ISPs may be forced to pass on high data retention cost

Government plans to force Internet service providers (ISPs) to store and retrieve e-mail and Web traffic for the police and other...

Government plans to force Internet service providers (ISPs) to store and retrieve e-mail and Web traffic for the police and other government agencies will impose enormous costs on the industry, a cross-party group of MPs heard this week.

ISPs told the All Party Internet Group that the costs of buying and running the IT systems needed to store and manage Internet traffic data would be far in excess of the compensation offered by the Government.

Although current proposals for companies to store and retrieve Internet traffic for up to one year are voluntary, firms that ignore the rules could face legal action if proposals to change the legislation are made law.

ISP AOL revealed it had already spent $40m (£25m) on systems to retain its customers' data for three months, with storage costs adding an additional $40m a year.

This alone adds up to more than the £20m the UK Government is offering the whole of the ISP industry to fund the retention scheme over five years, MPs were told.

Industry experts have warned that the Government regulations will force ISPs to increase their charges to cover their compliance costs.

Proposals by law enforcement agencies to increase the retention period to 12 months would impose a heavier financial burden, said Camille De Stempel, AOL's public policy director.

"We would store IP addresses for around three months. That is something that suits our business, the security of our customers and law enforcement. Adding nine months is adding an enormous cost," she said.

Thus is a smaller ISP that will be affected by the regulations. It told MPs that its IT systems were capable of storing e-mail data for only two days to provide a back-up against system failures.

A dedicated system for storing data for law enforcement for a year would need a significant investment in technology and security, said Clive Feather, technology expert for the company.

ISPs called for the Government to abandon plans for a voluntary data retention code in favour of a compulsory scheme that would give the industry protection against challenges from its customers under data protection and human rights laws.

"A lot of people thought it should be voluntary but people are coming around to the idea of mandatory because it makes things simple. If ordered to disclose, then data protection would not apply," said Feather.

Data proposals
  • The Government and police want ISPs to store e-mail and Web traffic for 12 months

  • The ISP industry is being offered £20m over five years to cover the additional costs

  • Service provider AOL has already spent $40m (£25m) to retain its customers' data and expects to spend another $40m a year on storage

  • Industry experts said the compensation offered is not enough and predicted that ISPs will pass on costs to users.

Read more on IT risk management