Data Retention Enthusiast Says Those Against The Idea Just Want Everything 'Free Of Charge, Free Of Responsibility'

from the dirty-pirates dept

Arguments over whether internet connection metadata should be retained for law enforcement purposes are raging around the world, but nowhere more heatedly than in Australia, where a new law bringing in data retention is currently being rammed through parliament. This has provoked widespread criticism of the move as unnecessary, intrusive and ill thought-out. Defenses have been thinner on the ground, which makes this column in the Australian newspaper The Age particularly interesting. The author, David Wroe, seems to think that the problem is a failure to explain what's really going on here:

Plans to force telcos to keep people's phone and internet metadata for at least two years haven't been explained as thoroughly as they probably should, with the consequence that many Australians remain confused and vulnerable to excessive claims that their privacy is being trampled upon.

Well, it's certainly true that the Australian Attorney General George Brandis, who is responsible for bringing in the data retention law, was very confused when he was asked to explain metadata in a TV interview. But rather than dispelling that confusion by pointing to explanations of what metadata can do, Wroe simply makes the following claim:

A data retention regime of two years, with proper precautions around how that data it is accessed by authorities, is reasonable, proportionate and necessary.

No support is provided for that statement. That's not really surprising, because all the evidence we have is that data retention simply doesn't help. In Germany, for example, police records show that blanket data retention had no effect on crime statistics:

The national crime statistics recently published by Germany's Federal Crime Agency reveal that after the policy of blanket telecommunications data retention was discontinued in Germany due to a Constitutional Court ruling on 3 March, 2010, registered crime continued to decline (2007: 6,284,661; 2008: 6,114,128; 2009: 6,054,330; 2010: 5,933,278) and the crime clearance rate was the highest ever recorded (56,0%). Indiscriminate and blanket telecommunications data retention had no statistically relevant effect on crime or crime clearance trends.

In Denmark, police found that retaining huge quantities of internet connection data actually made things harder for them:

"Session logging has caused serious practical problems," the ministry's staffers write in the report. "The implementation of session logging proved to be unusable to the police; this became clear the first time they tried to use [the data] as part of a criminal investigation."

Leaving aside this inconvenient fact that there is no evidence that data retention helps, here's one of the author's arguments in its favor:

It is absurd to allow a situation in which police might need to establish whether one criminal suspect phoned or emailed another suspect last year only to find the telco has already wiped those records.

Not really: we don't expect DNA or fingerprints from the scene of a crime to be preserved years later. We hope they may be available soon afterwards, and in the same way there's no reason why the police might not ask ISPs to provide information about recent online activity of a suspect. But it is not reasonable to expect everything to be kept for years, just because it's possible -- not least because this allows the authorities to engage in fishing expeditions and thus apply the Cardinal Richelieu approach. There's also no reason why the police should not be required to obtain a warrant before doing so, despite what Wroe says:

Some have called for warrants to be required for accessing metadata. This would be too unwieldy.

Warrants have worked well enough in the past, so why discard them now in the digital field? Because they might put a brake on the routine use of stored metadata by the authorities? That's a feature, not a bug: it would help to ensure that its use were truly proportionate, unlike the system proposed by the Australian government. Here's another attempt to defend data retention:

Arguments that retention is pointless because ill-doers can use encryption programs to hide their identities, or because the regime won't capture overseas data – meaning Gmail, Hotmail and other US-based services are exempt – are silly. Nothing in a free society is foolproof; something is better than nothing.

But when that "something" is such a marginal improvement on nothing, and comes at such great cost -- both financially, in terms of the burden on ISPs and taxpayers, and socially, through the damage to the privacy and freedom of the public -- then it is hardly rational to proceed purely because it is "better than nothing," especially in the absence of any more compelling reasons.

As this indicates, the author's arguments in favor of data retention are weak; but what is most striking is his attack on those who defend their right to privacy, and dare to challenge the badly-planned rush to impose mass surveillance on Australians:

At the heart of the anti-retention argument is an attitude that everything to do with the internet should be free: free of charge, allowing unlimited downloading of pirated content, and free of responsibility, meaning that nothing we do on the web should be discoverable later on.

In other words, anyone against massive, disproportionate surveillance is probably just some kind of dirty copyright thief.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, data retention, david wroe, george brandis, privacy

Despite Lack Of Evidence It Will Help, Australia Still Planning To Bring In Data Retention, Still Not Clear If It Could Be Used Against Copyright Infringement

from the learning-the-hard-way dept

Last year, we noted that one danger of bringing in data retention in Australia is that stored metadata might end up being used for all kinds of purposes that have nothing to do with fighting "terrorism," its principal justification. One particular concern is that it could be used to hunt for people downloading files illegally. Several months later, the signals are still very mixed. On the one hand, we have the following, as reported by the Guardian:

Authorities are not interested in using the Abbott government's proposed data retention scheme to go after internet pirates and would be prevented from doing so by the commonwealth ombudsman, the assistant commissioner of the Australian federal police, Tim Morris, has said.

Morris also said any changes to the way metadata is collected and used would have to be approved by the ombudsman.

But that guarantee is less than watertight because of the following:

The ombudsman, Colin Neave, has told Guardian Australia his office would not play a formal oversight role in the scheme and would give advice only at the attorney general’s discretion.

The Greens senator Scott Ludlam, noted that the ombudsman's oversight provided only "weak" protection against function creep, and that the public could not therefore depend on Morris’s assurances that the scope of the scheme would not expand in the future.

Whether or not stored metadata will be used against copyright infringement may be in doubt, but it seems that the Australian government's intention to bring in data retention is not, despite the fact that when asked on multiple occasions for evidence the move was justified, it has been unable to provide any. That's not really surprising given the Danish experience that keeping this kind of data didn't help, and may actually have hindered police investigations. Sadly, it looks like Australia is determined to discover this fact the hard and expensive way.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, copyright, data retention, george brandis, piracy, surveillance

European Commission Wants Collection And Retention Of Passenger Data For Everyone Flying In And Out Of Europe

from the open-breach-of-fundamental-rights dept

Another day, another shameless exploitation of the Charlie Hebdo attacks. We've just reported on an EU call for Internet companies to hand over their crypto keys; now the European Commission is trying to push through a requirement for wide-ranging information about everyone flying in and out of Europe to be collected and stored for years. As reported by the Guardian:

The European commission plan to be published on Wednesday would require 42 separate pieces of information on every passenger flying in and out of Europe, including their bank card details, home address and meal preferences such as halal, to be stored on a central database for up to five years for access by the police and security services.

The European Commission calls its plan (pdf) a "workable compromise", and goes on to list revisions that it claims address concerns of the European Parliament's Civil Liberties Committee, which rejected the whole idea of blanket retention of "Passenger Name Records" (PNR) back in 2013. Statewatch provides a summary of the main changes:

Changing the scope from "terrorism and serious crime" to "terrorism and serious transnational crime";

Reference to all the offences covered by the European Arrest Warrant is replaced by "a shorter list of offences that a relevant to transnational travel";

Reducing the retention period of the "full PNR" from 30 days to seven days, and changing the longer "depersonalised" retention period to four years in relation to "serious transnational crime" (it remains five years for terrorism);

"establishing stricter conditions for access to PNR data" including "the appointment of a Data Protection Officer within the national units responsible for the processing of PNR data";

"explicitly spelling out the rights of passengers to have access to their PNR data (retained by the PIU) and to request the modification or erasure of their data";

Whether or not these are enough, the Greens MEP Jan Philipp Albrecht, who is vice-chairman of the European Parliament's Civil Liberties Committee, points out a more fundamental problem with the proposal:

"The commission plans are an affront to the critics of the European parliament and the European court of justice who have said that data retention without any link to a certain risk or suspicion isn't proportionate.

"It is an open breach of fundamental rights to blanketly retain all passenger data," he added.

Albrecht is referring to the important judgment handed down by the EU's Court of Justice last year, which ruled blanket data retention was "invalid". The European Commission is acutely aware of this issue, and says right at the start of the leaked document:

The proposed compromise takes due account of the judgment of the Court of 8 April 2014 on the Data Retention Directive, as far as the judgment appears applicable to PNR.

However, it is by no means clear that the current proposal would in fact be regarded as "valid" by the court. Moreover, the Commission's document admits that it is anyway likely to meet resistance in the European Parliament:

In case the Commission would adopt its revised proposal without an accompanying Impact Assessment, the [European Parliament] or in any case some political groups would likely express their criticism, given the important implications derived on PNR from the [EU Court of Justice] ruling on [Data Retention Directive].

As that indicates, this move is just part of a larger argument within the European Union about how much surveillance of European citizens is appropriate, how long data about them should be retained and with what data protection safeguards. That, in its turn, feeds into even wider discussions with the US over the Safe Harbor agreement, NSA spying and the inclusion (or not) of a chapter on data flows within TAFTA/TTIP and TISA.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, european commission, passenger data, privacy

Latest EU Country With Legal Challenge To Blanket Data Retention: The Netherlands

from the gathering-pace dept

Last week we wrote about how a ruling by Europe's highest court, the EUCJ, that blanket data retention was "invalid," had received a further boost from an analysis by the European Parliament's legal services. That, in its turn, made it more likely that more overbroad data retention laws in EU nations would be challenged, as has already happened in the UK and Sweden. Here's one such move in the Netherlands, as reported by Computerworld in Australia:

After evaluating that ruling [of the EUCJ] the Dutch government decided in November largely to maintain the national data retention law on the grounds that it "is indispensable for the investigation and prosecution of serious criminal offenses." Only a few adjustments to the law were deemed necessary, mainly tightening who has access to the data and under which circumstances.

By maintaining the law, the government also ignored the advice given by the Council of State, a constitutional advisory body that concluded that the Dutch data retention law should be withdrawn because it violates fundamental privacy laws.

The fact that the Dutch government decided to maintain its data retention law despite advice from experts to the contrary, coupled with the latest report from the European Parliament, means that the legal challenge -- from the civil rights organization Privacy First, the Dutch Association of Criminal Defense Lawyers, the Dutch Association of Journalists, the Dutch Section of the International Commission of Jurists, ISP BIT and the telecom companies VOYS and SpeakUp -- might stand a chance of being successful. While it would be premature to celebrate, the fact that this is even a possibility is a useful reminder of how the surveillance landscape in Europe has shifted over the last year thanks to the EUCJ ruling.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, eu, the netherlands

European Parliament Study Likely To Boost Legal Challenges To Blanket Data Retention In Europe

from the principles-of-proportionality-and-necessity dept

Back in April last year, we wrote about a surprising and hugely important ruling by Europe's top court that the framework for data retention in Europe -- the Data Retention Directive -- was "invalid". That was largely because it allowed data retention on a scale that was disproportionate. But an interesting question that arises from that decision is: if the Directive itself is invalid, where does that leave all the EU agreements and laws that require data to be retained? What exactly is their legal status now that the Directive has been struck down? Are they invalid too?

A few months ago, we reported on the leak of a document from a closed meeting of EU Justice and Home Affairs ministers, which suggested that "general and blanket data retention" is no longer possible in the EU, because of the top court's ruling. Independently of that legal opinion, one of the key EU committees -- that dealing with civil liberties -- asked the European Parliament's internal Legal Services for a formal study on the question. That report has now been completed (pdf), and the digital rights organisation Access has obtained a copy. It has also put together an accessible post explaining the key points:

the European Parliament legal services indicates that these agreements [involving data retention], while controversial, are still valid as they benefit from "presumption of legality". However, the report then adds "That said, the 'presumption' of legality of EU acts can also be rebutted and so it cannot be excluded, at this stage, that any other EU act could suffer the same fate as the data retention Directive". Therefore, all existing agreements currently in place remains valid, however, citizens can request the Commission to look into the validity of these agreements, or they can choose to take legal action to test their validity.

In other words, it is the view of the European Parliament's Legal Services that citizens can challenge any EU agreement or law involving data retention so that its validity is examined in the light of the court's ruling. There are two main classes affected.

The first is agreements that the EU has made with other nations. These include the Passenger Name Records agreements (PNR) and the Terrorist Finance Tracking Programme (TFTP). The former allows details of EU air passengers to be passed to other countries (notably the US), while the TFTP allows financial information to be shared (again, mostly with the US.) Successful legal challenges to these would cause huge problems for EU-US co-operation in the realms of counter-terrorism and beyond.

The second class potentially affected by the latest opinion is the national laws passed by EU Member States to implement the Data Retention Directive. It is the EU Legal Service's view that these national laws are also covered by the European court's decision, and that they too may be invalid if disproportionate. As Access explains:

Concerning member states' existing legislation on data retention, the EP legal services clarifies that, while the ruling does not outlaw these national laws, it does created a "twofold effect". First, since member states are no longer obliged by law to retain communication data, they can then decide to repeal their related laws -- as several countries such as Austria or Romania have done since the ruling. Second, if member states were to decide to keep measures for the retention of communication data, such rules would fall under EU legislation from 2002, the so-called E-privacy Directive.

Therefore, member states must ensure that their national laws on data retention comply with the EU Charter of Fundamental Rights and fulfill the requirements laid down in the E-privacy Directive regarding the principles of proportionality and necessity. And perhaps, most importantly, the report then adds that all the criteria set out by the Court in its ruling on the need for safeguards, proportionality and the "existence of clear and precise rules" must be included in these national laws. As a result all existing national acts on data retention should be examined on a case-by-case basis to check their compliance with those criteria.

As Access goes on to point out, it seems extremely unlikely the UK's new Data Retention and Investigatory Powers Act (DRIP), rushed through as result of the European court's ruling, would be in compliance. The latest study from the European Parliament's Legal Services is therefore likely to encourage digital rights organizations to add yet another challenge to DRIP, making it even more likely that it, too, will be struck down for being disproportionate, just as the Data Retention Directive was.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, data retention directive, eu, eu parliament

Google Allegedly Closing Down Russian Engineering Office In Response To Russian Data Laws

from the not-messing-around dept

It appears that Google may be done messing around with ridiculous laws. Just after announcing that it was shutting down Google News in Spain due to a ridiculously bad copyright law that is about to go into effect, it's been reported that the company is also shutting down its Russian engineering office, likely in response to new Russian laws, requiring that any personal data of Russian citizens be held inside the country. The Russian government, of course, claims this is to better protect Russian citizens, but most people believe it's actually to allow for greater surveillance of Russian citizens:

Google Inc has plans to shut down its engineering office in Russia amid a crackdown on internet freedoms and a law regarding data-handling practices, the Wall Street Journal reported.

Of course, Russia is not alone in either requiring localized data storage or in ramping up digital surveillance. It's going to be worth watching how a variety of large internet companies start dealing with these new challenges. Ever since the Snowden leaks first came out, many in the tech industry warned of the threat of "localization" rules that might splinter the internet, by requiring all data to be stored "locally" (greatly diminishing the economies of scale of global data centers). Closing down one office in protest is worth noting, but it only foreshadows a much bigger global fight to come.

Filed Under: data laws, data retention, engineering, laws, russia, splintering
Companies: google

Challenges To The UK's Surveillance And Data Retention Powers Continue To Mount

from the unacceptable-in-a-democracy dept

As Mike wrote recently, to no one's surprise, the UK's meek Investigatory Powers Tribunal decided that GCHQ's surveillance did not violate anyone's human rights, despite its scope and scale. All is not lost, however, since that case is now likely to move to the European Court of Human Rights. Moreover, it's just one of a growing number of a challenges to the UK's spying activities.

A key element of the argument that GCHQ's activities are legal is the use of powers granted under the UK's Regulation of Investigatory Powers Act (RIPA). This, too, is being scrutinized by a variety of official groups, including the Intelligence and Security Committee of the UK Parliament, the Independent Reviewer of UK Terrorism Legislation, and a further standalone surveillance review. In addition, the important Home Affairs Committee of the UK Parliament has been looking at one particular aspect of RIPA, its use against journalists:

This inquiry addresses police forces' use of RIPA powers to acquire communications data in the course of investigations. In two recent, high-profile cases, police have used RIPA powers to obtain material which might be regarded as journalistic material for the purposes of [the Police and Criminal Evidence Act 1984].

That has naturally sent shockwaves through the UK journalistic establishment, which sees its privileged communications with sources under threat. The Home Affairs Committee's report is short, and offers an interesting summary of how RIPA is being used, including the following statistic:

In 2013, there were 514,608 notices and authorisations for communications data, down from 570,135 in 2012. Of these, 87.7 % were submitted by law enforcement agencies and 11.1 % by the intelligence agencies.

Its conclusion is equally short, but unequivocal in its scathing rebuke to UK police forces for the way they are currently using RIPA in their investigations:

RIPA is not fit for purpose, with law enforcement agencies failing to routinely record the professions of individuals who have had their communications data accessed under the RIPA. The recording of information under RIPA is totally insufficient, and the whole process appears secretive and disorganised with information being destroyed afterwards. Whereas we acknowledge the operational need for secrecy both during investigations and afterwards (so that investigative techniques more broadly are not disclosed), we are concerned that the level of secrecy surrounding the use of RIPA allows investigating authorities to engage in acts which would be unacceptable in a democracy, with inadequate oversight. We recommend that the Home Office use the current review of the RIPA Code to ensure that law enforcement agencies use their RIPA powers properly.

Alongside RIPA, there is also the more recent DRIPA, the Data Retention and Investigatory Powers Act, which was pushed through the UK Parliament in record time this summer in response to the EU's Data Retention Directive being ruled invalid. Two MPs -- the Tory David Davis, and Tom Watson from Labour -- immediately announced that they would seek a judicial review of DRIPA, and this week a High Court judge has given permission for the review to go ahead. The UK government may show no sign of reining in its snooping voluntarily, but challenges to the UK's spying apparatus continue to multiply, which offers the hope that at some point it will be forced to do so.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, legal challenges, privacy, surveillance, uk

Australians' Stored Metadata Could Be Used In Any Civil Case, Including Against Copyright Infringement

from the not-what-they-said dept

It was bad enough when the Australian government announced that it was joining the growing club of countries that would be retaining huge swathes of its citizens' metadata. But now people are beginning to realize that once that store of metadata exists it not only can, but probably will, be used for many other purposes that have nothing to do with the avowed aim of fighting terrorism. The first hint that this might happen came from a slip made by the Australian Federal Police Commissioner, reported here by Gizmodo Australia:

When asked if stored metadata could be used to combat piracy, Australian Federal Police Commissioner, Andrew Colvin, replied at a press conference that the stored data of Australians could be used for a whole number of things, including anti-piracy:

“Absolutely. Any interface or connection someone has over the internet, we need to be able to identify the parties to that collection. Illegal downloads, piracy, cyber crimes, cyber security. Our ability to investigate them is pinned to the ability to retrieve metadata,” Colvin told journalists.

Understandably, this caused such a storm that the Australian government tried to backtrack. The country's Attorney-General, George Brandis, was quoted in TechWorld Australia as saying:

"The mandatory metadata retention regime applies only to the most serious crime -- to terrorism, to international and transnational organised crime, to paedophilia, where the use of metadata has been particularly useful as an investigative tool," Brandis told ABC's Q&A program last night.

So that's a return to the original script: metadata is for fighting terrorism and serious crimes. But Brandis then went on to say:

The laws will apply "only to crime and only to the highest levels of crime," the attorney-general said. "Breach of copyright is a civil wrong. Civil wrongs have got nothing to do with this scheme."

The trouble with that argument is that infringing on copyright can also be a criminal offense, as the Australian Federal Police (AFP) site explains:

The AFP is committed to taking action against those believed to be the organisers, major importers and/or wholesalers of infringing products.

The AFP is committed to building partnerships with industry and other law enforcement agencies to combat IP crime and wherever possible ascertain links to organised crime.

Moreover, the recent leak of the TPP IP chapter shows that one of its measures aims to lower the bar for the criminalization of copyright infringement, even when there is no commercial intent:

Each Party shall provide for criminal procedures and penalties to be applied at least in cases of willful trademark counterfeiting or copyright or related rights piracy on a commercial scale. {For the purposes of this Article, [US propose, CA/MY oppose: such acts of [NZ: willful] copyright or related rights piracy {on a commercial scale} include at least:] [CA/MY propose: In respect of copyright or related rights piracy, acts carried out on a commercial scale include at least:] [CL propose:181] [182]

(a) acts carried out for commercial advantage or financial gain[CA propose:183]; and

(b) significant acts [CA oppose: of copyright or related rights piracy], not carried out for commercial advantage or financial gain, that have a substantial prejudicial impact on the interests of the copyright or related rights owner in relation to the marketplace.} [AU propose:184]

Since it's still a draft, that's a bit of a mess, but the important parts are at the beginning -- "Each Party shall provide for criminal procedures and penalties to be applied" -- and at the end, where Australia wants criminal penalties even if "not carried out for commercial advantage or financial gain", but simply if they have "substantial prejudicial impact on the interests of the copyright or related rights owner in relation to the marketplace". It's not hard to see how uploading a single music file might be claimed to do that, since potentially it could be copied thousands of times. That non-commercial upload would therefore be subject to criminal penalties under TPP, which opens up the possibility of using stored metadata to track down the person responsible.

The transcript of an interesting radio program from the Australian broadcaster ABC reveals another way in which stored metadata might be applied to cases involving alleged copyright infringement:

the Government not using metadata to fight internet piracy is one thing, the rights holders themselves using the metadata trove to expose customer details is an entirely different scenario.

[Australia's Communications Minister Malcolm Turnbull] admitted as much this morning, saying that under legislation, stored metadata would be accessible by third parties via a court order. That could mean that copyright holders could sue ISPs for customer information, forcing them to reveal which user was responsible for a download, opening up the user to claims for damages.

But this route could be used for any civil case, despite claims from the Australian government that data retention is only about serious crimes. A lawyer who works for Marque Lawyers, the law firm acting for the copyright owners of the film Dallas Buyers Club, explained on the program:

Any civil litigation where a question arises about a person's conduct or activities or where they've been and when they've been there, which often can arise in all sorts of civil cases. This kind of information could be extremely useful.

...

It's historically been quite difficult to get information out of telcos because they hold an enormous amount of data and not always in the most easily accessible way and they don't like handing it over. But if they're forced under this new regime into a protocol which establishes a very clear and consistent methodology for storing data for a particular period, then that becomes a much more easily accessible resource and much more difficult to say, "Oh, you know, we can't find it." Yeah, I think, I think it'll be quite popular.

It will doubtless be especially popular among copyright trolls, who will be able to use it to track down people before sending in their "speculative" invoices....

Retaining everyone's metadata in order to tackle terrorism was always a bad idea, given the attendant risks, but it looks like it could turn into a legal and political nightmare once the lawyers start applying to Australian courts for routine access to this highly-private information. That's yet another good reason not to proceed with this ill-advised scheme at all.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, copyright, data retention, george brandis, metadata, piracy

ISP Wants European Commission To Take Action Against Sweden For Refusing To Halt Data Retention

from the good-luck-with-that dept

Back in April, Mike wrote about the decision of the Swedish ISP Bahnhof to delete all user log files in the wake of the judgment from the EU Court of Justice that the present EU data retention requirements are "invalid". According to an article in Computerworld UK, Bahnhof did this with the permission of the Swedish Post and Telecom Authority (PTS), which agreed that the Swedish law implementing data retention was problematic. However:

in mid-August the PTS ordered Bahnhof to start retaining data again, Bahnhof CEO Jon Karlung said. The PTS has made a 180-degree turn in policy by ordering Bahnhof -- and Tele2, which also stopped retaining data for a while -- to resume doing so.

According to a PTS spokesman, it was the government that ordered the PTS to start enforcing the Swedish data retention law again. "They appointed a commissioner to investigate if the Swedish national legislation could still be applied" despite the CJEU's ruling, he said. The commissioner came to the conclusion that the national legislation stands, and from that point on, the PTS has been enforcing the law again, he said.

Bahnhof is not only fighting this reversal of policy in the Swedish courts, but also calling on the European Union to take action against the Swedish government for its refusal to halt data retention:

Bahnhof, the renowned Swedish network operator and internet carrier joins forces with 5th of July Foundation to urge the EU Commission to initiate proceedings against the Kingdom of Sweden for blatantly ignoring the judgment of the Court of Justice of the European Union on April 8, 2014, which declared the Data Retention Directive invalid. Sweden now fails to fulfil its obligations according to The Charter of Fundamental Rights of the European Union, articles 7 and 8, ‘Respect for private and family life’ and ‘Protection of personal data’.

It's rather a long shot, since the European Commission has given no indication it wants to get rid of data retention, and so is unlikely to help Bahnhof in its battle with the Swedish authorities. Still, it's nice change to have an ISP willing to stand up for its users time and again, as Bahnhof has done; long may it continue to do so.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, eu court of justice, europe, sweden
Companies: banhof

Australian Officials Pushing For Data Retention Had No Idea What A VPN Is

from the government-follies dept

If you haven't yet, you really should watch the video we pointed to recently of Australian Attorney General George Brandis trying to explain his internet data retention plan when it's clear he has no idea how the internet works. It's the one where he's asked if it will track the web pages you visit, and Brandis vehemently insists that it will not, but that it will track the web addresses you visit. Some people have said that perhaps he meant it won't record the actual content on the pages, but just the URL (which might matter if it's dynamic pages), but later in the conversation, he also implies (almost clearly incorrectly) that he means it will just track the top level domains, not the full URLs. Here's a reminder snippet:

Brandis: Well, what we'll be able... what the security agencies want to know... to be retained... is the... is the electronic address of the website that the web user is visiting.

Host: So it does tell you the website.

Brandis: Well... well... it tells you the address of the website.

Host: That's the website, isn't it? It tells you what website you've been to.

Brandis: Well, when... when you visit a website you... you know, people browse from one thing to the next and... and... that browsing history won't be retained or... or... or... there won't be any capacity to access that.

Host: Excuse my confusion here, but if you are retaining the web address, you are retaining the website, aren't you?

Brandis: Well... the... every website has an electronic address, right?

Host: And that's recorded.

Brandis: And... um... whether there's a connection... when a connection is made between one computer terminal and a web address, that fact and the time of the connection, and the duration of the connection, is what we mean by metadata, in that context.

Host: But... that is... telling you... where... I've been on the web.

Brandis: Well, it... it... it... it... it... it... it records what web... what at... what electronic web address has been accessed.

Host: I don't see the difference between that and what website I've visited.

Brandis: Well, when you go to a website, commonly, you will go from one web page to another, from one link to another to another, within that website. That's not what we're interested in.

Host: Okay. So the overarching... if I go to... SkyNews website, it'll tell that, but not necessarily the links within that that I go to?

Brandis: Yes.

While it's a bit of a third hand story, Reason recently did an interview with Australian Senator David Leyonhjelm (who is against data retention, and describes himself as libertarian). Towards the end of the interview, he discusses data retention and tells a very troubling story about how those pushing for data retention had no idea what a VPN is. The story involves a much more knowledgeable government official -- which Gizmodo Australia suspects is Communications Minister Malcolm Turnbull -- demonstrating a VPN and leaving them all dumbfounded:

The other one that's causing a fair bit of grief is a metadata retention plan, the equivalent of what your NSA does. We don't have metadata retention at the moment and the agencies have been saying, "Oh, well we should have it. You can't use it if you haven't got it," sort of thing. But I spoke to one of the ministers last week about this because he does know what "metadata" means—he knows quite a lot about the Internet and how it works—He said to me people who are asking for this data, people who are thinking this is a good idea, actually have no idea what they're asking for. They don't know what they're going to do with it. They don't know what the implications of requiring it are. They haven't really thought this through.

He gave them a demonstration on a VPN [virtual private network] and said, "By my IP address, tell me what you can find out about me now." And they had no idea there was such a thing as a VPN. It indicates to me that these people are not well-informed enough to make these kinds of decisions. As it stands, it may be that the government may only require the Internet companies to store the IP address of the originating Internet use, so they'll know what computer you're from and what IP you're working from, which is not a lot different from keeping a record of the phone you're calling from. So if that's the case, it's probably not going to pose too much alarm. He's a minister and he knows what he's talking about. But he's surrounded by people who don't know what they're talking about who think that they need something more. We don't know yet where this will end up. It does have the potential to be very dangerous.

Now, the story does not make it entirely clear about who he's talking about. It could be read to be Brandis or his staff that didn't know about VPNs. Or, much more troubling, it could be read to be the intelligence community -- though I find that hard to believe. Either way, however, it does suggest a sort of blind adherence to the "collect it all" philosophy of intelligence gathering, without any real understanding of the issues or consequences.

Filed Under: australia, data retention, david leyonhjelm, george brandis, malcolm turnbull, metadata, vpn