number of EU users may react to the increased monitoring by using encrypted proxies
in non-EU countries to avoid local ISP surveillance, maybe to hide illegal activity but
maybe to hide legal but sensitive personal activity. The directive may encourage these
proxy users to route their connections through non-EU countries to avoid the data retention mandate altogether.
The net effect of this process may very well be that law enforcement has less access to
useful data. Likewise, smart users may proxy their data through autocratic countries
like China that are least likely to share data with EU countries to avoid monitoring
by another EU country compliant with the data retention directive. If enough users
resist monitoring through the use of proxies, ISPs will be pressured to try to block
such proxied traffic. If ISPs were to take this step, they would likely start an arms race
between proxy tools and proxy blocking tools analogous to the current arms race between malware and antivirus software (as has happened in China with its attempts to
block filtering circumvention tools). This arms race could further strain the network
through the same sort of knock-on effects of the malware arms race: users wanting to
avoid monitoring would become increasingly dependent on increasingly sophisticated
anonymizing tools and therefore become increasingly vulnerable to the developers of
such tools (some with good, some with bad intentions as with the current developers
of antivirus tools). We have already seen this process with music downloading tools,
which have become a vector for malware infections as the music industry has driven
them underground. 19
The popularity of tools that circumvent various sorts of filtering of music downloading tools points to the possibility that large numbers of users will attempt to route
around the monitoring, particularly if authorities brand illegal music downloading a
‘‘serious crime.’’ But users also have a tendency to accept gradual erosions of privacy
without resorting to resistance. 20 Even relatively small-scale usage of proxy tools could
have the strong effect of making those few users very susceptible to false suspicion by
law enforcement authorities. Given the widespread availability of proxying tools and
widespread publication of the EU data retention directive, it seems safe to assume that
many of the most serious criminals will use such tools, reducing the effectiveness of
the monitoring of such users. Internet service providers can use contextual information about connections to detect the use of proxies and will be tempted to track which
users are resisting monitoring. This possibility raises the risk that merely resisting monitoring will label a user as suspicious.
Server Surveillance
As with the network, the collection of data on Internet servers is highly concentrated
among a few big actors. Even though there are hundreds of millions of servers on the
Internet, a few large entities like Google, Yahoo, Facebook, and Wikipedia capture a
large proportion of Internet traffic. Virtually all these big sites collect data about their
The EU Data Retention Directive in an Era of Internet Surveillance
41
in non-EU countries to avoid local ISP surveillance, maybe to hide illegal activity but
maybe to hide legal but sensitive personal activity. The directive may encourage these
proxy users to route their connections through non-EU countries to avoid the data retention mandate altogether.
The net effect of this process may very well be that law enforcement has less access to
useful data. Likewise, smart users may proxy their data through autocratic countries
like China that are least likely to share data with EU countries to avoid monitoring
by another EU country compliant with the data retention directive. If enough users
resist monitoring through the use of proxies, ISPs will be pressured to try to block
such proxied traffic. If ISPs were to take this step, they would likely start an arms race
between proxy tools and proxy blocking tools analogous to the current arms race between malware and antivirus software (as has happened in China with its attempts to
block filtering circumvention tools). This arms race could further strain the network
through the same sort of knock-on effects of the malware arms race: users wanting to
avoid monitoring would become increasingly dependent on increasingly sophisticated
anonymizing tools and therefore become increasingly vulnerable to the developers of
such tools (some with good, some with bad intentions as with the current developers
of antivirus tools). We have already seen this process with music downloading tools,
which have become a vector for malware infections as the music industry has driven
them underground. 19
The popularity of tools that circumvent various sorts of filtering of music downloading tools points to the possibility that large numbers of users will attempt to route
around the monitoring, particularly if authorities brand illegal music downloading a
‘‘serious crime.’’ But users also have a tendency to accept gradual erosions of privacy
without resorting to resistance. 20 Even relatively small-scale usage of proxy tools could
have the strong effect of making those few users very susceptible to false suspicion by
law enforcement authorities. Given the widespread availability of proxying tools and
widespread publication of the EU data retention directive, it seems safe to assume that
many of the most serious criminals will use such tools, reducing the effectiveness of
the monitoring of such users. Internet service providers can use contextual information about connections to detect the use of proxies and will be tempted to track which
users are resisting monitoring. This possibility raises the risk that merely resisting monitoring will label a user as suspicious.
Server Surveillance
As with the network, the collection of data on Internet servers is highly concentrated
among a few big actors. Even though there are hundreds of millions of servers on the
Internet, a few large entities like Google, Yahoo, Facebook, and Wikipedia capture a
large proportion of Internet traffic. Virtually all these big sites collect data about their
The EU Data Retention Directive in an Era of Internet Surveillance
41