Today's Dept. of Justice Information Forum

Hi,

I presume there'll be an article by Karlin in the Irish Times tomorrow but in any event here's a brief description of what happened. Further details of Joe Meade's (the Data Protection Commissioner) speech can be found at: http://www.dataprivacy.ie/7nr240203.htm

It's actually really good as it not only describes how we got to the current situation but also the privacy arguments against traffic data retention.

The room was small(-ish) but crowded with over 40 people there. All the country's main telcos, ISPs and cable ISPs were present.

The Minister Mr. McDowell opened the session by saying that this was the first stage of a process and that he had an open mind on many of the issues regarding data retention. He (along with speakers from the Department of Communications and the Gardai) explained the current legislative position. This is already contained in Joe Meade's speech at the above link. The Department of Communications speaker explained that the Directive has to be applied by the end of October and that current Irish data retention requirements don't cover ISPs.

The Garda speaker explained about the internal criteria the
Gardai have to vet requests before submitting them to telcos. He said that not all requests pass the criteria and consequently are refused.

He then went on to state why they needed traffic data retention. Examples of its use include:
- Paedophilia. He cited Operation Amethyst. (I could be wrong but
I thought in this case the FBI supplied the gardai with a list
of names, addresses and credit card numbers. The gardai used
images on peoples' hard drives as evidence in subsequent cases.
It's not clear what role traffic data retention played in this.)
- Omagh bombing
- Veronica Guerin murder case. (Both these cases were some time
ago and probably before the criminal community realised that
this kind of monitoring was possible.)
- Transnational Organised Crime and our commitments through
membership of Interpol, Europol etc.

I won't go into the details of Joe Meade's piece as it's at the link above. But in summary he opposed the imposition of a direction on telcos last year which required them to store traffic data for 3 years. This direction, by the way, was secret and telcos weren't allowed to disclose that they received it.

Then there was a question and answer session where most of the speakers (who were from ISPs) raised technical/business reasons as to why they might have difficulties implementing the system. Among the issues raised were:

- Whether e-mail that looked like web traffic (i.e. if it was generated by Hotmail/Yahoo mail accounts) needed to be logged. If this is the case then traffic will need to be parsed in real-time.

- Concerns about the costs this system will put on ISPs - costs which will be passed on to customers.

I asked the Minister the following questions which although he spent 5 minutes answering he never actually dealt with the substance of what I'd asked:

- This is the first stage of a consultation process. What are the next steps?
- Can we have objective, empirical data which demonstrates the need for this type of data retention before we diminish our privacy rights?
- The speaker from An Garda Siochana referred to the cell site location being made available to them. With advances in mobile 'phone technology it's getting easier to pinpoint someone's location more exactly. Soon it'll be possible to determine someone's location to within 10 metres. Will this kind of information be requested under this legislation?

Another speaker from an ISP explained how it's actually impossible to retain internet traffic data. This is because of the extremely high volume of traffic which would need to be retained and then sifted through. Another person said that as data transfer rates are several orders of magnitude higher than current storage speeds it actually isn't possible to do real-time storage of all this information. (I'm not sure if you'll need to store everything that goes through though so I'm not clear how valid this argument is.)

It then drifted into a technical discussion where issues such as VoIP etc. were discussed.

So in summary we're really none the wiser. The Government seem to want to store traffic data for 3 years and to formalise the system for accessing it. It's not clear whether it's technically feasible to store traffic data on ISPs as the Government haven't exactly defined what they want stored yet.

There are to be further phases in this consultation process but we don't know what they are yet.

I'll check in here regularly over the next few days. If anyone has any other questions just post them and I'll try to answer them.

-Mal.