Data - gold or tar?

Submitted by vlado on Wed, 2005-09-21 12:06.digital wrongs | rights | scribbles

It is in the eyes of the beholder,

Suw Charman of chocnkvodka and ORG fame wrote this

You don't need us to tell you that the mandatory retention of data about every EU citizen's calls, mobile phone movements, and internet usage would be a bad thing (if you do, check http://www.edri.org/docs/lettertoUKpres.pdf for a joint letter from EDRi and Privacy International to the Council of Ministers on the problems with data retention).

But it's happening anyway: the EU Commission just published their proposal to do just that:
http://www.statewatch.org/news/2005/sep/com-data-retention-prop.pdf

While I'm no legal buff, so my thoughts are not nessesarily legally prompt, I'll attempt to summarise my thoughts on this document below. Overall I'm sceptical about the effectiveness of data retention for fighting crime and terrorism in the modern day and age. Active surveilance measures will work better, but they should be backed by strong protection by the independent judiciary.

There several questions, which need to be answered, before making your own conclusions on this matter.

What are the implications on your privacy?

The data about your communications - phone or internet is going to be stored for 1y/6m respectively. Only the instance, participants, time and type of commnications is kept. The security services, i.e the police and related can request access to that data.

Sounds nearly innocent, isn't it? That may be, but there is no explicit safeguards to unnessary or illegitimate use, for example permission by the courts to such data. This is left to the national leg islation, as far as I can understand.The ages old question Who guards the guardian? springs to mind. I'll leave the full analysis for human rights specialists, although my personal instincts are against such solutions. Why should anyone, especially the state, be interested in my movement, whom and when do I talk to, when I do no harm to anyone. I don't want to rely on the good will of anyone, I just don't want them to know it. This is my right to privacy and not the fact these not to be disclosed to the general public. I have the right to negotiate any limitations of my rights, for any practical purposes. In the end the purpose of the state is to serve me, not me being their rightful subject. But that is going too deep into politics, so let's stop here.

What are the implications on the telecoms industry?

While it is true, that it will simplify the infrastructure requirements, that will come true only after the data retention requirements are imposed on the telecoms. Is there a study on the extra data storage capacity required to satisfy the logging demands? I don't want speculative numbers to be seriosly considered, but the logs of one of the low-traffic web-servers I looked after take about 100MB/year, so by making wild extrapolations I think this will lead to many petabytes of extra storage required Europe wide. Who is going to back the bill? Us the consumers or tax payers?

What are the implications on fighting crime and/or terrorism?

How such data can be used in fighting terrorism? Does fact that person A called person B at time X, or Person A visted site B constitute evidence of illegal activities? Does this information help the operations of the police, for example determinining a cloud of contacts, who are possibly related to a group involved in illegal activities? Can this be achieved via courts/judiciary controlled/ordered operations?

In my opinion, this might, just might, possibly lead to the identification of a (large) number of suspects, but will have no real status of proof. Further more, explicitly ordered surveilance operations by the courts will be far more efficient, in gatering proof.

Is it feasible? Is this directive largely made obsolete by current technology?

I would say yes. Internet age old technologies like p2p networks, encryption, vpn, tunnelling, etc..., which are commonly used for legitimate purposes, makes the information to be gatered marginally interesting, since they effectively obfuscate the communication channels. Surely, ill meaning characters will actively employ such techniques, to keep their evil deeds largely unknown.

OK, let's say we can keep the data and use advanced datamining techniques, to find out the enlarged evil clouds. What computing resources can/will be made available to do that? Is it a good value for money, taking into account the relatively low value of this information, as hinted above?

Is such data open to abuse?

I would say yes. Who within the security forces and the telecoms will have access to this information? For what purposes? How can we prevent the leaking of this information to third parties for other purposes, rather than crime/terrorism prevention?

There were several cases in the press recently of reveiling personal traffic data, for example to find out if someone's girlfriend is cheating on them or not. Do we want to make this illegal activity possible even more?

footnote

This is a scribble in progress. I'll be modifying it as time passes. Net bless, the times will be good for us.

add new comment

Topics

programming

design

random thoughts

alter ego

Collections

Similar things