The Security Mentor

What would you think of a situation where your internet service provider

• Kept records of some of the things you did online
• Retained those records for a month or two, but discarded them when no longer needed for their business purposes
• On request from law enforcement, held on to the same records for another 90 days
• Balanced the need to store records against the cost of the storage
• Didn't necessarily log all your email and IM activity

?

Would you think that was a reasonable way to meet the needs of police investigating crimes, or would you think it went too far toward compromising privacy?

According to the Attorney General, it's not enough. Attorney General Gonzalez, and recent legislation, would require ISP to store records of your activity for years or indefinitely, whether you were under investigation or not, in case someone came along later and wanted to read all your correspondence.

The backers of this legislation are spouting about child pornography investigations. Is the scope limited to that? Of course not. Records retention would apply to all users, the records could be used for any reason, and in fact since the law only says "court orders" it could apply to lawsuits as well as criminal investigations. Think about your ex-spouse's lawyer fishing through your 'net activities N years back, and you've got an idea where the problem is here.

As a security issue, spying on hundreds of millions of people in the hope of catching a few hundred is usually a losing proposition.