ISPs experiences with police use of personal location data

Internet service providers (ISPs) are important potential sources of personal lo-cation data for the police. In order to get an impression about the relationship between these businesses and the police, we have carried out a simple inquiry among eighteen ISPs in the eight countries participating in the European part of RESPECT WP7 which was conducted by the national research teams.⁸⁵ Our aim has been both to capture national characteristics and differences as well as possi-ble differences within countries represented with more than one ISP. Thus several

84 Three of twelve respondents, compared to one of twelve respondents regarding the other technologies.

85 ISPs in Austria, Bulgaria, Germany, Italy, Norway, Romania, Slovakia and Slovenia.

countries in our selection are represented by more than one ISP.⁸⁶ The inquiry was based on statements with reply alternatives yes, no and don’t know.

First we wanted to have a picture of changes regarding police use of personal location data stored by ISPs:

• The police often ask for access to traffic data which may reveal individual’s location.

The majority of ISPs answered yes to this statement (11/18), six replied no and one did not know. One interesting result was that ISPs from the same country re-sponded differently to this statement. One of two Austrian, two of six Bulgarian, two of three Italian and three of four Slovenian ISPs answered yes. It is hard to explain these internal differences. One possibility is however that ISPs which an-swered no have a smaller volume of data and thus have a lower probability to be contacted by the police. Romania was the only country with no yes result.⁸⁷

The next statement concerned movements (and not location as in the previ-ous statement):

• The police often ask for access to traffic data which may reveal individuals’

movements.

Eight ISPs gave affirmative answer to this statement and a majority of ten re-spondents replied no. Even here, answers from ISPs of the same country differed similar to answers regarding location. Romania was the only country with no yes result.⁸⁸ Answers regarding location and movements gave in other words more or less the same results.

We also wanted to have a picture of possible development regarding police access to personal location data:

• It happens more frequent today than two years ago that the police request ac-cess to traffic data which may reveal locations and movements of objects (and thus individuals).

Twelve of eighteen of the ISPs gave positive reply to this statement, while six an-swered no. Again, there were differences between ISPs of the same country, but every country had at least one ISP giving affirmative reply to this statement.

We wanted to know whether or not ISPs made independent judgements of police requests for access to traffic data:

86 Replies have been received from two ISPs in Austria, six in Bulgaria, three in Italy and three in Slovenia. We have tried to have answers from more than one ISP in all seven countries, but did not always succeed.

87 Romania was only represented by one ISP.

88 Romania was only represented by one ISP.

• Our company does not always act in accordance with police requests for ac-cess to traffic data that may reveal the location and movements of objects (and thus individuals).

Five of eighteen ISPs representing three of seven countries responded affirma-tively to this statement, ten ISPs disagreed and three did not know. Here, the threshold for a positive reply was set very low (“not always”). Thus, it is natural to assume that negative replies either mean that no one of the requests from the po-lice have contained legal flaws or serious uncertainties, or that the legal validity of such requests are not checked by the ISPs before they comply with police orders.

We read this result as an indication of lack of independent judgement by the ISPs of police requests for traffic data.

We assume that a competent and well manned police force will do analyses of collected traffic data themselves. Nonetheless, considerations of time and costs may make it practical for the police to ask the ISP to carry out analyses. We asked the ISPs to consider the statement:

• Our employees often perform analyses of traffic data on behalf of the police.

Three ISPs (two Bulgarian and one Austrian) gave affirmative responses to this statement. Eleven gave negative responses, two did not know and two did not respond on this statement. We do not know the concrete background for the po-sitive replies, but one general issue of discussion is of course the degree of inde-pendence or integration between police and ISPs. Seen on the background of the previous referred statement regarding compliance with police request, it may be claimed to be problematic if ISPs always act in accordance with police requests and often perform analyses on behalf of the police. Two of the Bulgarian ISPs seem to come in this category.

Discussions of the Data Retention Directive illustrate how traffic data are re-garded highly sensitive by many people. Thus confidentiality obligations of the ISPs (pursuant to law or contract) should be seen as a possible problem for the ISPs when police request traffic data in order to locate and trace objects and peo-ple. With this general background in mind, it is hardly surprising that no one of the responding ISPs disagreed to the statement:

• It rarely creates problems with our confidentiality obligation if the police re-quests access to traffic data from our company.

Fourteen ISPs gave affirmative responses, three did not know and one did not give a response to this statement. We should, for the sake of good order,

emphasi-se that there is no basis for interpreting don’t-know answers as a sort of disguiemphasi-sed confession that such problems occur.⁸⁹

To sum up this brief ISP inquiry, it is important to remember that results first and foremost say something about the situation in each country (Bulgaria, Germany, Italy, Norway, Romania, Slovakia and Slovenia), and that generaliza-tions on this basis may create uncertain results. This being said, we believe that some general conclusions may cautiously be made as starting point for further examination and discussions:

• Police use of traffic data which may reveal peoples’ location and movements stored by ISPs is probably increasing, and probably creates increased pressure on the ISPs as source for the police.

• There are reasons to further address the relationship between ISPs and police in order to map and discuss their relationship and independence.

Our inquiry comprised only internet service providers. Various other businesses provide services based on PT technology. It is probable that questions of pressure from the police and the issue of independence could be more challenging in these other businesses than for the ISPs.⁹⁰