Data Retention From the police point of view Privacy vs Security Data Retention From the police point of view

Theory and practice What is the Theory and what is the Practice? Theory - if things should be, but not Practice - things are, but nobody knows why The ideal is, when Theory and Practice work together.

Some facts for background We have in Estonia active SIM-cards (ca 1 600 000) more than citizens (ca 1 300 000). Ca 90% citizens are using Internet. The telecommunication is already involved with all areas of our life. Almost in all criminal cases communication devices are used at some point. Some crimes have changed in nature, and telecommunication is more and more involved. Often there are no physical evidence any more, like it used to be. You can find traces only from the Internet - for instant frauds. Today it is even possible to rob a bank through the Internet. We have a lot of cases where all phases of the crime remain in the Internet (child pornography).

Some raised proposals for regulation of DR Retained data should only be used for investigation of serious crimes DR is only allowed when person is involved in crime or has criminal ties. Time for DR should be shorter. All those proposals will make police work more complicated. WHY???

Retained data should only be used for investigation of serious crimes There are a lot of crimes and minor offences that are commited using telecommunication devices or are commited against them, but these are not considered as serious crimes. Examples: Internet scams – somebody sells not existing goods in the internet, and collects money from simple-minded people. The amount of money per case is not big, it means – DATA IS NOT AVAILABLE. Group of youngsters are steeling mobilphones from elders and children. The cost of phones is small, violence was not great - DATA IS NOT AVAILABLE. BUT......

Retained data should only be used for investigation of serious crimes Community is very much concerned in cases which affect the sense of security and expectations to solve these cases are much higher than in cases where somebody stole 100 000 EUR from state. What should the police do?

DR is only allowed when person is involved in crime or has criminal ties. More than 50% of pedophiles and persons involved in child pornography don’t have any earlier criminal record. Usually community knows them as nice family members and not very rarely these people are well known in community. The same situation is with first level drug dealers on the street. They live and act as regular citizens. Do we need to let them continue untill we can prove their involment in crime and then start DR?

DR is only allowed when person is involved in crime or has criminal ties. Sometimes we need to start the investigation with collection of data of the victim. Example: Recent trend is, that young girls (13-15) sell themselves in the Internet to get „pocket money“. BUT THEY ARE VICTIMS, not criminals. For different reasons victims of violens or sexual abuse don´t tell us the truth or just leave out some important facts. We have to collect evidences without victims help, processing also victims data. Sometimes we need to know, who was close to victim during the crime (rape case), and where it happened. Again we need to process victims data.

Time for DR should be shorter. In Estonia the time for DR is one year. The oldest data (1 year) is needed only in serious crime cases – homicide, robbery, pedophile cases and etc, where in the beginning of investigation we usually don`t have any ideas who is the suspect. In pedophile cases we try to find as many victims as possible. Because these victims need help and they never come to ask it by themselves. Therefore in such cases we use all allowed data.

My opinion of the solution From Security side: No additional limitations for DR The data should be available for all crimes and misdemeanours which are commited using telecommunication devices or are commited against them. From Privacy side Better supervision of the retention and use of retained data. DR should be states responsibility, not service providers.

Thank you for attention Let Theory and Practice work together