[cooperation-wg] Prism

In message <48096A22-98BD-49F3-8D80-713070256165 at frobbit.se>, at 
21:26:22 on Sun, 30 Jun 2013, Patrik Fältström <paf at frobbit.se> writes
>In the paper I wrote that was not accepted I explained exactly what Lars-Johan explain above, and concluded that as SMTP and IMAP connections
>are involved data about the messages will be retained.
>
>I.e. webmail consists of one "web" transaction between client and web server, and one email transaction from the web server to the mail server.
>If now mail is to be retained the mail transaction has to be retained. As web transactions are not to be retained that leg should and will not
>be retained -- even if it is a web transaction that as a result will generate email.

Whereas I am suggesting that a suitable compromise would be to retain 
the details of transactions between client and 
web-servers-known-to-be-mail-systems. Like Hotmail, Gmail and so on.

>That was not acceptable by the parties that to me obviously where not happy with the result during the discussions in the European Parliament
>where it to be at least was clear that web should not be retained.
>
>And I get somewhat bad taste in my mount when I heard people after decision is taken in the European Parliament that web is not to be retained
>still try to retain "some" web transactions.

I don't think that an "Internet e-mail service" should be excluded 
simply because it takes place on port 25. They are only very tenuously 
"web" transactions[1] anyway, rather than http[s] transactions.

And no, this isn't splitting hairs, it's trying to assert some clarity 
in the terminology. The lack of clarity isn't helped by organisations 
like the BBC constantly inviting viewers to "email us via our website". 
By which they mean fill in a web form, which might or might not then get 
successfully emailed to someone inside the BBC by the web server.

NB. In this context, I'm not advocating logging and retaining which 
pages at http://news.bbc.co.uk people browse to, although I know some 
people who would, especially if it's http://www.howtomakeabomb.com

ps The reason I'm especially interested in this is that the list of data 
types in Article 5 is partly based on some work I did in 2001 (and 
subsequent pre-Directive Data Retention laws in the UK).

[1] I can't remember the last time I clicked on a hyperlink pointing to 
www.gmail.com, it's either an app on my Windows task bar, a different 
app on my Android phone, or a parameter entered into my POP3 client 
(yes, you can access gmail by POP3 too, as I'm sure you know; and why 
does the access protocol make any difference to whether the transaction 
should be logged/retained, either in terms of common sense, or what it 
says in the directive?)
-- 
Roland Perry