Does the DIA log or not?

Forums › ICT Policies and Regulation › Does the DIA log or not?

bnapi

92 posts

Master Geek
Inactive user

#79153 14-Mar-2011 00:10

DIA deputy secretary for Regulation and Compliance
"Logging of some information for 30 days for trouble-shooting. No user-identifiable information is kept or recorded. Following the period of 30 days, all records relating to the filter are destroyed."

http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10633115

Techliberty
"You will see a message saying that access to the site has been banned. Your internet address will be logged. This will be able to be tracked back to your internet account."

http://techliberty.org.nz/issues/internet-filtering/filtering-faq/

I am confused as these sources of info contradict each other.
If a person accesses a blocked url and gets the DIA warning message is a person's ip address logged or not?
And if it is logged the DIA website says it will not be used for law enforcement purposes. Is this because people are viewing the DIA warning message placeholder site which does not contain any content from the blocked url?
If the ip address is not logged, what information is kept by the DIA if a person accesses a blocked url?

thomasbeagle

21 posts

Geek

Trusted

#448095 14-Mar-2011 07:08

It is our understanding that the DIA's internet filter does keep logs, including IP addresses, for some time. The DIA say that these logs are deleted periodically.

So there's really no inconsistency here. The DIA does log some information and then deletes it.

I will note that the DIA have always been quite insistent that the filter will not be used for enforcement purposes. However, one wonders what would happen if the Police got a warrant under the Telecommunications (Interception Capability) Act 2004 to seize the logs that they do have.

Thomas Beagle
Tech Liberty

freitasm

BDFL - Memuneh
79281 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#448100 14-Mar-2011 07:31

bnapi: And if it is logged the DIA website says it will not be used for law enforcement purposes. Is this because people are viewing the DIA warning message placeholder site which does not contain any content from the blocked url?

Probably not because of that, but because they already said the filter was to prevent people seeing those "by accident". So by saying that they now have a much harder time to prove someone is reaching those page accidentally.

Of course it's all about statistics. If someone would stumble upon one of these pages over a period of year, and someone else constantly hit those pages every day... Then it's easy to conclude what's going on - but still doesn't prove anything.

bnapi

92 posts

Master Geek
Inactive user

#448132 14-Mar-2011 10:06

I'm assuming no one from the DIA posts here on geekzone so how would I submit an official information act request to the DIA? Their website has some emails on it but no email addresses for official information act requests. I'm assuming they won't reply to me so how long should I wait with no reply from the DIA before informing the ombudsman?

thomasbeagle

21 posts

Geek

Trusted

#448150 14-Mar-2011 10:44

To submit an OIA request to the DIA about the filter:

Write to Steve O'Brien, Manager Censorship Compliance, PO Box 805, Wellington.

There is no need to format an OIA request in any particular way, nor do you have to mention that it is an OIA request (all requests for information to government depts are handled under the OIA).

Before writing you may want to start by having a look at the information posted on the Tech Liberty site ( http://techliberty.org.nz/category/filtering/ ) and the DIA's site ( http://www.dia.govt.nz/diawebsite.nsf/wpg_URL/Services-Censorship-Compliance-Digital-Child-Exploitation-Filtering-System?OpenDocument ).

The Tech Liberty site also includes some examples of letters/answers to the DIA, including the report from the Chief Ombudsman that the DIA does not have to release the list of blocked sites. http://techliberty.org.nz/internet-filter-list-to-be-kept-secret/

Some advice: ask your questions in a clear and answerable way. If you're not sure what to ask for, you can ask about what sort of documents and other material they do have. Ask for copies of reports and so on.

(P.S. Is it sad that I know their PO Box address off by heart? :)

bnapi

92 posts

Master Geek
Inactive user

#448158 14-Mar-2011 11:10

Is it possible to send an OIA request via email and what is the email? I don't have a po box so if I want a reply from the DIA I would need to use my address which I do not want to do.

thomasbeagle

21 posts

Geek

Trusted

#448159 14-Mar-2011 11:12

From http://www.dia.govt.nz/Contact-us

censorship@dia.govt.nz

An OIA request via email is as valid as one by letter or phone.

bnapi

92 posts

Master Geek
Inactive user

#449080 17-Mar-2011 00:21

That was fast. I just got a reply from the DIA for my OIA request:

Thank you for your email of 15 March 2011 requesting information about the Department's website filtering system.

Below is the section from the Code of Practice related to the treatment of data by the website filtering system. The Code of Practice can be access by following this link: http://www.dia.govt.nz/pubforms.nsf/URL/DigitalChildExploitationFilteringSystem_FinalCodeOfPractice_January2010.pdf

6. Data

6.1          During the course of the filtering process the filtering system will log data related to the website requested, the identity of the ISP that the request was directed from, and the requester’s IP address.

6.2          The system will anonymise the IP address of each person requesting a website on the filtering list and no information enabling the identification of an individual will be stored.

6.3          The collection of data is necessary so that the system is able to be reviewed to ensure 24-hour, 365-day uptime, and no loss of business due to a technical glitch or fault, for ISPs who join the system.

6.4          The logs will be used to troubleshoot the connections between the Department’s system and the ISP.

6.5          Data shall not be used in support of any investigation or enforcement activity undertaken by the Department.

6.6          Data may be used for statistical and reporting purposes; for example to inform the Department of the level of demand in New Zealand for child sexual abuse images.

6.7          The logs will be kept for 30 days, which is the standard period for keeping logs for troubleshooting and is period consistent with Rule 9 of the Telecommunications Information Privacy Code 2003. At the end of this period the logs are then manually deleted and a record is made noting this.

In addition you have asked whether a person who has been blocked by the filtering system has broken New Zealand law and if not, why not? New Zealand law provides that it is a serious offence to possess child sexual abuse images with knowledge, or reasonable cause to believe, that they are objectionable. Where the website filtering system prevents access to a blocked website, the user does not possess the images in question. The Department has no way of determining whether an internet browser attempting to access that site is a deliberate act by the user or the result of a pop-up, a redirection or even a botnet.