[AusNOG] From the AGD - Data Retention - Starts October 15 2015

[Paul Brooks]

On 10/06/2015 12:02 PM, Ross Wheeler wrote:
>
>
> On Wed, 10 Jun 2015, George Fong wrote:
>
>> BTW if you want contact details of the AGD's Communications Access
>> Co-ordinator, they are here at the bottom of this page:
>>
>> http://www.ag.gov.au/NationalSecurity/DataRetention/Pages/Industry-Implementation-of-data-retention.aspx
>>
>
> Serious question, since you've spokent to them (I presume) and I haven't (I've been
> waiting with baited breath on the "simple, accurate, approved" interpretation from
> CA/et al), but do these clowns from the goobermint actually understand themselves,
> and are they able to convey in honest, technical terms we can actually apply, what
> the hell it is we have to do?

In technical terms? No. Thats not their role - and would you really expect a bunch of
lawyers and policy people to be able to explain to technical experts what they should
be doing in technical terms? They aren't about to try to tell the technical community
how to suck eggs, or manage logfiles, and they know we'd laugh them down if they tried.

They have set out the required outcomes, and I think they do understand at a high
level what they want to achieve. Its up to us and you - the technical experts - to
work out the 'how'.

Certainly there are some of the required outcomes that aren't clear enough for our
liking, and I and Patrick Fair spent a couple of hours on the phone with them last
night working through a couple of nuances regarding web-browsing and trying to educate
them on why we were looking for clarifications. They are genuinely taking that to
heart, and I believe looking to revise some of the Q&A answers they have started with.

>
> I'm presuming NOT, because if it was that simple, the well educated, legally
> trained, technically competent people of the SIG would have had a straightforward,
> unambiguous document out to us within a few hours.
>
> Therefore, I wonder what possible benefit there is talking to these dweebs, if
> they're just going to regurgitate verbatim the unintelligible piffle in the release
> itself, which attempts to define what we must do by defining what they DON'T expect
> us to do (and even then, doing so in self-contradictory terms!)
>
> Or is it just me?

Not just you, but not as dire as you suggest.  They just talk a different language -
they talk legaleze, we talk packetitus, and some of us are trying to translate one to
the other. They are just as puzzled about some of our queries as we are about some of
their requirements. I genuinely think we'll bridge the language barrier - - but
calling them dweebs and clowns doesn't help. They have a job to do to, and they aren't
about to try to do your job for you, just as you wouldn't do theirs.

The benefit of talking and interacting with them is that we learn how to frame the
exemption requests, and they understand the need for the exemption requests so they
can approve them faster, and they learn what is feasible vs what isn't so the CAC
doesn't expect what isn't possible, and just maybe we can convince them to re-word
some of the requirements.
If we don't talk to them, then down the track we find we're non compliant and have to
explain to a judge why we didn't comply with the law.
THATS why we're talking.

Paul.