|reply to TSI Marc |
Re: Discussion about log retention
said by TSI Marc:Thanks for the post stating TSI position more clearly.
If for example they were needed to identify a situation that was urgently required for reasons of danger to health, life, public safety, etc. If, as an extreme, we were to keep no logs at all, what happens when you get a call indicating an anonymous user just made a post suggesting they were going to kill themselves, or harm people in their workplace, etc.? And how well would it play if police were urgently trying to locate a victim in a case of a child exploitation crime-in-progress, but weren't able to proceed because we made it a policy not to keep logs, largely in order to protect customers from copyright claims. And let's be clear: while there are certainly copyright trolls who are inappropriately trying to squeeze people for damages well beyond what they might actually be able to obtain in court, there are internet users who are regularly engaging in activity that is contrary to Canadian law, copyright, defamation, hate crimes, fraud... you name it. I for one do not want to adopt retention policies driven by the objective of making it impossible for police to apprehend suspects or rights holders to enforce their legitimate legal rights.
ISPs that adopt very short term log retention (or no log retention) risk becoming havens for people that intend to break the law. Once an ISP has that kind of reputation, it will likely face even more attention from law enforcement and civil litigants, and more invasive, and potentially ex parte court orders.
I think it should be a few days to maximum 1 week.
I am talking about data that can identify individuals and violate their privacy.
For emergency and life and death situation or crime in progress situations, real time is probably what is needed and 3-5 days should be more than enough.
For real law enforcement detective work purposes investigating copyright, defamation, hate crimes, fraud... etc. Lets remember that past logs are not the only or best tool they have at their disposal. Law enforcements have wiretapping powers via court warrants and ISP are required to have facilities in place to allow such wiretapping when they are issued by courts. This is basically dumping everything a person do into the lap of the police which is much much better proof and surveillance than past logs. For that it requires more work, planning and preparation by law enforcement to obtain and execute a successful wiretap. And it is a good thing because we are talking about invading the privacy of canadian citizens. You need law enforcement to put in the necessary work to be able to overstep such a fundamental right, so fundamental that it is in the constitution under the Canadian Charter of Rights. Not just show up and demand logs AFTER the fact which is exactly what these civil litigants who are not law enforcements are trying to do.
For the civil litigants that are out to make money and not law enforcement, I dont think you owe them anything more than what is required by law which is nothing as the law stand on minimum data retention. Actually like you said yourself, the law actually calls for you to protect your customers personal data from 3rd civil parties out for profit.
There is a reason why mandatory data retention is not required in Canada. It is because there are other alternatives and powers at the disposition of law enforcement. And our legislature/parliament have judged that for now, those offer the best balance between protecting constitutional privacy rights and the ability for law enforcements to investigate crimes.
I think based on that stance you will not take any PR hit from adopting a smaller log retention timeframe. And I dont think you risk becoming a haven for criminals ( I mean real criminals not the 9yo downloading the latest hit song in this story : »torrentfreak.com/police-raid-9-y···-121122/) since like exposed above, law enforcements have the wiretapping tools necessary to do their jobs. It just take them more work to obtain access but that is a good thing as we are talking about transgressing a fundamental right here. The only people that do not have wiretapping powers are the civil litigants out for profit.