May 31, 2006 1:56 PM PDT
Industry, others object to data retention
(continued from previous page)
Google said it would continue in discussions with Justice Department officials about how to prevent child pornography and related crimes--and, like Microsoft, sounded a note of caution about sweeping data retention rules.
"We are aware of a number of proposals in the U.S. and Europe regarding data retention and data preservation requirements for Internet companies," Google said in a statement. "We believe these proposals deserve careful review and must consider the legitimate interests of individual users, law enforcement agencies and Internet companies."
A Yahoo representative said on Wednesday that the company was going to decline to comment until it had details about what the Justice Department wanted. AT&T spokesman Dave Pacholczyk said, "We will follow the law," and declined further comment.
"Cox remains committed to the privacy of our customers, maintains secured records for an appropriate amount of time--according to the applicable laws--and only provides access to customer information to law enforcement, to the courts or to other authorities when legally required to do so," said David Grabert, Cox Communications' director of media relations.
For his part, Gonzales said in a speech last month at the National Center for Missing and Exploited Children that Internet providers must retain records to aid investigations of criminals "abusing kids and sending images of the abuse around the world through the Internet." More recently, the Justice Department has invoked terrorism as the justification for data retention.
Two proposals to mandate data retention have surfaced in the U.S. Congress. One, backed by Rep. Diana DeGette, a Colorado Democrat, says that any Internet service that "enables users to access content" must permanently retain records that would permit police to identify each user. The records could only be discarded at least one year after the user's account was closed.
The other was drafted by aides to Wisconsin Rep. F. James Sensenbrenner, the chairman of the House Judiciary Committee, a close ally of President Bush. Sensenbrenner said through a representative earlier this month, though, that his proposal is on hold because "our committee's agenda is tremendously overcrowded already."
"Preservation" versus "retention"
At the moment, Internet service providers typically discard any log file that's no longer required for business reasons such as network monitoring, fraud prevention or billing disputes. Companies do, however, alter that general rule when contacted by police performing an investigation--a practice called data preservation.
A 1996 federal law called the Electronic Communication Transactional Records Act regulates data preservation. It requires Internet providers to retain any "record" in their possession for 90 days "upon the request of a governmental entity."
Because Internet addresses remain a relatively scarce commodity, ISPs tend to allocate them to customers from a pool, based on if a computer is in use at the time. (Two standard techniques used are the Dynamic Host Configuration Protocol and Point-to-Point Protocol over Ethernet.)
In addition, Internet providers are required by another federal law to report child pornography sightings to the National Center for Missing and Exploited Children, which is in turn charged with forwarding such reports to the appropriate police agency.
When adopting its data retention rules, the European Parliament approved U.K.-backed requirements saying that communications providers in its 25 member countries--several of which had enacted their own data retention laws already--must retain customer data for a minimum of six months and a maximum of two years.
The Europe-wide requirement applies to a wide variety of "traffic" and "location" data, including the identities of the customers' correspondents; the date, time and duration of phone calls, voice over Internet Protocol calls or e-mail messages; and the location of the device used for the communications. But the "content" of the communications is not supposed to be retained. The rules are expected to take effect in 2008.
CNET News.com's Anne Broache contributed to this report.
7 commentsJoin the conversation! Add your comment