Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

German ISP Forced To Delete IP Logs

Posted by ScuttleMonkey on Tue Nov 07, 2006 12:38 AM
from the next-the-request-will-be-used-as-evidence dept.
The Internet Privacy
An anonymous reader writes "A German federal court decided today that T-Online, one of the largest ISPs in Germany, was obligated to delete all IP logs of a customer upon request to guarantee their privacy. From the article: 'The decision (German) does not mean that T-Online is now obliged to delete all their IP-logs, the customers first need to complain. But, if they ask T-Online to delete their IP-logs, the ISP has no other choice than to comply. A lawyer from Frankfurt already sketched a sample letter (German) to make this process easier.'"
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

German ISP Forced To Delete IP Logs 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • The way it should be. (Score:5, Insightful)

    by rolyatknarf (973068) * on Tuesday November 07 2006, @12:40AM (#16748203)
    There's not a chance in hell that anything like this would ever happen in the United States. I hope it works for the Germans. This is the way privacy should be treated. The people have rights.

    • Re: (Score:3, Insightful)

      by LilGuy (150110)
      If it works, I envision much spam and rooting originating from German end users' machines.
    • You should have a send a letter to request being logged.

      • Re: (Score:3, Insightful)

        by rolyatknarf (973068) *
        Yes, an ISP in the US could delete the logs but I think that is unlikely. I believe we all know that our government is already pushing for, and probably already has arrangements with communication and information companies to retain records.

      • Re: (Score:2, Interesting)

        by JPriest (547211)
        AFAIK US ISP's are required to keep the logs for some 180 days in case of a criminal investigation. It is fairly common to get investigations for things that happened more than, say 60 days prior. I believe there is legislation in the works to force ISP's to keep logs for longer periods of time (1 year?).


        Disclaimer: By "logs" I don't mean record of what web sites were surfed and what files downloaded, I mean record of what customer had X IP address at Y time.

            • Re: (Score:3, Informative)

              by Benaiah (851593)
              64bits for an ip.
              48 for a mac.
              how big is a datetime? give it 128.
              30 bytes being generous.
              another datetime for disconnect.
              30+30+8+6 = 74bytes
              why not make it a clean 100 bytes.
              If you stored the connection details for every single possible ip adress in the 64bit space.
              you got 4billion connections a day at 100 bytes.Thats only 400g
              So the entire worlds isps would only generate 144TB of connection data a year and only if everysingle ip in the space was used and being connected everyday.

              A few thousand TB is waaaa

        • Re:The way it should be. (Score:5, Informative)

          by 1u3hr (530656) on Tuesday November 07 2006, @07:50AM (#16750211)
          Let me explain. I do not "expect" privacy. I do not "expect" all ISPs to spend millions of Euros on logging mechanisms based on each user records. The impact of this is huge. Currently all user activities are normally written to a single log file. The files are normally rotated based on time.

          This case is about deleting a particular user's records. If you don't keep them, you don't have to do anything. You seem to say you'll need to create an all-encompassing tracking system so you can selctively delete the records. Just delete them all as soon as you've abstracted any information you need for billing or debugging.

          Has anyone asked what the plaintiff has to hide? hope he gets cyber-stalked by a hate group

          In TFA: "The court ruling is the result of a case that was initiated by Holger Voss, a 33 year old man from Münster. Voss was sued for making a sarcastic comment in an Internet forum back in 2002."

          Sarcasm? Yeah, he totally deserves to be stalked and vilified by a hate group. That'll learn him not to mouth off.

          • Voss was sued for making a sarcastic comment [wikipedia.org] in an Internet forum back in 2002.

            Sorry for reading TFA...

            • Re: (Score:3, Interesting)

              by sholden (12227)
              From wikipedia: "during the course of the trial, it was also revealed that his disclaimer of the posting as sarcasm had been left out from the legal documents provided to the prosecutor by law enforcement agencies."

              You would hope that would be a crime in itself.
            • How many child molesters will be regularly sending legal form letters to their German ISPs...

              How ironic that some Anonymous Coward wrote this crap.

            • Re: (Score:3, Insightful)

              by arminw (717974)
              ..... it makes sense to require or have this for everyone.......

              Only if your basic assumptions is that everyone is guilty of some sort of crime every single day of their life and it is the job of someone to sift through all that data to find all these criminals. Would it not be more effective to monitor ONLY those who are truly suspects of a real crime? A real crime that does real damage to others? Most possession crimes do not rise to ever hurting anyone, until the illicit substance or object is actually u

      • Re:The way it should be. (Score:4, Insightful)

        by KnuthKonrad (982937) on Tuesday November 07 2006, @07:23AM (#16750079)
        Germany takes privacy laws to the extreme, in my opinion.

        As a admin, working for a german company in Germany, I know that our privacy laws are a PITA.

        As a german citizen, living and working in Germany I think our privacy laws are way too relaxed.

        That said, I very much welcome the decision of the court. We had a couple of similar decisions lately. And one always got the impression that the judges not only talking about the very case they had to handle, but that their sentence was also aimed at our politians to show them how german courts think about the EU data retention act. This one can't be trialed in Germany yet, as it hasn't become german law as of now. So this seem like a warning about what to expect when that gets taken to court, once it made it into german law.

  • Requests to delete server logs (Score:5, Funny)

    by Neoncow (802085) on Tuesday November 07 2006, @12:44AM (#16748219) Journal
    Requests to delete server logs, however, will be logged.

  • But no privacy in the land of the free (Score:5, Insightful)

    by Salvance (1014001) * on Tuesday November 07 2006, @12:44AM (#16748223) Homepage Journal
    I wonder why the average American (or Brit) doesn't demand the same level of privacy that many of the mainland Europeans now have? While some other freedoms (e.g. speech,press) are more limited in countries like Germany, there appears to be a strong right-to-privacy movement backed up by the government.

    Sure, our media and government pay lip service to privacy issues, but the reality is that our government wants to increase monitoring in the name of fighting terror. Compare this story of Germany forcing the ISP to delete logs for a customer to this one [msn.com] outlining yet another argument by US officials to require ISPs to maintain even more user data.

    I'd hate to see us to become a 'surveillance society' like Britain has. Unfortunately, we seem to be quickly heading down that path, particularly since our citizens haven't yet raised up to demand greater freedom.
    • We know we won't get it if we ask, so we don't bother. You don't get anywhere lying down, but at least you don't get red-flagged by asking for some privacy.

    • Re:But no privacy in the land of the free (Score:5, Insightful)

      by foobsr (693224) * on Tuesday November 07 2006, @02:08AM (#16748623) Homepage Journal
      some other freedoms (e.g. speech,press) are more limited in countries like Germany

      Any source? Just curious, as I am living in Germany and did not really realize.

      Also:

      Press Freedom Index 2006 [rsf.org]

      CC.

      • Re:But no privacy in the land of the free (Score:5, Insightful)

        by Jugalator (259273) on Tuesday November 07 2006, @03:18AM (#16748991) Journal
        He may be considering hate speech [wikipedia.org] laws, but then, on the other hand, is he considering free speech zones [wikipedia.org] in the US, and so on? I'm hesitant to call freedoms more limited in countries like Germany for this reason, especially with the actions GWB has taken in the US lately.
      • I think your parent poster has got something mixed up. What he meant was freedom of speech. And by all means, that is limited in Germany and Switzerland as far as my little swiss mind can remember. Try stating that you think jews are subhuman and see what happens (I advise you to only do that if you don't really like your life as it is all that much...).

        Of course we could argue that such sentiments are stupid anyway, but that is clearly a matter of opinion. And just because our opinion (assuming you also do

            • Re:But no privacy in the land of the free (Score:4, Informative)

              by nath_de (535933) on Tuesday November 07 2006, @03:27AM (#16749049)
              Sorry, but you're wrong there. Copyright for "Mein Kampf" has fallen to the state of Bavaria after Hitlers death (since there were no heirs). You can only get an annotated version as Bavaria won't publish the original version. 2015 the copyright should expire (70 years after authors death) and the book should go into the public domain (barring any changes to copyright laws).

    • Re:But no privacy in the land of the free (Score:5, Informative)

      by Trevelyan (535381) on Tuesday November 07 2006, @03:29AM (#16749063)
      UK does have laws protecting peoples privacy. Namely the Data Protection Act and Rights of Investigatory Powers Act. The first one controls disclosure as well as providing means for individuals to review the data kept about them. The second controls what a co. such as an ISP can do with the data (eg traffic logs) as well as what the authorities can do. The two together means that you have to be able to justify the data you keep and for how long you keep it. The network that I work for does not keep data for longer than 3 months, unless it relevent to some network issue/investigation, then its kept for 2 years; but never indefinately. Lastly there is also the Freedom of Information Act, which allows citizen access to all sorts of government and civil service information and documentation. So you can double check their procedures for example.

    • I wonder why the average American (or Brit) doesn't demand the same level of privacy that many of the mainland Europeans now have?

      Well, Germany actually had a dictator lie his way to power by using fear and patriotism as bludgeons against his opponents. They know firsthand what dangers lie at the end of that road. We still think we can have everything along the road (the exaggerated nationalism, the fear-mongering, the reduction of freedom to save freedom, etc) without necessarily arriving at the same

      • Re:But no privacy in the land of the free (Score:4, Informative)

        by dajak (662256) on Tuesday November 07 2006, @07:09AM (#16750017)
        People sometimes do learn from history, though the knowledge probably gets diluted with time and distance.

        The fear of politicians and government of being perceived as nationalist sometimes has perverse results. Here in the Netherlands we used to have a historical curriculum that identified tolerance as a key part of national identity, but the reluctance of government to prescribe historical dogma about "our ancestors" gives license to for instance schools with a majority of muslim pupils to gloss over impopular subjects like the holocaust and the eighty years' war (1568-1648), where "our protestant ancestors" are the ones being persecuted.

        Teaching children about the attack by the resistance in 1943 on the population register in Amsterdam, with the intent to burn it down in order to frustrate Nazi bureaucracy, is the best way to instill respect for privacy. Reference to this event that most people know about is a powerful antidote to suggestions that "you have nothing to fear if you are innocent": it was the Dutch government that, in better days, compiled the data that allowed the Nazis to trace most jews (population register) and gave them few places to hide (cadastral maps). What to remember and what to forget is still a policy choice.

        The US and continental Europe have different experiences of, and therefore perspectives on, WWII. For the US, WWII is a license to interfere militarily in perceived Nazi regimes abroad (as they did in WWII), while formerly occupied countries, and Germany itself, are busy simply not being a Nazi regime.
    • Actually, the legal basis for this decision in Germany, is the EU data privacy regulations, which each member country are required to reflect in national laws. In the UK this would be the Data Privacy Act that gives us similar protections to the Germans.

  • A question for network admins (Score:5, Interesting)

    by gaijin99 (143693) on Tuesday November 07 2006, @12:46AM (#16748235) Journal
    I'm not an admin, and never have been so I'm working on ignorance here. But my question is, why bother with long term logs anyway? I understand a need to keep logs of activity for a week or so to deal with various attacks, zombie machines, etc, but why not set the logs to automatically wipe anything past that point? I can see maybe going nasty and selling it to advertisers, but other than stuff like that is there a use?
    • Yes, there is a use. Law Enforcement LOVES long data retention. Really, they do.

      The MPAA/RIAA/IFPI/etc. all LOVE long data retention as well, especially when combined with Law Enforcement.

      I'm pretty sure all manner of intelligence services also LOVE long data retention.

      I have yet to see a case of a consumer/customer loving long data retention.
      • Yeah, but the ISP's are doing it, and they aren't compelled to do so by law (at least not yet in the US). That implies that they have reasons of their own, and I'll be buggered if I can see what those reasons might be, beyond evil stuff like selling the info to advertisers.
        • Did you miss that AOL and TW merged ? Many ISPs are part of larger conglomerates, or in bed with parts of the media industry. That should be enough incentive.
          Traffic usage logs are interesting as well; one broadband ISP (1&1) in Germany regularily offers some of their customers $150 if they leave for another provider, since these customers actually used the bandwidth being advertized and generated generous amounts of traffic. You can't do that without retaining information on traffic usage.
          Other ISPs mi
        • "logging IP addresses" means logging which IP address your connection had at a particular point in time within the last 80 days. (so a lookup of 1.2.2.4 in their database would yield "mxs", or whatever my customer number is)

          hrrm ... wouldn't UDF work as a replacement for fossilfs ?

    • Re:A question for network admins (Score:4, Informative)

      by Burdell (228580) on Tuesday November 07 2006, @09:26AM (#16750949)
      I work for an ISP. As part of my job, I handle abuse reports. Often
      reports are for events more than a week old (typically worm type reports
      come fast, but spam reports are often delayed because the recipients
      don't read their email every day).

      We also use long-term data for trend analysis: which POP needs more or
      less dialup lines, who dialed in to a POP (with how much they pay, does
      the POP make financial sense), etc.

      While trend analysis doesn't require IP addresses (for the most part),
      the call database has a record per call that includes the IP (same
      database as used for IP abuse lookups). To not retain IP addresses,
      we'd have to set up a second database, second lookup interface, and some
      transfer mechanism between the "with IP" and "without IP" databases.
      That's a real PITA, so we don't do that.
      • To me that would seem to apply mostly to people hosting commercial sites, not an ISP providing end user access. Is that your angle, or did I miss something obvious?
      • Well, its what worries me about people *keeping* logs, actually....

        On a practical note, how much storage are we talking about for a decent sized ISP? I'm assuming you'd want to store the customer's ID, the IP address visited by the customer, the website address (if there is one), a timestamp for that visit, and maybe the amount of transfer both upstream and downstream each time the computer sends or recieves. Even for small ISP's that sounds like a lot of info to keep, indefinately, for every single custo

        • Re: (Score:3, Insightful)

          by mxs (42717)
          The ISP in question stores your assigned IP, duration of the session, start-time of the session, bytecounters up/down, username, and probably access concentrator (i.e. which physical land line was used).
          No logs of website accesses or acribic list of all packets sent and received are made.

          A lot of data is accumulated, but really, what does a terabyte of online storage cost these days ... Peanuts.
          Amazon stores your entire clickstream history, everything you ever did on their website, for an indefinite amount

  • You Can Delete the Logs Present Now... (Score:3, Insightful)

    by MSTCrow5429 (642744) on Tuesday November 07 2006, @01:11AM (#16748373)
    ...but what happens when the user logs on again, after the IP log purge? Are they back in the records from that point on?

  • Blurb text misleading (Score:5, Informative)

    by mxs (42717) on Tuesday November 07 2006, @01:12AM (#16748375)
    Not /exactly/ true. The sample letter speaks of a complaint, but T-Online has every choice not to comply.
    The linked webpage then recommends sueing T-Online in that case. If/Once you win that lawsuit, T-Online has no choice but to comply. This is a tad different from what the blurb here would have you believe.

    (All this is based on rather strict privacy laws that require a provider not to collect any data not relevant to accounting; since IP addresses and data volume is not needed for accounting on plans with a flat fee per month, T-Online has no right to do so; they, however, save that data for 80 days.)
  • After deleting the logs, does the ISP have to delete the letter that requested the logs be deleted?
  • Sometimes tools like Google language or Babelfish are an absolute necessity when dealing with texts in a language other than your own...

    Othertimes though... [google.com]

    The deplored one is condemned to omit it with the use of the Internet entrance

    Machine translation just isn't up to task.

  • Not quite as good as it looks (Score:5, Insightful)

    by njdj (458173) on Tuesday November 07 2006, @02:47AM (#16748797)

    The original article [spiegel.de] points out that keeping logs is incompatible with existing German law. But the law will soon be changed, because Germany will have to comply with an EU directive mandating that logs be kept for at least 6 months. Germany has already asked for an extension of the deadline to comply with this, but the strong likelihood is that the German privacy laws will be changed to comply with the EU-mandated snooping.

    EU pols and bureaucrats are as hostile to personal privacy as US pols and bureaucrats.

    • Re: (Score:3, Informative)

      by hweimer (709734)
      The original article points out that keeping logs is incompatible with existing German law. But the law will soon be changed, because Germany will have to comply with an EU directive mandating that logs be kept for at least 6 months.

      It wouldn't be the first time that the highest German court nullifies the implementation of a EU directive [bundesverf...gericht.de].

  • The interesting political spin... (Score:3, Insightful)

    by phooka.de (302970) on Tuesday November 07 2006, @03:38AM (#16749113)
    The ISP is germany's biggest ISP, the "Telekom". By the law, they were only entitled to keep logs that are required for billing. If you have a flatrate, no IP-logs are needed for billing and other ISPs didn't keep them, but the Telekom did.


    Now here's the interesting bit: The entity that owns most of Telekom's shares is - the Bundesrepublik Deutschland, the German gouvernment. The "Innenminister", the guy responsible for the justice system, police etc. was one of the kind of politicians who'd like to know everything about everyone for the sake of "security". (Who needs freedom if they are secure? Oh wait, that was prison.)


    So, while by the law he could not force ISPs to retain that data, the biggest german ISP that just happened to be controlled by... him(!)... did so anyway, aiding law enforcement in trivial (and here: unfounded) cases with said data.


    Unfortunately, even in germany, noone seems to bother about privacy anymore.

    • Australia.. (Score:5, Interesting)

      by swordfishBob (536640) on Tuesday November 07 2006, @01:01AM (#16748323)
      It should work in Australia. Privacy laws here state that:
      - If I ask a company operating in Australia what information they have about me, they are obliged to tell me
      - If I ask where they got this information, again they must answer
      - If I ask the same company to remove such records, AFAIK they must, though there are reasonable exceptions to this one. (e.g. if i've done business with them, they have to keep financial records. if it's my bank, they might have to cancel the mortgage to comply..)
      - Companies operating here are not supposed to pass on private information without consent, which is why so many competitions and things have clauses in tiny writing to get your consent.
      • Unfortunately the laws don't work very well with small companies. I filed a complaint against a Sydney real estate agency who sent multiple unsolicited text messages to my mobile phone. They just ignored my requests to 1. stop and 2. tell me where they got my number from.

        The Office of the Privacy Commissioner [privacy.gov.au] will only launch investigations against larger companies (IIRC they need to have an annual turnover >$500K) and they told me as much when I complained. So that leaves a fair bit of room for unscr

        • Re:What type of logs? (Score:5, Informative)

          by mxs (42717) on Tuesday November 07 2006, @01:18AM (#16748413)
          Radius, actually. That particular ISP does not use DHCP; all (A|V)DSL(2\+?)? connections are handled with PPPoE, so you get your IP from the PPP session set-up. Connections are reset every 24 hours automatically, and you do not usually get the same IP again after 24 hours (they claim this is done for technical reasons, which is, simply put, BS :)
            • This problem could be handled differently. You could tear down a PPPoE connection if no data has flown through it in 24 hours, for instance, or automatically reset the connection if new LCP packets arrive indicating the customer wants to set up a new PPPoE connection; also contrary to popular belief, you can set up multiple PPPoE sessions on the same wire; they need to have the Host-Uniq flag set, or use different MACs -- but it is possible; for instance, you can open connections to T-Online and Titan Netwo
    • The laws resulting from that directive will not be in effect before Jan 1, 2007.

    • Re: (Score:2, Interesting)

      by aeschenkarnos (517917)
      Because: (a) some people commit actual crimes (like, the kind with victims) on the internet, and the ISP's logs are equivalent to the film from the CCTV camera across the street from a robbed bank; (b) there are good technical reasons, ie statistical data used for load-balancing purposes, network expansion, upgrade scheduling etc, for keeping logs (although obviously, stripping out identifying data ought to be done wherever this doesn't interfere with that purpose); (c) to some extent, keeping "logs" as suc
      • >a) some people commit actual crimes (like, the kind with victims) on the internet,

        Yet in almost no country does the post office keep track and logs of who mail who despite crimes both in the past and present probably occur thorugh mail. Further, many countries does not have any law requiring ISPs to keep logs, yet they do it anyway.

        >b) there are good technical reasons, ie statistical data used for load-balancing purposes,
        >network expansion, upgrade scheduling etc, for keeping logs (although obviou
    • You didn't get the memo, it seems. The A now means "All." Big merger. They also are the CIA now. Analysts were fired to free up office space for shredders, and all raw intel is funneled into Dick Cheney's office, where it is sorted into two piles, "reality," and "tomorrow's talking points." The first pile is thrown out, where Colbert Report operatives posing as facts (so they won't be noticed) smuggle the reality over to Comedy Central, where it is broadcast and uploaded just in time to highlight the

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.