Presentation held by ISPA secretary general M. Schubert at European Forum Alpbach 2012

1. „between a rock and a hard place“
Maximilian Schubert
21.08.2012, EFA 2012 - Alpbach

2. Overview
About ISPA
Implementation Data Retention Directive
Official Requests for Information by LEA
Outlook & Future Challenges

3. About ISPA
• Founded 1997
• Approximately 200 members from the fields of
access, hosting, content, services etc.
– 75 % purely Austrian companies
– 25 % are part of international organizations
– Two thirds of members have up to 25 employees
– 50% more than € 1 Mio. annual turnover
– Customer structure
60% mainly business customers
10% mainly private customers
30% both

4. ISPA’s mission statement
„ISPA is the Austrian association of Internet
Service Providers, representing approximately
200 ISPs. ISPA is the major voice of the Austrian
Internet industry. Our goal is to shape the
economic and legal framework supporting optimal
growth of the Internet and Internet services. We
regard the use of the Internet as an important
cultural skill and acknowledge the resulting socio-
political responsibilities.”

5. Stopline.at
- an International Success Story -
ISPA founded Stopline.at, the Austrian internet hotline for
• Child Pornography
– § 207 a StGB (Austrian Penalty Act)
• National Socialist (‘Nazi’) Offences
– VerbotsG, Abzeichengesetz
Reports are handled anonymously, no feedback is provided.
“Deletion instead of
blocking & filtering”

6. Stopline - workflow

7. Number of illegal content found remains
relatively stable
6000
5000
4000
3000
2000
1000
0
2009 2010 2011
2006 2007 2008
2003 2004 2005
2000 2001 2002
1999
Potentially illegal reports Incoming reports

8. Some numbers
More than 21.000 reports since 1998; continuous increase,
most likely due to increased awareness.
● Approx. 16% of all reports refer to obviously illegal content
● Approx. 95% of valid reports refer to child pornography
● Approx. 5% of valid reports refer to national socialist offences
In 2011 in only one case illegal content
was found to be hosted by an Austrian ISP.

9. Overview
About ISPA
Implementation Data Retention Directive
Official Requests for Information by LEA
Outlook & Future Challenges

10. Timeframe for the implementation
2006 2007 2008 2009 2010 2011 2012
t
2006 Feb 2009 Dec 2011
Enactment of Assignment of a Publication of
DR-Directive Human Rights Institute first tech. spec.
2007 Nov 2009 May 2011 1st April 2012
Failure of the 1st Draft of revised Enactment of commencement
implementation Telecommunications national acts of retention duty
Act (TKG)
July 2010 30th of March 2012
ECJ: Infringement Enactment of decree for
of EU law reimbursement of costs
late March 2012
planned go-live of the
data exchange interface
(“Durchlaufstelle”; DLS)

11. Data Retention in Austria - Factsheet
• Retention of traffic data, no content data
(Access-IP, mobile communication, Email)
• Retention for a maximum period of six month
• Access to retained data only for criminal offences
• Exceptions for small ISPs and certain technologies
(approx. EUR 300.000 yearly turnover, public ISPs, NAT/PAT)
• Data remains with the IPS, exchange interface (DLS)
and use of CSV-Files to prevent data mining
• No “ex ante” safeguards for lawyers, doctors, etc.

12. ISPA actively participated in the
implementation
ISPA helped to scope an interface (DLS) which
facilitates the secure and transparent exchange of
information (CSV-File), while providing a high level of
security and transparency.
DLS could provide information on the
total number of requests for
information!

13. Data Retention in Austria
- Summary -
The Good
• Legal definition of “dynamic”-IP-Adr
• High degree of security through DLS
The Bad
• Very incoherent legal framework & numerous delays
The Ugly
• No requirements for judicial decree & no minimum
sentence required for most important cases (e.g. IP-Adr.)
• Incomplete statistics

14. Overview
About ISPA
Implementation Data Retention Directive
Official Requests for Information by LEA
Outlook & Future Challenges

15. Cooperation with LEA:
continuous improvement
• Numerous and lengthy legal disputes concerning “dynamic
IP-addresses” within last couple of years.
• Reference by the Austrian Supreme Court (OGH) to the
European Court of Justice on this matter
• Clarification through adaption of the Austrian
Telecommunications Act §92 Par 3 Z 16 TKG
 ISPA position paper and sample answers provide
guidance for ISPs and LEAs.

16. ISPA supports members and LEAs
• formal requirements (e.g. request in writing)
• substantial requirements (within 48hrs, continuing danger)

17. Requests for information under
Austrian Law – legal environment
• Requests for information can be
based on different legal grounds
- Telecommunications Act 2003 (TKG)
- Security Police Act (SPG)
- Criminal Procedure Act (StPO)
- eCommerce Act (eCommG)
- Federal Act Against Unfair Competition (UWG)

18. Overview
About ISPA
Implementation Data Retention Directive
Official Requests for Information by LEA
Outlook & Future Challenges

19. Future challenges for ISPs
- Intermediary Liability -
Directive 2000/31/EC 'Directive on electronic commerce'
Article 14
Hosting
1. Where an information society service is provided that consists of the storage of
information provided by a recipient of the service, Member States shall ensure
that the service provider is not liable for the information stored at the
request of a recipient of the service, on condition that:
(a) the provider does not have actual knowledge of illegal activity or information and,
as regards claims for damages, is not aware of facts or circumstances from
which the illegal activity or information is apparent; or
(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously
to remove or to disable access to the information.

20. Future challenges for ISPs
- ACTA et al -
Anti-Counterfeiting Trade Agreement - ACTA [3.12.2011]
Art 27
ENFORCEMENT IN THE DIGITAL ENVIRONMENT
2. Further to paragraph 1, each Party’s enforcement procedures shall apply to
infringement of copyright or related rights over digital networks, which may
include the unlawful use of means of widespread distribution for infringing
purposes. These procedures shall be implemented in a manner that avoids the
creation of barriers to legitimate activity, including electronic commerce, and,
consistent with that Party’s law, preserves fundamental principles such as
freedom of expression, fair process, and privacy.1
1Forinstance, without prejudice to a Party’s law, adopting or maintaining a
regime providing for limitations on the liability of, or on the remedies available
against, online service providers while preserving the legitimate interests of right
holder.

21. Future challenges for ISPs
- Net Neutrality -
Net Neutrality
vs.
Network Management

22. Future challenges for ISPs
- Net Neutrality -
Net Neutrality
vs.
Network Management

23. Future challenges for ISPs
- Privacy -

24. Future challenges for ISPs
● Continuous improvement of awareness
about the safe use of the Internet
(e.g. Stopline.at, saferinternet.at)
● Efforts to reduce legal uncertainty as to the
liability of ISPs for illegal conduct by their
customers
● Contribution to the discussion on copyright and
its enforcement

25. Contact details:
Email: maximilian.schubert@ispa.at
Phone: +43 1 409 55 76
Web: www.ispa.at

26. BACKUP
BACK UP

27. BACKUP
NAT/PAT

28. Explanation: NAT/PAT
internal IP: 10.xxx.xx1
internal IP: 10.xxx.xx2
Ports Öffentliche POOLADRESSEN
10.xxx.xx7
Port_a IP_a_194.xxx.xxx.xxa 10.xxx.xx1
Port_b IP_b_194.xxx.xxx.xxb 10.xxx.xx2
Port_c IP_c_194.xxx.xxx.xxc 10.xxx.xx3
Port_xy IP_xy_194.xxx.xxx.xxd 10.xxx.xx4
PAT NAT internal IP: 10.xxx.xx3
Public IP 194.xxx.xxx.xxb Port a
Internal IP: 10.xxx.xx5
Public IP 194.xxx.xxx.xxb Port b Ports differ
Public IP 194.xxx.xxx.xxb Port c internal IP: 10.xxx.xx1
IP-Adr. identical

29. Explanation: NAT/PAT
Even after the implementation of the data retention Directive in
Austria ISPs are not under the obligation to store internal IP: 10.xxx.xx1
NAT (internal
IP addresses) and PAT (Port) information, as such information
also had not been stored before the implementation.
internal IP: 10.xxx.xx2
Ports Öffentliche POOLADRESSEN
10.xxx.xx7
Port_a IP_a_194.xxx.xxx.xxa 10.xxx.xx1
Port_b IP_b_194.xxx.xxx.xxb 10.xxx.xx2
Port_c IP_c_194.xxx.xxx.xxc 10.xxx.xx3
Port_xy IP_xy_194.xxx.xxx.xxd 10.xxx.xx4
PAT NAT internal IP: 10.xxx.xx3
Requests must not be answered by the ISP, if the information
Public IP 194.xxx.xxx.xxb Port a
provided would identify a “larger number” of subscribers Internal IP: 10.xxx.xx5
Ports differ
(“größere Anzahl” von TeilnehmerInnen).
Public IP 194.xxx.xxx.xxb Port b
Public IP 194.xxx.xxx.xxb Port c internal IP: 10.xxx.xx1
IP-Adr. identical