12:14 PM

Tech Giants Challenge French Data Retention Law

Facebook, Google, Microsoft, Yahoo, and others are appealing a legal decree that would require companies to store and share usernames, passwords, and other personal details with authorities.

A consortium of technology companies is fighting a recent French decree requiring them to store and provide the government with the usernames, passwords, and IP addresses of anyone who creates or accesses online content.

On Feb. 25, the French government released a legal decree, updating the 2004 Legal Regime for E-Commerce Trust (LCEN), which is France's implementation of the European Union's E-Commerce Directive. One of the decree's updates is that Internet access and hosting providers -- including service providers, Web mail providers, e-commerce companies, and online music and video sites -- must now retain numerous types of data on their users and customers. That data includes financial transaction details, the duration of their Web site visits, usernames, passwords, pseudonyms, mailing addresses, phone numbers, and passwords.

The decree requires that companies share this information with government agencies, at their request, and retain the data for at least one year.

Tuesday, the French Association of Community Internet Services (ASIC), which counts eBay, Facebook, Google, Microsoft, Wikipedia, and Yahoo amongst its members, petitioned France's highest administrative court to annul the decree -- although not the LCEN. The group is challenging the cost required to store large amounts of data for a long duration, charging that the data-gathering requirements exceed what's specified in the LCEN and the EU's E-Commerce Directive, and also that France failed to consult the EU on the changes, which may be a violation of EU law.

That's because the directive specifies "that member states mustn't restrict people's rights, or change these data collection and retention obligations, and that every member state has a requirement to consult with the EU Commission," said French lawyer Stephane Lemarchand, a partner at DLA Piper in Paris, in an interview. "And apparently -- this appears to be true -- the EU Commission wasn't consulted."

Whether the decree would apply to global companies, such as Google, is unclear. Benoit Tabaka, ASIC general secretary, as well as the director of legal affairs for French e-commerce giant PriceMinister, told the French newspaper Liberation that it was unclear whether international companies would be forced to comply with the new law, should his organization's annulment attempt fail. (ASIC expects its appeal process to take up to a year.)

Tabaka also said that for security reasons, Internet companies such as Google store user passwords in encrypted format, and are loathe to transmit them in plaintext, given the security implications. Indeed, should the information get stolen or lost -- via a targeted attack or simply government carelessness -- then users of related Web sites would be at risk of having their accounts hijacked and identities stolen.

What's the rationale for the French government issuing the new decree? In fact, according to Anne-Sophie Lampe, a lawyer who specializes in Internet law and copyright for DLA Piper, when the LCEN was first released, it stated that a forthcoming decree would specify exactly what data hosting and access providers would have to store. The decree has thus been over a decade in the making.

When the LCEN was released, it was unclear what types of information needed to be collected. "The judge, in the absence of the decree, tended to consider that the IP address of the person who had posted content was sufficient," said Lampe in an interview. Successful claimants could then take the IP address and request that an Internet service provider furnish them with the IP address' owner.

The decree, however, now stipulates that much more data must be collected. "So it creates now additional discussions because the scope of the data is wider than the case law has defined," said Lemarchand.

The French government's push to have ready access to more information about Internet users parallels recent discussions in the U.S. Senate over the degree to which American's personal information should be protected -- satisfying privacy concerns -- or made available on demand to government agencies, to aid law enforcement agencies in their investigations.

Recent interpretations of the Electronic Communications Privacy Act (ECPA), passed in 1986, have tended to allow law enforcement agencies to access any Internet user data with a subpoena, as opposed to having to convince a judge to issue a warrant. As Congress debates overhauling that law, the Department of Justice has argued against restricting its access to information.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.