Federal Ombudsman for Victims of Crime
Heard. Respected. Victims First.
Common menu bar links
Special Report:
What More Needs to be Done—Recommendations
3. Gathering Evidence—Disappearing Information
As discussed, the ability of police to identify and rescue children in an expedient manner is tied directly to their ability to get information about Internet customers. Obtaining this information, however, is not always straightforward, even with the cooperation of ISPs because in some cases they have already purged it from their systems.
“Client logs” contain information about when a client logged onto the Internet, what the client did while on the Internet and which IP address the session was linked to. This information is very useful for law enforcement agencies that are investigating a case. Police are required to obtain judicial authorization to obtain this information; however, too often even after police have authorization the information is no longer available because it has been erased or purged.
ISPs are not legally obligated to retain client logs. There is also no standard length of time for data retention. In some cases, data are purged after four hours.91 If the information no longer exists, the investigation cannot proceed. This obviously has serious implications for victims.
The Kids Internet Safety Alliance (KINSA) has called for legislation that requires ISPs to “retain the IP address logs, indicating which subscriber had a particular IP address, for a period of 5 years.”
KINSA also promotes a requirement that ISPs retain subscriber information for past customers for the same time period.92
Data retention requirements would require providers to collect and keep information from all users of a communication service—regardless of whether or not they are the subject of an investigation. This would ensure that information vital to an investigation is not deleted before the police can obtain a search warrant or production order to access the specific data.
Other countries have data preservation laws that enable law enforcement authorities, during a criminal investigation, to instruct a service provider to set aside specified data about a specific individual or IP address that is already in the service provider’s possession until law enforcement procures the proper documents to require the data’s disclosure. Preservation has been the law in the U.S. since April 1996.93
In Canada, ISPs have raised concerns about the cost of data retention, as they have with other aspects of Internet enforcement. While it is beyond the scope of this report to address the issue, the Supreme Court of Canada recently confirmed that police do not have to pay for third parties (in this case, a phone company) to produce records needed in criminal investigations.94 The Court heard evidence that the annual cost of TELUS to comply with production order requests would be over $660,000, which represents 0.023 percent of operating revenue for 2004 and 0.058 percent of Telus’ earnings—“…the equivalent of a person earning $100,000 a year having to spend up to $58 to comply with jury duty.”
95
Benjamin Perry, assistant law professor at the University of British Columbia, contends, “Internet service providers do make a lot of money off of the sharing of child pornography online”
and they “have an obligation to contribute more to eradicate child pornography than they do now.”
96
RECOMMENDATION 3—That the federal government introduce legislation to require ISPs to retain customer name and address data, traffic data and content data for two to five years.
