Tempus fugit II …..

Time flees as the Latin tag says (perhaps more commonly recognised as ‘Time Flies’) and it certainly seems to be the case with Data Retention.

It seems just a short time ago that we were watching the progress of the Directive through the European parliamentary system, from introduction through discussion (is that really the right word for the actions of the UK Presidency in 2005?) to amendment and then to final acceptance and transposition to national law.

In the UK we were there at the beginning, transposing the first parts to apply to fixed line and mobile telephony. 18 months later came the inclusion of Internet data. The interesting bits were the differences between national transpositions - some elected for retention for as little as 6 months, others for 12 and some for as long as 24 months (but would have liked longer). The UK opted to allow for reimbursement of capital expenditure and the provision in relation to Internet data seems to pay only slight compliance - requiring retention of data only where the national authorities deem that it is necessary.

Some member states have only brought data retention within national law in recent months - Portugal in August 2009, Italy at the end of 2009 and Poland only at the beginning of 2010 (UK, 1st phase Sept 2006, 2nd phase March 2008). There remain a number of member states where data retention has still not been applied - Austria, Belgium, Greece, Ireland, Luxembourg, Romania, Sweden - so much for the idea of ensuring a common approach to law enforcement.

But, time flies. The implementation of the Data Retention Directive provided for an evaluation of the Directive. The time has now come for that evaluation and a number of conferences and meetings have taken place. The results of evaluation will be published later in the year, probably in October 2010. After that, the Commission will begin the processes that will lead to proposals for a revised Directive, probably by the end of 2011 with expected implementation by 2014.

It is too early to say what that new Directive may include, but undoubtedly there will be pressure to expand the range of retained data to include a wider range of Information society services - The Crusher would expect to see pressure for the inclusion of social networking data and web site access. There may be some agreement on a reduction in the range of the approved time scales -although as most members currently retain for 12 months this is unlikely to affect the majority (including the UK).

The evaluation report from the Commission does include some interesting data relating to the number of requests for access to retained data in 2008.

Clearly there are wide variations in the raw number of requests with France and the UK heading the number of actual requests. Of course, both have fairly high populations so it is reasonable that there should be a large number of requests. But, when the figures are compared against the national populations the data requests become more interesting. the right hand column shows the number of data requests per 100,000 of population. Under this order, Lithuania shows a massive 2239 requests per 100K with the UK behind France at a much lower 769. Yet Cyprus only requests data at the rate of 3 per 100,000!

Of course, there will be variations in what is perceived as relevant crime and the use of data to locate rather than to determine specific use. It may well be that the larger number of requests are being used more as a location tool than as a more detailed investigatory procedure. But, the figure for Lithuania is so much greater than others it does rather beg the question what use is being made of retained data in that small state? Perhaps there remains an investigatory throwback to a prevous regime - although the lower (far lower) figures for neighbouring Estonia and Latvia may negate that suggestion.

Interesting data - it will be interesting to watch what comes out of the Commission in late summer/autumn 2010.

Tempus fugit …..

Where does the time go? It seems only just a few weeks ago that we were discussing the ramifications of the proposal for a European Data Retention Directive. The reality is that this was now five years ago and the major discussions took place during the UK Presidency of the European Union in the second half of 2005.

We are now fast approaching the date set within the Directive for the European Commission to report to the European Parliament and the Council on the working of the Directive and its impact on the economic operators and consumers. The date for the submission of the evaluation is 15th September 2010 - just 6 months away now. As a result of the evaluation, the Commission will determine whether it is necessary to amend the provisions, particularly in relation to the nature of the data to be retained and the period of retention. The results of evaluation must be made public.

In the background to the imminent evaluation there are some interesting developments and it is clear that the Directive has not yet been applied across all member states of the European Union.

On March 2nd, the German Constitutional Court ruled that the implementation of the Directive in Germany was in contravention of the German Constitution. Der Spiegel reported on Wednesday 3rd March that the Court had ruled that data collected and retained under the (now unconstitutional) law was to be deleted with immediate effect and that strict controls were to be brought into place before the law could be re-introduced. The case has taken some two years to progress but was brought as a class action on behalf of some 35,000 German citizens who argued that the new law went too far.

The court agreed and said that there was insufficient clarity in the reasons for the retention of data and that there were insufficient safeguards on the data once retained. A key point here is that the Constitutional Court has struck down the German implementation of the Data Retention Directive, not the Directive itself. The German government must now look at the decision of the Court and consider the safeguards that must be put into place before it can draft a new law and introduce that. It is certain that there will now be intense public scrutiny.

Belgium also faces an interesting period, particularly as it is scheduled to take over the rotating Presidency later in the year and will be ‘in the hot seat’ when the evaluation of the Directive is due to be presented. The transposition of the Directive into national (Belgian) law has taken some time and there has been considerable and vocal opposition to the Government proposals. The proposals went much further than provided for within the Directive including banking data and use of the data beyond what may be determined as ’serious crime’. The Belgian proposals also called for the retention of data at the maximum period (24 months) provided for within the Directive. The initial proposals attracted a negative response from the Belgian data protection agency, an almost unheard of situation - although that eventually was turned around to a more positive response when the proposals were watered down time scales pulled back to a more standard 12 months.

The Belgian proposals have not yet completed the parliamentary process. In the last couple of months, Belgian ministers have been trying to reach consensus with stakeholder groups to see if they can bring forward a new law before June. That is an important date - the rotating Presidency comes to Belgium on 1st July and the government wants to prevent the country from critiscism about their failure to implement whilst they are also supposed to be leading discussions on evaluation.

It is clear that some Belgian politicians had been awaiting the outcome of the case before the German constitutional court. That is now clear - it remains to be seen how this may affect the Belgian transposition.

Whither ‘mere conduit’?

‘Mere conduit’ is a defence - laid down within the European e-Commerce Directive and transposed to UK law within the Electronic Commerce (EC Directive) Regulations 2000 - that allows an intermediary, typically an Internet Service Provider, to limit liability for illegal activity. This follows on from the accepted position that a mail carrier (Royal Mail etc.) is not liable for the contents of mail that it carries - provided that it does not know what is in the package.

Article 12 of the European Directive sets out the position:

‘Mere conduit’

1. Where an information society service is provided that consists of the transmission in a communication network of information provided by a recipient of the service, or the provision of access to a communication network, Member States shall ensure that the service provider is not liable for the information transmitted, on condition that the provider:

(a) does not initiate the transmission;
(b) does not select the receiver of the transmission; and
(c) does not select or modify the information contained in the transmission.

2. The acts of transmission and of provision of access referred to in paragraph 1 include the automatic, intermediate and transient storage of the information transmitted in so far as this takes place for the sole purpose of carrying out the transmission in the communication network, and provided that the information is not stored for any period longer than is reasonably necessary for the transmission.

So, that seems reasonably clear. An Internet Service Provider (ISP) is an intermediary - they carry traffic across their network, they do not initiate the traffic, they do not select the recipient and they carry it without selection or modification. Provided they adhere to the conditions then they may claim a defence of mere conduit and cannot be held liable for, say, the transmission of illegal criminal content (child abuse content) or unlawful content (Peer 2 Peer file sharing). The problem for the ISP comes when they are told about the traffic or otherwise become aware. Once an ISP is ‘put on notice’ then they must take action.

OK, so why is there a question mark over ‘mere conduit’, what appears to be a well established point of law. The problem, as so many affecting ISPs today, has derived from the peer 2 peer discussion. We know that pressure from the industry has resulted in the ‘3-strikes and you’re out’ process - shortly to be incorporated within the UK Digital Economy Bill. Now it seems that the rights industry has been able to exert pressure in other areas and the outcome of this could be important for the intermediary.

The problem area is ACTA. AC what you say - ACTA stands for the Anti-Counterfeiting Trade Agreement. OK, what has that got to do with ISPs. Governments have been engaged in a series of discussions, the most recent of which have taken place in Seoul, South Korea, to look at the updating of laws to protect intellectual property. Most readers will be familiar with actions brought against online auction houses (e-Bay) alleging collusion in the sale of counterfeit goods diluting the trademark interests of well known luxury brand names. Other actions have been taken by Customs and Trading Standards officers to confiscate counterfeit goods - sunglasses, handbags, rip-off DVDs etc. That all seems fairly straight forward and expected.

The problem comes with the extension of the counterfeiting argument to copyright infringement in the electronic environment. Hints of the nature of the Seoul discussions appeared in leaked preparatory papers. An European Commission (DG Trade) document in September indicated that the EU and US had engaged in discussion in Washington as part of the Intellectual Property Rights Work Group. Within those discussions, a side meeting had been held to discuss the US preparation of the future Internet Chapter of the ACTA. At that time the US delegation indicated that they had been working for some while on the chapter and had engaged in discussion with other Govt. agencies and with interested private stakeholders (not defined or named as these were bound by NDAs). The US delegation gave an oral presentation to the EU Trade group. It is now clear that discussions in Seoul have followed the inital oral advice and that the US drafted chapter appears to follow the provisions of the US Digital Millennium Copyright Act (DMCA)

ACTA requires that ACTA members (Government/member state signatories) have to provde for third-party liability; Safe-harbours for liability regarding ISPs to be based on Section 512 of the Digital Millennium Copyright Act and to benefit from safe-harbours, ISPs will need to put in place policies to deter unauthorised storage and transmission of IP infringing content (these might include making changes to customer contracts to allow a graduated response - ie, ‘3-strikes and you’re out’).

The European Parliament has now voted against the ‘3-strikes’ approach - there is development within the new Telecoms Package to be agreed between the European Council and the European Parliament. That is likely to reach consensus with provisions to allow a ‘3-strikes’ approach but perhaps subject to appeal or judicial oversight.

There is more amongst the discussion from Seoul. It would appear that rights owners will be able to initiate proceedings against intermediaries alleging that they have allowed their networks to be used for unlawful activities. European ISPs have long known that US based rights owners would like to see the European protection removed and brought into line with the US DMCA practice. In order to claim safe-harbour protection the European intermediaries would need to ensure that they, ‘put in place policies to deter unauthorized storage and transmission of IP infringing content.’ That is a wholly different approach to the current status, transferring the onus to the ISP. The EDRI newsletter notes, “European citizens should be concerned and indignant. As reported, the ACTA Internet provisions would also appear to be inconsistent with the EU eCommerce Directive and existing national law, as Joe McNamee, the European Affairs Coordinator of EDRi notes: “The Commission appears to be opening up ISPs to third party liability, even though the European Parliament has expressly said this mustn’t happen, ACTA looks likely to erode European citizens’ civil liberties.”

There has been real concern about the nature of the discussions - and the secrecy within which they have been conducted. The EU leaked paper noted, ‘As agreed among ACTA participants, the negotiating papers are not public documents’. The Washington Post noted that civil rights organisations had written to President Obama to complain about the lack of transparency.

The Washington Post article noted. ‘The groups, which include Public Knowledge and the Sunlight Foundation, wrote in a letter that the secrecy of the process – and on an issue that could have broad implications for Web users – could unfairly the benefit content providers that are most actively involved in the process.

“We applaud your promise of a more transparent, collaborative and participatory government,” the groups wrote. “However, multiple aspects of ACTA fail to meet these standards.”

The Swedish Presidency has published a note about the 6th round of negotiations. The Swedish note notes, ‘discussions at the meeting were productive and focused on enforcement of rights in the digital environment and criminal enforcement.’ The note continues, ‘Participants also discussed the importance of transparency including the availability of opportunities for stakeholders and the public in general to provide meaningful input into the negotiating process.’

The opportunity for the public to ‘provide meaningful input’ is important. The next stage of the ACTA negotiations will take place in Mexico in January 2010. With the Lisbon Treaty in full force from 1st December, the EU will represent all member states and any decisions accepted will be implemented for all. The current (Swedish) presidency of the European Union notes that ACTA hopes to reach agreement and implementation early in 2010 - there is not much time left before we might see major changes that will affect ISPs and other third parties. Where will be the opportunity for public consultation and input in this timescale?

Data retention - still some unhappy states

The Data Retention Directive was introduced into European law back in 2006 - with a requirement that member states transpose the first phase by September 2007 and the second phase by March 2009 (where the State took advantage of a derogation in rellation to IP based traffic).

Interestingly, both Belgium and The Netherlands advised the European Commission of their intention to take advantage of the derogation in relation to IP. That still meant that they were expected to transpose in relation to fixed line and mobile telephone traffic by September 2007 but that had opted, like the UK, to leave IP based retention until the later date.

A group of Belgian organisations have now raised a petition to protest the local transposition of the Directive. In August, the Belgian Minister of Justice proposed a retention period of 2 years (the maximum within the range of the Directive - 6 months to 2 years) . The UK settled on 12 months - interestingly the Belgian Data Protection Supervisor felt that the 2 year period was too long and disproportionate and should be reduced to 12 months. The Belgian petitioners felt that there was not sufficient evidence to justify the retention of traffic data which they felt was not a solution to security issues.

Just to the north, the Netherlands government is also engaged in discussion. A few wees ago, government agencies held meetings with ISPs to provide some clarification of terms within the new Data Retention Act - EDRI-News reports that after the meeting there was still confusion as to what was required and for how long. As currently implemented, both telcos and ISPs are required to retain data for 12 months but discussion in the upper house of the Netherlands parliament (Senate) has suggested that the Minister may be prepared to reduce the ISP requirement to just 6 months (as was suggested in the UK, bearing in mind the low level of requests of user data in relation to IP based traffic).

A full description of the Netherlands law (2008) can be found at the site for Agentschap Telecom, the Dutch telecoms regulator.

There has also been discussion in the Netherlands about the possibility of centralised retention of traffic data. ‘Bits of Freedom’ in the Netherlands reports that some 3 Million requests for traffic data were served by the Netherlands police in 2008 - on a population of some 16 Million. That is a very high figure when compared against the reported request rate in the UK - Surveillance Commissioner reported 0.5 Million requests in 2007 against a population of some 60 Million. If the UK rate were the same as the Dutch then that figure would be in the order of some 11 Million requests!

Clearly there remains considerable concern and disquiet across Europe.

The Directive provides for review of the retention policies in 2010. Clearly there is likely to be a lot to be discussed.

Emergency, which service ……..?

Most people are familiar with the process for making an emergency call - whether it is to the Police, Fire Service, Ambulance or Coastguard. Pick up a phone and dial 999 - or 112 as the pan-European common emergency call number.

When the call is answered by the emergency service operator at the telco, the operator will ask you which service you require and will ask you to confirm the number you are calling from. No problems there.

The operator will see the calling line number displayed in front of them and can immediately cross-reference with reverse look up to identify the location. OK, no problems there - but hold on a minute, what happens if you are not using a land-line?

Technology has moved on and there can no longer be an assumption that all users are calling from a fixed land-line. Emergency calls can be made from a mobile number and, increasingly, from a Voice over IP phone (VoIP). Now, these latter two present something of a problem. Mobile numbers are not geographic (they do not have a specific regional location exchange code) and can be made from pretty much anywhere (except in my house where the mobile does not work!). Emergency operators can access data from the mobile providers to locate the cell where the call is being made from - and triangulation from a number of base stations can provide a fairly accurate geographic location of the calling phone. That’s what law enforcement do when they want to track a criminal or suspect target - the mobile phone is a very effective piece of electronic tracking gadgetry sitting in your pocket. You don’t have to make a call, the phone will register itself with the local cell whenever it is switched on and will thereby giveaway its position.

OK, again, no real problems there. Problems arise with VoIP. There may be a number associated with a VoIP call but it may be a geographic number and the geographic number assigned to the call may bear no relevance to the actual geographic location of the VoIP handset or software. This may be connecting through any IP link - perhaps a fixed line broadband circuit or perhaps a WiFi connection in a public place (cafe, pub, airport etc.).

The Ofcom General Conditions of Service require providers to make details of callers available to emergency service operators. For fixed line and for mobile calls that is fine - the provider has all the data and can cross-reference databases. For VoIP there is a problem - the VoIP service is likely to be provided by a different service provider to the underlying IP transport. The VoIP provider may have a record of the geographic number associated with the call and may be able to reference that to a customer - but cannot tell whether or not the customer is at the location they have. The IP address used for the call and included within the packet data will be allocated by the ISP providing the transport layer - there may be no quick look-up between the VoIP provider and the ISP to determine the location and user of the IP address. It is quite possible that the VoIP user could log in from a range of IPs during a single day - particularly if they are connecting using WiFi access points.

The problem can have tragic consequences. A Canadian family called the emergency services using a VoIP service - the trackback from their initial service registration indicated a location in Toronto so that was where the medical team was sent. Unfortunately the family were hundreds of miles away in Calgary and had not updated the location information held by the VoIP provider.

To overcome the problem the emergency services want to be able to make a quick look up request to ISPs to determine the telephone line reference (CBUK record) for the line on which the VoIP call originated. That might seem straightforward but the practicalities are much less so. There is no standard format for ISP customer service records and there is no standard interface that will allow an external agency to access and requues information from those databases. Emergency service developers have suggested that ISPs should install systems that will allow real-time look-up requests from the emergency service operator. The operator would identify the call as a VoIP origin, identify the associated IP address, refer that to a central look-up registry to identify the ISP (RIPE?) and then pass the request to the ISP who would be expected to return the CBUK reference for the line. All this in real-time and in no longer than it has taken you to read this last paragraph.

The implementation of the Data Retention Directive at a European level has meant that there have been developments to create a standardised form of data request - ETSI standards. Implementing these may be fine for the larger operators who have teams of developers and can bear the costs. But for the medium and smaller level ISPs there will be a real problem - substantial development costs and quite likely whole changes to back end and Internet facing systems. It is quite likely that the smaller ISPs will simply not have the resources to be able to comply.

The Crusher can see another problem here. Once an interface system is in place then a remote operator will be able to input an IP address and return a telephone line reference which can be used to determine a location. That is exactly the type of information that typical Section 22 notices issued under the Regulation of Investigatory Powers Act (RIPA) often require - law enforcement agencies can issue a notice requiring an ISP to provide details of a user. Requests often cite a date, time and IP address - and require the ISP to identify the user. If that can be done automatically by the emergency operator then it will not be long before other parts of law enforcement agencies (LEAs) identify the route as a rapid way to investigative data. Politicians will trot out the tired old lines about importance for public safety, citizens have nothing to fear etc. And will then introduce legislative changes that permit LEAs to process automatic data requests.

Any development for emergency use will have to be developed with extensive safeguards and strict controls. These must ensure that access can only be made in genuine emergency situations and that it is not possible to investigators to access for alternate purposes. Equally, it must not be possible for other organisations to attempt to access data - for example, for rights owners to try to identify end users flagged up as potential copyright infringers.

The emergency request is fairly self-explanatory. The problem is the likelihood and the inevitability of mission creep.