Slashdot Mirror
Swedish Court Says IP Numbers Privacy Protected
oh2 writes "The highest applicable Swedish court, Regeringsrätten, has ruled that IP numbers are protected (in Swedish) since they can be traced to individuals. This means that only government agencies are allowed to track and store IP addresses, leaving 'anti-piracy' advocates with no legal way to find possible copyright infringers." Update: 06/18 14:42 GMT by KD : The original linked article had been pulled due to factual errors and a new article has been posted (link replaced above). Here is a Google translation. The new article makes clear that the ruling does not affect the anti-piracy efforts of rights-holders.
Update: 06/18 15:08 GMT by KD : Behind the link below is a summary in English of the article sent in by the submitter, oh2.
This autumn Datainspektionen will start monitoring how the IPRED law is applied when it comes to disclosure of personal information. A recent verdict in the Regeringsrätten, Sweden's highest applicable court, has upheld Datainspektionens decision that IP addresses are to be considered personal information and therefore protected under law.
In 2005 Datainspektionen ruled that collecting and storing personal information online like copyright advocates were doing was a breach of the Swedish PUL, Personal information act, that regulates how and what kind of information that can be traced to a single individual that can be stored. The anti-piracy organizations were quickly granted an exemption though, that expired March 31st. Starting April 1st this year IPRED allows holders of copyright to apply to the courts for this information.
Datainspektionen will now monitor closely how any personal information acquired from the courts in this manner is used by copyright holders.
Update: 06/18 15:08 GMT by KD : Behind the link below is a summary in English of the article sent in by the submitter, oh2.
This autumn Datainspektionen will start monitoring how the IPRED law is applied when it comes to disclosure of personal information. A recent verdict in the Regeringsrätten, Sweden's highest applicable court, has upheld Datainspektionens decision that IP addresses are to be considered personal information and therefore protected under law.
In 2005 Datainspektionen ruled that collecting and storing personal information online like copyright advocates were doing was a breach of the Swedish PUL, Personal information act, that regulates how and what kind of information that can be traced to a single individual that can be stored. The anti-piracy organizations were quickly granted an exemption though, that expired March 31st. Starting April 1st this year IPRED allows holders of copyright to apply to the courts for this information.
Datainspektionen will now monitor closely how any personal information acquired from the courts in this manner is used by copyright holders.
I see growing trade for companies who 'launder' access to other sites, and not just warez, but absolutely anything else. Perhaps there'll be more TOR exit nodes there now?
And no way for server admins to track what virus infected bots are trying to break into their systems.
This rule will hurt more than it will help.
This decision doesn't only affect anti-piracy hunters. Virtually all web companies track user ip addresses for various purposes.
Football Odds
http://www.dn.se/kultur-noje/nyheter/ny-dom-paverkar-inte-ipredlagen-1.894500
There's an exception to this law in the recently enacted IPRED-law (based on an EU directive) that basically allows rightsholders to gather IP-addresses anyway.
Money for nothing, pix for free
The article had a lot of errors and DN has replaced it with a new article: http://www.dn.se/kultur-noje/nyheter/ny-dom-paverkar-inte-ipredlagen-1.894500 In short: They can still do what they want, but they need a permit for it.
Sadly the Swedish anti-pirate bureau has an exemption allowing them to store the IP-addresses. This has already been updated in the Swedish press.
English is not my first language, so cut me some slack -: Om du kan lasa det har sa kan du Svenska
So If I run a web server in Sweden, all my apache logs are now illegal? Better block all my nationals.
Here's the new link.
The bottom line is that despite the ruling from regeringsrÃtten, APB may still collect IP addresses.
News for nerds, stuff that's English.
I'm going to fire off an email to my friends right now letting the know about this landmark decision. I'll also send it unencrypted so the NSA can hear about it too.
SJW: Someone who has run out of real oppression, and has to fake it.
Isn't the whole point of a publicly routable address to trace to a specific host or gateway? I sense some significant unintended consequences here. A ton of services will have real problems if this gets enforced thoroughly.
I'm comparing this to phone numbers in my head. Even if you have an unlisted number, should it be illegal for someone to write down your number if it shows up on caller ID when you call them?
The posted link didn't work for me, but http://www.dn.se/kultur-noje/nyheter/ny-dom-paverkar-inte-ipredlagen-1.894500 did.
I think overall this is a win for Copyright lobby and not the other way around.
1) Legitimises IP address being tied to account holder. IE lessens the "TOR/ Wifi Defense"
2) APB have gotten an exemption and are now allowed to track IP's.
So are they now illegal in Sweden?
Blessed be he who reads this post, Cursed be he who tells my boss.
If you are a server operator in Sweden, this presumably means you also cannot store IPs for later analysis of where your traffic is coming from. Now, you might say that IPs can be geocoded on the fly, but there are other issues:
You also can't log the IPs of attackers. You can't log IPs to analyze botnets. You can't log the IPs of spammers.
There are lots of legitimate reasons for private individuals and companies to store IP addresses. By forbidding it wholesale, the court is demonstrating its technological ignorance.
Finally, I'll just add that it's a common argument here that IPs don't actually correspond to individuals with any certainty because of shared computers, NAT, insecure wireless networks, dynamic IPs, etc. Clearly, the court here decided otherwise, and gave license to the government to record IP addresses. Thus, in future Swedish criminal court cases, it might be assumed that an IP address is sufficient to tie a defendant to a criminal act. I find that prospect much more disturbing than file sharers winding up in civil court on shaky evidence (which, if it's shaky, should easily be rebutted).
Sweden has some strange privacy norms. Asking what someone votes for politically is close to a serious faux pa. In fact some people I know have absolutely no idea how their parents or even partners vote. That is a very private thing. But you can look up car owners on a free and public website by registration number, you can go and check tax returns for anyone in Sweden, and see what they earn. On the other hand, religion is another area that you very much leave alone and don't ask about.
Hopefully the IP information will be considered something a little more private, and after the Pirate party did so well in the European elections maybe there is a chance that common sense will prevail and rules like IPRED will be struck down anyway.
In related news, the bandwidth usage in Sweden is back up to the numbers before the IPRED law was enacted. Normally the usage is low during the summertime, but apparently not this summer. It is speculated that the increase is because the law is pretty toothless at the moment, and the bandwith usage may decrease if the current investigation goes to court and leads to a conviction.
/ The Arrow
"How lovely you are. So lovely in my straightjacket..." - Nny
PARADIGM_REG ^= (1FASCIST_BIT_OFFSET); /*There ya' go, buddy!*/
So if I'm running an online forum or game of some sort, I can't drop IP-bans on offensive parties since that would constitute tracking an IP address?
I'm pretty much of the opinion that if you visit my website then you're volunteering your IP address. It's just like if you mailed me a letter or sent me an email. In either case you're supplying a return address.
"I'll create a GUI interface in Visual Basic, see if I can track an IP address."
Swedish Court Says: No you won't!
The summary clearly states that the logging of IPs is to be stopped. As a server admin, no, I don't give a damn about the actual ID of a person using an IP. But how am I to "report the IP" that is causing the problem if I can't log IPs to begin with?
SirWired
A short summary in english.
This autumn Datainspektionen will start monitoring how the IPRED law is applied when it comes to disclosure of personal information. A recent verdict in the RegeringsrÃtten, Swedens highest applicable court, has upheld Datainspektionens decision that IP adresses are to be considered personal information and therefore protected under law.
In 2005 Datainspektionen ruled that collecting and storing personal information online like copyright advocates were doing was a breach of the Swedish PUL, Personal information act, that regulates how and what kind of information that can be traced to a single individual that can be stored. The antipiracy organizations were quickly granted an exemption though, that expired march 31st. Starting april 1st this year IPRED allows holders of copyright to apply to the courts for this information. Datainspektionen will now monitor closely how any personal information aquired from the courts in this manner is used by copyright holders.
Now the world has gone to bed, Darkness won't engulf my head, I can see by infra-red, How I hate the night.
I like that IP numbers are protected when they are in Swedish, but I doubt I can keep up the accent.
...perhaps a little less googlish: http://www.allende.se/blog/2009/06/en-ipred-fant-balanserade/
Basically APB argues IP addresses are not personal data and can not be linked to actual persons, thus should not be govenerd by the Personal Data Law (or something like that PUL, Person Uppgifts Lagen).
The court ruled that since APB is using IP addresses to sue people who are participating in illegal file sharing, then obviously IP addresses can be linked to persons and are thus protected by PUL.
The PUL law as google translated it:
http://translate.google.com/translate?hl=en&ie=UTF-8&sl=sv&tl=en&u=http://www.notisum.se/rnp/SLS/lag/19980204.HTM&prev=_t
I oppose intellectual property, but I am often disappointed that most who do are inconsistent,
Many people explained that DMCA makes numbers illegal. Well, so is this. There's nothing wrong with storing IP adresses.
Information about people is information, just because you like privacy doesn't mean there's ethical magic surrounding this kind of information.
\u262D = \u5350
Next up: Street addresses and telephone numbers are banned.
An IP address cannot be *definitely* linked to an individual, but it's not totally random either.
What tiny bit I know about someone/anyone's law across multiple countries, I'd want this basic court level protection in place. Then we can go after removing the exemption for the copyright holders, and reinstating basic IT workflow. But the base law might be a step against the privacy-abusing laws that are a *worldwide* rage these days.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
It doesn't matter that they are protected or not... I can't read Swedish.
Your IP lease expired by DHCP server because the DHCP server violated privacy policy. You will be asked to go to the ISPs website to "opt-in" to have that data persistnant but - whoops - you have no IP to connect with...
They tie to a computer, not to a person.
And in many cases, they don't even do that.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
If I can use a standard protocol (ICMP, ARP, etc.) to determine your IP address, and such tools are available to anyone, then it is not reasonable to expect privacy. If I know your host name, I can get your IP. If you're connecting to my services via TCP or UDP, I have your IP, and kindof need it in order to do anything.
On the other hand, server logs with this info in it should be considered private. Your transactions between you and my server are business between you and me. You should have an reasonable expectation that I will keep that information private. I would not divulge the information unless it were required by due process -- a warrant or subpoena or whatever.
I haven't read the court's decision yet, so I'm not sure what they're really saying, but depending on context the information may be reasonable to consider IP addresses in some sense private.
You see? You see? Your stupid minds! Stupid! Stupid!
I don't think this has the implications a lot of people think it has. The courts are very able to say that storing IPs with the purpose of protecting yourself against attacks is acceptable, but doing it the way the APB has been doing it is not. In fact, if I'm not mistaken Swedish law actually does specify how information is to be used when you supply a service over the net. ISPs ( as an example ) are required to delete details when they are no longer used. Due to EU directives they may soon be required to store it for 6 months, but regardless it is clear that Swedish law does permit "service providers" to store information for as long as is necessary to supply their service ( and afterwards they are required to delete it). What is considered "necessary" is down to the courts to decide I guess.
It would appear that the courts have simply ruled that APB stored personal details in a manner that is not consistent with Swedish law. I.e, it's not just the fact that they stored it. It is also a matter of how they stored it, and why they did it. I very much doubt that a Swedish court is going to convict you for having an IP ban in your server config as an example.
Oh, and because this is Sweden I don't have to rant about how I'm not a lawyer.
Can I get a amen!?
Then I guess they are busy bringing charges against LiveJournal and every other website that stores IP addresses.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
Once upon a time it was possession and control of land, real estate, that caused friction, conflict, and wars. No more: land is a finite commodity. The new Last Frontier is this so-called intellectual property, where an infinite amount of things to control can be created out of thin air. These things don't require armies of soldiers to control them, instead they require armies of lawyers and expert witnesses. There seems to be an economy of scale to this new IP real estate, though, because it requires a whole lot less investment in hardware and human resources to control this IP than a coveted patch of land with armies and tanks and planes and guns.
!{those who are not{anti{privacy{piracy}}}};
If I understand correctly, this ruling does NOT affect webserver logs, because that person came TO YOU. It would, however, affect the legality of you selling or giving away those logs.
This is analogous to a doctor being able to keep records of his patients, but not able for that same doctor to sell or even disclose those records to a third party.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
Personal Data Act (1998:204)
"IP numbers are protected (in Swedish)". I did not know you could translate IP numbers from one language to another! Perhaps you pronounce it with diphthongs.
One ring to bind them - should probably have more fiber and less rings in their diet.
I would imagine that storing logs that show someone trying to brute-force attack your server would also be against the law. I would hope that any illegal act would be made pretty much impossible to prosecute because of a lack of identifying information from this.
That is the idea, isn't it?