Now that I have been alerted to the <i>possibility</i> of needing to keep records <i>just in case</i>, have I received constructive notice from the gummint, so that I must begin to keep such records at my business website?

Umm, further, do I have to make a written record of a verbal conversation I have had <i>just in case</> the subject/s become relevant in some <i>possible</i> future legal altercation?

Where will this all end?

George Orwell would be impressed - not only is Big Brother watching, but he's persuaded us to help him keep an eye on us!

So the US can no longer torture people (although I'm sure it still will) as they got found out.

They can no longer listen into phone calls as they got found out.

Now they want to store every bit of info anbout ANYONE in the world (hint Bush, you are NOT the world). They say it's for when the issue cout orders, yeah right. Wait a few years and find the next news story where they routinely tap into this info....

"Effectively, this makes the telephone companies into the warehouses for the government and for anybody with a subpoena. "

In effect it backdates the subpoena, so that information can be retrieved for a time before the subpoena was issued.

Why you can even collect evidence from *before* the alleged offence was committed and infer a pattern of behaviour likely to lead up to the offence. The more data, the easier it is to selectively choose the data that fits the offence you're trying to prove.

Now if you had the ability to backdate your defence, so you could go back in time and collect the evidence you will need to defend yourself in the future time that would be great! Who used your PC on 2nd Nov 2005? Hop in the Tardis and find out! Accused of pirating that CD 'backup'? Go back in time and find the receipt for the original CD!

They consider there is something in RAM which requires permanent retention, although their definition of this item does not exist until the time that they decide they need it... logically then anything existing even momentarily in RAM must be permanently retained. Some kind of rolling memory dump? Goodbye any expectation of performance (and good luck later identifying the bit of data you decide that you wanted.)

The best privacy policy I've ever seen on a website was:

"This information will not be used for any other purpose -- not even to keep us out of jail."

So ISPs (and company IT depts, ...) need to keep a copy of everything that goes through -- just in case. Presumably the same logic will also apply to:

* post office - record which post box a letter was collected from, where it is going to, dates, etc

* shop - what/when you bought, what notes/coins you used

* shop, etc, anti theft video now to be kept for 2 years

* taxi company: where from, to, name of booking over phone + phone number

What about consumer goods: should my DAB radio store details of what I have been listening to ?

The level of spying on citizens is becoming intolerable.

Now that most telephone companies are "digital end-to-end" *all* voice conversations over a telephone - particularly over a mobile - are in a device's RAM at some point...

This is just silly.

... the same way "*temporarily* stored" is not "stored". You can't possibly store in RAM, since by essence it is *volatile* memory.

Ok, but let's push further the argument of this clever court:

- When you *speak*, you temporarily *store* your speech in the *air*. Air is a wonderful storage medium obviously, it's a fact known by everybody, in particular by those Hollywood lobbyists that have eaten to much crap movies to distinguish SF from reality. You stored it under the form of pressure waves, very convenient, and undoubtfully persistent.

- Now, when you're subject to a litigation hold, or think you are, or think that may be it's time to consider the possibility of being so, then you suddenly need, are requested to immediately buy a recording device + microphone (preferably encumbered with lots of DRM Hollywood patents and license fees), and glue it to your mouth so that to be sure to store everything you might say (and no, you're not allowed to switch it off when you go to the loo...).

Really clever.

Hmmm. How deep does the rabbit hole go?

Will I need to start thinking about backing up my Server's L1 & L2 cache? ;-)

Or may be it is time to take shares out in undelete software programs...

Part of the problem here is in definitions. What browser someone is using while surfing the web is not "personal" information. I can not use the fact that "a surfer" used Firefox, therefore it must be "John Q Public".

Same goes for IP address, if I am on a private network and access the Net via a proxy of some sort and it assigns a public IP address to me and 100's or even 1000's of other users, that is not "personal" information.

Where I was last on the web is also not personal information. I could be using a shared computer and log in after the previous user finished surfing to the Taliban's recruitment web site and then it "appears" that *I* went from the Taliban's recruitment web site to the United Nations web site.

Let the interested parties request legal access to loggable information and then require the maintainers of this loggable information to comply under court order and let the logging begin. I think the whole thing stinks of 1984ism and counter acts the whole "innocent until proven guilty" premis. Now it's "you are probably guilty so we are going to log it until we need to prove it and even then it's all superficial anyway"

Glad I am Canadian, for now...

--Pete

"The first problem with this privacy policy – like most privacy policies – is that it's not true. Whenever you visit a website, you "involuntarily" provide "personal" information to the site operator – things like the type of browser you are using, your IP address, the physical location of that IP address, your configuration settings, and what website you may have been referred from or to, among other things."

Where's the personal part? The only element you listed that "might" be considered personal is the referrer info.

1) Browser (user-agent) can be spoofed, though I honestly don't see why I'd care if anyone knows that I use FireFox or IE or whatever.

2) IP address isn't personal information (though under certain circumstances my ISP could probably be compelled to link it to personal information).

3) The disclosure and accuracy of the physical location of "my" IP address isn't controlled by me and is likely limited to the information provided by my ISP to ARIN et al (though under certain circumstances my ISP could probably be compelled to link it to personal information).

4) The configuration settings of my browser aren't personal. Who cares if someone logs what language my browser is set for? Or what plugins I have installed?

5) Ok so someone might be able to figure out that I ordered pizza or flowers etc based on what site I browsed to their site from or where I go as I leave their site. BIG DEAL! At worst they link this to a user name I provide on their site which may or may not (likely may not) provide them any details as to who I actually am (ie: Thorin Oakenshield, etc.)

Its not really that unreasonable. It seems to be saying that if a court specifically tells a company to retain the log information then they have to...

The real winners are disk storage sellers.

How fast is your RAM in terms of data throughput?

How fast is your HDD?

There is no physical way to get all the data that went through RAM into a HDD - the difference in data speeds is several orders of magnitude.

I think a demo involving a hosepipe and water jars might be useful at the appeal - try to get all the water out of a fast-running hosepipe into a series of small jars through a tiny funnel - without spilling any of it.

If my privacy policy (which states that I won't collect any information other than that required to provide the actual service and that that information will not be retained or provided in any shape to any third party) is a binding contract, than an order to the contrary might be considered tortuous interference. IANAL, but I serve on the board of directors of a home owners association and testified at a state house committee hearing on legislation that would have changed how we dealt with our members. The bill died in committee.

I actually record the IP address, but delete that data after a day or so.

Given the Republican party's recent fiasco with email - not following the government's own policy on which accounts, servers, etc. can be used to send Federal government email and which to send party political email - my only response to this latest sphincter-tightening would be, "I will if you will."

So the court has determined that TorrentSpy need to keep a record of transient data passing through the servers memory? Fine. Configure the servers to dump their entire core every second. Presumably then TorrentSpy will meet the terms of discovery by delivering a few hundred terabytes per day of binary core dumps to the plaintiff. It's their problem then, extracting the weblogs from it... }:>

The FBI, NSA, Department of Justice, etc. all use commercial telephone and data services, in addtion to their own "black" networks; sometimes the data is encrypted, sometimes not.

Under the premise of this article, the telephone companies should be required to maintain the total sum of data for several years. This will have two obvious knock-on effects:

1. The cost of telephone and data communications will skyrocket, due to the additional costs of storing terabytes of data.

2 .The data becomes vulnerable to espionage because it is outside the direct control of the government, thus posing a serious threat of grave damage to the nation.

From the second point above, it follows that any judge who orders such storage of transitory data is, whether consciously or not, a threat to national security, and as such, should be arrested and tried for treason.

"information that is fixed in a tangible form and to information that is stored in a medium from which it can be retrieved and examined"

RAM does not store data "fixed in a tangible form", and nor is it "a medium from which it can be retrieved and examined", therefore it is not required to capture that information. This is a last-ditch attempt by federal attorneys to get data from Torrentspy using barely-understood (by them) vehicles. It's not going to be codified, in the end. They can demand that log files be retained in the future, but, as "Backdated subpoena" suggests, there is still the matter of relevance to the current set of laws governing information search and seizure, which would also need to be revised to accommodate anything like this new legislative attempt.

I was going to post along the lines of what J.A.Blackley said ... re: "lost" emails from the RNC servers. That, plus the nature of volatile memory plus the intriguing ideas posted by Morely Dotes all spell failure for this legislation.

I was about to make the exact same point.

I don't see how you can be forced to keep logs that you have explicitly stated you would not keep though. Not without the express permission of every data protection force (sorry, service) on the planet. Those damned interwebs get everywhere you know?

I must caution you that anything you say, may say, might have said, did say, are thinking of saying, could have said or didn't say will be recorded and used in evidence against you. George Orwell he don't know nuffin!

I'm with Aquilus - they want this information, drown the bastards in it, terabyte core dumps and all.

Actually, if the pigopolists tried to force me to do something like this, my next act would be to dump a huge number of random IP addresses into the logs, backdated with modified datestamps, at a ratio of around 1 actual IP : 100,000 random fake IPs. Yes, that's illegal. No, they will have no way to tell that I'm doing it. No, I have no respect for a law or a government that no longer serves its people or the principles of justice and democracy. Yes, I'm a doubleplusungood crimethinker. Down with Big Brother!

James wrote:

nor is it "a medium from which it can be retrieved and examined"

It can be retrieved and examined.

While it is not something I do regularly, I have had occasion as a sysadmin to load up a debbuger and read from active memory, modifying Solaris kernel parameters on the fly for performance tuning.

If memory was not "a medium from which it can be retrieved and examined" then I would not have been able to read the current in-memory kernel settings and modify them.

I guess a way around this issue that TorrentSpy (or anyone else) has would be to setup an anonymous SSL proxy server that removes any header information from the request (referrer, browser info etc, I have done this before with corporate proxy servers) owned by a separate corporate identity. Therefore any court orders to supply data would only include the proxy servers address as the originator. I guess the court could always issue a separate court order to the company owning the proxy server, but then you could always locate the proxy in a third country. And this is the reason for using SSL, as if the proxy was in the US for example, all the court order would get are the addresses, not the content of the data, or of the server was in the US, then they'd just get the data and not the originator.

The proxy server (hell, the routers/gateways too) would also have to add small random latencies to traffic to make traffic analysis attacks harder.

JimC wrote:

"Its not really that unreasonable. It seems to be saying that if a court specifically tells a company to retain the log information then they have to..."

Yes it is unreasonable. These guys don't have a single understanding of modern technologies. The court doesn't say you have to retain data, but that "you must suspend your document destruction policy and stop deleting that relevant information." How can you stop something that you are not doing???

Justin wrote:

"It can be retrieved and examined."

You seem to have advanced skills in your field. But you don't have to go that far. It is well known that data can be retrieved and examined from RAM. That's the main purpose of it. But the key point is that RAM is NOT a *medium*. Do s.o. ever has transmitted or carried on data by giving to s.o. else some pieces of RAM??? RAM is a *transient* memory. By definition, every data there is meant to be deleted. Actually, it is so transient that it's content must be refreshed continuously or information would be deleted. And what if server was regularly shut down say at midnight? May be advanced forensics would still be able to "retrieve and examine" data from unpowered RAM, but this is clearly not a standard. Pushing further, may be this court could hire some Shaman to sense the air in TorrentSpy computer room for spiritual remnants of dead IP connections...

1.How in the world can you retroactively retain RAM memory?

2.Unfunded mandates are so easy to create, yet the creators don't bear the economic burden of compliance. Look at "no child left behind". Works really well, doesn't it?

3.Steve Roper, great idea, even better spiritedness!

4.Time for internet anonomizing software, or at least proxies. Land of the free? That's eroding faster than coastal shorelines. At least it does seem that we still have enough spirit to still be the home of the brave.

SaMM

Apparently this is all in attempts to circumvent the incredibly difficult process of obtaining a wiretap order. Wiretaps laws have been put into place to prevent breaches of the 4th amendment in which "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Be it voice or data, telco or broadband, the gathering of this type of information is nothing more than a wiretap that is either being compelled from the defendent or legal secured from the ISP.

"The Court in Berger v. New York identified the following requirements for an interception order to be constitutional under the Fourth Amendment: (1) there must be probable cause to believe that a particular offense has been or is being committed; (2) the conversations to be intercepted must be particularly described; (3) the surveillance must be for a specific, limited period of time;(4) if the warrant is to be renewed, continuing probable cause must be shown; (5) surveillance must terminate once the conversation sought has been seized; (6) notice must be provided unless a factual showing of exigency is made; and (7) a return must be made on the warrant so the court may supervise and restrict the use of the seized conversations." also "Unlike traditional search warrants, a federal magistrate judge is not authorized to issue a wiretap. Only a federal district or circuit court judge may issue a wiretap." (http://www.monnat.com/Publications/Wiretap.pdf)

In addition the proposed court order is also requesting Torrentspy or any other future entity to possibly incriminate themselves by storing data that is not normally stored for day-to-day business use and is in breach of privacy policy. This would in essence force them to violate the 5th amendment where no person will be "compelled in any criminal case to be a witness against himself." For pete sake, if you can't manage to satisfy the requirements for a wiretap on your own, you shouldn't be trying to force the defendant to provide his own evidence either.

The attorneys, and the judge need to be disbarred for even pursuing such action. Just for spite I would tack on a packet sniffer onto the server's net port and do a direct dump to a printer--in BINARY. Then walk into the courtroom with 3 pallets of copy paper boxes filled with sheets of 1's and 0's and tell them, "Here is more than you required, have fun. See you in about 2 years after you figure out what's in there. Oh, and here's the bill for the toner and paper supplies for this DAY's worth of data."

Some people are saying that the type of browser you use, your IP address, the Web sites you have visited, etc., is not personal information.

From answers.com, one definition of personal (there are many!):

"Concerning a particular person and his or her private business, interests, or activities..."

The browser we use, our IP address, etc., is information concerning our private activities, and is therefore personal. Even if we use a public computer, and the previous person's activities are recorded along with our own, it's still personal - as it relates to what we were doing at a certain time and who we were around - that we were on this computer, or this network, that these were the sites we visited, and maybe these sites, too - though, perhaps, someone else viewed them, maybe a friend, maybe a work colleague, maybe some kind of associate, or maybe a stranger - it all relates to our private activity: where we were, what we were doing, what time we were doing it, who was - or might - have been with us, who might have seen us, the ISP we were using, etc.

Whether this personal information can then be used to identify us is another matter altogether.