ISP selling customer data 'shock' and 'shame'

 

Gallery

Posted on 7 Dec 2009 at 09:58

A detailed document describing the information Yahoo! can provide to law enforcement, including the prices it charges to do so, has been leaked onto the web.

The internet company has issued the Cryptome.org website with a Digital Millennium Copyright Act (DMCA) take-down notice to force its removal, although the PDF document remains online at the time of writing.

Yahoo! claims that publishing the document is in breach of copyright, while Cryptome's owner John Young replied that "it provides information that is in the public interest about Yahoo's contradictory privacy policy and should remain a topic of public debate on ISP unacknowledged spying complicity with officials for lucrative fees."

Early last week student Christopher Soghoian used the Freedom of Information Act to request that US legal agencies release price lists supplied to them by ISPs and telecoms companies for the provision of intelligence on service subscribers. Yahoo! objected, along with telecoms firm Verizon, claiming that the information released to this individual would be used to "shame" the company and "shock" its customers.

The document itself is not quite as shocking as you might think, given Yahoo!'s stiff reaction (which was almost guaranteed to draw more attention to the document). Reimbursement to companies for providing subscriber data is made according to Federal law, and Yahoo! makes an exception in certain cases, not requiring payment for information relating to abduction or exploitation of children. Typical (Yahoo!) costs applied to complying with law enforcement requests are listed as follows:

Basic subscriber records - $20 for first ID, $10 per ID thereafter
Basic Groups information (including details of moderators) - $20 per group with single moderator
Subscriber account contents (including email) - $30 - $40 per user
Contents of Groups - $40 - $80 per group

It is interesting to note how long Yahoo! stores certain types of information. Users of its Flickr photo service might be reassured to know that all of their data is deleted as soon as they deactivate their accounts. Neither does the company hold onto deleted email messages. However, web-based chat logs (but not those generated by the executable IM client) are archived for 45 to 60 days under certain circumstances and the contents of Groups web forums are always available, as well as being saved for at least 30 days after the Group has been terminated.

Account login details are saved for up to one year while the IP address used to register an account could be stored indefinitely. The company claims that records go back to 1999.

Author: Simon Edwards