The buzz is going insane today on this - I think I've gotten 20 emails on it in the last 24 hours, so I decided to write on the subject - the so-called "Protecting Children from Internet Pornographers Act Of 2011."

Internet providers would be forced to keep logs of their customers' activities for one year--in case police want to review them in the future--under legislation that a U.S. House of Representatives committee approved today.

Well, this isn't what it sounds like.

I know the commitee revised things and Thomas doesn't have the updates yet, but I read both the comments and the original bill.

It essentially imposes a "business records retention" requirement, which sounds bad.

But in reality, it's a big fat nothing.

Here's why.

The requirement is that the provider keep your billing information (e.g. credit card or bank account number, electronic record of the check you paid with, etc) and IP assignments.

A last-minute rewrite of the bill expands the information that commercial Internet providers are required to store to include customers' names, addresses, phone numbers, credit card numbers, bank account numbers, and temporarily-assigned IP addresses, some committee members suggested. By a 7-16 vote, the panel rejected an amendment that would have clarified that only IP addresses must be stored.

This caused everyone to seize on this as some sort of monster violation of civil liberties.

Nope folks.

Look, in 1995 MCSNet had online, in our internal databases, every single session you had ever engaged in.  We also had all your billing records.

This was not because we were intrusive bastards, it was because we need to have them in the event there was a credit card dispute or other reason for us to look it up (e.g. you claimed you really didn't use that extra 50 hours of time we billed you for.)  And by the way, that happened a lot - people try to steal all the time.  They'd claim they didn't really use the login time, they'd sign up on our "2 week risk-free trial" that was explicitly one per household, cancel, and then try to do it again so as to never pay at all and other similar scams.  If we hadn't kept the records we would have been robbed blind!

For each dial-up session we had the port it came in on, the start and end times of the session, the number of bytes transferred in each direction, the ANI of the calling phone line, the IP address assigned and the account identifier (your login ID.)  In the billing system we had every invoice generated and how it was paid.

Note that nowhere in that list (nor in the bill text I can find) is any requirement to log and keep the sites you go to while you're actually online.  That would be a ridiculous requirement, both from a standpoint of implementation but also the storage and indexing requirement to do so would be extraordinary.

Never mind that our customer service agents had online access to the invoices which in turn had summary information on usage.  If you called in with a question or needed a reprint of a 2-year old invoice our people would be happy to look it up or fax you a copy.  Big deal.  Ordinary course of business stuff here folks.

What's covered by this are ordinary business records folks.  They're normally generated by any ISP in the normal course of operations.  And every ISP needs to keep them around as business records until the statute of limitations expires on any claims that might be raised in any way related to those events, which in most cases means three years as there's always the possibility of some sort of tax action (e.g. an audit) that requires you to prove up revenues and how you derived them.

What this bill appears to do is to put a fork in those ISPs and other related internet companies who intentionally obfuscate records, despite the risk of adverse result in the event of a challenge (e.g. an audit) and the utter idiocy from a standpoint of reasonable business practice.  That is, it puts a fork in those "firms" that market themselves indirectly to or are otherwise "friendly" toward those who engage in various illegal acts online, including but certainly not limited to kiddie porn.

I see no problem with this bill.  It would alter exactly nothing in regard to how we did business in the 1990s; every record they're calling for an ISP to retain we already retained for far longer than they required.  We did it not do it to spy but for perfectly-legitimate business purpose - specifically the ability to defend, if necessary, any business-related action we might wind up involved in.

And yes, we were occasionally subpoenaed, including by agencies looking for information related to kiddie porn distribution or consumption.  I have no problem with that either - the subpoenas were lawful documents issued by a judge that had binding jurisdiction over our operations.  We got paid for the cost of compliance and we did what we were ordered to by that court of competent jurisdiction in each and every case, just as I will if I am served with such a subpoena as the operator of Tickerforum.

Perhaps someone can tell me how a bill that does not in any way impose a requirement that any legitimate ISP operating as a legitimate business will not be doing anyway is somehow violative of people's privacy rights?  The law enforcement agency that wants the records has to get a legitimate subpoena signed by a judge citing lawful authority for the request and serve it upon the ISP, exactly as they do now.

What's the problem?