[AusNOG] From the AGD - Data Retention - Starts October 15 2015

[Paul Brooks]

That particular clause (187A(4)(b) - yes its burnt into memory) was the precise topic
for the 1.5 hrs session yesterday. It appears to say one thing, the Explanatory
Memorandum says something else. We've identified to AGD people a few other problems
with it. They are re-looking at the other interpretations (which never occurred to
them at the time). I hope we can get a clarification directly from the AGD and CAC soon.




On 10/06/2015 4:36 PM, Ross Wheeler wrote:
>
>> Before you all panic, the legislaton (in my non expert opinion) states that
>> destination IPs are not required, as in:
>
>> Note:This paragraph puts beyond doubt that service providers are not
>> required to keep information about subscribers’ web browsing
>> history.
>
> I too am not a lawyer, but this reall goes to demonstrate the lack of clarity in the
> document, the (mis)use of conflicting and ambiguous terms without definition as to
> how the author intended us to interpret them, and lack of understanding of "how
> stuff works".
>
> There are other parts of the same document that make it perfectly clear that they DO
> expect the IP addresses (plural, source and destination) of other traffic.
>
> I am indeed unsure if their intention in the bit you quote (and I've re-quoted)
> means that they don't want the "URL" ("internet address"), or they don't want the IP
> address (IPv4, IPv6, or whatever else may come to pass). Not demanding the URL/URI
> is possibly a pre-emptive response to the anticipated public backlash from needing
> to see what people are browsing. How all this fits with HTTP/1.1 name-based hosting
> of hundreds or thousands of domains on a single IP address, I'm not sure.
>
> The document is QUITE contradictory in a number of places, directly saying one thing
> in one place, and the opposite in another. It's poorly worded by people clearly
> without any fundmental understanding of what they're legislating, and without the
> wisdom to come to those in the industry who DO, to get it sorted out properly first.

Yes. Yes. and Yes. They didn't get our collective wisdom first. However, its now law,
we lost that battle. Non-compliance (except with an approved exemption or retention
plan) is not an option. Now its time to point out the inconsistencies without too many
"I told you so"s and try to work out the least-bad implementation process.