyone for the sake of "security". (Who needs freedom if they are secure? Oh wait, that was prison.)
So, while by the law he could not force ISPs to retain that data, the biggest german ISP that just happened to be controlled by... him(!)... did so anyway, aiding law enforcement in trivial (and here: unfounded) cases with said data.
Unfortunately, even in germany, noone seems to bother about privacy anymore.
Regardless of this ruling, the EU data retention directive will force providers to retain connection info, such as IP assignment to DSL accounts, for up to six months. So unless the directive gets repealed (IIRC Ireland has brought it before the EU court of justice), providers will have to keep all this info anyway.
technically the data protection act says that any company must remove all your details and information they have on you upon your request... any ideas?
In my country home users generally are billed by the month; colo-ed, peered, and commercial users are generally billed by the bit.
☠
heise.de is somewhat comparable to slashdot. It's the biggest IT news site in German language. Trolling is even worse.
http://en.wikipedia.org/wiki/Holger_VossWikipedia article on the incident
After all, this is an achievment, yes. However there's an http://www.heise.de/newsticker/meldung/77185EU law (pdf) being considered that not only allows but forces ISPs to save logs starting 2009. Oh, and did I mention that some politicians are actually trying to incriminate so called "hacker tools", here? Oh, surely they will think of Nessus and Wireshark as needed security tools. They are politicians, they know that.
... in the article. This court decision only applies to this one customer. If any other customer wants their ISP to actually comply with the current law in Germany (and sadly hardly any do at the moment) they also have to sue, every single one of them. Currently this court decision doesn't change much, but chances are good that more customers will sue and ISPs will finally realize that cannot continue like this anymore. Well, that is until the EU forces Germany to change the law and makes us give up even more privacy.
It sounds like this might be possible in the UK as well. The Data Protection Act allows an individual to request all electronically stored data about them at a company be deleted. Normally they can charge you a nominal fee (£10) to do it, but they must comply.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I would assume that these logs are backed up nightly. So if you request to have your logs deleted, do you really think an administrator is going back through every backup, and removing them?
Sorry for reading TFA...
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
... in enough english-speaking jurisdictions in North America that library software companies arrange for their programs to only keep logs while a book is actually in the hands of a patron (think: IP address is assigned by DHCP), and discard the identifying information as soon as the book is returned, or paid for if lost.
Non-identifying information, like "book x circulated twice this year", is retained for planning and statistical purposes.
If one happens to do business in a jurisdiction that has such a requirement, which you can probably discover from the ALA, then you have a perfect right to obey the law and discard old logs once appropriate billing information is obtained from them, or not retain them at all if you do not need them for a legitimate business purpose.
Of course, you will face the same pressures that librarians do in their everyday work (;-))
--dave
davecb@spamcop.net
> 'The decision (German) does not mean that T-Online is now obliged to delete all their IP-logs, the customers first need to complain.
Yes it does. Maybe not yet, but soon as German ISPs get these complaints by the hundreds daily the only way to handle the requests will be to just change their log retention policy and delete them all after n days.
- For the complete works of Shakespeare: cat
Who on earth needs anonymous proxy chains now? I'm off to Berlin.
Without logs, it seems it would be harder to track down network abuse (i.e. crackers). So you trade privacy for some protection from assholes. To me, that's a fair tradeoff, but what happens when the German courts demand that an ISP assist in some investigation and they can't because they've deleted certain logs (as the SAME courts told them they have to do)?
Seems like it puts the ISP between a very uncomfortable rock and a hard place.
In Soviet Russia, government orders ISP to delete logs!
"Because: (a) some people commit actual crimes (like, the kind with victims) on the internet, and the ISP's logs are equivalent to the film from the CCTV camera across the street from a robbed bank;"
The CCTV camera doesn't watch *every* person in the world, 24/7/365.
Let's take a look at another example: telephones. You wouldn't tap a guy's phone until he was suspected of a crime, so why would you "tap" a guy's internet connection when he hasn't done anything to warrant suspicion? I'm all in favour of law enforcement being able to obtain warrants and order log keeping for particular users suspected of crimes, but doing it by default across the board is too extreme.