Dutch study fails to prove usefulness and necessity data retention

By EDRi · June 29, 2005

On 22 June 2005 the Dutch Erasmus University published a report about the
usefulness and necessity of data retention for law enforcement purposes.
The report is the first public research in Europe into the actual use by
law enforcement of historical traffic data.

The researchers looked at 65 police investigations that were provided by
the Dutch ministry of justice as good examples of the usefulness for
traffic data for law enforcement. They conclude ‘in virtually all cases’
the police could get all the traffic data they needed, based on average
availability of telephony traffic data of 3 months. The researchers also
warn they can’t qualify the usefulness of these data as direct or indirect
evidence, or the representativeness of the sample of cases for law
enforcement in general.

But after failing to meet this essential test, the researchers organised
talks with several anonymous police representatives. Based exclusively on
those talks, the report recommends 1 year mandatory data retention, for
Internet even to a much wider extent than the current European proposal.
Besides logging every incoming and outgoing IP-request from each
customer’s computer(s) and registering every service used by customers,
ISPs should also log URLs and the obligation should be extended to hosting
providers and internet-cafes. On the other hand, the report mentions no
need at all for data about modern messaging services, such as SMS, EMS and
MMS, or new data services such as GPRS and UMTS, or failed
caller-attempts.

Dutch EDRI-member Bits of Freedom immediately issued a press release
stating that the report can only be qualified as a police wish-list,
without any substantial evidence for the necessity of data retention.
Members of the special European Legal Affairs Committee of the Senate
debating on the report on 28 June 2005 clearly agreed with this vision. In
a unique confrontation with his own christian-democrat minister of
Justice, MP Hans Franken thoroughly blasted the report and the decision
making process so far. Fully supported by the other government coalition
partner (right-wing liberals) and the major opposition parties, he said
the government completely failed to meet the essential proportionality
test decreed by Article 8 of the ECHR. The government did not prove the
necessity, did not consider any less infringing alternatives to general
data retention, and did not do any valid investigation into the costs and
economic impact of the proposal. Last but not least, the government
apparently did not consider the effectivity. The 68 year old Franken
clearly caught the minister by surprise when he summed up a long list of
technical problems with the proposal, especially in connection with
Internet and new data services provided by mobile operators. He mentioned
the astronomical amount of data handled by ISPs, explained that data
retention requires a full internet wiretap on every user, and mentioned
cost calculations amounting to a 7 million euro initial investment for a
small Dutch ISP with a 2.5% market share. Franken also pointed at the
wider context, both technically with IPv6 and Voice over IP replacing
regular telephony networks and internationally, with no similar obligation
planned for providers in the United States and an abundance of choices for
internet-users to use proxies or encrypt all traffic.

Minister Donner could only stammer a reply that cost calculations differed
a lot and for example Denmark had a very effective data retention law,
with much lower costs. MP Franken didn’t let that pass, and told the
minister there was indeed a framework law in Denmark decreeing data
retention, but the law had not materialised in a specific decree yet. That
left the minister with no other argument than a reference to the next
informal JHA meeting, in Newcastle on 8 September 2005, where besides
police officials apparently also representatives from the telecom-industry
will be given a chance to explain their problems with the proposal.

Both chambers of parliament will debate the Erasmus report in depth in
September 2005, but only after they have jointly been coached to the right
opinion by a presentation by the Public Prosecutors department and police
commissioners. Meanwhile, the European ministers of Justice and Home
Affairs will continue to work on the proposal, with a next meeting of the
working party of government officials planned on 4 and 5 July 2005 and the
UK presidency of the EU already having warned several members of the
European Parliament their resistance is futile, since the UK is set on
creating mandatory data retention via Europe after they failed nationally.

Report Erasmus University (in Dutch only, 22.06.2005)
http://www.justitie.nl/Images/20050620_5357934b%20aanbieding%20rapport%20Erasmus%20Universiteit_tcm74-75134.pdf

Press release Bits of Freedom (in Dutch only, 22.06.2005)
http://www.bof.nl/docs/persbericht_bewaarplicht_21062005.pdf