Extracts from the EDRI newsletter

theking

The EDRI is the European grouping of digital Rights NGOs.

You can sign up for their newsletter at their site.

But here are some of the items from the most recent pop out.

1. German industry position paper against data retention
===========================================================

The general German industry association (BDI) and the two
telecommunication associations (BITKOM and VATM) have jointly published a
strong position paper against the European proposals for mandatory data
retention.

The German industry calls on both the European Commission and the
ministers of Justice and Home Affairs to provide a solid and adequate
impact assessment, since "LEAs have demonstrated neither the concrete need
for a data retention regime nor the alleged lack of effectiveness of the
current practice."

"Industry would like to point out that the European Union is confronted
with a crisis of acceptance and a loss of confidence because politicians
are too often unable to explain the purpose and benefits of European
activities to citizens and industry."

The industry mentions 5 more specific demands on both Commission and Council:

1) Any period, if the necessity can be proven, must not exceed 6 months;
2) Any obligation to retain data must not include data types currently not
centrally processed and recorded within the networks;
3) Any obligation can only address services provided directly by the
provider of a customer;
4) Full cost reimbursement for both infrastructure and operational costs,
in stead of the vague wording of 'additional costs';
5) No additional obligation on the industry to collect statistics.

With regards to the second demand, the paper details the problems with
data that are only generated but not used for billing or service delivery,
such as failed caller attempts and registration of type of communication
used. Storage of unsuccessful connection attempts (amounting to 40% of all
calls according to GSM Europe!) would require fundamental rebuilding of
all switching centres, resulting in costs "within the three-figure million
Euro range." Storing whether a user sends a fax or makes a phone call is
equally irrelevant to the operators, and would require equally substantial
technical upgrading.

Specially addressing the demands on mobile communications, the industry
explains that the demand to store the 'end' location of a mobile phone
connection is unjustified, because it often goes to another provider. Law
enforcement has "not yet proven an added value, as the retention of the
cell ID at the beginning of every call already suffices to establish a
movement profile." The demand for IMEI meets equal criticism from the
German industry. In a consultation with German law enforcement, no need
could be proven and the demand was dropped immediately.

With regards to Internet data retention, the paper notes that
"communication data of the internet services used are not available for
most services. Technical facilities to record, retain and analyse these
data would first have to be created and would lead to a tremendous rise in
the volume of data to be stored." Storage of the MAC address is completely
unrelated to the ISP business, and "the added value of a MAC, in addition
to an IP address, with regard to a clear identification of the user is
questionable and has not been demonstrated."

On the demand for statistics, the industry justifiably points out that
should have been the start of the legislative process to estimate the
effectiveness and proportionality of a data retention regime. Industry
also claims such an obligation exclusively resides with the competent
authorities. True as that might be, from a digital civil rights
perspective it would be a very good idea if the Commission would create a
shadow-obligation on the service providers to collect statistics and
jointly publish them in an annual report. But the Commission proposal
doesn't address the public availability of the statistics, and given the
lack of public supervision in many EU countries on the actual use of
interception and surveillance powers, that is not a promising start.

Demands of German Industry (in German and English, 04.08.2005)
http://www.bitkom.org/Default_33225.aspx

Not only, but also

===========================================================
7. Follow-up: jurisprudence hyperlinks
===========================================================

In response to the article about the Norwegian Supreme Court decision on
hyperlinks in the previous EDRI-gram, subscriber Matthias Spielkamp from
Germany pointed to an article he wrote about recent jurisprudence in
Germany. Contrasting the Norwegian decision that a hyperlink can not be
considered unlawful in a copyright context, irrespective of the legal or
illegal nature of the content offered, the appeal court of Munich decided
to uphold a ruling that the e-zine Heise had to remove a link to the
website Slysoft.com. At the site software was offered to make copies of
copy-protected CDs and DVDs.

Spielkamp writes: By providing a link to the company's homepage, the court
said, Heise intentionally provided "assistance in the fulfilment of
unlawful acts" and is therefore liable as "an aider and abettor". The case
is based on article 95a of the German authors rights code, resembling the
infamous section 1201 of the US DMCA, prohibiting the circumvention of
copy protection measures.

Spielkamp continues: Christian Persson, Heise Online's editor in chief,
said "it has to be taken for granted that in online reporting it is legal
to provide a link to a company's web site". The High Court had ruled in
2004 that links are a "fundamental component of online journalism". They
could only be seen as breach of law in case journalists "ignore blatant
evidence that they are unlawful".

German appeals court outlaws links to websites offering circumvention
technology (09.08.2005)
http://www.immateriblog.de/archives/000254.html

German High Court ruling (01.04.2004)
http://www.linksandlaw.de/urteil63.htm