US panel approves data retention bill

A US House of Representatives committee has approved legislation that would force internet service providers (ISPs) to keep logs of their customers' activities for one year, in case police want to review them in the future.

House Judiciary Committee prepares to vote on a sweeping data retention mandate.
(Credit: US House of Representatives)

The 19:10 vote represents a victory for conservative Republicans, who made data retention their first major technology initiative after last autumn's elections, and the Justice Department officials who have quietly lobbied for the sweeping new requirements — a development first reported by ZDNet Australia's sister site CNET.

A last minute rewrite of the Bill expands the information that commercial internet providers are required to store to include customers' names, addresses, phone numbers, credit card numbers, bank account numbers and temporarily assigned IP addresses, some committee members suggested. By a 7:16 vote, the panel rejected an amendment that would have clarified that only IP addresses must be stored.

It represents "a data bank of every digital act by every American" that would "let us find out where every single American visited websites", said Representative Zoe Lofgren of California, who led Democratic opposition to the bill.

Lofgren said that the data retention requirements are easily avoided, because they only apply to "commercial" providers. Criminals would simply go to libraries or Starbucks coffeehouses, and use the web anonymously, she said, while law-abiding Americans would have their activities recorded.

To make it politically difficult to oppose, proponents of the data retention requirements dubbed the bill the Protecting Children From Internet Pornographers Act of 2011, even though the mandatory logs would be accessible to police investigating any crime, and perhaps even attorneys litigating civil disputes in divorce, insurance fraud and other cases.

"The bill is mislabelled," said Congressman John Conyers of Michigan, the senior Democrat on the panel. "This is not protecting children from internet pornography. It's creating a database for everybody in this country for a lot of other purposes."

In events that were first reported by ZDNet Australia's sister site CNET , Justice Department officials have been lobbying to require internet providers to keep track of what Americans are doing online. Here's the timeline:

Supporters of the measure characterised it as something that would aid law enforcement in investigating internet crimes. Not enacting it "would keep our law enforcement officials in the dark ages", said its primary sponsor, House Judiciary chairman Lamar Smith.

"Both Democratic and Republican administrations have called for data retention for over a decade," said Smith, who noted that groups including the National Sheriffs' Association, the Major County Sheriffs' Association and the Fraternal Order of Police have endorsed the concept.

For a while, it seemed like opposition from a handful of conservative members of Congress, coupled with Democrats concerned about civil liberties, would derail the bill.

Representative F James Sensenbrenner, a Wisconsin Republican and previous chairman of the House Judiciary committee, had criticised it at a hearing earlier this month, and again in the latest voting session.

"I oppose this bill," said Sensenbrenner. "It can be amended, but I don't think it can be fixed ...It poses numerous risks that well outweigh any benefits, and I'm not convinced it will contribute in a significant way to protecting children."

So did Representative Jason Chaffetz, who has made privacy a signature issue, and introduced a geo-location bill last month, after trying to curb the use of airport body scanners two years ago.

The original version of the bill, introduced in May, required internet providers to "retain for a period of at least 18 months the temporarily assigned network addresses the service assigns to each account, unless that address is transmitted by radio communication". The wireless exemption appeared to be the result of lobbying from major carriers, but drew the ire of the Justice Department, which says it didn't go far enough, and was removed in a revised draft.

The mobile exemption represents a new twist in the debate over data retention requirements, which has been simmering since the Justice Department pushed the topic in 2005, a development that was first reported by CNET. Proposals publicly surfaced in the US Congress the following year, and President Bush's attorney-general, Alberto Gonzales said it's an issue that "must be addressed". So, eventually, did FBI director Robert Mueller.

In January 2011, CNET was the first to report that the Obama Justice Department was following suit. Jason Weinstein, the deputy assistant attorney-general for the criminal division, warned that wireless providers must be included because "when this information is not stored, it may be impossible for law enforcement to collect essential evidence."

Smith introduced a broadly similar bill in 2007, without the wireless exemption, calling it a necessary anti-cybercrime measure. "The legislation introduced today will give law enforcement the tools it needs to find and prosecute criminals," he said in a statement at the time.

"Retention" versus "preservation"

At the moment, ISPs typically discard any log file that's no longer required for business reasons such as network monitoring, fraud prevention or billing disputes. Companies do, however, alter that general rule when contacted by police performing an investigation — a practice called data preservation.

A 1996 federal law called the Electronic Communication Transactional Records Act regulates data preservation. It requires internet providers to retain any "record" in their possession for 90 days "upon the request of a governmental entity".

Because internet addresses remain a relatively scarce commodity, ISPs tend to allocate them to customers from a pool based on whether a computer is in use at the time (two standard techniques used are the Dynamic Host Configuration Protocol and Point-to-Point Protocol over Ethernet).

In addition, an existing law called the Protect Our Children Act of 2008 requires any ISP who "obtains actual knowledge" of possible child pornography transmissions to "make a report of such facts or circumstances". Companies that knowingly fail to comply can be fined up to US$150,000 for the first offence and up to US$300,000 for each subsequent offence.

Via CNET