Government shifts onus on ISPs to retain communications data

The Home Office has moved away from its original plan of a centralised database for storing everyone’s email, social networking and other web activity. Instead, it wants all communications service providers to hold data required by the public authorities.

The idea of a centralised “super database” was mooted last October as part of maintaining UK’s communications capabilities to fight new threats arising out of sophisticated technology. Following months of public outcry and privacy concerns, this plan was dropped yesterday [Monday, April 27].

Home Secretary, Jacqui Smith said: “The Government recognises the privacy implications of a single store of communications data and does not, therefore, intend to pursue this approach.”

She added: “We recognise that there is a delicate balance between privacy and security, but to do nothing is not an option as we would be failing in our duty to protect the public."

As an alternative, the government proposes fixed line, mobile and WiFi operators, which own the network infrastructure, to record and maintain people’s online activity which then could be made available to public authorities. The Home Office emphasised that service providers are required to retain details such as date, time, email IDs, web-address (URLs) and not the content.

It is estimated that it will cost £2bn to implement this programme. In addition to tracking information, service providers are required to provide it to the authorities in the format understood by them. Smith said: “The Government recognises that any option focused on communications companies would put additional demands on industry, especially around the collection and retention of third party communications data” and invites suggestions to minimise the cost and impact on the private sector

Under the current Data Retention regulations, internet service providers are required to retain details of users’ online information activity for 12 months (IWR May 2009: ISP’s extended data retention sparks security fears).

The new proposals would also require them to retain details of communications that originated in other countries but passed across British networks – for instance a person accessing a US-based email account in Britain, or phone calls from outside Europe.

Still in a proposal stage, the consultation will run until July 2009. It is expected to raise criticism as public trust in government authorities over data security is low following a series of high profile cases resulting in sensitive data loss.