Congress targets social-networking sites

Lawmakers have been trying to get ISPs to retain data on customers. Now Congress is turning to sites like MySpace.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
4 min read
The concept of forcing companies to record information about their users' Internet activities to aid in future criminal prosecutions took another twist this week.

Rep. Diana DeGette, a Colorado Democrat, originally proposed legislation (click here for PDF) in April that would require Internet service providers to retain activity logs to aid in criminal investigations, including ones involving child abuse.

Now DeGette and some of her colleagues in the House of Representatives are suggesting that social-networking sites should be required to do the same thing.

"How much would it cost your company to preserve those IP addresses?" DeGette asked at a hearing on Wednesday that included representatives from Facebook, Xanga and Fox Interactive Media, the parent company of MySpace. "You're going to store the data indefinitely?"

An IP address is a unique four-byte address used to communicate with a device on a computer network that relies on the Internet Protocol. An IP address associated with CNET.com, for instance, is

Michael Angus, executive vice president of Fox Interactive Media, said he agrees with the idea of data retention for MySpace. "As a media company, Fox is very committed to data retention," Angus said. "It helps us police piracy."

Rep. John Dingell, a Michigan Democrat, added: "Why can't data that links IP addresses to physical addresses be stored longer?"

The concept of mandatory data retention was pioneered by the European Union, which approved such a requirement for Internet, telephone and voice over Internet Protocol (VoIP) providers last December. A few months later, the Bush administration endorsed the idea, with Attorney General Alberto Gonzales calling it "an issue that must be addressed" and--as first reported by CNET News.com--following up in private meetings with Internet providers.

In those meetings, Justice Department representatives went beyond the argument that data retention was necessary to protect children--and claimed it would aid in terrorism investigations as well.

During Wednesday's hearing, politicians also claimed that social-networking sites were not doing enough to verify that their users who claimed to be a certain age were telling the truth. (Recent news reports have said that sex predators are using MySpace and similar sites to meet up with teens.)

"There is more you can do," DeGette said. "You can do algorithms that will go beyond just the date of birth that they register, to start to weed out some of the underage users." She also called for the companies to participate in a "national public service program" to distribute an educational video.

Two paths for data retention
Data retention legislation could follow one of two approaches, and it's not entirely clear which one U.S. politicians will choose.

One form could require Internet providers and social-networking sites to record for a fixed time, perhaps one or two years, which IP address is assigned to which user. The other would be far broader, requiring companies to record data such as the identities of e-mail correspondents, logs of who sent and received instant messages (but not the content of those communications), and the addresses of Web pages visited.

Earlier in the week, Internet companies tried to forestall potentially intrusive new federal laws by launching a campaign against child pornography designed to tip off police to illegal images. Participants include AOL, EarthLink, Microsoft, United Online and Yahoo.

In addition, Comcast announced that it will begin to retain logs that map IP addresses to user identities for 180 days, up from its current policy of 31 days. (The company stressed that it does not record information such as "Internet use or Web surfing habits.")

But Rep. Joe Barton, the Texas Republican who heads the Energy and Commerce Committee, said even after hearing the news, that he still wanted to enact "a comprehensive anti-child-pornography" law. "I think the Congress is tired of talking about it," Barton said, adding that it was time to "protect our children against these despicable child predators that are on the loose right now in our land."

Barton has not released details about his legislation.

This isn't the first time that MySpace and social-networking sites have faced criticism from politicians--and the threat of new federal laws.

A bill introduced last month by Rep. Michael Fitzpatrick, a Pennsylvania Republican, would cordon off access to commercial Web sites that let users create public "Web pages or profiles" and also offer a discussion board, chat room or e-mail service. It would affect most schools and libraries, which would be required to render those Web sites inaccessible to minors, an age group that includes some of the category's most ardent users.

In addition, politicians proposed a slew of related measures this week, including blocking access to off-color Web sites for all Americans, dispatching "search and destroy" bots that would seek out illegal content, regulating search engines and targeting peer-to-peer networks.