+I and Legality

nenolod · Idler Joined: 23 Jan 2004 Posts: 334 Location: A box!

With all of this talk of +I lately, I have decided to do some research on the topic.

+I qualifies as wiretapping, under US law, and is thus illegal even on private systems (yes! private systems included! Some company just got sued for snooping on phone conversations via their corporate PBX, so yes, wiretapping is not allowed on private systems.).

In addition, vendors providing tools for wiretapping to non-government contacts are violating yet another law. This means that +I patches could be potentially illegal in the US, and that developing them could be classified as illegal as well.

So, the topic for this thread is: "What laws in other countries do you feel would be relative to +I?"

Arguments can be made either way, either in favour of +I or not in favour.

After all, if we're going to bicker about +I, lets do it in some sort of intellectually stimulating manner other than "lolz +I suks cuz they can wch mi cybar the other irc cop for free o:linez."

- nenolod

FuRiOuS · Lurker Joined: 01 Feb 2006 Posts: 244

From a legal perspective I have nothing to add at this point, however I think this is a much better topic than simple slamming +I and those who create it.

GXTi · none Joined: 06 Mar 2004 Posts: 1

You could argue that by connecting to an UnrealIRCd server, you forfeit your right to privacy or any other expectations of fair oper practice. It isn't wiretapping if the victim has no expectation of privacy, and I'm only half-joking about this...

FuRiOuS · Lurker Joined: 01 Feb 2006 Posts: 244

braindigitalis · Idler Joined: 22 Sep 2003 Posts: 443 Location: IRC

Have you noticed that when you call a technical support line or sales line, they say:

"Calls may be recorded for training purposes"

This is the reason.

If you put in your Message of the day:

"Your PRIVATE messages and PUBLIC messages may be monitored or logged in real time for security purposes", would you expect to keep many users?

FuRiOuS · Lurker Joined: 01 Feb 2006 Posts: 244

upinsmoke · Posted: May 11, 2006 1:40pm Post subject:

i am not a lawyer but heres 2 quick sections of the ELECTRONIC COMMUNICATIONS PRIVACY ACT, which can be found here
http://floridalawfirm.com/privacy.html

braindigitalis · Idler Joined: 22 Sep 2003 Posts: 443 Location: IRC

magpie · Idler Joined: 18 Jan 2004 Posts: 454 Location: Essex, UK

I disagree with your assessment of the last point. To me that says that all you are allowed to do is record the fact that a user connected to your server ,or typed some text, at a specific point in time.

However, I'd say all of this is a grey area and none of us here (unless there happens to be a lawer versed in international law - specifically that with regards to telecommunications) are qualified to judge the legality.

EDIT: Gah, brain managed to post before I did. :P

upinsmoke · Posted: May 11, 2006 1:59pm Post subject:

Scire · Newbie Joined: 14 Apr 2006 Posts: 84 Location: IRC

braindigitalis · Idler Joined: 22 Sep 2003 Posts: 443 Location: IRC

Just to point out that depending on your country, other laws may be in effect. Usually you have to abide by the laws where your server is hosted i believe.

Take for example the UK, there is what is known as the data protection act. While not an act forbidding monitoring per se, it has the following basic rules:

Data gathered about individuals must be up to date, accurate, secure and confidential, and a user can request it be updated or removed from a database at any time with nothing more than written notice.

This means that if you live in the uk, and you log private chats, these could be considered data about individuals.

Therefore, it is illegal to give this data to any unauthorized person(s), it is illegal to keep this data if it is no longer relevent (up to date) or is no longer accurate, and if the user asks for it not to be stored or used then you must comply, or you are then breaking the law -- remember you are not the police and you have no legal right to keep this data.

Before anyone comes up with "well, how do you know this, are you a lawyer" no im not, but just about every IT professional in the UK is made aware of the data protection act and it is one of the basic things we must all know the details of to conduct IT related business in this country. I suggest that everyone "Chatter Emptor" (Chatter beware Wink

) and double check on all local laws before trying anything like spying on users, with or without prior announcement that you are doing so!

magpie · Idler Joined: 18 Jan 2004 Posts: 454 Location: Essex, UK

Hmm, I think I'm going to have to dig out the actual act and have a read. On the face of it I'm not sure it's immediately obvious how it applies to logged IRC conversations, particularly because you don't necessarily have any additional information that ties it to an individual.

Also, it's worth noting that an entity is allowed to charge a reasonable fee for sending you all the data they hold about you. So if somebody asks you for your logs, you know what to do. :)

braindigitalis · Idler Joined: 22 Sep 2003 Posts: 443 Location: IRC

magpie · Idler Joined: 18 Jan 2004 Posts: 454 Location: Essex, UK

The following is a quote from the website of the Information Commissioner's Office:

"If you are an individual and you hold information about others, but only do so for personal, family or household reasons (including recreational purposes) then neither the Data Protection Act 1998 (DPA) nor the Freedom of Information Act 2000 (FOIA) impose any legal obligations on you."