• by Wendy Davis  @wendyndavis, February 23, 2009

Republican lawmakers have introduced legislation that would require Internet service providers to store information about users for at least two years.

Sponsors Rep. Lamar Smith (R-Texas) and Sen. John Cornyn (R-Texas) tout the measure as combating child pornography. But privacy advocates and civil rights watchdogs say the measure threatens people's privacy and creates potential security risks.

The proposed bill--the "Internet Stopping Adults Facilitating the Exploitation of Today's Youth Act," or Internet Safety Act (S. 436 in the Senate and H.R. 1076 in the House)--would apply to all providers of electronic communication and remote computing services, including cable companies and telecoms as well as coffee shops, airports, hotels and even individuals who set up Wi-Fi routers in their homes. Among other provisions, the measure would require the retention of "all records or other information pertaining to the identity of a user of a temporarily assigned network address the service assigns to that user."

Keeping that data would create a trail that could connect people to their prior Web activities. While federal law already requires Internet service providers and telephone companies to preserve some data at the request of the police, that law is only invoked when law enforcement authorities are already investigating a crime. By contrast, the new bill would require preservation of data about every Web user--and the vast majority of users are not under any specific investigation.

Cornyn contends that the bill will protect children. "While the Internet has generated many positive changes in the way we communicate and do business, its limitless nature offers anonymity that has opened the door to criminals looking to harm innocent children," he said in a statement.

But civil liberties advocates say there is no valid reason for the government to mandate that Internet service providers record everyone's Web activity. "It's a dreadful proposal," said Marc Rotenberg, executive director of the Electronic Privacy Information Center. "This is the definition of a fishing expedition before you know there are any fish," he said.

Rotenberg added that law enforcement authorities don't typically collect information unless they are gathering evidence about specific incidents. "This bill stands the principle of criminal investigation on its head," he said. "It might be much easier to pursue criminal investigations of all of us if we had to leave our front doors open every night for the police to walk through."

He added that retaining that information creates more opportunities for data to fall into the wrong hands, resulting in identity theft or other fraud. "Everything about privacy and security points to minimizing the amount of information retained."

Kevin Bankston, a senior attorney at the Electronic Frontier Foundation, also criticized the bill. "These data retention proposals unnecessarily threaten the privacy and anonymous speech rights of every Internet user, treating all of us as if we are criminals deserving of surveillance," he said.