<div dir="ltr"><div><div><div><div>Regards section 282 certs, s282 of which Act / Regulation?<br></div><br></div>Near as l can see, all disclosure provisions in the Act itself are either voluntary, or require a warrant, where the police need to locate a caller in a life threatening situation the one exception.<br><br></div>Kind regards<br><br></div>Paul Wilkins<br></div><div class="gmail_extra"><br><div class="gmail_quote">On 2 May 2018 at 15:29, Ross Wheeler <span dir="ltr"><<a href="mailto:ausnog@rossw.net" target="_blank">ausnog@rossw.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
On Wed, 2 May 2018, Noel Butler wrote:<br>
<br>
</span><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
After DR, two things have chan<wbr>ged.<br>
1. We have a legal obligation <wbr>to capture and securely retain<wbr> a<br>
whole pile of things.<br>
2. We are required to give ext<wbr>racts of that information<br>
when requested, and but DO <wbr>NOT REQUIRE A WARRANT.<br>
</blockquote>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
No, only number 1 is new<br>
</blockquote>
<br></span>
Are you saying that we now DO require a warrant to give an authorised person data captured in compliance with the mandatory data retention laws, or that we DIDN'T require one previously? Because as far as I was aware, we required a legal instrument before, and for DR stuff (as opposed to interception) we now explicitly will NOT get a warrant except for the specific case of information requested of a journalist.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
, and as for ISP's (not telcos) Id hardly call radius and email logs a "whole pile of things",<br>
</blockquote>
<br></span>
For some of us, it is far more than radius and email logs.<br>
It includes SIP, FTP, and indeed any other service you provide that isn't an "OTT" service, a webserver or a few other specific exclusions.<span class=""><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'd also not call it that for those offering phone services either since clients like to lookup to see their recent history they would be keeping that for a while anyway,<br>
</blockquote>
<br></span>
What you kept for production and billing purposes is unchanged, but the legislation actually requires all information captured for the DR (and the wording is sufficiently unclear that it appears that "if it is captured for DR (even if it is ALSO captured for billing or operational reasons)" that data MUST be encrypted and secured at the point of collection (unless you asked for and were granted an exemption on the immediate encryption of otherwise collected data).<span class=""><br>
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
its hardly earth shattering for typical ISPs. <br>
</blockquote>
<br></span>
I didn't say or imply it was. Merely that for some people there was significant additional work to collect logs that they had not previously needed, and not all systems made that easy. I was lucky, most did.<span class=""><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
And #2 has always been the case under s282, I recall doing them as far back as 2002<br>
</blockquote>
<br></span>
Yes, but S282 certificates are specifically NOT REQUIRED for LEA and others to access (quite specifically) data captured and stored under the mandatory data retention legislation.<span class=""><br>
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
huh? where do you get interception from or are you just moving the goal posts<br>
</blockquote>
<br></span>
Others raised "interception".<span class=""><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
your OP never mentions a word of it, and<br>
nobody has unless I missed a post or three,<br>
</blockquote>
<br></span>
You have, then.<span class=""><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
your post was a bout user joe blogs information which never has required it, DR or no DR. <br>
</blockquote>
<br></span>
Huh? You're saying now that an ordinary users information has never required a warrant? Now YOU are conflicting your own statements?<br>
<br>______________________________<wbr>_________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>