Features

net.wars: Civil liberties got run over by a reindeer

A Reindeer? Yes; just in time for Christmas – and the end of the UK's presidency of the European Union – on Wednesday the European Parliament passed the data retention directive after a lot of last-minute dickering that seems to have turned the text into a self-contradictory mess.

The fundamental issue seems to be that despite the fact that we are now – at least in terms of the mass market – a decade into the Internet Era – politicians have come about as close to understanding what is technically easy or hard as Hollywood executives demanding a screenplay rewrite. The screenwriter William Goldman comments on this phenomenon in one of his books about the screen trade, when he noted that one executive said to a writer he knew that the screenplay was fine, just fine, but could he lop about ten years off the lead character's age? A change like that changes everything about a character and, said Goldman, when the wind blew in the right direction he could still hear the screams…

And so with the data retention directive. According to Malcolm Hutty, the regulation officer for LINX, the London Internet Exchange, the directive can be read to say either that service providers across whose networks traffic passes in transit to and from other providers (known in the trade as transit providers) must retain all that traffic data – or that they don't have to.

"If transit providers have to," says Hutty, "there's no Internet industry. There is no high-speed equipment that can perform that reconstruction." Or, since people are hardly going to give up their broadband, the entire industry will have to operate illegally.

It must sound very logical to someone who doesn't understand how the Internet works to say that middlemen should save traffic data, but even a small amount of research into how the Internet works would reveal that it isn't as though the traffic slows down to go tamely and trackably through a phantom tollbooth every time it crosses onto a new network. Maybe they're thinking of old-style phone calls, which opened a single circuit between caller and respondent that remained helpfully open between those two points for the duration of the call.

Internet data (which could be email, the contents of Web pages, voice calls, or peer-to-peer shared video files) isn't nearly so single-minded: it gets divided up into packets for shipping by whatever seems the best route at that split second. It's as if you sent a box of books from Ithaca, New York to Edinburgh, Scotland, and it got chopped up into millions of little chunks that each jumped onto the back of the nearest pigeon and arrived in Edinburgh after jaunts to Belize or Buenos Aires, Mauritius or Mumbai, jumping from pigeon to pigeon en route.

So what the directive may – or may not – be requiring is for each of the pigeons to remember the directions written on the chunks. Which makes the whole thing even nuttier: if you're law enforcement in hot pursuit of a suspected terrorist, how are you going to know which pigeons to interrogate?

In any event, says Hutty, the data the police use now is all phone records. "The case of ISPs has been that Internet data is so far from what they're using at the moment that we should wait to discuss it when we get there and understand the market." Most of the time, he says, the only thing that's really useful is to know which user has a particular IP address at a given time – which ISPs are generally cooperative in disclosing.

Overall, it's a pretty depressing sort of Christmas present, though the fight isn't over yet. The directive still has to be transposed by each national parliament, and it's already clear that they're likely to take different views of what the directive actually says. The feared hijacking by the copyright industry of a few weeks ago seems not to have quite happened: the directive states that access to the data is restricted to those prosecuting serious crimes, with the definition of what those are left to the member states.

Says Gus Hosein, the LSE Fellow who's done more work on this than anyone, "I'm predicting that this will lead to a swath of new crimes being labelled as 'serious crimes', just as the Serious and Organised Crimes Act passed last year here erased the distinction between 'offence' and 'arrestable offence'."

Data retention isn't the end of our Christmas goodies, though some won't be fully delivered until next year. The Terrorism bill will introduce a new set of notice-and-takedown requirements for statements that might promote terrorism, and the Audio/Visual Services bill seeks to extend the rules regulating television and radio to the Internet. More on those anon.

While I recognise the great thoughtfulness the government has gone to in presenting us with these gifts, really, truly, I'd have been happy with a stuffed armadillo from Interfauna. And it would have been a lot cheaper. But, you know, whatever.

See some of these tags: data retention, arrestable offence, transit providers, LINX