Europe votes to end data privacy

European law enforcement agencies were given sweeping powers yesterday to monitor telephone, internet and email traffic in a move denounced by critics as the biggest threat to data privacy in a generation. Despite opposition from civil liberties groups worldwide, the European parliament bowed to pressure from individual governments, led by Britain, and approved legislation to give police the power to access the communications records of every phone and internet user.

The measure, which will be approved by the 15 EU member states, will allow governments to force phone and internet companies to retain detailed logs of their customers' communications for an unspecified period. Currently, records are kept only for a couple of months for billing purposes before being destroyed.

Although police will still require a warrant to intercept the content of electronic communications, the new legislation means they will be able to build up a complete picture of an individual's personal communications, including who they have emailed or phoned and when, and which internet sites they have visited.

From mobile phone records, police will also be able to map people's movements because the phones communicate with the nearest base station every few seconds. In urban areas, the information is accurate to within a few hundred metres, but when the next generation of mobiles comes on stream it will pinpoint users' locations to within a few metres.

Tony Bunyan, editor of Statewatch, said: "This is the latest casualty in the war against terrorism as far as civil liberties are concerned. The problem with wanting to monitor a few people is that you end up having to keep data on everybody."

The British government, which played a key role in driving through the new measures, has already introduced such powers as part of the anti-terror bill rushed through in the immediate aftermath of September 11, although the data retention measures have yet to be implemented.

UK civil liberties groups had hoped that if MEPs rejected data retention, it would open up the possibility of a legal challenge to the British legislation on the grounds that it was incompatible with European data protection law. After yesterday's vote they now expect the government to press ahead with implementing the act.

The measure is contained in an amendment to a bill originally intended to improve the security of e-commerce transactions. "Looking at the results, it amounts to a large restriction on privacy and increases the power of the state," said Italian independent MEP Marco Cappato, the bill's author who tried to prevent the amended clause being added.

Last night, the Home Office welcomed the result. "The UK is very pleased that the [European] council and parliament have reached agreement on a text that will ensure that the fight against terrorism and other crime will be given the appropriate weight. It is, of course, very important to protect people's fundamental rights and freedoms, but, as the tragic events of September 11 show, this must be balanced with the need to ensure that the law enforcement community can do its job."

But critics said the move amounted to blanket general surveillance of the whole population. The communications industry has also opposed data retention, questioning the feasibility and cost of storing such vast amounts of information.

John Wadham, director of Liberty, said: "This violates a fundamental principle of privacy, which is that data collected for one purpose should not be used for another.

"The police and other authorities will be able to trawl through all the details of the communications of millions of innocent people merely because there is a possibility that they might come across something suspicious."

" Umhmm. 512-bit is trivial to break, PGP goes 1024 to 2048 bit, and that's an open method"

Umhmm, I think that is addressed in the link that you're responding to, including reference to an architecture design to crack 1024 bit keys in less than a minute. Who knows what really exists so I'm in disagreement with your dismissive boast that "ROFL. Brute force doesn't get you anywhere.""

"Bernstein's machine, once built, will have power requirements in the MW to operate, but in return will be able to break a 1024-bit RSA or DH key in seconds to minutes."

There's something about those powers of 2, though... oh yea, that's right, they're exponential :)

So use 2048-bit keys as the post you referenced suggests. Or 4096, or 8192, or whatever level makes you comfortable. Now for most of us who might want to use a public key present PGP is limited to 1024 bit (it's the old command line one that was more robust) but if you actually cared about your data (like a company might be if its competitors were snooping) and not just encrypting everything just to make life difficult for snoopers, you could use more since your recipient would expect it.

Of course if everyone is encrypting, even if its all breakable with some effort, it's not feasible to scan through everything. Thus EU is putting a stop to that possibility.

Or, to put it another way, the fact that they are bothering to pass laws like this is an indicator that breaking crypto is not yet incidental to various governments.

"Or, to put it another way, the fact that they are bothering to pass laws like this is an indicator that breaking crypto is not yet incidental to various governments"

Or that they'd rather just spend the 10 billion instead of 20 billion next year to update their equipment.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.