Slashdot Mirror
German Court Rules That Websites Can't Retain Logged IPs
tmk writes "The local court of the Berlin district of Mitte has barred the Federal Ministry of Justice from logging IP adresses of the visitors of its website. German law prohibits storing personal data for a longer time — if not needed for accounting. German privacy activists have started a campaign Wir speichern nicht, ("we don't log your data!") which provides manuals how to turn off the IP logging on your server."
My webserver == my home. You're welcome to visit, but you will obey the rules I set. If you don't want me logging you, just turn down my offer and be on your way.
Yes, this applies to everything else as well.
Global warming is a cube.
There has been a movement to INCREASE the amount of logging going and to force ISP's to maintain detailed records for long periods of their users actions. That is WAY more intrusive then a website logging your ip. You do NOT have to go to a website, you are bound to use an ISP.
Before all the privacy loonies wake up, remember that it is perfectly normal for ALL your phone calls to be logged and it is standard practive for the police to check them, with court order, if they suspect something.
The most common example of this is a bomb threath. The police will have a record of where the call was made from.
This ruling makes this impossible to do the same with a bomb threath send over the internet. Wouldn't this ruling make even the most basic web policing, the blocking of ip adresses, impossible?
This seems like an overly broad ruling that leaves a lot of web admins in trouble because they can no longer effectively manage their servers.
Yes it is a nice counter to the european wide move to log EVERYTHING but there is such a thing as balance. Logging everything is wrong, but not being able to log anything can lead to just as much trouble.
For all the slashdot privacy nutters I ask you this. How often have you sniggered when some scumbag was traced by online activists and had his private information published on slashdot?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
What if some users are uploading/downlöoading child pornography or other illegal material? How do I track down the motherfucker? Yes, some people will say, let everyone do whatever they want... But no, laws are laws and log files are an effective (yet, imperfect) way of keeping things in order, at a minimum. Is like having a law that says that all door locks are ilegal...
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!
As I understand this law is that my private server in Germany is now open for brute force attackers because I can't ban their ip address after 3 login failures? Heck I can't even break that law since everyone can easily tell that I'm using a ban list and just call the police.
I think someone in the German government should google brute force attacks and why ban lists are good.
I really doubt this is going to last, and nobody outside of Germany is going to take it seriously. Too many servers log IP addresses, if nothing else just because IIS and Apache do that by default.
Then there is the issue of competing laws. In the US, for example, federal encryption laws require IP addresses to be logged when certain pieces of software are downloaded.
Gifts for Geeks - Stuff that really matters!
So, you can't store people's IPs on your web server, but if you operate a TOR node, you do? Or only if you are ordered to by a court?
I think I'm confused.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Your logic is fallacious.
A single IP address is not necessarily associated with a single person. Correct. A -> B. This does not imply B->A in any way, shape or form.
The site actually doesn't make that argument, however. It makes the argument that an IP address is not permanently associated with a single person and easily changed for most (most ISPs here assign you a different IP on each login, out of a pool of millions; and most ISPs here do not allow connections to stay connected for longer than 24 hours).
Furthermore, the site states the exact opposite of your assertion a few paragraphs later. IPs are, in fact, personally identifiable to at least the government, police, and intelligence agencies (as well as foreign hostile intelligence agencies and witty hackers of the legal and technical kind) since ISPs store that data (even though they are not required to (yet) and actually currently forbidden to, lawfully.
Last, but not least, your jump from "it's not exactly 1 person == 1 ip" to "it's not personal data at all" is plainly wrong. Take phone numbers as an analogy. You can clearly change phone numbers. Are they suddenly less not associated personally with you, AT ALL ? Take credit card numbers. You can have many of them, or share one with several people, or even change them once they become compromised. Does that make them any less personally identifiable ?