The latest news from the Justice Department is Uncle Sam wants you! to enlist in the War against Terror. More accurately perhaps, the government wants your data, and if you don’t give it up voluntarily, then they’ll come get it.
For law enforcement, our digital age is a double-edge sword. On the one hand, digital communication has made it easier to engage in a variety of criminal activities. Whether it’s terrorists planning an attack or college students illegally sharing music, the Internet has made crime cheap and easy. Even worse, digital technology has made it harder for law enforcement to track down the source of illegal activity.
Digital communications are harder to monitor, and it is easy for criminal enterprises to operate offshore where US law enforcement efforts are hampered by a lack of jurisdiction. Despite concerted effort, law enforcement appears not to have made much of a dent on — let alone stamp out — criminal activity in cyberspace.
On the other hand, while real-time tracking may be more difficult, every digital communication leaves behind a record in the form of server logs. When tied to customer records, the information in server logs can be used by law enforcement to track the source of illegal activity. Such information may be even more valuable when aggregated and subjected to data-mining. Patterns in the data may reveal criminal enterprise that would otherwise operate undetected. However, for the government to take advantage of the data generated by electronic commerce, it has to have access to the data, and the more data, the better.
The growing government appetite for data appears voracious. New reports of government programs to gather data seem to appear daily. To name a few familiar items: the NSA is reported to be monitoring international communications; at the request of the government, major telecos have voluntarily turned over call records; and over the objection of the European Union, the TSA demands passenger information on international flights in return for landing rights.
Now, we learn that the FBI and the Justice Department are turning their sights on the data logs of Web site operators. Such data can already be obtained from ISP’s by court order, but law enforcement is apparently concerned that Internet companies are not keeping enough information long enough. The government is exploring whether it wants a law that would require the retention of web-surfing records and email transmission data for some period of time — perhaps two years. Most companies retain such data for much shorter periods.
Although the government position appears to be a modest proposal, it is not. At the least it would mandate the storage of data much longer that any private company would deem necessary. In addition, it would likely require the specification of data that needed to be kept (and perhaps of additional data that would need to be collected) and require companies to take steps to ensure the data could be easily searched and retrieved in response to government subpoenas. In effect, the law, if passed, would mandate that private industry create a gigantic archive of Internet activity.
It’s clear that law enforcement can use, and has used, data held by private companies to effectively combat crime. But it’s also clear that there is no limit to the amount of data to which government would like access. Viewed purely from law enforcement’s perspective, all data should be retained forever.
It’s not so clear though that law enforcement’s is the only worthwhile perspective. At the very least, this proposal would impose significant costs on the Internet industry. Compliance would be costly, particularly for smaller companies. And storage, while getting cheaper, will never be free.
Perhaps even more important in a society that calls itself free, the concept that a government should have unlimited access to information about its citizens needs to be viewed skeptically. It is time for the US to publicly debate and then implement a thoughtful approach to personal information and what it can be used for. This country needs a balanced policy that addresses both the needs of law enforcement and the right of citizens to go about their business without wondering who is monitoring their activities.