Data retention proposals make cybercrime suspects of us all
The Federal Government is concerned about cybercrime, which we understand and expect. However, in response to this concern, they’re putting forward a proposal that would oblige ISPs to retain all customer phone and Internet records for up to two years, in line with the ‘European Directive’.
They’re not just talking about suspected offenders here, they’re talking about everyone – you and me and even every child that ever uses a mobile or personal device like a tablet or smart-phone, or a home computer, or school laptop. Everyone in Australia – even your grandma.
That just seems over-the-top to me. We don’t live in a country wracked by civil unrest or political violence. We live in a stable, western democracy. Our law enforcement agencies already have the power to demand information about the telecommunications habits of ‘people of interest’ via warrants or court orders.
Attorney General Nicola Roxon claims the changes are required to allow law enforcement departments and intelligence agencies to crack down on criminals in this digital age, telling a conference in Canberra:
“We can’t live in a society where criminals and terrorists operate freely on the internet without fear of prosecution. We can’t allow technology to create a safe haven for criminals or a no-go zone for law enforcement.”
Well, you know, I think that sentence should really read –
“We can’t live in a society where innocent Australians cannot operate freely on the internet without fear of being spied upon.”
The role of an ISP in fighting cyber crime
Fighting cybercrime means that we will need to cooperate with law enforcement agencies as necessary – and we do. That usually means that the authorities determine whom they want information about and by using an existing process, issue us with an appropriate order to either establish a tap for them or supply whatever information is required by the warrant.
We only need to retain data required for us to deliver the services for our customers, in line with the National Privacy Principles, and additional data is only retained when authorised.
Innocent until proven guilty
The proposal being discussed at present, however, is that all telecommunications records about any telecommunications event (email, web surfing, phone calls, etc) by any Australian, including kids, will be collected all the time. Retaining customer data from all Australian Internet and phone users assumes that we suspect everyone and trust no one. This is a backwards step by government – whatever happened to the principle of ‘innocent until proven guilty’?
A police state ?
One of the most controversial aspects of the proposal is the fact that ISPs would be obliged to retain phone and Internet records for all customers – not just persons of interest.
Dr Anthony Bendall, Victoria’s acting private commissioner commented that the proposal would make ISPs agents of the state, typical of a police state.
Interestingly, three countries in Europe have rejected similar proposals based on the ‘European Directive’ because they consider them to be unconstitutional. These countries are Romania, Germany and the Czech Republic – countries that have trodden the path of the heavy-handed police state in the past. Perhaps it is their experience of where this sort of intelligence gathering leads, that has led to their rejection of such an approach.
A security issue
While we’re opposed to the proposal on the basis that it would make iiNet an agent of the state, it also opens up new issues in terms of data security and cost.
Our estimate of the costs associated with such a scheme is that a large data centre storing possibly 20 thousand terabytes of data at a cost of around $60 million would be required. The government won’t pay for that, so our customers would have to pick up the tab in higher charges.
The retained customer information would need to be carefully encrypted and securely stored. As we know, security breaches can and do happen, opening up the Federal Government and ISPs to major headaches –keeping customer records, on the off chance the information, may be useful to build a criminal case two years down the line!
Another thing to think about is how far this proposed data retention could extend. While, for the moment, the proposal focuses on telecommunications providers, why would this sort of legislation stop there? Isn’t it logical that if this approach is seen to be acceptable, that transport companies, utility providers, retail stores, banks and other private organisations would also be told to store customer data?
Just in case?
Steve Dalby made a statement to the Parliamentary Joint Committee on Intelligence and Security on Thursday, September 27th 2012. You can read the full statement below:
Thank you for your invitation to the iiNet Group to offer additional comments to this Parliamentary Joint Committee on Intelligence and Security.
The iiNet group includes iiNet, Internode, Netspace, TransACT and Westnet and a range of other brands.
I am iiNet’s Chief Regulatory Officer and my colleagues are John Lindsay, Chief Technical Officer and David Ohri, legal Counsel.
Our written submission has been previously provided and covered our concerns about Carriers and CSPs being saddled with :
- additional intelligence gathering on its customers;
- additional obligations for response times;
- additional obligations for decryption;
as well as proposals to provide:
- unfettered power to government agencies for information about our private infrastructure and to direct C/CSPs to take certain actions in respect of their networks.
In brief, we believe that there is inadequate information in the discussion paper or in the public domain to make any review of the reforms meaningful and we understand that such a comment repeats what others have said.
However, more recently other, more useful details have been provided by the Attorney General, detailing the information being sought by government.
The recent advice from the Attorney General, via her public letter to this Joint Committee, is that the dataset being considered is the same dataset that (so far) has been rejected by three European countries as unconstitutional and that the issue of such data collection is far from settled elsewhere in Europe.
Far from an unnecessary debate, it is important that all stakeholders, including the general public, be granted access to the range of data the government believes should be collected on every Australian (including minors), on every telecommunication, at all times into the future. That proposal should, for the sake of clarity, avoid jargon and be stated in plain English. Even with the Attorney General’s letter, it appears that there is still some requirement for clear communication about the Government’s objectives.
For iiNet Ltd, comprehensive retention of information relating to all Australians is an issue of important principle that touches us all. It is a concern at both a personal and also at a corporate level. Apart from our sincere misgivings about the principal of non-stop intelligence gathering on innocent members of the community who are never ‘persons of interest’ in the law-enforcement sense, we also recognize a significant unreasonable commercial impost that will be born by those same people.
It should be noted that in the internet environment a range of applications or ‘apps’ may run simultaneously on the same service. These apps can emulate telephony, video communications, text and other communications on the same platform, using internet protocol. Many of these apps allow a person wishing to mask either their identity or location via wireless networks, proxy servers and other techniques to communicate in a covert way.
We find ourselves also assuming that the imposition of data retention obligations on private companies such as ourselves can be extended to any other part of the private sector, including transport companies, utilities providers, retailers, banks and so on. We see that the principle of mandatory data retention, being pursued in relation to the use of telecommunications products and services, could logically and quickly be extended to the use of any other product and service acquired by Australians as they go about their daily affairs. We do not have such high opinions of ourselves that the telecommunications sector is likely to consider itself as unique in respect of such attention.
As potential intelligence agents of the state, the impact on our business means that the significant costs incurred, will necessarily flow through to our customers. This suggests, therefore, that not only will we be intelligence agents of the state, but also tax collectors, as we recover the costs of law enforcement on behalf of the Commonwealth. We understand that the Commonwealth will only reimburse for the actual cost of the tiny proportion of the data as requested from time to time. This extreme approach to the collection of stupendous volumes of data, most of which will never be used, is – to say the least – a most inefficient approach. The suggestion that the sector ‘can afford it’ misses the point that the end-user actually foots the bill of such costs. Masking the funding for such initiatives by passing them through the private sector, rather than funding directly via government, tends to reduce the transparency, yet again.
In order to illustrate the scale of what we have to assume is being proposed, we have made some preliminary calculations on the likely financial impact of the data collection on the iiNet group of companies and, therefore, its customers.
To enable our customers to connect to the internet, we have around 200 gigabits of network capacity which is designed to meet demand both in and out. We prefer to avoid congestion.
Users of the internet negotiate on-line by the use of universal resource locators (or URLs). These URLs are translated to IP Addresses, a numerical code used to identify the location of objects on the web. Not only does the page have an IP Address, but so also does every item on that page. A page like the ABC’s or a newspaper or a corporate home page could include several hundred IP Addresses, each one describing a link or image or piece of text or an advertisement or an animated clip or video. ‘Clicking’ on any of those objects will cascade open to another page, also with many links and associated IP Addresses, all of which will need to be recorded in satisfaction of the requirements appended to the Attorney General’s letter.
The letter includes the sentence
“No data revealing the content of the communication may be retained under the Directive. The data set is at Attachment A.”
Attachment ‘A’ includes the following :
certain categories of data must be retained, namely data necessary for identifying:
a) the source of a communication;
b) the destination of a communication
The only conclusion we can draw about the ‘destination of a communication’ when considering internet access is that – what must be retained are IP addresses. As noted previously, little to no specific guidance is given by the Attorney General’s department on the data to be gathered, so will continue to make assumptions.
As I have mentioned, each object (or content) on each page also has an IP address, none of which can be discriminated from any other on the page, it is therefore a paradox that requires resolution when the letter has declared that the data revealing content must not be retained, but that the address data must.
Estimates indicate that web caches or the devices that facilitate internet access, could see 25 URLs per second, per megabit. Our bandwidth of 200 gigabits could, therefore, generate 5 million URLs per second – if we assume that the traffic is all web requests.
Naturally, under the proposed regime, it would be an offence to lose this data so the expectation is that we will need to store it all securely and reliably. The data will need servers to process and file the data so that it can be stored and later recovered, as efficiently as possible.
We may choose to deploy commodity servers with directly attached storage and which will be obsolescent and discarded every two years because the solution proposed requires double the bandwidth and double the storage every two years.
We can currently purchase a 4TB disk for about $2,000. We will need ten thousand of these to store 20,000 terabytes of data. We can put ten of them in a rack so we will also need a thousand racks and about 2 megawatts of power to run the equipment and to run the cooling. That will require a serious data centre to house such infrastructure, for which our preference is green, efficient cooling to minimize our carbon footprint.
The estimated cost for this component is $20 million for the IT equipment and $10 million for the data centre building – to meet current traffic levels.
If we amortise the hardware over two years and the data centre over ten years, we estimate that the cost will be $1 million per month, plus power and overheads. Of course, there is always the option to outsource such a centre. Utilising a third party facility would cost about $2million per month at current rates for 1,000 racks at $1,000 per month, for two years’ data.
Either way, assuming we’re efficient about it we would still need to double that to cater for two years so we’re closer to $60 million for start up costs.
This leaves us with an estimate of $3million per month, just for iiNet, or a law enforcement tax of approximately $5.00 per month per service collected from our customers.
That unsophisticated estimate is simply for our own business, which has approximately 15% of the current market. Extrapolating these assumptions to the whole market gives us a possible estimate of $400 million for two years data storage.
Undoubtedly this figure will differ from estimates provided by others, simply because so little detail is available for us to genuinely calculate the cost. I believe we have been conservative in this estimate.
Given that our industry will be required to fund such activity, the incentive to provide a ‘belts and braces’ high-cost solution for the collection and retention of such data is unclear.
Stephen Dalby
Chief Regulatory Officer
iiNet Ltd
13 comments
-
-
@Bruno Watt, I don’t agree that the customer (subscriber) should shoulder the charge for storing the volume of data the legislation would require. The government wants the data to be available, let it pay all the ISPs around the country to hold it for them!
-
-
I agree that it’s not feasible to store the data, even in limited form. And the ephemeral nature of the Internet is that those using IP addresses change. Web sites change. Content changes! The people at a phone number and IP address change. Metadata are insufficient to establish which people are communicating.
It is routine, despite being close to “worst-practice” for computer accounts to be shared by several to many individuals; especially in larger companies where “managers” are under the impression that there is no harm in people having access to each other’s identity. And much the same applies in family households. Physical and virtual. Families are starting to use VPN to network around the world.
Data retention is a can of worms. Data security breaches, even at government level, aren’t even newsworthy. Laptops, CD/DVD/flash drives, etc get left by bureaucrats in cars, restaurants, … and what we are told is only the tip of the iceberg.
Within private business, data breaches are often swept under the carpet because of the embarrassment factor. Businesses sell their old computers, or when they go out of business, liquidators sell it at whatever price they can get, without first ensuring that data are irretrievably deleted.
I mention private businesses because they are the ones which will probably be contracted to do the data trawling for the law enforcement agencies. Those contractors will need (access to) full data sets to construct a picture of activity for “suspects”.
There are a number of security-aware people within governemnt agencies; notably DSD, who also have a sense of proportion and the need to keep the objective in view; instead of blindly stumbling into a process.
-
I agree with Dalby’s post. This current federal government is so intent on control that the freedoms and rights we have all taken for granted and enjoyed throughout my lifetime are now under threat.
The passing of such a law as suggested in Dalby’s post would provide the government and its agencies with far more power than is required to gather evidence against persons of interest in terrorist and intelligence matters. Criminal matters would also be covered in the legislation, which police (federal and state) already have access to by court order.
We should all oppose this legislation by any legal means available to us. -
FFS IInet and the other ISP’s ,Equopean Initiative ,like the boasted about Carbon Tax !.
Australians can barely afford the overpriced mobile and adsl plans.Data retention and the public pays for it ,lets all go back to Russia ,if the governor wants it ,he can pay for it .
Why the f5 do they need it ,they can get information when they need it now based on a suppeona.
Imagine the performance hit to the networks with this in place.
Telstra cannot keep its networks secure at present ,and with no clear definition of the standard of security required,any retained data will become open slather to those who want it ,albeit -illegally.
This government is bending over to the global new world order ,with no cajoles ,and
does not care about this country and what it stands for : FREEDOM .Sack em all ,we can do it Australia.
-
This legislation is once again based on Fear as the motivating force. The difficulty is our governments take their orders from overseas masters at the expense of our Laws founded on innocence before guilt. This is another furfy by the goverment to extend control over not only individuals, also isp’s. Our freedom is Precious and not that evident in the world so much these days. So resist and keep our freedom alive and well. If you think our govt. will act responsibly – ask yourself ‘How come they are so willing to take your freedom away whilst telling you it is for your safety’, that shows a distinct lack of integrity on the governments part. Stand up now and shout NO, Education is our best defense if indeed we need one. Lastly there are already existing judicial processes that cover these situations and do not impinge our Freedoms.
Instead they enshrine our freedoms, as we ourselves should.
Please remember that these measures are appearing worldwide and the only real conclusion is a massive attempt to set up methods for controlling people. The Germans well remember how data allowed politicians to stop listening to their population and bully them into a terrible submission at a massive cost to lives. As for criminals they have been plying their trade and will continue to whether the internet exists or not – again Education is your friend not misinformation as our goverment seems to want to give us. Freedom comes with some risks – Control comes with a million more risks very few of which have an upside. Say NO and keep saying NO to this type of legislation
Above all Australia value your FREEDOM it has made us who we are, laid back, delightful and caring -
The current Federal Government’s Data Retention proposals are alarming to say the least. In my view, they clearly lay a framework for the establishment of a “Police State” – a Totalitarian Society, if you like.
I strongly recommend that everyone reads the following article published by the Australian Broadcasting Corporation at:
http://www.abc.net.au/technology/articles/2012/09/28/3599864.htm
How many of you have read, George Orwell’s book “Nineteen Eighty-Four”? This novel, written during the mid to late 1940’s, is recommended reading for all citizens who believe in open democracy, freedom of speech, freedom of association, and the concept of “innocent until proven guilty”.
It did not escape my attention that “Nineteen Eighty-Four”; was most likely, a very close reflection on the society of surveillance created by Joseph Stalin’s Soviet Union.
Similar oppressive societies were maintained by the Third Reich’s Gestapo, and the further enhanced apparatus of control and surveillance maintained for almost forty years, by East Germany’s Ministry for State Security (Ministerium für Staatssicherheit), known to many as the “Stasi”.
History is replete with examples of governments purporting by claim or constitution to be open representative democracies, progressively drifting towards the implementation of totalitarian policies.
Open democratic liberal societies that support the principles of freedom of speech, freedom nd equality of association, and the concept of “innocent until proven guilty”; have to be maintained by all of us – the citizenry. YOU and I – WE, have to make it known to our lawmakers that we object to the erosion of our civil liberties and privacy.
If you still don’t understand, but value your freedom, read George Orwell’s “Nineteen Eighty-Four”, and contemplate life as a citizen in former police states such as the German Democratic Republic (East Germany), the Third Reich, and the Soviet Union.
Of course, dare I say it, if you’re looking for a contemporary example of a well organised police state, look no further than China and it’s policies on the aforementioned liberties and the internet.
-
Hi
I remember [a bit] the bombing at the CHOGM in Sydney back in the 80s. With concomitant increase in asio powers. Then quite a few years latter a police man who had been injured in the blast doing a interview on radio jj. In this he talked about police people who he at the time of the interview he realised were in the ‘loop’ and were pulled away from the bins. Were as he and some of the garbage men were not and subsequently killed/injured.
We can not trust those who see themselves as more deserving than the rest, whatever party they belong to… try getting some info on the TPP. -
God Give me strength please, We have systems in place to protect people when banking on the internet, yet still people get ripped off, how long will it take these “Criminal elements” to firgure out how to circumvent the data storage.
Then there is the other point if this proposal becomes law, you get a knock on your door only to find 2 Police officers standing there ready to arrest you, their evidence on the 15th November 2010 you emailled fredbear@thepark.com in that email you threatened to blow up Parliament, problem is you have no idea what the hell they are talking about cos you don’t remember the email that was sent nearly 2 Years ago.
-
Surely the storage of too much data from everyone would just croud an investigation, if investigation is what the Government is really talking about. Surely, if the nasties are out there, they will stand out more if there is less information stored. More like, big fish in a small pond, rather than a big fish in a big pond. Security YES, privacy YES, but what I find most frightening is what other disastrous idea is going to come forth from this Government.
-
I think Nicola Roxon really wanted to say “We can’t live in a society where innocent Australians CAN operate freely on the internet without fear of being spied upon”.
The fundamental issue is the right of the government (any government) to:
a) intrude into the privacy of its citizens on the basis that everyone is potentially guilty until proven innocent)
b) charge its citizens for doing thisLet’s leave aside the problem that the the Attorney General is not spelling out how the privacy of the innocent citizens will be GUARANTEED.
My opinion is that unless this cannot be GUARANTEED to be safe and secure, the mechanism should never be introduced because the likelihood of misuse is too high.On a final note, if I were a terrorist, I would take care to use a prepaid (ie untraceable) phone to make my calls and access the internet. Intelligent use of the technology will render the collection of
connection data worthless.Mr DALBY – if you want to influence the outcome and avoid the waste of taxpayer / subscriber funds, I suggest you spend your time lobbying the liberal party to make the scrapping of this plan a policy, to be raised at the next election
-
China here we come!(maybe I should not say that, in 2 years time there could be a police officer knocking on my door) As I have lived through the Bjelke-Petersen era when you had to be very careful about what you said and did,are we now going back to those times?
-
Yes. I remember the horrendous stories coming out of Queensland during the Bjelke-Petersen era too.
At about the same time, here in Western Australia, we had an oppressive public assembly law in place. It was known in general use as, “Section 54B of the Police Act. This particular act prohibited the public assembly of more than three people without police permission.
What disturbs me is the general ignorance and complacency of the Australian population regarding most matters of importance to their lives, including any notion of civil rights. I fear, and sincerely hope that I’m wrong, that this situation is just getting worse.
Perhaps our education system and the popular media are no help in this matter.
To further emphasise the gravity of the measures that the Parliamentary Joint Committee on Intelligence and Security is considering, I also urge you to view the following program available for the next eight days at the SBS website (if you can):
The misery experienced by citizens living in the former German Democratic Republic has been well documented, and sends us a clear warning.
We have to make it absolutely clear to our lawmakers that we will not accept any erosion of our civil liberties and privacy. We must demand that the proposals put forward by the police chiefs and the Attorney General be rejected.
Sounds like you just made a rod for your own back with the above statement!
$5 a month per account? Bring it! I have 3 IINET services and would welcome such a cost to keep the responsibility out of the hands of the goverment. Even $10 a month is reasonable. I do agree we need to limit what data is stored, metadata should be sufficient really but whining about even doing this isnt going to stop it.
Arguements about how many records would need to be kept given how URL’s and websites work is not helpful. Argue about how we guarantee the government can never misuse the information.
If you are opposed you need to outline, in public, YOUR solution to the problem in full. Surely as australia’s number 2 ISP you have seen this coming, lets face it the internet is a dangerous and secretive place.
Show some stewardship and keep the solution out of the hands of Comrade Conroy!
I’ll back you guys you provide an excellent service and are in the right position to do this.