Last week the U.S. joined the
Council of Europe Convention on Cybercrime. The Convention was ratified by the Council of Europe in 2001 and covers a lot of ground. In the U.S., there has been a lot of debate about whether the Convention will lead to an increase in requests from foreign law enforcement entities for data from U.S. companies. What I find interesting in the Convention, is that it contains a significant number of data retention and requirements for "expedited" production of electronic data. As I noted in my
July 2006 column in the WHIR, and in my last post, there is a great deal of legislative and law enforcement activity taking place around information collection. This area, more than any other compliance area, should be followed closely by hosts (and other Internet infrastructure providers). It is highly likely that in the very near future, you will be required to keep session ids, IP logs and other information for a fixed period of time. Keep this in mind over the next year as you're structuring and configuring your network as well as acquiring new hardware.
