Which Telecoms Store Your Data the Longest?

[s13sr20det]

http://www.wired.com/threatlevel/2011/09/cellular-customer-data/

The nation’s major mobile-phone providers are keeping a treasure trove of sensitive data on their customers, according to newly-released Justice Department internal memo that for the first time reveals the data retention policies of America’s largest telecoms.

The single-page Department of Justice document, “Retention Periods of Major Cellular Service Providers,” (.pdf) is a guide for law enforcement agencies looking to get information — like customer IP addresses, call logs, text messages and web surfing habits – out of U.S. telecom companies, including AT&T, Sprint, T-Mobile and Verizon.

The document, marked “Law Enforcement Use Only” and dated August 2010, illustrates there are some significant differences in how long carriers retain your data.

Verizon, for example, keeps a list of everyone you’ve exchanged text messages with for the past year, according to the document. But T-Mobile stores the same data up to five years. It’s 18 months for Sprint, and seven years for AT&T.

That makes Verizon appear to have the most privacy-friendly policy. Except that Verizon is alone in retaining the actual contents of text messages. It allegedly stores the messages for five days, while T-Mobile, AT&T, and Sprint don’t store them at all.

The document was unearthed by the American Civil Liberties Union of North Carolina via a Freedom of Information Act claim. (After the group gave a copy to Wired.com, we also discovered it in two other places on the internet by searching its title.)

“People who are upset that Facebook is storing all their information should be really concerned that their cell phone is tracking them everywhere they’ve been,” said Catherine Crump, an ACLU staff attorney. “The government has this information because it wants to engage in surveillance.”

The biggest difference in retention surrounds so-called cell-site data. That is information detailing a phone’s movement history via its connections to mobile phone towers while its traveling.

Verizon keeps that data on a one-year rolling basis; T-Mobile for “a year or more;” Sprint up to two years, and AT&T indefinitely, from July 2008.

The document also includes retention policies for Nextel and Virgin Mobile. They have folded into the Sprint network.

The document release comes two months before the Supreme Court hears a case testing the government’s argument that it may use GPS devices to monitor a suspect’s every movement without a warrant. And the disclosure comes a month ahead of the 25th anniversary of the Electronic Privacy Communications Act, an outdated law that the government often invokes against targets to obtain, without a warrant, the data the Justice Department document describes.

“I don’t think there there is anything on this list the government would concede requires a warrant,” said Kevin Bankston, a staff attorney with the Electronic Frontier Foundation. “This brings cellular retention practices out of the shadows, so we can have a rational discussion about how the law needs to be changed when it comes to the privacy of our records.”

Sen. Patrick Leahy (D-Vermont) has proposed legislation to alter the Electronic Privacy Communications Act to protect Americans from warrantless intrusions. Debate on the issue is expected to heat up as the anniversary nears, and the Justice Department document likely will take center stage.

 

[qupee]

hmm ... i was under the impression that all texts would be stored for a period measured in years... seems unusual that text message content wouldn't be stored at all, I have a hard time believing that.

You think storing cell phone data is bad?

Our government is working on legislation that requires ALL web browsing to be recorded and made available to government (without a warrant).


http://www.unitedliberty.org/articles/8727-big-brother-in-the-21st-century

Big Brother is watching you. Make no mistake. While the federal government doesn’t have the resources to watch you directly, they’re doing their damnedest to make your ISP provider a proxy. After all, the House Judiciary Committee voted 19-10 to pass HR 1981 (it really should have held out for HR 1984 though) which will require all ISP providers to maintain a log of internet activity for 12 months.

The bill, called ‘‘Protecting Children From Internet Pornographers Act of 2011’’, is designed to do just that. I have no problem with going after child pornographers. The problem is, this ain’t going to just be used to catch people looking at kiddie porn. It will be used as a tool for other things, even when looking at information on the internet isn’t illegal.

The Electronic Frontier Foundation says this:

H.R. 1981 would impose sweeping requirements on a broad swath of online service providers to keep new records on all of their customers, just in case the police ever want to investigate any of them. In particular, the bill would require any commercial providers of Internet access to keep for at least 12 months a record of which users were assigned to particular network addresses at particular times.

Such addresses, like the Internet Protocol (IP) address assigned to your cable modem by your cable company, or to your laptop by a wireless router, can be used to identify who visited particular websites or posted particular content online–threatening your right to privately browse the web and to speak and read anonymously when you’re online.

Mandatory data retention would force your Internet Service Provider to create vast and expensive new databases of sensitive information about you. That information would then be available to the government, in secret and without any court oversight, based on weak and outdated electronic privacy laws.

What’s that? No court oversight? Surely the EFF blew it on that one, right?

Unfortunately, they’re right. The new bill amends the federal code to permit what are called “administrative subpoenas” to be used to require ISPs to provide the requested data. Administrative subpoenas are tools used by various agencies to compel entities to provide required data. They do not require a judge to sign jack squat. The dreaded “National Security Letter” is a kind of administrative subpoenas.

So no, they’re not wrong on that one. However, the EFF brings up another excellent point about this bill.

That same data could become available to civil litigants in private lawsuits–whether it’s the RIAA trying to identify downloaders, a company trying to uncover and retaliate against an anonymous critic, or a divorce lawyer looking for dirty laundry. These databases would also be a new and valuable target for black hat hackers, be they criminals trying to steal identities or foreign governments trying to unmask anonymous dissidents.

Despite the fact that is intended to only combat something as heinous as child pornography, the data is there. That means that others will try and access that data, either through legal means or through hacking. An unscrupulous district attorney could get hold of this data easily. I know of at least one instance where a DA got phone records through what appear to be less than legitimate means. If that could happen before, this simply gives those who would do such a thing more tools to ruin their targets.

This provides a very slippery slope. I can easily envision this being used to tar and feather someone in the court of public opinion without yielding anything of value towards criminal prosecutions. For example, a man is charged with an act of domestic terrorism. The government looks at his web traffic and finds that he frequented a number of Tea Party websites, militant political websites, etc. This information is often revealed to the public, as is typical of things learned about suspects (see Jared Loughner for an example). However, there’s not enough evidence to say he did it. By law, he’s innocent…but the court of public opinion already has his labeled a terrorist. In this scenario, since I made it up, I can tell you that the reason there wasn’t enough evidence to say he did it is because he didn’t. Yet his internet browsing history has been published for all to see.

I have no problem with law enforcement having the tools necessary to catch criminals. However, there needs to be ample protections in place for the privacy of the American people. This law, which will create costly requirements for ISPs, will really do little to help catch child pornographers. What it will do is create an environment where Big Brother can keep his eye on you thanks to the people you pay each month for your communications needs.

Nice, ain’t it?