German industry position paper against data retention

The general German industry association (BDI) and the two
telecommunication associations (BITKOM and VATM) have jointly published a
strong position paper against the European proposals for mandatory data
retention.

The German industry calls on both the European Commission and the
ministers of Justice and Home Affairs to provide a solid and adequate
impact assessment, since “LEAs have demonstrated neither the concrete need
for a data retention regime nor the alleged lack of effectiveness of the
current practice.”

“Industry would like to point out that the European Union is confronted
with a crisis of acceptance and a loss of confidence because politicians
are too often unable to explain the purpose and benefits of European
activities to citizens and industry.”

The industry mentions 5 more specific demands on both Commission and Council:

1) Any period, if the necessity can be proven, must not exceed 6 months;
2) Any obligation to retain data must not include data types currently not
centrally processed and recorded within the networks;
3) Any obligation can only address services provided directly by the
provider of a customer;
4) Full cost reimbursement for both infrastructure and operational costs,
in stead of the vague wording of ‘additional costs’;
5) No additional obligation on the industry to collect statistics.

With regards to the second demand, the paper details the problems with
data that are only generated but not used for billing or service delivery,
such as failed caller attempts and registration of type of communication
used. Storage of unsuccessful connection attempts (amounting to 40% of all
calls according to GSM Europe!) would require fundamental rebuilding of
all switching centres, resulting in costs “within the three-figure million
Euro range.” Storing whether a user sends a fax or makes a phone call is
equally irrelevant to the operators, and would require equally substantial
technical upgrading.

Specially addressing the demands on mobile communications, the industry
explains that the demand to store the ‘end’ location of a mobile phone
connection is unjustified, because it often goes to another provider. Law
enforcement has “not yet proven an added value, as the retention of the
cell ID at the beginning of every call already suffices to establish a
movement profile.” The demand for IMEI meets equal criticism from the
German industry. In a consultation with German law enforcement, no need
could be proven and the demand was dropped immediately.

With regards to Internet data retention, the paper notes that
“communication data of the internet services used are not available for
most services. Technical facilities to record, retain and analyse these
data would first have to be created and would lead to a tremendous rise in
the volume of data to be stored.” Storage of the MAC address is completely
unrelated to the ISP business, and “the added value of a MAC, in addition
to an IP address, with regard to a clear identification of the user is
questionable and has not been demonstrated.”

On the demand for statistics, the industry justifiably points out that
should have been the start of the legislative process to estimate the
effectiveness and proportionality of a data retention regime. Industry
also claims such an obligation exclusively resides with the competent
authorities. True as that might be, from a digital civil rights
perspective it would be a very good idea if the Commission would create a
shadow-obligation on the service providers to collect statistics and
jointly publish them in an annual report. But the Commission proposal
doesn’t address the public availability of the statistics, and given the
lack of public supervision in many EU countries on the actual use of
interception and surveillance powers, that is not a promising start.

Demands of German Industry (in German and English, 04.08.2005)
http://www.bitkom.org/Default_33225.aspx