Slashdot Log In
EU Approves Data Retention
Posted by
CmdrTaco
on Wed Dec 14, 2005 10:44 AM
from the finally-someone-is-being-data-retentive dept.
from the finally-someone-is-being-data-retentive dept.
submanifold writes "The EU have ratified rules that will force ISP's and other telecommunication companies to retain data for two years. This data includes the time, date and locations of both mobile and landline calls (as well as whether or not they were answered) along with logs of internet activity and email.
Apparently the content itself would not be accessible, merely the data concerning it. However, despite being touted as an anti-terrorist measure, the record industry has already admitted interest in aquiring such data."
Related Stories
[+]
Your Rights Online: U.S. to Gain Access to EU Retained Data 323 comments
shenanigans writes "After the EU recently ratified controversial data retention laws for ISPs and other telecommunication companies, it now looks like the US government will get full access to the data. From the article: 'US authorities can get access to EU citizens' data on phone calls, sms and emails, giving a recent EU data-retention law much wider-reaching consequences than first expected'. Apparently, the US has been calling members of the EU to 'ensure that the data collected [...] be accessible to them'."
[+]
IT: FBI Head Wants Strong Data Retention Rules 256 comments
KevHead writes "Speaking at a conference of international police chiefs, FBI Director Robert Mueller called for strict data retention guidelines for US ISPs. Echoing DHS head Michael Cherthoff's assertion that the Internet was enabling terrorists to telecommute to work, Mueller went further and said that the US needs stricter data retention guidelines. '"All too often, we find that before we can catch these offenders, Internet service providers have unwittingly deleted the very records that would help us identify these offenders and protect future victims," Mueller said. The solution? Forcing ISPs to retain data for set periods of time.' If that happens, how long before the MPAA and RIAA start asking to take a peek at the data too, as they have in Europe?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
I am going to be rich! (Score:5, Insightful)
Re:I am going to be rich! (Score:4, Funny)
Parent
Press release from FFII (Score:5, Informative)
Parent
Re:Press release from FFII (Score:5, Insightful)
But there appears to be no process for overturning the directive. EU directives override national law. This is a great success for the UK government which tried and failed to have this law passed in the UK.
Ironically, a report by the Commission just 4 years ago on the Echelon surveillance system [cr.yp.to] stated quite clearly that "Only in a 'police state' is the unrestricted interception of
communications permitted by government authorities."
The EU is now officially a 'police state', by the Commission's own words.
Parent
Re:I am going to be rich! (Score:4, Insightful)
Solution 1: The Mountain of Paperwork Method
Set up your system logging to pipe all that data to a line printer. When the authorities ask for your records, point them to a room in which there are a few hundred thousand pounds of unsorted stacks of fanfold paper. If you can convince all the ISPs out there to do this, the law will quickly be abandoned as not useful.
Solution 2: The Law of Information (a.k.a. Thermodynamics/Quantum Electrodynamics) Method
Send the data into a black hole. When they attempt to sue you for failing to retain the data, insist that they prove conclusively that the black hole did not, in fact, retain said data.
Solution 3: The One-Time Pad Method
Using an alpha emitter, generate a one-time pad. Make an offer to allow to use your OTP generator for a reasonable fee. Use this encrypted data stream to encrypt the log data. According to the rules of OTP encryption, destroy the pad immediately after encryption. Insist that if the police state wanted access to the data, they should have been paying for access to your OTP's data stream for the past several months. Hand them a hard drive containing random bytes.
Solution 4: The Laser Beam Into Space method
Encode the data by modulating a laser beam and bouncing the beam off of a planet orbiting a star that is at least three light years away. Upon questioning, insist that if the police state really needed that data, they should have launched a deep space probe centuries ago. Give them the opportunity to launch one now, but remind them that the Alpha Centaurians need the data, too, so if they hurry, they might be able to get the information by the year 2600.
Parent
two years? (Score:5, Insightful)
Re:two years? (Score:5, Insightful)
Yeah...I think about that ever time I go across the damned toll bridge down here. Was supposed to be toll only as long a period till it was paid for, which by now is way overly paid for.
I think now...the only operating cost is the actual toll booths they have to pay to maintain and man....
As for actual laws being repealed...about the only one I can think of in the US is the amendments for prohibition. Anything else repealed since then?
Parent
Volumes of Data (Score:5, Insightful)
There had better be some incentives for housing that kind data. For a busy ISP, that would mean GBs and GBs of data. Where's it going to be stored and who's going to pay for it?
Re:Volumes of Data (Score:3, Insightful)
Re:Volumes of Data (Score:5, Interesting)
I should have said TBs and TBs of data.
You mean YBs and YBs of data.
(http://en.wikipedia.org/wiki/Byte [wikipedia.org])
Parent
Re:Volumes of Data (Score:5, Insightful)
Parent
Re:Volumes of Data (Score:5, Insightful)
EU ISP customers. One way or the other.
Parent
Re:Volumes of Data (Score:4, Insightful)
EMC, for example, offers mass storage devices capable of coping with that.
I know a major ISP in Europe who has an EMC storage with several TB of capacity.
and who's going to pay for it?
The ISP. Which in the end means you, the customer. Nice, isn't it? Not only are you now under constant surveilance, you also pay for it yourself.
Parent
Re:Volumes of Data (Score:5, Insightful)
And where are the ISP's going to get the money to pay for this?
So for 50 bonus mod points,
Parent
Re:Volumes of Data (Score:4, Interesting)
And as the government's expenses have just risen, and it's workload increased, there will:
a) Be a tax hike to cover the cost that is given to the ISPs to retain the data.
b) Be a tax hike to cover the salaries of the extra bureaucrats required to fill in the paperwork to support the new directive.
c) Be a tax hike to cover the cost of the consultants to work out a way of actually sifting the signal from the noise (or pay for extra M.O.D. staff to do the work).
Part of that tax hike may be applied to the ISPs, so they'll end up paying more, so to recoup costs, they'll have to raise prices.
All of which comes back to bite the basic guy in the street right in the ass.
Lots of cost, no appreciable gain.
One day, the governments will learn that just because you can do something doesn't mean you should. They'll end up with so much noise, they just can't pick out the signal.
Parent
Re:Volumes of Data (Score:3, Informative)
The Dutch ISP xs4all [xs4all.nl] is actively campaigning [dataretent...lution.com] against this law.
They give the realistic argument that this law will commercially cripple European ISPs, and the government paying for the storage is unrealistic.
This story belongs in "Your Rights Online" (Score:5, Insightful)
Re:This story belongs in "Your Rights Online" (Score:5, Funny)
You might change your mind after a few months...
Parent
encrypted proxies (Score:5, Insightful)
The solution to the Recording Industry (Score:3, Insightful)
Why this is not ok (Score:5, Insightful)
Re:Why this is not ok (Score:5, Insightful)
People often joke that George Orwell was a mere 20 years or so off the mark, such delay perhaps caused by the very fear his book invoked in the hearts of those who would fall victim to such surveillance.
But the scary truth is, this is not a joke. As a majority of communications moves online, even as phone calls are now almost all routed at some point over an IP network, this is perhaps the single largest surveillance undertaking and law that I have ever seen pass. I cannot imagine that any citizen would accept this as representing their beliefs or desires. This is, in fact, one of the scariest things to happen in a long time.
What concerns me further is the reach this has. This is all data that passes over any EU country's network, meaning that any time I visit a website hosted in Europe, my data will be tracked. Any time I email someone in Germany or France, my information will be tracked. This is in no way just surveillance of the EU's citizenry, but of the entire world's.
I for one am off to fashion a tin foil hat.
Parent
Well, what about SMTP? (Score:4, Interesting)
So how can they keep track of my gmail account? That is unless they log all the throughput of data coming in and out of my computer, of course. Now I see a legal and proper use of eDonkey: keep on downloading and uploading free software!!! That way they have LOADS of data to log.
With a bit of luck, the next DMCA will also make that illegal! What a relief for the ISPs.
Re:Well, what about SMTP? (Score:3)
GMail will have to provide the data.
Yes, they thought about webmail. I had a copy of the specifications for the whole thing in my hands once. Everything passing through an ISP or other service provider (such as GMail) will be captured. The only way to be safe is to run your own mailserver and use TLS. And even then, your mails will be logged on the "other end", i.e. the guy you talk to, unless he's also running his own mailserver.
Re:Well, what about SMTP? (Score:4, Insightful)
Hang on - did I just compare my country to China? 8-O
Parent
Who doubts the endgame? (Score:3, Insightful)
If you think they're merely out for fair sharing, think again. I may hate the rights I've lost through Bush and Clinton's wars and social programs, but I see no real difference in Europe. In some ways I see fewer freedom and more tyranny.
Open WiFi access points make these rules useless.
Re:Who doubts the endgame? (Score:3, Informative)
A friend is visiting the States with us right now, her first visit. 23, female, college degree in economics. After converting from metric, she's blown away at how cheap electronics, food, gas, and even liquor is.
I'm starting a business right now in Europe (acrylics) and the pay vs taxes vs cost of living saddens me.
Good point (Score:3, Informative)
Time to pack up? (Score:5, Interesting)
Am I caught by this? It sounds like I am. Am I now expected to keep mail logs for two years and be legally liable if I don't? If so, I am almost certainly out of the business. Just not worth the risk to me.
Cheers,
Ian
Phew, that's a relief (Score:5, Insightful)
Of COURSE they're interested in gaining access (Score:3, Insightful)
It only becomes a problem when the authorities grant them access. They ask all they like, as long as they don't get it. If they do get it, then it's the authorities that should be blamed.
Time to get off the grid (Score:5, Interesting)
Having every aspect of my life recorded just scares the hell out of me. We have countried collecting Internet and phone usage. Many cities are putting cameras up to monitor your travel. All your purchases made via credit card are recorded. At work, your company probably monitors your email. Even companies like Tivo monitor your tv viewing habits. What else is left?? Governments/corporations will know damn near everything about you and what you do. I say to hell with this... I'm buying an island in the Pacific and starting my own country.
http://religiousfreaks.com/ [religiousfreaks.com]Of course... (Score:3, Informative)
Keep in mind that data will be kept for UP TO two years; most will opt for the minimum of half a year instead.
Exemptions for individuals (Score:5, Funny)
European individuals can gain exemptions from having their data retentioned if they sign a waiver giving away all rights to their first-born to the audio-video retail industry.
Those without children may instead put their signature at the bottom of a blank terrorist confession sheet and mail it to their local secret service. This will also automatically enter them into a free prize draw with many chances to win free flights to a European location of the CIA's choice.
--I for one welcome our new data-retentive overlords
Damn UK (Score:3, Interesting)
The UK opposes a lot of the good proposals of the EU (for instance, having completely free markets with respect to alcohol in Europe, so I would be able to order a crate of beer direct from Germany or a case of wine direct from Italy), and push through crap like this. And then the Brits all whine about the EU.
Encryption (Score:3, Informative)
Encrypt your private communications.
Use anonymous remailers.
If you actually get charged, they'll require you to give up your keys, but they won't be snooping at your E-mails behind your back.
pgp.com [pgp.com]
gnupg.org [gnupg.org]
Hardware? (Score:3, Insightful)
I run a small startup telco in the UK (Score:5, Interesting)
Any arguments from telcos who complain about the volumes of data are only using it so that they are not liable if someone arse deletes it.
Under UK privacy laws you have to delete the data identifying the particular person after you're done with the connection and the billing thereof.
Almost all transaction data is anonymised by a one way hash. Say md5sum. All the keys are done this way. Hashing removes the particular identification, and satisfies this. Almost always this hash uses more space than the original data anyways.
telcos use the hashed equivalents to evaluate aggregate data.
The law could ask for a tap and require you to retain those records anyway. These new laws just put into legislation what was already happening, and creating an offence for not doing it properly.
Make the records publically available. (Score:5, Insightful)
But the _reason_ they want these is to maintain social/political power over people. An elite with privileged access to all that information can control society. In a free society, either everyone should have the communications metadata, or no-one: It's unbalanced information availability that would give the police power to become the classic Big Brother. I'm a lot safer if everyone knows I have a particular embarassing sexual inclination or whatever than if only a small, powerful subset knows.
See David Brin's book "The Transparent Society: Will Technology force use to choose between privacy and freedom?"
New Market (Score:3, Interesting)
"ServStor" 36 GB drive! Guaranteed to die within 10 months!
Seriously though, how is the law going to deal with the inevitable but accidental data loss of that stuff? Criminal charges for obstructing justice just for being unlucky enough to choose equipment that turns out to be flakey?
Background (Score:5, Informative)
According to their own Press Service: Deal on EU data retention law [eu.int]; more comprehensive version in German: Ja zur Vorratsdatenspeicherung bis zu zwei Jahren - Keine Speicherung der Kommunikationsinhalte [eu.int]. Incidentally, even the latter "limitation" (allegedly no storage of the contents of communications) is void in particular with respect to URLs - these being identifiers for the contents transmitted anyway.
Loopholes aplenty have already triggered plans e.g. in Poland to extend the storage even further, to a staggering 15 years (!), and remaining safeguards (if any) are not expected to last: The media industry wants access to that data, too [zdnet.co.uk] (and a further directive is in the works, cf. the EU Legislative Observatory [eu.int]).
How soon we forget... (Score:5, Insightful)
It wasn't just that the data wasn't retained, the data was never even collected unless you requested it -- otherwise the only billing information that would be kept was a running counter.
Today, the supposedly-democratic countries want to use surveillance that would have given Gestapo and Stasi wet dreams; it's probably no coincidence that the prime ministers in the countries that have pushed the most (UK and Sweden) have been ones acting like power is a God-given right to them personally.
Send in your data voluntarily in protest (Score:5, Interesting)
When you click on the "Skicka"-button, the information will be sent to the Swedish minister of justice (the guy on the picture), so that he has access to the data immediatelly instead of having to look through the ISPs.
Now, the point with this protest is to make mr. Bodström realise how much data that is going to be stored. So, slashdot-people, you can do it.
Back to repeat earlier mistakes? (Score:5, Interesting)
Then came World War Two. As the German Army overcame and occupied Allied countries, they immediately headed for the Post & Telecommunications (or Telegraph) offices. This was to sieze the call records maintained there. They then looked up call records for known Allied agents and sympathizers, Jews and other groups. They used these call records to discover who was talking to whom and went to investigate and/or arrest people who might also be agents/Jews/Etc., or collaborators. These people were then sent to prison, or worse.
After the war, Western European countries decided not to keep call records any longer and instead moved to a metered system. This prevented a reccurance of the bad situation they found themselves in while occupied.
Now these records have been reinstated, in a blatent case of not learning from earlier mistakes. It seems the phrase "Those who cannot learn from history are doomed to repeat it" has once again been demonstrated.
Re:Gimme a break (Score:5, Insightful)
In order for this to happen, you have to stop supporting them. Don't buy (or download) their products. Don't listen to their mass marketed drivel. Tell your friends, your family, and everyone else you think will listen that every time you support these companies, you are chipping away at your freedoms.
As long as the majority of us continute to pay the record industries money, they will simply continue in their quest to make sure that we all pay them more money. If we stand up for our rights, stop buying their products, and make sure that they realize that they are here to sell entertainment to us, and that we do not exist to buy entertainment from them, then that will be a start.
All this talk of "screw them" and "I hope they die off" and whatever else will do nothing to protect our rights, especially when governments are making it easier and easier for these corrupt and greedy companies to infringe on our privacy.
Parent
Re:Gimme a break (Score:3, Insightful)
Either way, the customer is screwed.
Re:Gimme a break (Score:3, Insightful)
Re:Basic IT Knowledge (Score:3, Informative)
Yes, it will still be an expensive PITA, but probably no worse than running a Usenet service.
Re:Filesharing and this law (Score:5, Insightful)
No ports, no IP's. The folks who came up with this don't think that far.
They think that:
- e-mail is just like phone
- spam does not exist
- ISP's only handle private traffic
- ISP's handle ALL traffic, and have full access to it
- Only EU citizens use ISPs in Europe
- Encryption does not exist
- No-one has his own mailserver
- No-one is going to try to make money by offering tunneling services to non-EU countries
- Terrorists are dumber than they are
It's not that they want every ISP to scan all packets. They're just thinking like lusers. They think internet is managable.
Their plan sucks. It doesn't work, it's leaking like a raincloud, it's unconstitutional for a lot of member states, and they bombard ISPs with costs, work and responsibilities they never asked for and they KNOW is bullcrap.
It's absurd.
Parent
Re:A scenario (Score:5, Interesting)
What you need to do instead is look at the opposite situation - what bad can come from it? Why stop at just the ones you talk to directly? Maybe you're talking through secrect codes on mailing lists, so we need to up the net to the ones you've talked to AND the ones that the ones you've talked to have talked to. Two degrees of seperation. Then we'll be getting somewhere. And we can then get a much clearer picture.
Of course, the terrorists know this, so they'll be very elaborate and set up systems with three degrees of seperation. Might even get brilliant and go to four.
Then what? Even with two degrees of seperation, just how many people do you think will come under suspicion (which of late seems to equate with guilty until proven innocent - but we won't give you that chance)? Me, I have maybe 50 people I talk to directly in any given month. Two degrees of seperation that's at LEAST 2,500 people suspected of whatever I am. Go to three, and it's 125,000.
You'll be throwing out nets so far, you'll drown in useless data. So now you have information you can't use AND you've incriminated 125,000 people because you suspect one guy. They're now on your watch list - just in case.
Me - I'd rather we said "fuck the best case scenario" and concentrate on the worst case scenario. And by that I don't mean me barely surviving being near $explosion. I mean me getting assraped by $government_agency for no aparent reason and no way of redeeming myself - after all, I wouldn't be on their list if I hadn't done something bad, would I?
It's like torture. Sure, the upside is "suppose we know for a fact, 100% irrefutable, that $person knows what we need to do to prevent $bad_thing" - do we torture him to get the information? That's not an interesting question - the interesting question is - "we are fairly confident that YOU (yes, you, Syberghost) know what we need to do to prevent $bad_thing. You refuse to tell us (because you are innocent), but we are even more confident that we can break your spirit and make you tell us what we want to know - how to stop $bad_thing from happening." Do we torture you?
THAT is the question you need to ask. Best case scenarios are like dreaming of getting blowjobs from beautiful women while being served great food prepared by the best chefs in the world - not very useful.
Parent