Police: Internet providers must keep user logs
Law enforcement representatives are planning to endorse a proposed federal law that would require Internet service providers to store logs about their customers for 18 months, CNET has learned. — The National Sheriffs' Association will say it …
Context & Ripple Effects
The endorsement is the latest step in a lobbying arc that began when Congress first weighed a bill forcing ISPs to retain user data for two years in February 2009, followed by the FBI's 2010 request for records of Web sites visited and the Justice Department's January 2011 call for mandatory retention. What changed this week is who is speaking: the National Sheriffs' Association, a law enforcement trade group rather than a federal agency, is putting its weight behind the mandate — and at a shorter, more politically sellable window of 18 months.
The narrowing from two years toward 18 months suggests the proposal is being calibrated for passage, coming just two months after the DOJ asked that the requirement be extended to wireless providers — meaning the scope of who must store logs, not just how long, is expanding alongside the endorsement.
First-order effects
- Internet service providers would become legally obligated custodians of 18 months of customer logs, converting what is today a variable business practice into a uniform compliance cost regardless of company size.
- The National Sheriffs' Association's endorsement hands the bill a grassroots law-enforcement constituency that the Justice Department alone could not supply, strengthening its odds in congressional hearings.
Second-order effects
- Wireless carriers, already targeted by the DOJ in May 2011, would face the same storage burden, pulling mobile broadband operators into a compliance regime originally framed around wired ISPs.
- Retained logs become a standing evidentiary trove: every ISP turns into a searchable archive for subpoenas, shifting litigation and investigation strategy toward data that previously was never kept.
Third-order effects
- If the U.S. mandate passes, it aligns American practice with the retention regimes already debated abroad, normalizing the idea that network operators are de facto arms of criminal investigation infrastructure.
- Small and regional providers, least able to absorb logging infrastructure, would face pressure to consolidate or outsource network operations to larger players that can spread the compliance cost.
The trend: Law enforcement agencies are steadily converting ISP data practices from voluntary business choices into statutory retention mandates, with each successive proposal adjusting the duration and widening the class of covered providers.