Risk
4/8/2011
12:14 PM
50%
50%

Tech Giants Challenge French Data Retention Law

Facebook, Google, Microsoft, Yahoo, and others are appealing a legal decree that would require companies to store and share usernames, passwords, and other personal details with authorities.

A consortium of technology companies is fighting a recent French decree requiring them to store and provide the government with the usernames, passwords, and IP addresses of anyone who creates or accesses online content.

On Feb. 25, the French government released a legal decree, updating the 2004 Legal Regime for E-Commerce Trust (LCEN), which is France's implementation of the European Union's E-Commerce Directive. One of the decree's updates is that Internet access and hosting providers -- including service providers, Web mail providers, e-commerce companies, and online music and video sites -- must now retain numerous types of data on their users and customers. That data includes financial transaction details, the duration of their Web site visits, usernames, passwords, pseudonyms, mailing addresses, phone numbers, and passwords.

The decree requires that companies share this information with government agencies, at their request, and retain the data for at least one year.

Tuesday, the French Association of Community Internet Services (ASIC), which counts eBay, Facebook, Google, Microsoft, Wikipedia, and Yahoo amongst its members, petitioned France's highest administrative court to annul the decree -- although not the LCEN. The group is challenging the cost required to store large amounts of data for a long duration, charging that the data-gathering requirements exceed what's specified in the LCEN and the EU's E-Commerce Directive, and also that France failed to consult the EU on the changes, which may be a violation of EU law.

That's because the directive specifies "that member states mustn't restrict people's rights, or change these data collection and retention obligations, and that every member state has a requirement to consult with the EU Commission," said French lawyer Stephane Lemarchand, a partner at DLA Piper in Paris, in an interview. "And apparently -- this appears to be true -- the EU Commission wasn't consulted."

Whether the decree would apply to global companies, such as Google, is unclear. Benoit Tabaka, ASIC general secretary, as well as the director of legal affairs for French e-commerce giant PriceMinister, told the French newspaper Liberation that it was unclear whether international companies would be forced to comply with the new law, should his organization's annulment attempt fail. (ASIC expects its appeal process to take up to a year.)

Tabaka also said that for security reasons, Internet companies such as Google store user passwords in encrypted format, and are loathe to transmit them in plaintext, given the security implications. Indeed, should the information get stolen or lost -- via a targeted attack or simply government carelessness -- then users of related Web sites would be at risk of having their accounts hijacked and identities stolen.

What's the rationale for the French government issuing the new decree? In fact, according to Anne-Sophie Lampe, a lawyer who specializes in Internet law and copyright for DLA Piper, when the LCEN was first released, it stated that a forthcoming decree would specify exactly what data hosting and access providers would have to store. The decree has thus been over a decade in the making.

When the LCEN was released, it was unclear what types of information needed to be collected. "The judge, in the absence of the decree, tended to consider that the IP address of the person who had posted content was sufficient," said Lampe in an interview. Successful claimants could then take the IP address and request that an Internet service provider furnish them with the IP address' owner.

The decree, however, now stipulates that much more data must be collected. "So it creates now additional discussions because the scope of the data is wider than the case law has defined," said Lemarchand.

The French government's push to have ready access to more information about Internet users parallels recent discussions in the U.S. Senate over the degree to which American's personal information should be protected -- satisfying privacy concerns -- or made available on demand to government agencies, to aid law enforcement agencies in their investigations.

Recent interpretations of the Electronic Communications Privacy Act (ECPA), passed in 1986, have tended to allow law enforcement agencies to access any Internet user data with a subpoena, as opposed to having to convince a judge to issue a warrant. As Congress debates overhauling that law, the Department of Justice has argued against restricting its access to information.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.