Slashdot Mirror
Sonic.net's CEO On Why ISPs Should Only Keep User Logs Two Weeks
Sparrowvsrevolution writes "Dane Jasper's tiny Internet service provider Sonic.net briefly took the national spotlight last October, when it contested a Department of Justice order that it secretly hand over the data of privacy activist and WikiLeaks associate Jacob Appelbaum. But Sonic.net has actually been quietly implementing a much more fundamental privacy measure: For the past eighteen months it's only kept logs of user data for two weeks before deletion, compared with 18 to 36 months at Verizon, AT&T, Comcast, Time Warner and other ISPs. In a lengthy Q&A, he explains how he came to the decision to limit logging after a series of shakedowns by copyright lawyers attempting to embarrass users who had downloaded porn films, and he argues that it's time all ISPs adopt the two-week rule."
excellent good sense, what more can one say?
-wb-
It is truly shocking that some people resist the idea of the police state! If for your own good! Think of the children! The only people with anything to hide are terrorists and criminals!
Face it, folks. The bottom line is, our governments and the corporations that control them, want a police state. They are afraid of freedom, and they will go to any lengths to limit freedom. Badmouthing the president is cause for the Secret Service to put a bullseye on you, and your communications channels. Exposing fraud in the corporate world is reason to haul your ass through the court system, and to take everything you own, along with everything that you might ever hope to own. And, cheating an author out of a dollar of royalties? Phht - ten years in prison sounds about right - to the police state, anyway.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Kudos for having the balls to do this in the face of (gov't) adversity. Too bad it's unlikely for the big ISPs to do the same. They rely too much on gov't help/assistance/looking-the-other-way to want to rock the boat.
European law forces ISPs to retain traffic data for half a year. Germany is the only state currently refusing to implement the law, but I don't have any illusions that this will last.
Is multi-year log and data retention required by law, as it already is in the EU.
And if more ISP's jump on the 2-week "band-waggon" you'll quickly see one of the next "Defence Appropriations Bill" (or something like that) have a little addition sneaked in by someone in Homeland Security to legally require ISP's to hold 12 months of Logs/Emails.
Just like what's happening in the UK...
Laters Sol "Have you found the secrets of the universe? Asked Zebade "I'm sure I left them here somewhere"
18-36 months for user activity logs? Really? If they do that voluntarily, they have no credible argument from a cost perspective to ever say "no" to the government. None. Period. The amount of data they're freely taking on there is so high that the government can easily justify telling them that they must warehouse all activity, all users (past and present) indefinitely at their cost.
I simply cannot believe the bean counters are ok with this.
Two weeks is sufficient time for ISPs to be able to do things like tracking down abuse and perform troubleshooting/tech support but short enough that a government bureaucracy and/or a gaggle of RIAA/MPAA lawyers would likely not be able to prepare and serve out a search warrant or subpoena in time.
As far as I can read (which is not too far... I didn't dig deeply), the European directive doesn't specify that the data has to be stored electronically. All it says regarding storage requirements is: Member States shall ensure that the data specified in Article 5 are retained in accordance with this Directive in such a way that the data retained and any other necessary information relating to such data can be transmitted upon request to the competent authorities without undue delay.
So why not spool your old logs onto microfiche? And when you get a demand for logs, hand over all the films and say "Go nuts!"
If you want to congratulate someone, congratulate those who teach the public to vote that "two week rule" with their money.
If neither the local cable company nor the local DSL company observes the two-week rule, should people vote with their feet and move to a different city? The consensus last time I asked was that moving is not practical.
If you read all the way to the end, there's a great question about whether ISPs ought to market the privacy features of their VPN/Proxy solutions, and his response is that this kind of "privacy" is really just a cover for piracy. If you were a Chinese dissident, you'd be using something like Tor, not a private-label VPN. So, he cannot even market his policy of short-term logs, because he doesn't want to become a magnet for pirates. I'm really beginning to hate piracy. It has messed up so many things.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
Someone always want to be able to ask if a particular person has read "Steal This Book", or "How to Build an Atom Bomb". Librarians get that kind of demand all the time, and have successfully fought it at the personal and also at the technical level.
I once worked on library software, and it was a prerequisite in the business that, as soon as a book was returned or the non-return fine was paid, the record that "user X borrowed book Y" was deleted, and a counter of completed transaction was incremented. The latter was necessary for funding and statistical purposes.
This was a norm because the library community actively went out and found a number of states, Germany among them, that protected library patrons from snooping without a warrant. They then made that know to their software suppliers. As the software had to be legal in all the countries where it was to be sold, it was written to meet the highest legal standards, which included the highest privacy standards.
If a legitimate investigation needed to track a library patron's reading, and the investigator could convince a judge, then the library could put a watch on a patron in exchange for a warrant. The watch could not start in the past, of course, but a daily sql query could find out the books a patron currently had out.
There is at least one DHCP program around, written by an ex-librarian, that behaves just this way...
--dave
davecb@spamcop.net
For those who argue that they have nothing to hide, I suggest they read Daniel J. Solove's "I've Got Nothing to Hide and Other Misunderstandings of Privacy" for a succinct explanation of the issues.
For those with more detail-oriented interests, I suggest picking up a couple of his books on the issue of Privacy. A partial list can be found at his website.
Learning HOW to think is more important than learning WHAT to think.
Because a government that can search any person at any time can falsely incriminate anyone, and motives for doing so are abundantly self-evident.
"During a routine anti-terrorism sweep, civil liberties activist John Doe was found to be in possession of methamphetamine, child pornography, explosive-making material, and pirated ABBA songs. He was immediately taken into custody and is being held at an undisclosed location for the public's safety..."
Right now we have an important check in the form of a search warrant. Before searching me, a law enforcement agent must demonstrate to a judge probable cause that I have committed, or will commit, a crime. It's not perfect, and there are notable loopholes, but at least there is some documentation and accountability.
Cynicism, like dogmatism, can be an excuse for intellectual laziness. - Susan Shirk
Summary links to page two of the article.
page one
I'm a network analyst for a Rual ISP, and we keep DHCP logs for 1 month, pending no DMCA request. If we do receive a DMCA request we look up the customer's DHCP records, and record a separate log containing only that customers DHCP records; flushing the remaining logs.
Unlike larger ISP's, we don't turn over anything unless it's a court ordered.
Oh, and we don't forward on those drive-by copyright infringement notices from copyrightsettlements.com, but we do retain them for legal reasons, but nothing emailed to us is considered a valid request unless it is snail mailed via certified mail.
This is about money, and not privacy. The major ISP's are starting to fight (and win) subpenas trying to identify their clients, not because they care about privacy, but because it is cheaper in the long run. The ISP in this case is also trying to lower their costs with their 2 week record retention policy. There are three ways this reduces their costs.
1. Their logs are gone in 2 weeks so those who would attempt legal action will have an impossible time window of 2 weeks to file a case and get the court to agree to their subpenas.. The ISP simply replies checks the time frames specified in the subpena and if ti is more than two weeks ago they reply with a form letter that says "Our records retention policy requires that we delete all logs over 2 weeks old" so we are unable to provide the information requested. Case closed with a form letter, lawyer paid almost nothing. Eventually the folks filing these cases will get the message and stop trying and then you can fire the lawyer...
2. The labor required to service subpenas will be reduced, both in the technical and legal departments so they can reduce labor costs and save some money.
3. There will be a slight reduction in disk space required (albeit pretty limited) to store logs. This is not a huge issue for a small ISP, but it might lower their hardware and maintenance costs.
This ISP is not trying to protect anybodies privacy, and they admit that fact. They will gladly take advantage of PR generated by folks who would see this as a privacy issue in order to get more customers, but this is not about privacy it's about saving money.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
ISPs should be like electrical companies, gas companies or water-works.
In other words, yes, keep track of how may kilowatts or liters of your service I used, but not whether I powered my toaster or made coffee, that's none of your business.
I don't know the meaning of the word 'don't' - J
... as my ISP. There service is great (I can't remember ever having any downtime or slowdowns with them), and they actually respect their customers. Whenever I see promotions from Comcast or ATT in my mail, I toss them without even looking at their price. Those jerks can't offer a price low enough for me to switch.
False. Before searching you (in conditions that don't permit warrantless searches), a law enforcement agent must demonstrate to a judge probable cause to believe that a search with the parameters specified in the warrant application will unveil evidence relating to a crime (the specific type of evidence also being specified in the warrant application.) They only have to provide probable cause that you committed a crime if they want an arrest warrant, which is not the same thing as a search warrant.
And, at least until Pre-Crime Division is authorized, providing probable cause to believe that you will commit a crime in the future isn't grounds for any kind of warrant (though grounds to believe that may be relevant in bail or parole hearings, but that's a completely different set of issues from warrants.)