data retention

We've already asked about how to handle the forthcoming data retention directive in Germany.

A few more governments are either heading down that path, or already there:

• Internet black boxes to record every email and website visit at The Telegraph UK.
• Data Retention in Denmark.
• SORM-2 in Russia
• Sweden wants to record all cross-border communications.

I suspect we'll see proposals for this in the USA soon enough.

In early January after 24C3, I travelled to Stuttgart to meet with the
police there. I spoke to about 30 or 40 investigators. My goal wasn't
to advocate for any particular laws or policies (that's up to them,
after all), but rather to help give them background so they can make
more informed decisions: explain who uses Tor and how it works, and try
to answer any questions that come up. In particular, my goals were to
open a discussion about the data retention laws, and also brainstorm
how German Tor operators and German law enforcement can get along better.

It turns out that the fellow who did the September 2006 seizures was
part of this group, and he was very interested to talk to me and learn
more about Tor.

They explained that the data retention laws *they'd* asked for were
basically that large ISPs should be required to answer them when they
ask who had a given IP address at a given time (data the ISPs already
keep for the most part), and as a bonus, it would be nice if they paid
somebody to answer the requests on weekends too. The law that they got
was way more than that, and they don't need or want most of it. read more »