Secret data retention discussion paper leaked

It’s the secret industry consultation paper the federal government didn’t want you to see.

Produced by the Attorney-General’s Department and distributed to telecommunications industry members on Friday, the nine-page document attempts to clarify what customer internet and phone records the government wants companies such as Telstra, Optus and iiNet to store for the purpose of law enforcement and counterterrorism.

The requirement is part of a proposed data retention regime, which has been given “in principle” approval by the Abbott government. It seeks to continue to allow law enforcement and spy agencies to access customer identifiable data without a warrant as prescribed by law, but would ensure the data is not deleted for a mandated period of two years.

The paper, stamped “confidential” and marked for “preliminary consultation only” raises more questions than it solves.

It explicitly rules out the retention of data that indicates what sites internet customers access but it does not rule out agencies asking for a customer’s web history if a telco does hold it for other purposes. Recently, it was revealed Telstra handed over URL information without a warrant to agencies.

“Nothing in this data set applies to or requires the retention of destination web address identifiers, such as destination IP addresses or URLs,” the consultation paper states.

Information about the type of service a person is using over the internet is to be retained. Such information would help identify the use of communication services such as Skype or file-sharing services such as Bittorrent.

Providers would also be required to store “date of birth, financial, and billing information” of subscribers.

The paper also reveals they would be required to store source and destination telephone numbers from a phone call, the time of the call, its duration, and the location of all parties to the call.

But it neglects to mention access to data that could point to the use of messaging apps such as WhatsApp and Viber.

It does however, rule out the need to keep the channel surfing habits of internet TV (IPTV) users.

The paper also reveals that telecommunications companies would need to retain current and historical records that identify the names and addresses of internet and telephone ­account holders so as to provide an audit trail for law enforcement.

Telecommunications providers would also need to “capture any metrics that describe the use” of an account. An example provided states this could include upload and download volumes of an internet user and their allocated bandwidth – their speed of connection – at any given time.

Although costs associated with storing the data are mentioned briefly, the paper does not go into detail on this. Internet and phone providers iiNet and Optus have previously estimated the costs could be in the hundreds of millions of dollars depending on the amount of data required.

The paper states that input provided by industry in response to the paper will assist government to further develop policy “on a range of issues”, including future versions of the data set and retention periods.

Information security arrangements to protect the data from hackers – would also be taken into account from industry feedback.

The paper also concedes what many have known in industry circles for some time: that telecommunications data, commonly called metadata, is not defined in the Telecommunications (Interception and Access) Act 1979.

Instead, the paper states that such data is “negatively defined”.

“The TIA Act does not positively define what is data; only what is not data,” it says.

On Wednesday afternoon when pressed for a definition of metadata by Green Senator Scott Ludlam, Attorney General George Brandis told parliament a “statutory definition” of metadata would be part of the legislation, meaning it would include technical specifications.

The paper states it won’t be the last word on what data is stored and says the proposed definitions are open for consultation.

“We anticipate that this data set may be further refined during this consultation process.”

It reiterates the data is “vital to support law enforcement and security investigations”.

“The declining availability of this information is degrading the ability of the commonwealth, state and territory governments to combat serious crime and protect public safety,” it says.

Fairfax Media asked NBN Co, the company building Australia’s national broadband network, if it was involved with the discussions and if it would be subject to data retention.

“NBN Co does and will abide by any relevant statutory or regulatory requirements,” a company spokeswoman said. “Until the data retention policy is finalised, it wouldn’t be appropriate for NBN Co … to discuss or speculate about proposed government policy.”

This is not the first time Canberra seeks to future-proof the Act. A similar paper distributed to telecommunications companies between 2009 and 2010 by the previous government explicitly included destination IP addresses in the data required to be stored.

A copy of the 2009-10 document was obtained under freedom of information but was highly redacted out of fear it could cause “premature, unnecessary debate“.

via Secret data retention discussion paper leaked.

  Version 1.0—August 2014
Confidential industry consultation paper
Telecommunications data retention—Statement of requirements
This document has been prepared for the purpose of preliminary consultation only. The outcomes of this
consultation process will inform further policy development. This document does not represent approved policy
of the Australian Government.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the members of your
organisation involved in this consultation process without the approval of the Attorney-General’s Department.
Executive Summary
The purpose of this paper is to provide the telecommunications industry with information to support
further consideration of the development of a data retention scheme.
At this initial stage of consultation, Government is seeking information about the practicability of
retaining a set of telecommunications data that meets the requirements outlined in this paper. The
information provided by industry will assist Government to further develop policy on a range of
issues, including future versions of the data set, retention periods for each element of the data set
(to a maximum of 2 years), how to ensure requirements remain appropriate now and into the
future, across different systems, services, networks and providers, exemption processes, information
security arrangements, cost allocation, and implementation timelines and transitional arrangements.
Why is the Australian Government considering data retention?
Serious and organised criminals, and persons seeking to harm Australia’s national security routinely
exploit telecommunications services and applications to plan and carry out their activities. The
records kept by providers about the services they provide are, therefore, vital to support law
enforcement and security investigations. Data is an integral part of every national security
investigation, and in virtually every serious and organised criminal investigation.
However, the telecommunications industry is competitive and technology driven. This has brought
about a rapid increase of new services and the adoption of new business models that are eroding
traditional business reasons for retaining telecommunications data. The declining availability of this
information is degrading the ability of the Commonwealth, State and Territory Governments to
combat serious crime and protect public safety.
It is timely to consider how the public interest in effective law enforcement and national security can
be met without unduly impacting on the telecommunications industry. The requirements, outlined
below, would ensure that a set of data continues to be available for law enforcement and national
security purposes.
What is telecommunications data?
“Telecommunications data” is negatively defined in the Telecommunications (Interception and
Access) Act 1979—it is information or documents about communications, but not the content or
substance of those communications. The TIA Act does not positively define what is data; only what
is not data.
The Department has previously provided high-level examples of what can be considered to be data,
as opposed to content, to the Parliamentary Joint Committee on Intelligence and Security and the
Senate Legal and Constitutional Affairs References Committee. Those submissions provided that
data includes information about the parties to a communication (subscriber data) and information
that allows a communication to occur (traffic data).
Examples of subscriber data include the name and postal and billing address of a customer as well as
other contact details such as mobile numbers and email addresses. Examples of traffic data
previously noted include internet identifiers, mobile numbers called or texted, the time, dates and
durations of communications, and location information.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
A mandatory data retention scheme will apply to only a prescribed subset of “telecommunications
data”.
This paper elaborates on earlier work to provide greater and more useful detail on an initial,
proposed data set. The following dataset is based on the operational requirements of law
enforcement and national security agencies. We anticipate that this data set may be further refined
during this consultation process.
Who will data retention apply to?
The Australian Government’s current view, subject to consultation, is that data retention obligations
should apply to all entities that provide communications services available in Australia. Providers
should be subject to data retention obligations for all services they provide (including for roaming
and international services), subject to appropriate exemptions for services that are of limited or no
relevance to law enforcement or national security, potentially including IPTV services. Appropriate
implementation and transitional arrangements should apply.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
A. Requirements for data retention—Data set
The data set described in the following pages has been developed for consultation with the
telecommunications industry. It reflects the requirements of security and law enforcement agencies,
is designed to be technologically-neutral, and is broadly consistent with the categories of data set
out in Article 5 of the former Directive 2006/24/EC; and ETSI Standards TS 102 656 (V1.2.1) Retained
Data: Requirements of Law Enforcement Agencies for handling Retained Data, and TS 102 657
(V1.15.1) Retained Data Handling: Handover interface for the request and delivery of retained data.
The explanatory information in section B provides further information including examples of how we
would expect these requirements to apply to particular technologies and services.
Nothing in this data set applies to or requires the retention of destination web address identifiers,
such as destination IP addresses or URLs.
1. Information necessary to identify, and supplementary information regarding the subscriber or
user of a service:
(a) the current and historical name and address of the subscriber or user of the account,
service and/or device
(b) any current or historical account, service and/or device registered to the subscriber’s or
user’s account
(c) any current or historical permanent or transient identifier(s) allocated by the provider to
an account, service and/or device
(d) any current or historical supplementary identification, billing and payment, or contact
information
(e) current and historical account, service and/or device status
(f) current and historical information about the usage of the account, service and/or device
2. Information necessary to trace and identify the source of a communication (including
unsuccessful or untariffed communications):
(a) the identifier(s) allocated to an account, service and/or device from which a
communication is sent or attempted to be sent.
3. Information necessary to identify the destination of a communication (including unsuccessful
or untariffed communications):
(a) the identifier(s) allocated to an account, service and/or device to which a
communication is sent or attempted to be sent
(b) in cases where a communication is forwarded, routed, transferred or the like, the
identifier(s) allocated to an account, service and/or device to which a communication is
forwarded etc, or attempted to be forwarded etc.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
4. Information necessary to accurately identify the date, time of start and end or duration of a
communication (including unsuccessful or untarriffed communications)
(a) the time and date of the start and end of the communication, or attempted
communication
(b) the time and date of the connection to and disconnection from the service
5. Information necessary to identify the type of communication:
(a) the type of service used
(b) service features used by or enabled for the communication
6. Information necessary to identify users’ communication equipment or what purports to be
their equipment:
(a) the identifier(s)of the line, device and equipment connected to the service from which a
communication is sent or attempted to be sent
(b) the identifier(s) of the line, device and equipment connected to the service to which a
communication is sent, including a device or equipment to which a communication is
forwarded or transferred.
7. Information necessary to identify the location of communications equipment:
(a) the location of the device or equipment used to send or receive a communication, based
on the device’s or equipment’s connection to the service.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
B. Explanatory Statements
This section should be considered in conjunction with the requirements, and is intended to provide
further explanation on each element.
Note: Any examples given throughout this document are illustrative only. An example, or lack of,
does not indicate only data pertaining to the specific exemplified scenario should be retained.
Requirement Intent
Section one describes retention requirements for customer administration
1
information held by the carrier or carriage service provider.
This requirement intends to capture both present and past subscriber name and
addresses information (including residence, business, post office, billing,
1(a)
payment or installation addresses) as are known, or were ever known, to the
provider.
This requirement intends to capture both present and past identifiers allocated
1(b) to an account or service by the service provider (such as an IMSI, IP or email
address, or other network identifier).
This requirement intends to capture any present or past service, additional
1(c) account or additional feature information linked to the subscriber’s account(s),
such as any bundled services or alternative email accounts the user may have.
This requirement intends to capture any additional information collected by the
service provider as part of an enabling a service not explicitly outlined by a
previous or subsequent specific requirement (such as identification information,
date of birth, financial, billing and payment information, other transactional
information, or contact information).
1(d)
In the case of mobile pre-paid services, this requirement intends to capture all
identification and verification data obtained by a provider or its agent in
accordance with the ACMA Telecommunications (Service Provider – Identity
Checks for Pre-paid Public Mobile Carriage Services) Determination 2013 (as
amended), to the extent that they are not captured in the preceding items.
This requirement is to capture any change in the account state or billing type,
1(e) such as information about an account being suspended due to a failure to pay, or
about the pre-paid status of a service.
This requirement is to capture any metrics that describe the use of the account,
1(f) service or device, such as the available bandwidth, upload volumes and/or
download volumes.
Section two describes retention requirements relating to the origin of
2
communications.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
Requirement Intent
This requirement intends to capture any identifier which uniquely describes the
service at the time of the successful or attempted communication. An example of
such an identifier is an ITU-T E.164 telephone number (FNN or international).
For communications terminating on a provider’s network or service, the source
identifier should be retained even if the communication originated on another
provider’s network or service.
2(a)
Note: Category 2(a) does not apply to or require the retention of destination web
address identifiers, such as destination IP addresses or URLs. This exception is
intended to ensure that providers of retail and wholesale internet access services
are not required to engage in session logging. However, operators of such
services remain obliged to retain network address allocation records (including
Network Address Translation records) under category 1(b).
Section three describes retention requirements relating to the destination of
3
communications.
This requirement intends to capture any identifier transmitted to the network to
cause (or attempt to cause) a communication to take place. An example of such
an identifier is an ITU-T E.164 telephone number (FNN or international). Related
to this requirement is that of 3(b) which relates to the translation of identifier(s)
obtained from 3(a) into subsequent identifier(s).
For communications terminating on another provider’s network or service, the
3(a) destination identifier should be retained.
Note: Category 3(a) does not apply to or require the retention of destination web
address identifiers, such as destination IP addresses or URLs. This exception is
intended to ensure that providers of retail and wholesale internet access services
are not required to engage in session logging. However, operators of such
services remain obliged to retain network address allocation records (including
Network Address Translation records) under category 1(b).
This requirement intends to capture the scenario in which a communication is
routed to a subsequent identifier to that retained in 3(a). Examples of this is the
number to which a call was forwarded, a voicemail short-dial to full number
translation or a 13, 1300, 1800 prefixed number to other termination number
translation.
3(b) Note: Category 3(b) does not apply to or require the retention of destination web
address identifiers, such as destination IP addresses or URLs. This exception is
intended to ensure that providers of retail and wholesale internet access services
are not required to engage in session logging. However, operators of such
services remain obliged to retain network address allocation records (including
Network Address Translation records) under category 1(b).
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
Requirement Intent
Section four describes retention requirements relating to when communications
4
occurred.
These requirements intend to accurately capture the link between a
communication or connection and the time at which it occurred. To achieve this,
the provider must retain the service identifier with an accurate, unambiguous
4(a) and (b)
date & time marking; such a marking must include a method of indicating a time
zone or reference to a global time. An example of this is a username with an
accurate UTC & offset marking.
5 Section five describes retention requirements for the type of communication
This requirement intends to capture the type of service used, including an access
5(a) network or service (such as an ADSL or FD-LTE service) or an application service
(such as VoIP, instant messaging or email).
This requirement intends to capture any feature used by or enabled for the
5(b) communication, such as call-waiting, bandwidth allocation, or upload and
download allowances.
Section six describes retention requirements relating to the equipment used in
6
communications.
This requirement intends to capture the identifier(s) of the equipment from
which a communication is sent or is attempted to be sent. Examples of such
6(a) identifiers include the unique IMSI of the party originating the communication,
the unique IMEI of the mobile device used to originate the communication, or
the MAC address of the network interface used to originate the communication.
This requirement intends to capture the identifier(s) of the equipment used to
receive a communication. Examples of such identifiers include the unique IMSI of
the party receiving the communication, the unique IMEI of the mobile device
used to receive the communication, or the MAC address of the network interface
used to receive the communication.
This requirement includes the scenario in which a communication is routed to a
subsequent identifier to that retained in 3(a), such as the equipment to which a
6(b)
call was forwarded.
Note: Category 6(b) does not apply to or require the retention of destination web
address identifiers, such as destination IP addresses or URLs. This exception is
intended to ensure that providers of retail and wholesale internet access services
are not required to engage in session logging. However, operators of such
services remain obliged to retain network address allocation records (including
Network Address Translation records) under category 1(b).
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.
Requirement Intent
Section seven describes retention requirements relating to the location of the
7
equipment used in communications.
This requirement intends to capture the physical and logical location of the
device or equipment used to send or receive a communication.
7(a) Note: Location information contained in the content of communications, such as
assisted GPS information passing over a service or network, is not
telecommunications data and is not included in this data set.
This document has been disclosed to you in confidence for the purposes of consultation and may not be disclosed outside the
members of your organisation involved in this consultation process without the approval of the Attorney-General’s Department.

Bookmark the permalink.

Comments are closed.