Hold On To Your Routing Tables!

Posted by Claude Aiken on Mar 2, 2009 in Breaking News, Tech Law | 0 comments

A bill has been introduced concurrently in the House and Senate for the laudable purpose of combatting the distribution of child pornography on the internet.  However, as is sometimes the case with bills addressing the realm of technology, some of the terms could be a little on the broad side.  There have been some posts this past week alleging that the bill would require Joe Coffee Shop Owner to retain the routing data on his old Linksys router for 2 years or face criminal prosecution.  Julian Sanchez at Ars Technica repudiates the scope of the outcry.  Which side is right?

The hubub is about this particular section of the bill:

Retention of Certain Records and Information- A provider of an electronic communication service or remote computing service shall retain for a period of at least two years all records or other information pertaining to the identity of a user of a temporarily assigned network address the service assigns to that user.

Now, electronic communication service and remote computing service are terms that are defined elsewhere in the U.S. Code.  ECS, particularly has a very broad definition, i.e. “any service which provides to users thereof the ability to send or receive wire or electronic communications”.   Currently, there are a host of laws applying to ECS providers – among others the Wiretap Act, the Pen Register/Trap Act, and the one that started it all, the Electronic Communications Privacy Act.  All, broadly speaking, deal with privacy, interception, and disclosure of electronic communications.

The DOJ Cybercrime manual provides a pretty decent overview of what it means to be a provider of ECS (and an interesting look as to how opinions about the issue change over time), although the legislative history on the actual term itself is pretty hazy.  Courts have gone either way on the issue, sometimes holding that incidental providers of ECS, like businesses that provide internet access to their employees, are providers and sometimes not.

Ultimately, it is sufficiently ambiguous to go either way.  Given how cybercrime statutes can sometimes be used in novel ways (e.g., Lori Drew), there is a non-zero chance that a statute like this could be enforced against an unlikely suspect.