Klaus: Great to be back, unfortunately, with a not -so -great theme.
This is, again, an issue.
I remember talking about this at, I think it was
Congress 22 or 23, the first time, so in 2004.
So, unfortunately, we have to go through the process again.
Short history, data retention on the EU level first started in 19...
Oh, by the way, there's a lot of text on these slides.
You don't have to read this all. The slides will be available later on.
I wouldn't even mention everything which is on there, but
the slides are supposed to be used even without the talk.
So, that's the background, why there's so much text on there.
So, the first time I was confronted with this problem was in 98 with going dark.
So, law enforcement basically popped up and said, well, with all
these internet services, we don't get access to data anymore.
They were used to getting access through telecommunication services, more
or less, any way they wanted to, and they couldn't with internet services.
This led to nothing, but after 9 -11, data retention was argued as indispensable.
So, yes, there was a first proposal from France, Ireland, Sweden, and the UK
in 2004, and this led in 2006 to the first directive introduced by the EU,
which then all the countries were supposed to implement into national law.
So, this directive lasted quite some time before it was
abolished by the ECJ, which only happened in April 2014.
So, eight years it actually stayed with us.
And in 2016, and again in 2022 and 23, the ECJ always reiterated that all the
national implementations will hold, they will have to be abolished as well, and so on.
So, what happened in Germany, we had our first iteration from 2007 to 2010.
So, from November 9th, 2007, up until the abolishment by the Verfassungsgericht
in 2010, we had data retention, the first iteration in Germany.
I had the pleasure of being an expert there and helping abolish that.
And the second iteration from... Sorry, no.
And the second iteration from 2015 to 2023, that was a rather more lengthy process.
So, because the Verfassungsgericht didn't initially take the case.
So, it went through the Oberlandesgericht in
Münster, and then they stayed the implementation.
So, basically, we had data retention, but it didn't
need to be implemented by the service providers.
And that went through the Bundesverwaltungsgericht, and they referred the case to the ECJ.
We, as ECHO, supported this case.
So, it was brought by Spacenet, and later on also by Deutsche Telekom.
And on September 20th, 2022, the ECJ ruled that general retention is not
acceptable and can only be done for national security and serious crime.
So, later on, then, because of that ruling, the Bundesverfassungsgericht
actually took the case and ruled that the German law is non -conformant.
It doesn't need to be executed anymore. It stayed in the law until today.
It's still in there, in the telecommunication law, but it is not being executed.
But it never went away.
Like it stayed in the German law, it also stayed in most other jurisdictions in the EU.
Just because a directive is abolished doesn't mean that the
national implementations will go away or are deleted from the laws.
So in 2023, the last survey I found, over 20 jurisdictions
still had some form of data retention in the law,
both for telecommunication and ECS providers, and a lot of
jurisdictions actually amended their existing laws after 2022,
after the ECJ ruling, that they became executable again.
So meanwhile, because that will become very important
later, there was a shift of service usage by individuals.
So back in 2001, when this all started to be discussed,
over 90 % of communication was exit provider -based.
So we were using email, using telephone services, SMS.
That was the typical usage, and that was all based on the telecommunication services.
In 2024, already, 97 % of all interpersonal communication was through OTT services.
So basically, everything from email services, messenger services, social networks,
everything was on OTT services.
So the provisions for actual service storage became more or less meaningless.
Even for the remaining service, which is still
telecommunication service -based, which is telephony itself,
there's still a lot of usage with the telecommunication service providers.
They typically store this data a lot longer because they have a legitimate interest
because of the billing procedures in the back end.
So they can store the data for three to six months, and that is typically happening.
In some jurisdictions, it's even 12 months or more.
So even for that, you don't need service -specific storage, as in a mandatory data retention.
On the other hand, the services are no longer based nationally.
It's typically an international process where law
enforcement needs to access a foreign jurisdiction
that was historically through multilateral agreements,
which is a paper process where you send a translation and order and so on,
and then it's nationally executed, and the response is sent back to the requesting country.
It takes way too long. It takes months to execute.
And the retention periods for service data, if there is a retention period,
in some jurisdictions, there is no limitation at all for business purposes.
So if you can claim that the data actually belongs to you as the service provider,
and a lot of, for example, American companies do that,
they can basically store it forever.
Even the GDPR calls, which say there's limited storage time,
are overruled by national laws for data retention.
So in Poland, we have five years. In Italy, we even have six years.
But even in Ireland, which is probably the most relevant one,
because most of the service providers, at least the OTT service providers, sit there,
they have 12 months of data retention. So it's an interesting point.
If we have a discussion in Germany about how long is service data retained,
what does it mean if over 90 % of the communication or the actual interactions
are stored in some other jurisdiction where there is actually data retention?
Because law enforcement can still access this data under the new regimes.
I'm going to show you in a second.
So workarounds, which we tried, didn't really work because they were still too slow.
So even naming your representative, sending it through the representative and so on,
took way too long. So, sorry.
What came next was cross -border access to electronic evidence.
There is an EU directive and regulation, both, which was passed in 2023,
which basically built a fully digital request system for all types of stored data.
It's mandatory to register for service providers until August 18th, '26,
when it's supposed to go into effect and is supposed to start. Who does it affect?
It's the providers of telecommunication and electronic communication services.
They are used to doing this stuff because they are bound to work as law enforcement
in basically every jurisdiction anyway.
But also internet infrastructure providers, so DNS services, registration data,
privacy service, proxy service, and so on.
They're all supposed to retain and release data now.
But who else is addressed by E-Evidence?
It's information society service providers. What does that mean?
It means that basically anyone where there's communication between the users
doesn't need to register and release data as well. So that might be shop systems.
It might be gaming services.
There's also a provision that whoever stores and processes data for customers
is supposed to release data. So it could be anyone.
All sorts of cloud services and so on, file services, anyone. That's already part.
So if data is stored in a service provider,
it could be requested by law enforcement from another state within the EU.
Deployment model, maybe that's too complicated right now.
Basically, there's a national central authority on both sides,
which is this green box e -CODEX.
And there's other jurisdiction services which run over this as well.
So not just E -Evidence, but also whatever parking tickets
and exchange of land ownerships and all sorts of stuff.
All sorts of services run over e -CODEX between the member states.
And then there will be a national implementation,
basically web service for law enforcement and one for service providers.
So whoever registers supposedly uses a web service
to see if there's any requests they need to answer.
Larger service providers can connect through an API and run their own software,
which we'll see in a second is also not an easy task.
What categories of data are affected?
Subscriber data, basically all of law enforcement can request that
without any special provisions. There's no big security around this.
For traffic data and content data, at least it needs to be a serious offense.
So it needs to have at least a three -year maximum sentence.
And it actually needs to be signed by a judge. Okay, great.
But there's exceptions. If the offense is completely cyber -related.
So evidence is only there in electronic systems. There's an exception.
If it's terrorism -related, if it's CSAM content, it needs to be released anyway,
irrespective if there is what the actual levels of prosecution are.
There are obviously privacy concerns around it.
But E- Evidence tried to implement protections
so that lawyers, priests, members of parliament and so on,
whoever, journalists, whoever hold protections, that will be observed
and data won't be requested for these individuals.
How would some law enforcement from another jurisdiction even know about it?
Will they know that someone is a lawyer in another country,
that someone is a member of parliament in another country? They don't.
And the responsibilities to uphold that provision were never properly assigned.
In theory, it's with the country where the individual is located.
No, it's not where the individual is located,
where the service provider is located. But that even increases the problem.
So if you're a user from country A using a service in country B
and country C is requesting data, your own country is never involved.
So the authorities in country B would need to know
that you're a lawyer in country A in order to protect you.
It's never going to happen. So the protections are just not there.
Some states opposed end -to -end encryption.
The service providers asked for end -to -end encryption for all released evidence.
And there are some countries which just said, nah, we don't need this.
It's a secure system. We don't need this.
And digital signatures for everything are required,
but they're no longer verifiable for service providers
because we lost access to CDB, which is the central database
where all the participants are stored.
So service providers are not supposed to access
this hyper -secret database anymore. We need to supply our information to it.
We need to supply our encryption keys and so on to the database,
but we can't verify signatures by law enforcement or judges and so on.
And some language issues remain as well.
MLAT style translation services are no longer there. It's a complete mess
because judges will only sign orders,
typically only sign orders in their own language.
But what does it help me as a service provider in Germany
when I receive a Romanian order or an order from Spain or wherever?
So what do they actually mean? It's technical terms of jurisdictions
and it's technical lawyer terms. Will they be properly translated
if I use machine translation? We don't know. So that is a contested area,
but that has already been challenged
and some countries actually support the service providers
that this needs to be part of the order,
that this needs to be in the language of the service provider. Right.
But there's more. There's even more problems coming.
E-E vidence is just within the EU. But there's also the EU Cybercrime Convention,
also called the Budapest Convention, which is actually older. It's from 2001.
And 81 countries have subscribed to this already
and a further 16 are invited to exceed
and will be part of the Budapest Convention soon. So there's many EU countries
with vastly different legal systems. The way the evidence was argued
is the protections come from us basically, or within the EU basically having
at least a common understanding on how protections work.
We have the ECJ you can go to if you feel your rights are violated and so on.
How does that work if there's 81 countries? That includes whatever, Japan, the US,
but also countries we might feel questionable nowadays, Georgia, Hungary,
a lot of countries where we might not feel safe anymore, just releasing data to.
But under the second additional protocol of Budapest Convention,
there's also these changes now, and you can also go directly to service providers
and ask them for data. So law enforcement from all these countries can,
once it's enacted, it's not enacted right now,
it will probably be enacted early ' 27 or mid -'27.
Then from all the signatory countries of the second protocol,
which is currently 51, they can then also go to service providers
and directly ask for data. And it's even broader scope,
there could be financial data, administrative services and so on,
so they can go to your tax auditor and things like that.
And requests might even be for IP rights violations,
which is a big problem, obviously.
But there is no provision for a central database at all.
So neither is it clear how law enforcement
will actually find the right service provider
and not address the question to the wrong service provider,
which might have a similar name.
But it's also unclear on how can service providers
actually verify that this is a legitimate law enforcement agency
or legitimate judge's signature or something like that.
If there is no database, no way to verify it, how can we validate signatures?
If there is no database and how to do this. And also a contested issue is
how do we protect response data? Some countries, especially from Africa,
feel that it should be sent as is, it's not encrypted, nothing.
And obviously this is prohibited by GDPR for European service providers.
We just can't send data unencrypted, which is pertaining to private individuals.
Upcoming, just for completeness, is UN Cybercrime Convention,
which was basically brought up because Russia, China, Iran and these countries
were not allowed to join Budapest Convention
because their systems are deemed to be incompatible with the fundamental ideas
and human rights protections of Budapest Convention. So let's see where that goes.
I haven't seen anything on the implementation of the service providers so far.
Unfortunately, in 2024, we lost a significant battle with the ECJ HADOPI ruling,
which is a big problem because what the ECJ said is that they basically separated
IP address storage from service storage. And that initiated a new push
for data retention throughout Europe.
A lot of countries and legislators now thought, oh, there is a way we can do this.
We can actually have IP address retention
and we can use it for all sorts of crimes,
not just for serious crime on national security. And that was supported,
unfortunately the whole idea was supported by von der Leyen's political guidance
which basically asked for, oh, yes, we need data retention,
but we will also safeguard fundamental rights however this is going to happen.
And there was a call for evidence in a public consultation in 2025.
The principal changes in court position was this clear split of data retention
from the service users' retention and that they explicitly said
that the IP address retention alone
is no longer considered a serious infringement, which, well, we'll see about that.
But the limitations are basically, I'm not going to recite this,
is basically everything needs to be separately stored.
Service data cannot be overlaid with IP retained address data,
at least not by the service provider, and that's good enough, more or less.
So what does IP data retention in that context entail? It's basically nothing new,
and most importantly, it's not a reduced scope for IT data retention.
It was always the case that access providers needed to store IP addresses.
That hasn't changed. With the timestamp and when was that IP address assigned
and how long was it used and so on, no changes there. Increased amount of data,
even increased amount of data is now required with ports and probably IMSIs
and things like that in order to be sure that with the data set given,
you can actually identify the user. So, right. No flow data is to be stored,
so you can't really build a profile on this storage. That is true.
But it is still more data than was supposed to be stored before.
The time frame has become longer. I'll talk about time frames in a bit.
So there is no reduction in anything. So basically, IP data retention has stayed
as it was from 2004 onwards. Always the same.
Other than for the service provider side, we need to store it separately.
It needs to be a safe system. It needs to even support safe deletion,
whatever that means. And it's now also usable for all sorts of criminal offenses,
which is a huge problem because all sorts of criminal offenses can be anything
up until, and that's obviously the French position, intellectual property rights.
So something you would definitely not consider, at least most people,
would not consider it a serious crime, but that is obviously up for discussion
on where you are. Then there was the 2025 consultation by the commission.
And also there was a round of questions sent by the presidency to the countries.
So the commission asked, first for evidence, basically saying,
oh, what can be done with retained data and how does it work
and what are the time frames for what happens there?
And then there was a public consultation which went until September.
So basically anyone could, and there were thousands of submissions by individuals
and privacy rights organizations and so on,
which I hate to say are mostly dismissed. They're not seriously looking at it.
More interestingly, on November 27th, the presidency offered an insight
in what the member states submitted.
So the 15 member states who actually submitted something, they basically said,
no, no, we need a minimum of six months
IP data retention extendable by national laws. Otherwise,
they wouldn't be able to compromise on it
because some countries have no retention, some have six months,
12 months, up to six years. So how do you compromise? Oh, just allow that more
is permissible as well. They want access for all sorts of criminal offenses.
No news here. And that's the biggie here. Mandatory service level retention
for all telecommunication OTT services, but also for DNS, for VPN,
for cloud services, file storage, financial services, online shops, gaming, hotel,
taxi, food deliveries, and so on. So everyone. Everyone who's offering
electronic services would ideally store service data for six months plus.
So my personal assessment of the country's wish list, and I call it
the wet dream list, of course, yeah, but it's, there was never any,
that more than four weeks of data retention does anything meaningful
for actually more cases being solved that was never demonstrated.
There's no studies on this. There's even the data released
by law enforcement themselves. The statistics tell you
there is no meaningful increase after four weeks,
and most of the processes have streamlined in a way that this works.
There are, however, a number, a handful of high -profile cases
where in international, through international corporations, some crime rings
are being fought and so on, and there, it actually takes forever
to set up these proceedings, and so they might need data for longer than that.
But for general retention, you always argue about the mass,
the high amount of cases, and not about single and individual cases.
You'll always find a case where more time would solve a single case,
even after years. It could happen all the time. But that is no grounds
for data retention. And obviously, the,
and that's what law enforcement has in mind, right?
The envisioned combination of usage data from all these sorts of services
up to your food service, whatever, obviously fails this clear,
what the ECJ basically said is that still from the data, yes, yes,
IP data can be stored, but again, no profile of an individual should,
you couldn't do a profile of an individual from the service data
stored at some other location. And this clearly fails this test. If you use
all the service data, and then you can actually identify who's behind that
through IP address retention, you still have mass surveillance. You can,
you can completely, look, you have the glass citizen, right? You can look
through everything. And,
I mean, this will be an uphill battle for civil society, right?
So to demonstrate in front of the courts that several individual legal provisions now lead
to mass surveillance is kind of like what we had in
this Überwachungsgesamtrechnung discussion in Germany.
It will be so difficult to show that through these individual atomized measures,
so what law enforcement, or what the states are doing right now is more or less
atomizing these individual provisions and then trying to overlay it through
automated access even internationally. So, yes, you'll have, law enforcement
will have all the access they want, but nationally on the individual cases,
they can basically claim the individual measures are non -invasive or at least
not as invasive so that they're not permissible. Which leads us
to the reintroduction of data retention in Germany. We have the third iteration
now up. The service providers were sent the draft law on the 22nd of December
and we have for consultation until the 31st of January. And it only calls for IP
address assignment retention. No service retention. No general service.
Not even for telephony. There's no service retention in this anymore.
But you need to store ports, location, IMSI, MAC, and so on. But there is
something in there which is interesting, which is supposedly only a transposition
of what is called an epoch PR. This comes from E-Evidence and it's a preservation
order. So if law enforcement cannot produce a proper release order at any given
point in time, they can ask for preservation of data. Under E -Evidence,
this is only data up until this point in time. Not forward -looking. What we had,
the discussion we had in Germany for quick freeze, at least the latest version
of this, was also forward -looking. It didn't just freeze data, it was also
storing data for the future. What they did now is under the umbrella of EPOC- PR,
we're basically saying, oh, the German version, we can do it forward -looking
as well. And forward -looking up until now always required a judge's signature
because that's supposed to be a surveillance measure. Law enforcement can go to
the judge, ask for it before they issue the request. And they can basically
go to all service providers now and ask for it and they don't even need to
demonstrate probable cause. They can basically go to the service provider and say,
oh, there's a risk here, store it. Do it for any time, three months, six months,
it's not very clear right now. So, moving to the more interesting parts for this
audience maybe, the whole procedures are also an invite to side -channel attacks.
So, under E-Evidence, we already identified some problems. So, any compromised
law enforcement account can request all subscriber data from any service provider
within the EU. It doesn't matter how it was compromised. If it's a compromised
judge or court account, it can even request content data, which means also cloud
data. So, the whole cloud storage can request including also full social
media accounts, the complete streams, emails, cloud, file storage, and so on.
Everything. What does compromise mean? It could be hacked, it could
be blackmailed, and it can be shockingly cheap to even bribe a judge in certain
countries. I mean, this is in any country in the EU, right? It doesn't matter in
which country we're talking about. In some countries, I was told by experienced
individuals that it can be done even for single digit, thousands of euros figures.
So, if you can get the cloud storage of your biggest competitor or of your
whatever, not so intimate friend for a couple of thousand euros, bargain.
It's a lot. So, this is going to happen, definitely. And the EU has even
admitted to that already because they basically said there are significant
problems in the war on drugs because of all the money which is available
to organize crime. They're just bribing their way through the police force. So,
it's happening anyway already. Also, the system stretches to 27 countries.
It's about 10 ,000 plus law enforcement agencies throughout Europe. It's 400 ,000
service providers, diverse software implementations and the service provider said,
can we do this in a zero -trust environment so that nobody trusts each other in
this? We were told, no, it's not going to happen. There's also no IDS system,
so you won't see if there's abuse going on. But they don't need any of
this because the system is secure by design. No, by definition, it's even worse.
It's not by design. Design I could live with. But it's secure by definition. It is
demonstratedly unsecure and hacks will happen because the system which extends to
thousands of locations, how can you secure that? You can't. There's always ways to
even be part of the system, maybe just access the communication lines,
maybe compromise the systems. And these systems, because of the web interfaces,
are actually open to the internet. They're not separated from the internet.
The APIs and the web interfaces are part of the internet. So let's see how that
goes. On the cybercrime convention, the problems are... Sorry, how much time do I
have? Okay, I'm good. That even allows for fax transmissions where it's
completely unclear how you send back the digital data. You receive a fax for
digital evidence and then what? And there's no way to verify that the requesting
entity is actually a legitimate law enforcement agency, court, or whatever.
No provisions for that. It's already happening in the US that doxers are posing as
law enforcement to gain access to this type of data. And if you talk to Meta and
Google and so on, they say, oh, it's an everyday occurrence. We have that everyday
that people are trying to impose actually saying oh, we're law enforcement
when they aren't. So, but a similar database is not part of the protocol.
There are some third -party services like Kodex who offer this service, but they
only have very limited, they have about 60 ,000 law enforcement agents in
there which they know are legitimate agents. But what is that on a global scale?
It's nothing. So we have more than that in Germany. So also no provisions
for end -to -end encryption and no requirement for digital signatures on any orders.
Well, okay, and that's where we are. My main issues right now are we have to
learn that this overlay of service provision storage, IP address storage,
and access to all these data stored in other jurisdictions which have way longer
storage periods is the real problem. So why do we discuss data retention for
three months in Germany if the service provisions in Ireland is a year? But law
enforcement can just access the data stored there and when you ask for it
you'll have to get back anything which is stored with the service provider. So the
service provider doesn't observe what is legal in the requesting country.
in theory law enforcement would have to observe that, basically say, oh, we can't
request anything over three months, but they're not going to do that.
They never did and they never will. So, questions?
Thank you very much. That was Landefeld. Klaus, by the way,
we had a quick look through media .ccc .de. Do you know that this year is your
20th anniversary at Congress?
No, I didn't. Okay, yeah, thank you.
20. If you have questions, please line up on the microphones.
I think there is already a question on number six. Please.
audience: Hi, so thank you very much for the talk.
I was just wondering what's the motivation?
Like, this is a theme that's recurring since I can remember.
Like, what is the lawmakers end goal, the final plan, the great solution?
What problem is this the fix for? I just don't understand.
Klaus: Well, that's a very good question.
And it has a lot to do with how much crime can be solved.
And I always use that example where from November 2023
through NECMEC, NECMEC is this CSAM reporting system from the US, right?
So, where basically content is being reported. We receive ports as well.
Before that, we only received IP addresses as service providers, right?
So, when you only receive IP addresses because of CarrierNet,
you can obviously not tell them who used that IP address,
even if you received the request within 24 hours.
so we had to hand back 80 % of the requests.
So, after November, so basically '24 and ' 25 will
receive IP addresses and ports and very quickly.
So, you can actually tell them in 75, 80, sometimes even
higher percent of times who is behind that IP address.
So, everything they ask for and they use the old
statistics is completely besides the point and
with E -Evidence and that number will increase so you'll actually be able to solve 90 % plus
of crime at least due to the IP address retention.
The question really is what is the end goal? You'll never reach 100%.
So, at some point we need to set some solvage ratio where we basically say,
okay, if we reach 90%, that's okay
because that's better in most other phenomenon areas.
I don't know if that answers your question
but the idea obviously right now is they're working on statistics
where they claim we can only serve 30 % to 30 % of crime. That is not good enough.
We need to reach at least 90%.
audience: But do you think those are doctored?
No, it's not doctored. It's just wrong time frames they're looking at.
Technically we moved along a lot further and they're
just using outdated statistics to justify new laws.
Angel: Okay, then microphone one please.
audience: Yes, thanks.
Which of these regulations or directives that you have been talking about
are still up for debate for lack of better word
or which ones have already been decided and will be enforced?
Klaus: Yeah, so, the German data retention is obviously still up for debate.
It's under consultation right now.
What the commission and the council did this year will
only lead to a new legal proceeding. It's not there yet.
It's supposed to be released in January. So a lot of this is new, right?
E-Evidence is there. This is already under implementation. It will happen.
Budapest Convention second protocol is already there and it will be implemented.
There's no room for debate on this other than some
technical details on how it will actually be done.
Data retention in a lot of national jurisdictions is there as I said
in 20 plus and it's only increasing like the one in Germany.
So it's only a matter of time.
I believe by at least early ' 27 all jurisdictions
will have some form of data retention reintroduced.
That's my personal belief. So there's a lot of stuff going on.
audience: Thanks.
Angel: Microphone number four please.
audience: Hi. Thanks for the talk.
If I understand that correctly there is no database to show
who has legal lawful authority to ask for data requests.
So would it be technically possible to use that as an example and
having police station A spying on police station B to show why this is a terrible idea?
Klaus: That depends a bit on the measure we're talking about.
Under E-E vidence that is not possible because the database actually exists
and is maintained by the commission.
Under the Budapest C onvention this will totally be possible.
But what we're talking about right here is... just consider a case
where under the proposed German law law, but if that would become law,
German authorities would basically say, oh, do data retention,
retain something and we will give you as an EPOC- PR style request, right?
But they never actually do that.
But if some other country already requests the data, we'll have to release that data.
So even if it will never be able or legally be requested and released in Germany,
other countries can request that data.
So there might be ways through at least through cooperation,
maybe not spying on each other, but through cooperation of law enforcement
and that happens all the time
if they build their international cyber crime solving units,
then there's actually a strategic decision right now,
where do we place this so we can request most data? That is already happening.
audience: Thank you.
Thank you for the great questions. Unfortunately, time is up,
so where can the audience find you after the talk to discuss more questions
Klaus: absolutely yeah I'll be maybe right outside might
be the best place at least initially yeah okay