Risk
4/8/2011
12:14 PM
Connect Directly
RSS
E-Mail
50%
50%

Tech Giants Challenge French Data Retention Law

Facebook, Google, Microsoft, Yahoo, and others are appealing a legal decree that would require companies to store and share usernames, passwords, and other personal details with authorities.

A consortium of technology companies is fighting a recent French decree requiring them to store and provide the government with the usernames, passwords, and IP addresses of anyone who creates or accesses online content.

On Feb. 25, the French government released a legal decree, updating the 2004 Legal Regime for E-Commerce Trust (LCEN), which is France's implementation of the European Union's E-Commerce Directive. One of the decree's updates is that Internet access and hosting providers -- including service providers, Web mail providers, e-commerce companies, and online music and video sites -- must now retain numerous types of data on their users and customers. That data includes financial transaction details, the duration of their Web site visits, usernames, passwords, pseudonyms, mailing addresses, phone numbers, and passwords.

The decree requires that companies share this information with government agencies, at their request, and retain the data for at least one year.

Tuesday, the French Association of Community Internet Services (ASIC), which counts eBay, Facebook, Google, Microsoft, Wikipedia, and Yahoo amongst its members, petitioned France's highest administrative court to annul the decree -- although not the LCEN. The group is challenging the cost required to store large amounts of data for a long duration, charging that the data-gathering requirements exceed what's specified in the LCEN and the EU's E-Commerce Directive, and also that France failed to consult the EU on the changes, which may be a violation of EU law.

That's because the directive specifies "that member states mustn't restrict people's rights, or change these data collection and retention obligations, and that every member state has a requirement to consult with the EU Commission," said French lawyer Stephane Lemarchand, a partner at DLA Piper in Paris, in an interview. "And apparently -- this appears to be true -- the EU Commission wasn't consulted."

Whether the decree would apply to global companies, such as Google, is unclear. Benoit Tabaka, ASIC general secretary, as well as the director of legal affairs for French e-commerce giant PriceMinister, told the French newspaper Liberation that it was unclear whether international companies would be forced to comply with the new law, should his organization's annulment attempt fail. (ASIC expects its appeal process to take up to a year.)

Tabaka also said that for security reasons, Internet companies such as Google store user passwords in encrypted format, and are loathe to transmit them in plaintext, given the security implications. Indeed, should the information get stolen or lost -- via a targeted attack or simply government carelessness -- then users of related Web sites would be at risk of having their accounts hijacked and identities stolen.

What's the rationale for the French government issuing the new decree? In fact, according to Anne-Sophie Lampe, a lawyer who specializes in Internet law and copyright for DLA Piper, when the LCEN was first released, it stated that a forthcoming decree would specify exactly what data hosting and access providers would have to store. The decree has thus been over a decade in the making.

When the LCEN was released, it was unclear what types of information needed to be collected. "The judge, in the absence of the decree, tended to consider that the IP address of the person who had posted content was sufficient," said Lampe in an interview. Successful claimants could then take the IP address and request that an Internet service provider furnish them with the IP address' owner.

The decree, however, now stipulates that much more data must be collected. "So it creates now additional discussions because the scope of the data is wider than the case law has defined," said Lemarchand.

The French government's push to have ready access to more information about Internet users parallels recent discussions in the U.S. Senate over the degree to which American's personal information should be protected -- satisfying privacy concerns -- or made available on demand to government agencies, to aid law enforcement agencies in their investigations.

Recent interpretations of the Electronic Communications Privacy Act (ECPA), passed in 1986, have tended to allow law enforcement agencies to access any Internet user data with a subpoena, as opposed to having to convince a judge to issue a warrant. As Congress debates overhauling that law, the Department of Justice has argued against restricting its access to information.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.