Blogaria

I suspect that Yahoo are eager to do business in China, which they see as one big emerging market, and hence are forced to comply with local regulations. The sentencing of the two bloggers is harsh and conter-democratic, we will all agree - but did Yahoo do anything wrong, in the strict sense of the applicable law? I don't know.

And neither do the US authorities. Yahoo were summoned to a hearing in Washington DC, where two of their US-based executives were put to the test: could Yahoo have known what the Chinese authorities were going to do to the two bloggers, as they were turning over the identity data? If so, could they have avoided handing over the data? Could they have complied with the Chinese regulations in a "less strict" way? What does that mean, "yeah, comply with the Chinese authorities, but feed them bullshit"?

It's a strange world. Yahoo and other companies are required by law to retain data, and are required to turn over such data to the authorities when requested to do so. However, it appears that there are exceptions to this rule:

• The rule doesn't need to be adhered to strictly when applied to foreign governments.
• Actions that follow from this rule will come under scrutiny when the public outcry is loud enough.

So as I'm surfing the web, making phone calls, and doing all sorts of things, I'm leaving a trail of data. I consider such data very personal: they are my actions, which are private. If you want to know what I did and when, ask me - and if I think you're entitled to know, then I'll tell you. This doesn't work the other way 'round! You're not entitled to dig through my personal data to see if you can find anything that's of interest to you, whether your interest has a legal perspective, a commercial perspective or whatever. It's a matter of principle.

So, which organisations can I trust to handle my data trail in a careful and responsible way? The Dutch state? The European Union? The Chinese or US authorities? My telecom provider? My ISP?

My data trail is just too wide and too fragmented to enumerate whom I can trust and whom not. As far as I'm concerned, there is only simple common sense here: don't retain my data!

Here's how I think it should work.

• To my telecom provider: "When my mobile phone connects to some ground station, don't store such data on a per-connection basis. If you need to know the load of a given ground station, use a counter - not separate connectivity entries that are later analyzed."
• To my ISP: "Don't store my IP address with the URL's I visit. Don't store the mail headers of my incoming or outgoing mail. You don't need such data. If you bill me for bandwidth usage, simply store counts of upstream and downstream transfers."
• To my forum site operator, where I regularly post: "Don't store my IP address. I know you need some measure to block addresses when people post offensive material, but you can achieve this by storing e.g. a SHA-2048 hash of the IP address. This can be checked when someone connects to the forum, but a posteriori it is harder to reverse this to a physical address. If a forum entry isn't flagged offensive for say 3 days, then remove the associated data where the hash of the poster is stated."
• To my authorities: "Don't force my telecom provider, ISP, forum operator and others to store my private data. There is no guarantee that they are trustworthy. Even if we all agree that they're OK today, who knows how they will be in say 5 years from now? If you need to investigate me for e.g. illegal activities, get a court order, and start tapping my actions. Avoid situations where investigations can be run by sifting through existing data."
• To all of the above: "Rethink your point of view. At the moment it's OK to store private data, as long as you do it in a 'secure' way (whatever that may be - usually you have to appear to be making some effort so that the data don't get out on the street). That's not the way to look at this matter: rather, storing data should not occur unless absolutely necessary (e.g. my bank needs to know who I am). In all other situations, storing private data should be discouraged and even illegal!"