On Wed, 25 Feb 2009 09:06:13 -0800 Fred Baker <fred@cisco.com> wrote:
Data retention is discussed in section 5:
SEC. 5. RETENTION OF RECORDS BY ELECTRONIC COMMUNICATION SERVICE PROVIDERS. Section 2703 of title 18, United States Code, is amended by adding at the end the following: ‘(h) Retention of Certain Records and Information- A provider of an electronic communication service or remote computing service shall retain for a period of at least two years all records or other information pertaining to the identity of a user of a temporarily assigned network address the service assigns to that user.’.
Doing a thorough analysis of this bill is on my to-do list, possibly for a flight home on Friday. For now, I think the applicability remains ambiguous, because it's amending a law that was written ~25 years ago, when the concept of home computers was fairly new, let alone home providers of services... That said -- the definitions for 18 USC 2703 are in 18 USC 2510 (http://www4.law.cornell.edu/uscode/18/2510.html) and 18 USC 2711 (http://www4.law.cornell.edu/uscode/18/usc_sec_18_00002711----000-.html). The former includes the following: (15) “electronic communication service” means any service which provides to users thereof the ability to send or receive wire or electronic communications; the latter says (2) the term “remote computing service” means the provision to the public of computer storage or processing services by means of an electronic communications system; Now -- the remote computing definition includes "to the public", which pretty clearly excludes home users. The definition of "electronic communication service” is not limited to those serving "the public". In other parts of the statute, the phrase "to the public" is sometimes used, sometimes not; see, for example, 18 USC 2511(2)(a)(i) and 18 USC 2702(a)(1). I'm not a lawyer, either, but as I understand things where parts of a statute use a qualifier and parts don't the courts tend to conclude that Congress knew what it was doing when it differentiated the two cases. --Steve Bellovin, http://www.cs.columbia.edu/~smb