German ISP Forced To Delete IP Logs

An anonymous reader writes "A German federal court decided today that T-Online, one of the largest ISPs in Germany, was obligated to delete all IP logs of a customer upon request to guarantee their privacy. From the article: 'The decision (German) does not mean that T-Online is now obliged to delete all their IP-logs, the customers first need to complain. But, if they ask T-Online to delete their IP-logs, the ISP has no other choice than to comply. A lawyer from Frankfurt already sketched a sample letter (German) to make this process easier.'"

Comments

The way it should be.

[rolyatknarf]

There's not a chance in hell that anything like this would ever happen in the United States. I hope it works for the Germans. This is the way privacy should be treated. The people have rights.

Re:The way it should be.

[rolyatknarf]

Yes, an ISP in the US could delete the logs but I think that is unlikely. I believe we all know that our government is already pushing for, and probably already has arrangements with communication and information companies to retain records.

Re:The way it should be.

[Benaiah]

64bits for an ip.
48 for a mac.
how big is a datetime? give it 128.
30 bytes being generous.
another datetime for disconnect.
30+30+8+6 = 74bytes
why not make it a clean 100 bytes.
If you stored the connection details for every single possible ip adress in the 64bit space.
you got 4billion connections a day at 100 bytes.Thats only 400g
So the entire worlds isps would only generate 144TB of connection data a year and only if everysingle ip in the space was used and being connected everyday.

A few thousand TB is waaaaaaaaay off mate.

Re:The way it should be.

[KnuthKonrad]

Germany takes privacy laws to the extreme, in my opinion.

As a admin, working for a german company in Germany, I know that our privacy laws are a PITA.

As a german citizen, living and working in Germany I think our privacy laws are way too relaxed.

That said, I very much welcome the decision of the court. We had a couple of similar decisions lately. And one always got the impression that the judges not only talking about the very case they had to handle, but that their sentence was also aimed at our politians to show them how german courts think about the EU data retention act. This one can't be trialed in Germany yet, as it hasn't become german law as of now. So this seem like a warning about what to expect when that gets taken to court, once it made it into german law.

Re:The way it should be.

[1u3hr]

Let me explain. I do not "expect" privacy. I do not "expect" all ISPs to spend millions of Euros on logging mechanisms based on each user records. The impact of this is huge. Currently all user activities are normally written to a single log file. The files are normally rotated based on time.

This case is about deleting a particular user's records. If you don't keep them, you don't have to do anything. You seem to say you'll need to create an all-encompassing tracking system so you can selctively delete the records. Just delete them all as soon as you've abstracted any information you need for billing or debugging.

Has anyone asked what the plaintiff has to hide? hope he gets cyber-stalked by a hate group

In TFA: "The court ruling is the result of a case that was initiated by Holger Voss, a 33 year old man from Münster. Voss was sued for making a sarcastic comment in an Internet forum back in 2002."

Sarcasm? Yeah, he totally deserves to be stalked and vilified by a hate group. That'll learn him not to mouth off.

Requests to delete server logs

[Neoncow]

Requests to delete server logs, however, will be logged.

Re:Requests to delete server logs

[Duncan3]

Fear not! Google has a copy.

But no privacy in the land of the free

[Salvance]

I wonder why the average American (or Brit) doesn't demand the same level of privacy that many of the mainland Europeans now have? While some other freedoms (e.g. speech,press) are more limited in countries like Germany, there appears to be a strong right-to-privacy movement backed up by the government.

Sure, our media and government pay lip service to privacy issues, but the reality is that our government wants to increase monitoring in the name of fighting terror. Compare this story of Germany forcing the ISP to delete logs for a customer to this one outlining yet another argument by US officials to require ISPs to maintain even more user data.

I'd hate to see us to become a 'surveillance society' like Britain has. Unfortunately, we seem to be quickly heading down that path, particularly since our citizens haven't yet raised up to demand greater freedom.

Re:But no privacy in the land of the free

[foobsr]

some other freedoms (e.g. speech,press) are more limited in countries like Germany

Any source? Just curious, as I am living in Germany and did not really realize.

Also:

Press Freedom Index 2006

CC.

Re:But no privacy in the land of the free

[Jugalator]

He may be considering hate speech laws, but then, on the other hand, is he considering free speech zones in the US, and so on? I'm hesitant to call freedoms more limited in countries like Germany for this reason, especially with the actions GWB has taken in the US lately.

Re:But no privacy in the land of the free

[nath_de]

Sorry, but you're wrong there. Copyright for "Mein Kampf" has fallen to the state of Bavaria after Hitlers death (since there were no heirs). You can only get an annotated version as Bavaria won't publish the original version. 2015 the copyright should expire (70 years after authors death) and the book should go into the public domain (barring any changes to copyright laws).

Re:But no privacy in the land of the free

[Trevelyan]

UK does have laws protecting peoples privacy. Namely the Data Protection Act and Rights of Investigatory Powers Act. The first one controls disclosure as well as providing means for individuals to review the data kept about them. The second controls what a co. such as an ISP can do with the data (eg traffic logs) as well as what the authorities can do. The two together means that you have to be able to justify the data you keep and for how long you keep it. The network that I work for does not keep data for longer than 3 months, unless it relevent to some network issue/investigation, then its kept for 2 years; but never indefinately. Lastly there is also the Freedom of Information Act, which allows citizen access to all sorts of government and civil service information and documentation. So you can double check their procedures for example.

Re:But no privacy in the land of the free

[dajak]

People sometimes do learn from history, though the knowledge probably gets diluted with time and distance.

The fear of politicians and government of being perceived as nationalist sometimes has perverse results. Here in the Netherlands we used to have a historical curriculum that identified tolerance as a key part of national identity, but the reluctance of government to prescribe historical dogma about "our ancestors" gives license to for instance schools with a majority of muslim pupils to gloss over impopular subjects like the holocaust and the eighty years' war (1568-1648), where "our protestant ancestors" are the ones being persecuted.

Teaching children about the attack by the resistance in 1943 on the population register in Amsterdam, with the intent to burn it down in order to frustrate Nazi bureaucracy, is the best way to instill respect for privacy. Reference to this event that most people know about is a powerful antidote to suggestions that "you have nothing to fear if you are innocent": it was the Dutch government that, in better days, compiled the data that allowed the Nazis to trace most jews (population register) and gave them few places to hide (cadastral maps). What to remember and what to forget is still a policy choice.

The US and continental Europe have different experiences of, and therefore perspectives on, WWII. For the US, WWII is a license to interfere militarily in perceived Nazi regimes abroad (as they did in WWII), while formerly occupied countries, and Germany itself, are busy simply not being a Nazi regime.

A question for network admins

[gaijin99]

I'm not an admin, and never have been so I'm working on ignorance here. But my question is, why bother with long term logs anyway? I understand a need to keep logs of activity for a week or so to deal with various attacks, zombie machines, etc, but why not set the logs to automatically wipe anything past that point? I can see maybe going nasty and selling it to advertisers, but other than stuff like that is there a use?

Re:A question for network admins

[Burdell]

I work for an ISP. As part of my job, I handle abuse reports. Often
reports are for events more than a week old (typically worm type reports
come fast, but spam reports are often delayed because the recipients
don't read their email every day).

We also use long-term data for trend analysis: which POP needs more or
less dialup lines, who dialed in to a POP (with how much they pay, does
the POP make financial sense), etc.

While trend analysis doesn't require IP addresses (for the most part),
the call database has a record per call that includes the IP (same
database as used for IP abuse lookups). To not retain IP addresses,
we'd have to set up a second database, second lookup interface, and some
transfer mechanism between the "with IP" and "without IP" databases.
That's a real PITA, so we don't do that.

Australia..

[swordfishBob]

It should work in Australia. Privacy laws here state that:
- If I ask a company operating in Australia what information they have about me, they are obliged to tell me
- If I ask where they got this information, again they must answer
- If I ask the same company to remove such records, AFAIK they must, though there are reasonable exceptions to this one. (e.g. if i've done business with them, they have to keep financial records. if it's my bank, they might have to cancel the mortgage to comply..)
- Companies operating here are not supposed to pass on private information without consent, which is why so many competitions and things have clauses in tiny writing to get your consent.

Re:Australia..

[Heir Of The Mess]

You must be from America. Americans often send us Australians instruction manuals in German because they think everyone speaks German in Austraya.

Blurb text misleading

[mxs]

Not /exactly/ true. The sample letter speaks of a complaint, but T-Online has every choice not to comply.
The linked webpage then recommends sueing T-Online in that case. If/Once you win that lawsuit, T-Online has no choice but to comply. This is a tad different from what the blurb here would have you believe.

(All this is based on rather strict privacy laws that require a provider not to collect any data not relevant to accounting; since IP addresses and data volume is not needed for accounting on plans with a flat fee per month, T-Online has no right to do so; they, however, save that data for 80 days.)

Re:What type of logs?

[mxs]

Radius, actually. That particular ISP does not use DHCP; all (A|V)DSL(2\+?)? connections are handled with PPPoE, so you get your IP from the PPP session set-up. Connections are reset every 24 hours automatically, and you do not usually get the same IP again after 24 hours (they claim this is done for technical reasons, which is, simply put, BS :)

Not quite as good as it looks

[njdj]

The original article points out that keeping logs is incompatible with existing German law. But the law will soon be changed, because Germany will have to comply with an EU directive mandating that logs be kept for at least 6 months. Germany has already asked for an extension of the deadline to comply with this, but the strong likelihood is that the German privacy laws will be changed to comply with the EU-mandated snooping.

EU pols and bureaucrats are as hostile to personal privacy as US pols and bureaucrats.