More "going dark" problems: Europol wants data retention to ease identification of individual internet users
Follow us: | | Tweet
Europol has written to national delegations in the Council of the EU expressing the concerns of law enforcement agencies regarding the use of Carrier-Grade Network Address Translation (CGN) technology, which hampers "cyber" investigations by making it impossible for officers to "link a particular cyber criminal's activity back to a particular IP address."
See: NOTE from: Europol/EC3 to: Delegations, Carrier-Grade Network Address Translation (CGN) and the Going Dark Problem - initial debate (5127/17, LIMITE, 16 January 2017, pdf)
The note, writte by Europol's European Cybercrime Centre (EC3), says that:
"the Going Dark problem is not limited to the TOR network, proxy servers, bullet proof hosting and encrypted communication applications. A far more diffused technology - the carrier-grade network address translation (CGN) - is posing massive attribution problems to the law enforcement community around the world."
In order to trace individual users to IP addresses when CGN is in use, law enforcement agencies have to request from service or content providers "source and destination IP addresses", the "exact time of the connection (within a second)", and "source port number", but:
"the lack of harmonized data retention standard requirements in Europe means that content service, Internet service and data hosting providers are under no legal obligation to retain this type of information".
The note says that:
"Regulatory/legislative changes would be helpful to ensure that content service providers systematically retain the necessary additional data".
Europol suggests that such a solution could be sought "using already established channels for cooperation such as the EU Internet Forum," which was set up by the Commission at the end of 2016 and:
"brings together US internet companies (Microsoft, Facebook, Twitter, Google), government officials, and law enforcement agencies to discuss how to reduce the accessibility of undefined terrorist material and badly defined hate speech online (as defined by 28 different national laws that are not even properly implemented in some countries)."
See: Commission responds to Ombudsman investigation on EU Internet Forum (EDRi, link)
Europol's note asks national delegations two questions, firstly:
"Would Member States support such approach [seeking mandatory data retention] and thus recommend an extension of the scope of the EU Internet Forum to also cover the issue of CGN?"
And secondly, regarding the European Network of law enforcement specialists in CGN which will be launched on 31 January and have its secretariat hosted by Europol:
"How would Member States suggest the results of the work and the eventual recommendations of the future network of law enforcement specialists in CGN be brought to the attention of policy-makers and at which level in order to ensure their implementation, including by the providers and by this to facilitate the attribution of crime?"
The issue was due to be discussed at a joint meeting of the Horizontal Working Party on Cyber Issues and the JHA Counsellors (in their law enforcement "formation", pdf) this morning (20 January 2017). Given the previous form of the JHA Counsellors working party, it is not likely that formal minutes ("outcome of proceedings") will be published.
And: the Europol document: NOTE from: Europol/EC3 to: Delegations, Carrier-Grade Network Address Translation (CGN) and the Going Dark Problem - initial debate (5127/17, LIMITE, 16 January 2017, pdf)
Support our work by making a one-off or regular donation to help us continue to monitor the state and civil liberties in Europe.
Search our database for more articles and information or subscribe to our mailing list for regular updates from Statewatch News Online.
We welcome contributions to News Online and comments on this website. E-mail us, call +44 (0) 207 697 4266, or send post to 356 Holloway Road, London, N7 6PA.
Home | News Online | Journal | Publications | Observatories | Analyses | Database | SEMDOC | About Statewatch
© Statewatch ISSN 1756-851X. Personal usage as private individuals/"fair dealing" is allowed. We also welcome links to material on our site. Usage by those working for organisations is allowed only if the organisation holds an appropriate licence from the relevant reprographic rights organisation (eg: Copyright Licensing Agency in the UK) with such usage being subject to the terms and conditions of that licence and to local copyright law.