Tempus fugit II …..

Time flees as the Latin tag says (perhaps more commonly recognised as ‘Time Flies’) and it certainly seems to be the case with Data Retention.

It seems just a short time ago that we were watching the progress of the Directive through the European parliamentary system, from introduction through discussion (is that really the right word for the actions of the UK Presidency in 2005?) to amendment and then to final acceptance and transposition to national law.

In the UK we were there at the beginning, transposing the first parts to apply to fixed line and mobile telephony. 18 months later came the inclusion of Internet data. The interesting bits were the differences between national transpositions - some elected for retention for as little as 6 months, others for 12 and some for as long as 24 months (but would have liked longer). The UK opted to allow for reimbursement of capital expenditure and the provision in relation to Internet data seems to pay only slight compliance - requiring retention of data only where the national authorities deem that it is necessary.

Some member states have only brought data retention within national law in recent months - Portugal in August 2009, Italy at the end of 2009 and Poland only at the beginning of 2010 (UK, 1st phase Sept 2006, 2nd phase March 2008). There remain a number of member states where data retention has still not been applied - Austria, Belgium, Greece, Ireland, Luxembourg, Romania, Sweden - so much for the idea of ensuring a common approach to law enforcement.

But, time flies. The implementation of the Data Retention Directive provided for an evaluation of the Directive. The time has now come for that evaluation and a number of conferences and meetings have taken place. The results of evaluation will be published later in the year, probably in October 2010. After that, the Commission will begin the processes that will lead to proposals for a revised Directive, probably by the end of 2011 with expected implementation by 2014.

It is too early to say what that new Directive may include, but undoubtedly there will be pressure to expand the range of retained data to include a wider range of Information society services - The Crusher would expect to see pressure for the inclusion of social networking data and web site access. There may be some agreement on a reduction in the range of the approved time scales -although as most members currently retain for 12 months this is unlikely to affect the majority (including the UK).

The evaluation report from the Commission does include some interesting data relating to the number of requests for access to retained data in 2008.

Clearly there are wide variations in the raw number of requests with France and the UK heading the number of actual requests. Of course, both have fairly high populations so it is reasonable that there should be a large number of requests. But, when the figures are compared against the national populations the data requests become more interesting. the right hand column shows the number of data requests per 100,000 of population. Under this order, Lithuania shows a massive 2239 requests per 100K with the UK behind France at a much lower 769. Yet Cyprus only requests data at the rate of 3 per 100,000!

Of course, there will be variations in what is perceived as relevant crime and the use of data to locate rather than to determine specific use. It may well be that the larger number of requests are being used more as a location tool than as a more detailed investigatory procedure. But, the figure for Lithuania is so much greater than others it does rather beg the question what use is being made of retained data in that small state? Perhaps there remains an investigatory throwback to a prevous regime - although the lower (far lower) figures for neighbouring Estonia and Latvia may negate that suggestion.

Interesting data - it will be interesting to watch what comes out of the Commission in late summer/autumn 2010.

Tempus fugit …..

Where does the time go? It seems only just a few weeks ago that we were discussing the ramifications of the proposal for a European Data Retention Directive. The reality is that this was now five years ago and the major discussions took place during the UK Presidency of the European Union in the second half of 2005.

We are now fast approaching the date set within the Directive for the European Commission to report to the European Parliament and the Council on the working of the Directive and its impact on the economic operators and consumers. The date for the submission of the evaluation is 15th September 2010 - just 6 months away now. As a result of the evaluation, the Commission will determine whether it is necessary to amend the provisions, particularly in relation to the nature of the data to be retained and the period of retention. The results of evaluation must be made public.

In the background to the imminent evaluation there are some interesting developments and it is clear that the Directive has not yet been applied across all member states of the European Union.

On March 2nd, the German Constitutional Court ruled that the implementation of the Directive in Germany was in contravention of the German Constitution. Der Spiegel reported on Wednesday 3rd March that the Court had ruled that data collected and retained under the (now unconstitutional) law was to be deleted with immediate effect and that strict controls were to be brought into place before the law could be re-introduced. The case has taken some two years to progress but was brought as a class action on behalf of some 35,000 German citizens who argued that the new law went too far.

The court agreed and said that there was insufficient clarity in the reasons for the retention of data and that there were insufficient safeguards on the data once retained. A key point here is that the Constitutional Court has struck down the German implementation of the Data Retention Directive, not the Directive itself. The German government must now look at the decision of the Court and consider the safeguards that must be put into place before it can draft a new law and introduce that. It is certain that there will now be intense public scrutiny.

Belgium also faces an interesting period, particularly as it is scheduled to take over the rotating Presidency later in the year and will be ‘in the hot seat’ when the evaluation of the Directive is due to be presented. The transposition of the Directive into national (Belgian) law has taken some time and there has been considerable and vocal opposition to the Government proposals. The proposals went much further than provided for within the Directive including banking data and use of the data beyond what may be determined as ’serious crime’. The Belgian proposals also called for the retention of data at the maximum period (24 months) provided for within the Directive. The initial proposals attracted a negative response from the Belgian data protection agency, an almost unheard of situation - although that eventually was turned around to a more positive response when the proposals were watered down time scales pulled back to a more standard 12 months.

The Belgian proposals have not yet completed the parliamentary process. In the last couple of months, Belgian ministers have been trying to reach consensus with stakeholder groups to see if they can bring forward a new law before June. That is an important date - the rotating Presidency comes to Belgium on 1st July and the government wants to prevent the country from critiscism about their failure to implement whilst they are also supposed to be leading discussions on evaluation.

It is clear that some Belgian politicians had been awaiting the outcome of the case before the German constitutional court. That is now clear - it remains to be seen how this may affect the Belgian transposition.

Third strike?

The French ‘3 strikes and you’re out’ approach to Peer to Peer regulation is back in the news again. After the previous version was ruled unconstitutional by the French Constitutional Court the law passed back for further discussion and amendment.

Now, the amended version of the ‘Hadopi’ law has been passed by a vote in the French National Assembly - voting was 285 for, 225 against. However, that is not the end of the process. Although the law has now been cleared in the National Assemby it must still be approved by a commission drawn from both senators and deputies. The majority UMP voted in favour of the law which has the strong backing of President Sarkozy but the opposition Socialist Party has already indicated that it will make a further referral to the Constitutional Court.

The major problem, and the basis for referral, is the provision for withdrawal of Internet access on the order of a ‘‘Haut Autorité’ rather than by order of a judge in court. Opponents argue that a person charged with file sharing and subject to a third notice should be able to defend themselves in court and to challenge evidence presented by rights owners.

This is important as Internet access is now becoming regarded as a human rights issue. The European Parliament is investigating whether or not a withdrawal of Internet access is a breach of human rights - if that is upheld and, particularly, by the ECHR, then proposals such as the French ‘Hadopi’ law willl be ruled out. But the issue is much more fundamental than human rights - if a person is accused of carrying out an activity with a potential penalty then they must be given the right to defend their position and to challenge any evidence brought against them. That is a fundamental position for the courts and it should not (must not) be diluted through the creation of specialist agencies that may not provide the same level of protection for the accused.

Now, the French position is being carefully watched by others. Perhaps no more so than here in the UK where the Secretary of State for Business (Lord Mandelson) has made it clear that he favours a ‘three strikes’ and you’re out approach. Now this was initially rejected by the Digital Britain report and in previous Ministerial pronouncements but it is now back on the agenda. Sad to see that the re-launch of ‘3 strikes’ was as part of an amendment to documents under consultation - there really should be no option of moving the goalposts during consultation.

The outcome of the commission discussion and of the next referral to the Constitutional Court will be interesting and key to future progress of the ‘Hadopi’ law. 3 strikes may have risen again but may yet be pushed back down.

The word of a Minister should not be taken as binding ……

It is clear that the word of a Minister should not be regarded as binding, perhaps merely an expression of the state of policy at the time that he (or she) opened their mouth but nothing more than that.

Back in April, the then Minister with responsibility for Intellectual Property, David Lammy, made it clear that the option to implement a ‘three strikes and you’re out’ policy for peer to peer filesharers had been dropped from Government plans incluyding the Digital Britain report. The Minister said that ‘cutting off users was not “the right road” for UK law makers’. David Lammy told ‘The Observer’ that, ‘”It is for the French to determine what is right for them, (referring to the Hadopi law) but for us here we do not believe that would be the right road to go down.”

Then, in June, came the publication of Stephen Carter’s Digital Britain report. This discussed the issue of perceived piracy and the problems of file sharing and suggested that Ofcom should be tasked with the setting up of technical measures to combat persistent filesharers including restricting access etc. At this time, Stephen Carter’s report reflected the thinking espoused by the Minister.

It is now a couple of months later and it would appear that Government policy has taken something of a ‘U’ turn. It would seem that this Government is for turning with the announcement of policy changes that would see Ministers given the power to order the cutting off of Internet access for identified file sharers.

Now this is a major step in a different direction and completely at odds with previous announced policy. Clearly a Minister’s word counts for little (did we really think that it did anyway?). An announcement by the Department for Business Innovation and Skills (Tuesday 25th August) suggests that thinking in relation to policy has now changed and there is a requirement for a faster process than previously discussed together with the addition of the option to cut off Internet access as part of the technical measures. The announcement says, ‘Accordingly a thorough examination of the proportionality and effectiveness of the measure (as with any of the other measures) would have to be undertaken before ISPs would be required to implement it, even if the decision to move to technical measures is taken. As ever we would need to ensure any such measure fully complied with both UK and EU legislation.’

Now this is where we get interesting. Any decision to cut off Internet access could remove access for entirely innocent parties - such as other members of a family using a circuit. The European Parliament and the Commission have made it clear that they view Internet access as an essential human right. Commissioner Redding responding to questions in Brussels said, “The fourth element I would like to underline is the recognition of the right to Internet access. The new rules recognise explicitly that Internet access is a fundamental right such as the freedom of expression and the freedom to access information. The rules therefore provide that any measures taken regarding access to, or use of, services and applications must respect the fundamental rights and freedoms of natural persons, including the right to privacy, freedom of expression and access to information and education as well as due process?”

Now that seems to have made the Commissioner’s view quite clear. Internet access is a fundamental right and any rules must respect fundamental rights and freedoms. Any action to restrict Internet access must be taken by a judge in a court procedure - at which the end user will be the defendant with the right to defend his position and any proposed actions. It cannot be that removal of access is the result of an order by a Secretary of State or by Ofcom without the right of the affected user to challenge the decision. At present, any evidence to suggest illegal activity seems to be based on the detection of an IP address by automated systems operated by or on behalf of rights owners. There are well publicised indications that systems may be open to abuse and that not all IP addresses may be users engaged in illegal activity. There may well be circumstances where the person carrying out infringing activity is doing so using an unsecured wireless connection without the knowledge or permission of the actual circuit owner. Yet, if evidence based on the detected IP address were to be used it would be the innocent user subject to cut-off rather than the actual perpetrator.

So, it appears to be European policy that Internet access is a fundamental right. That cannot be removed without due process - and the process suggested in the revised consultation would not appear to give sufficient safeguards for those not involved in the infringing activity. Any actions taken would seem to face the immediate possibility of a challenge under UK Human Rights legislation and then action in the European Courts.

There is another interesting facet to this new disclosure. A few weeks ago BIS announced consultation on the proposals of the Digital Britain report. The consultation paper was produced and a deadline set for responses. Now, the Dept. has announced that it wishes to change the consultation during the period set for stakeholders and others to respond and has suggested that an extended response period should now be allowed. To change the nature of the consultation after publication would seem to fly in direct contravention of the Government advice and code of practice for consultation.

‘The Crusher’ has to ask why this change has come about. The Government will deny that there is any relation between this announcement and a private dinner at which the Secretary of State, Lord Mandelson, met with US film mogul David Geffen. Geffen is known to have views on piracy and the effects of file sharing on the creative industries. It remains somewhat disconcerting that such a major policy change announcement comes just a few days after such a meeting. Coincidence or just bad planning?

Whatever the real reason this is a real policy blunder by the Government. It is almost certain that any actions to remove Internet access for alleged file-sharing, and by order of the Secretary of State or by Ofcom, would be seen to be highly disproportionate and likely to impact on he human rights of the end user and others. It would appear that the Government has now decided to announce policy changes in the midst of a consultation exercice - contrary to its own guidelines.

This is guaranteed to annoy large swathes of voters - and in the last few months running up to a general election that really is a rather silly thing to do. Perhaps this demonstrates the arrogance of the politicians responding to the views of a rich business interest over those of the electorate. That will be determined no later than June 2010.

However, all of this may be irrelevant - except for the verdict of the electorate on the conduct of this Government - with the imminent decision at the European Court of Justice in a case referred from the UK involving L’Oreal and eBay. The legal news site ‘Outlaw.com’ reports that this case may make any proposed actions by Ofcom irrelevant if it orders that a rights owner can bring an action to injunct an innocent party. The case centres around a possible injunction brought by L’Oreal against eBay to require that party to remove access to infringing materials. If the ECJ is in favour of L’Oreal then it is likely that a music rights owner would simply apply to the UK courts for an injunction against the ISP providing service to an end user. Any costs in defending their position would then fall on the ISP - I suspect that many would simply accept the injunction without the end user having any involvement.

IMP - an overview

A significant paper from the LSE provides an overview and substantial critique of the Government plans for review of the interception of communications traffic data - currently under consultation.

The paper, which can be downloaded here provides a review of UK intercept law, changes in communications and the technological limitations of the proposals for high levels of deep packet inspection (DPI). This is a paper that is informative and a useful contribution to the debate. It notes that there are significant privacy issues although these are for others to discuss. What it does do is to point out the limitations of the core technology concepts behind the Intercept Modernisation Programme (IMP) and ‘Mastering the Internet’, the GCHQ programme aimed at collecting and analysing data within the UK’s Internet traffic.

Every MP and member of the House of Lords should read this - and should then be made to sit an examination on its contents with passage to permission to debate only granted on being able to demonstrate a satisfactory understanding of the content. Well, pigs might fly!

The Home Office Consultation, ‘Protecting the Public in a Changing Communications Environment’ can be downloaded here.

Emergency, which service ……..?

Most people are familiar with the process for making an emergency call - whether it is to the Police, Fire Service, Ambulance or Coastguard. Pick up a phone and dial 999 - or 112 as the pan-European common emergency call number.

When the call is answered by the emergency service operator at the telco, the operator will ask you which service you require and will ask you to confirm the number you are calling from. No problems there.

The operator will see the calling line number displayed in front of them and can immediately cross-reference with reverse look up to identify the location. OK, no problems there - but hold on a minute, what happens if you are not using a land-line?

Technology has moved on and there can no longer be an assumption that all users are calling from a fixed land-line. Emergency calls can be made from a mobile number and, increasingly, from a Voice over IP phone (VoIP). Now, these latter two present something of a problem. Mobile numbers are not geographic (they do not have a specific regional location exchange code) and can be made from pretty much anywhere (except in my house where the mobile does not work!). Emergency operators can access data from the mobile providers to locate the cell where the call is being made from - and triangulation from a number of base stations can provide a fairly accurate geographic location of the calling phone. That’s what law enforcement do when they want to track a criminal or suspect target - the mobile phone is a very effective piece of electronic tracking gadgetry sitting in your pocket. You don’t have to make a call, the phone will register itself with the local cell whenever it is switched on and will thereby giveaway its position.

OK, again, no real problems there. Problems arise with VoIP. There may be a number associated with a VoIP call but it may be a geographic number and the geographic number assigned to the call may bear no relevance to the actual geographic location of the VoIP handset or software. This may be connecting through any IP link - perhaps a fixed line broadband circuit or perhaps a WiFi connection in a public place (cafe, pub, airport etc.).

The Ofcom General Conditions of Service require providers to make details of callers available to emergency service operators. For fixed line and for mobile calls that is fine - the provider has all the data and can cross-reference databases. For VoIP there is a problem - the VoIP service is likely to be provided by a different service provider to the underlying IP transport. The VoIP provider may have a record of the geographic number associated with the call and may be able to reference that to a customer - but cannot tell whether or not the customer is at the location they have. The IP address used for the call and included within the packet data will be allocated by the ISP providing the transport layer - there may be no quick look-up between the VoIP provider and the ISP to determine the location and user of the IP address. It is quite possible that the VoIP user could log in from a range of IPs during a single day - particularly if they are connecting using WiFi access points.

The problem can have tragic consequences. A Canadian family called the emergency services using a VoIP service - the trackback from their initial service registration indicated a location in Toronto so that was where the medical team was sent. Unfortunately the family were hundreds of miles away in Calgary and had not updated the location information held by the VoIP provider.

To overcome the problem the emergency services want to be able to make a quick look up request to ISPs to determine the telephone line reference (CBUK record) for the line on which the VoIP call originated. That might seem straightforward but the practicalities are much less so. There is no standard format for ISP customer service records and there is no standard interface that will allow an external agency to access and requues information from those databases. Emergency service developers have suggested that ISPs should install systems that will allow real-time look-up requests from the emergency service operator. The operator would identify the call as a VoIP origin, identify the associated IP address, refer that to a central look-up registry to identify the ISP (RIPE?) and then pass the request to the ISP who would be expected to return the CBUK reference for the line. All this in real-time and in no longer than it has taken you to read this last paragraph.

The implementation of the Data Retention Directive at a European level has meant that there have been developments to create a standardised form of data request - ETSI standards. Implementing these may be fine for the larger operators who have teams of developers and can bear the costs. But for the medium and smaller level ISPs there will be a real problem - substantial development costs and quite likely whole changes to back end and Internet facing systems. It is quite likely that the smaller ISPs will simply not have the resources to be able to comply.

The Crusher can see another problem here. Once an interface system is in place then a remote operator will be able to input an IP address and return a telephone line reference which can be used to determine a location. That is exactly the type of information that typical Section 22 notices issued under the Regulation of Investigatory Powers Act (RIPA) often require - law enforcement agencies can issue a notice requiring an ISP to provide details of a user. Requests often cite a date, time and IP address - and require the ISP to identify the user. If that can be done automatically by the emergency operator then it will not be long before other parts of law enforcement agencies (LEAs) identify the route as a rapid way to investigative data. Politicians will trot out the tired old lines about importance for public safety, citizens have nothing to fear etc. And will then introduce legislative changes that permit LEAs to process automatic data requests.

Any development for emergency use will have to be developed with extensive safeguards and strict controls. These must ensure that access can only be made in genuine emergency situations and that it is not possible to investigators to access for alternate purposes. Equally, it must not be possible for other organisations to attempt to access data - for example, for rights owners to try to identify end users flagged up as potential copyright infringers.

The emergency request is fairly self-explanatory. The problem is the likelihood and the inevitability of mission creep.

Hadopi - three strikes and …. it’s out!

The French farce continues.

After passage through a singularly empty French assembly, then return to a more populous house, the Hadopi law (Haute Autorité pour la Diffusion des Oeuvres et la Protection des droits sur Internet - Higher Authority for the Distribution of Works and the Protection of Copyright on the Internet) has now received a further setback.

The superior court in France, the French Consititutional Court, has now ruled that access to Internet services can only be denied on the authority of a judge. The court has recognised the view in the European Parliament that Internet access is a basis human right - as also now recognied by Ofcom in the UK. The introduction of the bill to create the Hadopi in France was contentious - in France and elsewhere. Supported by President Nicolas Sarkozy the bill would have created a new agency with the power to disconnect users on third notification of file sharing infringement. The agency would also place the users on a blocklist to prevent them from simply migrating to another provider. This cannot now happen - any process to remove a user access must now go before a court and a judge - with the user able to defend his position in court.

The UK Government has already indicated that it does not favour the 3 strikes approach - again echoing the view that broadband access is now seen as a basic human right.

It’s back to the drawing board for the rights owners. Perhaps these actions might just focus their minds to consider some new business models. But then ‘les cochons peuvent voler’ as they might say in France.

Article 8 again ….. and the UK loses another case!

A few months ago we heard the outcomes of the case of ‘Marper and S v United Kingdom’ brought before the European Court of Human Rights. Now, you may remember this one - something of a landmark. The court opined that the storage of DNA profiles in England was contrary to the privacy requirements enshrined under Article 8 of the European Convention on Human Rights.

Just in case you had missed the Article, it states:

ARTICLE 8
1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

The problem for the UK, and for England in particular, was that the claimants in the case were innocent persons who had not been charged or convicted of any offence. It was, said the Court, an infringment of their privacy for their DNA records to be retained within a national criminal database. Now, interestingly Scotland applies the law in a different way to England (of course!) and the Scottish model was approved by the European Court. The Conservatives have given a commitment to implementing the Scottish model when (not if!) then win the next election. We’ll hold them to that. The Government in London has now announced a revision of rules to apply in England - rules that have all the sublety of a two fingered salute to Europe - and has indicated that it will change the rules to allow law enforcement to retain data for 6 or 12 years. No intention there to remove the data as required by the Europen court.

But - along comes another case and again the Courts find that the actions of law enforcement in the UK go against the requirements of Article 8. Andrew Wood had his photograph taken by police surveillance units when (perfectly legitimately) he attended the AGM of a company in which he had shares. The police photographs were stored on file and were potentially available for use in investigation of other acts. The Appeal Court has now rules (2 to 1) in the case and has instructed the Metropolitan Police to destroy copies of photographs of Mr Wood.

The implications here are interesting. The police must now destroy Mr Wood’s images - but must also now look to identifying, removing and destroying images of other perfectly law abiding persons who happened to come in front of their surveillance photographers - perhaps at football matches, demonstrations etc. Taking photographs is a legitimate practice the court held - but the police should identify those who were of good character and should destroy the images. The implication of that opinion by Lord Justice Dyson is that images should only be retained of those who are nicked - and they will be photographed at the police station anyway so facial recognition should be able to locate, and identify them in surveillance image databases. Anyone else should then deleted.

Naturally the police were not too happy and may now consider an appeal to the House of Lords (note - there was one dissenting opinion in which Lord Justice Laws argued that the police were ‘operating within the margin of operational discretion in keeping the photos’.

The Crusher senses the wind of change blowing - the surveillance society created under New Labour is unravelling before the courts. With an increasingly lame duck administration and an imminent election (which the PM has tacitly recognised that Labour will lose) we may be seeing a few steps back from the oppressive nature of surveillance. Where next - data retention and the Communications Data Bill?

French farce

A few postings ago we reported on the vote in the French Senate that introduced the ‘Hadopi’ law, providing for the 3-strikes and you’re out principle to be adopted by rights owners seeking the disconnection of persistent file sharers. After the initial vote in a sparsely attended house, the law passed on to the National Assembly where a rather larger house voted it down. Now it seems that the French authorities have adopted the European approach - if at first you don’t get the result you want, ask them to vote again until they give the right result!

The law was returned to the National Assembly for another attempt and this time it seems that there was a rather fuller attendance. Perhaps some ‘persuassion’ by the French equivalent of the Whips? There is clear intention by the French Government to push the law through and in advance of voting in the European Parliament on the Telecom Reform package.

A large number of amendments to the Bill made it impossible to proceed through the voting process by 5th May and the Bill must now return for further debate. It is seen as likely that this will be by mid-May so it is quite possible that President Sarkozy will see the new legislation in force by the end of the month. This will allow the setting up of a new agency (the HADOPI) which will deal with copyright infringement notices submitted by rights owners and will decide whether to warn or to disconnect users and place them on a list of blocked persons.

Quite clearly this will not be a popular piece of legislation. Civil rights campaigners will be campaigning and asserting that the law will be an infringement of the rights of the citizen. But the campaigners will have some powerful allies. MEPs voting in the European Parliament in Brussels and Strasbourg have indicated that they view internet access as a fundamental service and have voted down 3-strikes approaches.

When the Telecom Package came up for 2nd reading in the European Parliament, MEPs voted 407 to 57 for initial amendment 138 rejecting the Trautman report and reverting to the initial text which provided that only judicial authorities would be able to make decisions on cutting off users. The reversion to judicial authorities means that users accused of infringement would be able to submit a defence and to appeal any decision. It would seem that the HADOPI proposed in France would not be accepted as a judicial body and would not be acceptable under the European package.

Going further, it is interesting to read comments by Commissioner Redding responding to questions in Brussels: “The fourth element I would like to underline is the recognition of the right to Internet access. The new rules recognise explicitly that Internet access is a fundamental right such as the freedom of expression and the freedom to access information. The rules therefore provide that any measures taken regarding access to, or use of, services and applications must respect the fundamental rights and freedoms of natural persons, including the right to privacy, freedom of expression and access to information and education as well as due process?”

Now that makes the Commissioners view quite clear. Internet access is a fundamental right and any rules must respect fundamental rights and freedoms. That will make it difficult to impose any 3-strikes approach without their being a judicial process. Even then, there must be compelling reason to act - and, I suspect, copyright infringment will not be there as the most compelling reason. Perhaps use of the internet to download paedophilic content might be there.

So, how will this impact on the UK. There is discussion in Govt. and we are awaiting the final version of Stephen Carter’s ‘Digital Britain’ report. Trails suggest that that may include details of a Digital Rights Agency - amongst other things. The report is now unlikely to arrive before mid-June - it will not be published in the run-up to local and European elections at the beginning of June - and will probably be after voting in the European Parliament. Any agency that is then set up will have to accommodate the European Telecoms Package - so we are unlikely to see any 3-strikes here. Unlikely anyway as Govt. Ministers have now indicated that this is not favoured by Govt.

Not so centralised database ……

So, after all the speculation, the Home Office have now published the consultation paper on ‘Protecting the Public in a Changing Communications Environment’ and it now makes clear that the idea of a single centralised database containing records of all telephone calls, Internet login/logout, email, web access etc. has been kicked into touch. Page 25 of the paper makes clear, ‘The Government has no plans to create a centralised database to store all communications data.’

However, it is also clear that this would be the preferred option, ‘This approach would have several advantages. It would be the option most likely to come close to maintaining the historic capability of public authorities in their use of communications data. It would be the most effective at delivering fast and efficient access in support of the law enforcement and intelligence agencies and emergency services; the least challenging technically to implement; and the cheapest to build and run.’ But, Government is clearly aware of the sensitive politics of any implementation in this manner and has accepted that this wqould be a step too far and a massive intrusion into privacy. Richard Thomas, Information Commissioner, had made it quite clear that a single centralised database would be seen as an infringement of data privacy legislation and this advice seems to have been taken on board, ‘The Government recognises the privacy implications in holding all communications data from the UK from a 12-month period in a single store. The Government therefore does not propose to pursue this approach.’

So, the remaining option is to require communications service providers (CSPs) to retain data themselves and to release to national security and law enforcement authorities on receipt of the appropriate (RIPA) authority. That is similar to the current provision and the requirements of the Data Retention Regulations. However, the proposed plans go further than the requirements of the European Data Retention Directive (DRD) - law enforcement agencies have advised government that they require access to a broader range of data than that required under DRD. “We also need to ensure that UK companies collect and store additional types of communications data about their own services, which are not included under the EU Data Retention Directive. This includes data that communication service providers do not generate or process about their services.”

So what would this additional data retention requirement include. Web access for certain - but again, not the content, only the access to the server (to the domain rather to internal pages), volume of data transferred (download/upload), access to third party services.

Ah, this last is interesting. Acccess to third party services. Government is clearly aware of the limitations of the DRD and is now looking to close loopholes. DRD does not include web access and does not include access to services that are not hosted in the UK. Now, we know that a large number of users use webmail and that the major services (Hotmail, Gmail etc.) are hosted in the US. There is no provision under DRD for retention of any data relating to mail sent via these services - nor for any retention of data sent via other means including social networking sites, game sites, forums etc. Govt. now wants to close this loophole, ‘This would include third party data relating to internet-based services and communications services provided from outside the UK.’

Now that leaves some interesting questions. If CSPs are to be required to retain data relating to access to systems and servers outside of their network (and outside of the UK and EU) then they are going to have to collect the data by analysing the traffic flow on their own network. In practice this means deep packet inspection (DPI) of ALL traffic. DPI imposes some overheads - in order to undertake analysis and extraction of data without impacting on user experience will require real-time inspection with substantial processing demands. That is expensive. Well, at least the Govt. recognise this as the potential costs are estimated in the consultation as £2 Billion (yes, that’s right, 2 BILLION pounds).

The technical limitations are not the only concern. For CSPs to effectively read each and every packet will require substantial changes to current legislation. In effect, what will be required will be the electronic equivalent of opening mail, checking the contents and storing data. It is illegal to intercept the post, it is illegal to intercept traffic in a communications environment. Clearly the intention of the Government is to change the legal position to allow CSPs to analyse traffic and to retain data.

At present, there may be some inspection going on at CSP level in order to identify traffic types and to prioritise traffic flow - packet shaping. This is used to control use of high volume services such as peer to peer transfer. What is currently done is relatively simple compared to what may be required - traffic packets are checked to see what the type of data is and automatically routed or controlled as a result. The plan is for data to be read and then recorded and retained - and for the data to be retained for 12 months.

Now we can see an advantage for the Govt. in making CSPs retain the data. If there is a leak of data then it will be the CSPs at fault and not the Govt. Govt. agencies (national security, law enforcement etc.) will only become involved when they request data to be transferred from the CSP store.

The single centralised database has become a decentralised, distributed store of data. Once you set those up, the next step is to look to see how they could all be linked. We know that the Govt. views the single database as being the best option (and the cheapest). What they are going to do is to plan a distributed store that may circumvent privacy concerns, will be more expensive but will still store the same information. And that is going to be far more than is currently retained.

Privacy watchdogs will just be sharpening their claws - they will need them.