The short and long term future of the Cuban Internet

I gave a talk on the short and long term future of the Cuban Internet at the Conference of the Association for the Study of the Cuban Economy.

For the short run, I talked about things that are announced and underway -- expansion of public access and connecting schools, universities and homes as well as the possibility of satellite as an unlikely, but feasible means of interim connectivity.

I pointed out several characteristics of these short run projects -- they rely on a backbone network, China has been the preferred vendor nation so far and the quantity and quality of connectivity are far short of what we experience in developed nations. Even with the currently planned expansion, the Cuban Internet will remain in the 1990s.

For the long term, I pointed out that Cuba has the opportunity to skip technology generations and consider things like low-earth orbiting satellite, 5G wireless and advances in short range wireless.

That being said, long run policies regarding infrastructure ownership and regulation are more important than long run technology options. I suggested several ownership/regulation paradigms found around the world today and I encourage Cuba to consider them carefully.

In the middle of the talk, I took a brief digression to point out that two of the presenters in my session had been instrumental in bringing the Internet to Cuba and a third pioneer was in the audience.

When does the "long term" begin? It's a vague term, but by 2020 we will have a new Cuban government, the US embargo may be history and the Cuban economy will hopefully have improved significantly. Cuba should be in a better position to build a modern Internet by then.

The presentation consists of 26 slides in the style I prefer -- an image with a few words, accompanied by notes and annotation. The annotation both explains the point the slide is making and provides links to sources and more information. You can download the PowerPoint presentation here.

Here are a couple of the slides:

Cuban ICT statistics report for 2014

Cuba's National Office of Statistics and Information (ONEI) has released their annual report of selected information and communication technology (ICT) indicators, including the following table of physical indicators:

They report that the number of Internet users is over 3 million, but must be including people who access the domestic intranet in that total. There are only 533,900 connected computers, so each one is shared by around 5.6 people. Not only are the users sharing computers, the connections are much slower than we are used to in developing nations. (I don't know how they count smart phone access).

It's also interesting to look at percent changes over time:

We see that the percent of the population with cell coverage has been nearly unchanged since 2010 and completely unchanged since 2012. Evidently, they are no longer expanding the 2G cell network. Presumably, the next deployment will be 4 or 5G. The number of cell phones is growing, but they do not differentiate between modern smart phone/computers and 2G flip and candy-bar phones. Growth in the number of .cu domain names has slowed compared to last year, but it is still substantial, indicating increasing organizational use.

Growth in the number of computers and the number of phone minutes has slowed relative to last year:

Both may be related to the Internet -- people are buying smart phones instead of computers and using Internet applications to make voice over IP calls.

Finally, ONEI reported that there are 1,264,817 fixed phone lines, of which 967,963 are residential. That puts the goal of having DSL service available to 50% of Cuban homes by 2020 in perspective. In addition to installing DSL equipment in central offices, many of these phone lines may have to be upgraded. The number of central offices increased from to 688 to 740 -- perhaps the new ones are already equipped for DSL service.

You can see coverage of previous ONEI ICT reports here.

Leaked documents

Carlos Alberto Pérez publishes leaks -- "Chirileaks" -- on his blog La Chringa de Cuba. Two leaks pertaining to the Internet were one on Cuba's national broadband plan and another on ETECSA's plan for home connectivity.

Cuba is not known for kindness to dissidents, so one wonders why Pérez still has his job, not to mention his freedom. The answer might be that these are intentional leaks -- letting the world and the Cuban people know that Cuba is paying attention to the Internet and plans to improve things. Cuba has declared the Internet a priority and these leaks lend credence to that claim.

Anonymous quotes, "trial balloons" and government leaks are common in the US and Cuba may be doing the same. Regardless, Pérez is giving us interesting information and I hope the Chirileaks keep coming.

Speculation on the Cuban Internet backbone

Since the earliest days of the Internet, Cuba has stressed geographically distributed connectivity, unlike most developing nations, which focused on one or a few large cities. That policy is still in effect. There are plans to connect universities, schools and homes and there are already public WiFi hotspots and and Internet-access rooms in every province. (Of the original 118 public access rooms, only 12 were in Havana).

A backbone network covering the length of the island is necessary to achieve such geographically dispersed connectivity and, since essentially all of Cuba's international traffic is now routed over the undersea cable connection at the east end of the island, there must already be a backbone network connecting the provinces. The provision of 1 mbps international connectivity at the new WiFi hotspots is further evidence of a backbone.

I know nothing of the architecture or technology (fiber and wireless?) of today's backbone, but the load is very light compared to a future with planned traffic from homes, schools, universities and public access locations, so Cuba must be planning a high speed backbone.

We got a very hazy view of that plan in a Cuban market research study, which was just published by Nearshore America. The report includes diagrams of the three-phase backbone plan shown below:

These diagrams are attributed to ETECSA, but they have been substantially redrawn to protect the identity of the person who supplied them. While the legend on each slide shows 2 fixed and 9 reconfigurable multiplexers, I suspect that refers to the final phase. Similarly, I am guessing that "12 OLA" refers to optical wavelengths in each network link, but that is just a guess. The author of the Nearshore report was not told the time schedule for the phases.

I'd be curious to know a lot more, like who is designing and installing the backbone and who is supplying the equipment -- for example, are those Huawei multiplexers?

The one thing these images show us is that ETECSA is indeed planning a fiber backbone network.

-----
Uodate 8/20/2015

@yawnboy sent me a link to material releasesd by Edward Snowden showing that the NSA was thinking of installing back doors in Huawei routers in 2010.

An NSA presentation included this slide:

The text note accompanying the slide reads in part:

Many of our targets communicate over Huawei produced products, we want to make sure that we know how to exploit these products - we also want to ensure that we retain access to these communication lines, etc.

I'm offering this in jest, but it would have been ironic if Cuba had installed Chinese routers with NSA backdoors.

-----
Update 8/28/2015

Reader Ed Francis sent me a link to a 2005 post on Chinese companies in Cuba. The author visited the offices of several Chinese companies, including that of Huawei. The following is a Google Translate version of his observation:

Huawei to enter the Cuban market in 2000, when the company won the bid in an international tender Huawei Cuban government for the construction of a national fiber transmission network are conducted. Although the company is currently in Cuba only two market development officer and six engineers responsible for technical support, but Huawei's products have entered the all Cuban existing telecommunications.

Huawei's office, Interim Head of Cuban Mr. Humberto said Cuba telecom market competition is very fierce, before the market is mainly occupied by Alcatel, Ericsson and other large companies in Europe, I would like to win the market from their hands share of easier said than done. However, with a strong technical strength and highly competitive prices, Huawei has basically heard from a Cuban company became a pivotal role in the market. Cuba Telekom AG is the only company operating fixed telephone service, the total investment in 2004 to purchase 30% of Huawei's products.

It sounds like he is saying that Huawei won a bid for the construction of a fiber backbone in 2000. No details are given, but I wonder if that may be referring to the network pictured above.

The article also says Huawei has an office with two market development officers (salesmen?) and six engineers, headed by a Cuban, Mr. Humberto. (It is my understanding that Chinese infrastructure projects are typically run and staffed by Chinese, which would make this an exception).

I checked on the Huawei and Cuban Chamber of Commerce Web sites, and there is no listing for a Huawei office in Cuba today; however, ZTE does have an office in Havana. (ZTE sold ETECSA 5,000 home modems for the planned DSL rollout and may also be seeking to sell backbone equipment).

-----
Update 8/31/2015

Ed Francis has continued his detective work. On LinkedIn, he found that Jorge Rivero Loo has, since 2008, supervised the implementation and technical support of the optical backbone network outlined above. The network uses Huawei equipment and Mr. Rivero has worked for them since 2002. Before that, he worked for ETECSA and studied at Jarcov University (in Russia?) and CUJAE.

Have US firms missed the boat?

-----
Update 9/8/2015

Ed Francis has turned up more evidence of Huawei equipment -- a Cubatel photo gallery from 2008. Here is one of the photos, along with its caption:

A second photo refers to speeds of 2 and 34 Mb/s:

This facility is referred to as a "node on the national fiber optic network," and, given the year and speeds, I suspect this equipment may have served a metropolitan area network -- perhaps in Havana?

-----
Update 9/21/2015

Jon Williams, @WilliamsJon, and Michael Weissenstein, @mweissenstein, demonstrated the existence of the high-speed backbone between Havana and the undersea cable landing when they discovered that extra bandwidth had been allocated to access points used by journalists during the Pope's visit:

64 Mb/s from a mobile connection

100 Mb/s from a wired PC

Secretary of State Kerry's Trip to Cuba

US embassy in 1961

A senior State Department official held a press conference on Secretary Kerry's trip to Cuba to raise the flag over our new embassy. He said that due to space limitations, attendance at the embassy-opening ceremony will limited -- it will be "government-to-government event."

But, later in the day, there will be

a large event at the chief of mission’s residence, which is also a diplomatic installation, in which a broad range of groups will be invited, including the Cuban Government, Cuban Americans, Cuban artists and cultural leaders, the Diplomatic Corps, entrepreneurs, and Cuban political human rights and media activists ... nothing in the Secretary’s events on Friday will change our support for dissidents on the island, for political actors, for human rights activists, for independent media. Nothing has changed in that regard, and nothing will, and we will always stand with peaceful political activists who are looking for opening and space and human rights in Cuba.

You can read the full press conference transcript here and this Washington Post/Reuters video says that Cubans were enthusiastic about the new embassy:



-----
Update 8/17/2015

Press availabiliity (video and transcript) with US Secretary of State Kerry and Cuban Foreign Minister Rodriguez.

The Coming UK Surveillance Debate

This is a series of 13 posts about the forthcoming Investigatory Powers Bill, due to be published in draft this autumn for pre-legislative scrutiny by a Joint Committee of Parliament.

The Bill will replace a variety of statutes governing interception, mandatory communications data retention and communications data acquisition by public authorities. In particular it will supersede the Data Retention and Investigatory Powers Act 2014 (DRIPA) and parts of the Regulation of Investigatory Powers Act 2000 (RIPA).

1. Red Lines and no-go zones
2. Legal and policy origins
3. Bulk interception, Part 1 (External communications)
4. Bulk interception, Part 2 (The Section 8(4) certificate)
5. Bulk interception, Part 3 (Selection of intercepted material for examination)
6. Targeted interception (Reasonable suspicion, Thematic warrants, Ban on disclosure)
7. Extraterritoriality, Transparency and Data sharing
8. Communications Data Retention, Part 1 (Content/communications data boundary, Compelled data generation)
9. Communications Data Retention, Part 2 (Third party data collection, Request filter)
10. Communications Data Retention, Part 3 (Retention of weblog data)
11. Communications Data Retention, Part 4 (Mandatory data retention purposes, Prior independent authorisation)
12. Communications Data Acquisition
13. Future-proofing

Other Cyberleagle posts on related themes include:

Predicting the UK's new surveillance law

The Tangled Net of GCHQ's Fishing Warrant

Of straws and haystacks

IP address resolution - a conundrum still unresolved?

Another round of data retention

The other side of communications data

Dissecting DRIP - the emergency Data Retention and Investigatory Powers Bill

I am not an IP address

Key reference documents for the forthcoming Bill:

Privacy and Security: A modern and transparent legal framework (Intelligence and Security Committee of Parliament, March 2015)

A Question of Trust (David Anderson Q.C.'s report on Investigatory Powers, June 2015)

A Democratic Licence to Operate (RUSI Independent Surveillance Review, July 2015)

My own submission to the Anderson Review is here.

The Coming UK Surveillance Debate: Future-proofing

The last in a series of posts on the forthcoming Investigatory Powers Bill

Previous: Communications Data Acquisition

RIPA was future-proofed by writing it in such abstract technology-neutral terms that, combined with some fiendishly tortuous drafting, anyone not in the know had little chance of twigging what it was actually designed to do.

The draft Communications Data Bill took a different approach, building in flexibility to accommodate future technological innovation by granting broad order-making powers to the Secretary of State – orders that themselves would contain little detail.  This went down very badly with the Parliamentary Joint Committee that scrutinised it:

“We have not seen a draft of such an order, and we have been told that we will not be shown one. But it is clear that the order will only be a framework. The specific requirements will be imposed by secret notices by the Secretary of State.”

The Committee went on:

“Given the wide anxiety raised by the breadth of clause 1, we pressed the Home Office officials as to why it could not be narrowed to cover only the gaps which currently needed to be filled. Mr Farr’s answer was:

“The fundamental reason why we are nervous about limiting clause 1 is future-proofing ... Because I genuinely believe that no sooner will you get this legislation through than something else will come up, given the pace of change in the communications industry, which will create another gap, particularly if clever people know that we have filled one area, and so now try to exploit another. Future-proofing and flexibility are at the heart of the language we have used in clause 1.”

... We did receive from Mr Farr the important undertaking that Home Office officials would look at clause 1 again, and advise Ministers on whether it can be changed, enhanced or improved. We believe that it can indeed be changed and improved, by being narrowed to cover specifically the gaps so far identified. An undertaking, whether by officials or by ministers, that a power will be used only to a limited extent, is of little value. Once a power is on the statute book, it is available to be used, and also to be misused or abused, at any time in the future. It is hardly surprising that a proposal for powers of this width has caused public anxiety.”

The Anderson Report described Clause 1 as “an excessively broad power”.  (14.24)

A similar criticism can be levelled at the data retention powers under DRIPA, which are exercisable by notice from the Secretary of State to public telecommunications providers. The government treats the notices as secret and has declined to reveal any details about them, even to the court that heard the DRIPA judicial review, on grounds that to do so would prejudice national security.

At least under DRIPA the specific datatypes that can be ordered to be retained are listed, albeit there has been a move towards more generality (and concomitant obscurity) in the amendment made by the Counter-Terrorism and Security Act 2015 to cover IP address resolution data.

Although technological neutrality and future proofing are admirable in many contexts, they can be positively dangerous in the field of invasive powers where all manner of unanticipated activity may inappropriately fall into scope in the future. When powers intrude on fundamental rights of privacy and freedom of expression it may be more important that Parliament and the public have a clear understanding of what is being authorised than that the legislation be future proof. (This broadly corresponds to the suggestion recorded at 12.96(d) in the Anderson report). If legislation goes out of date, in an area of this sensitivity Parliament ought not to begrudge its time spent scrutinising any further proposal for new, extended or reduced powers.

The Coming UK Surveillance Debate: Communications Data Acquisition

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Communications Data Retention, Part 4

Next: Future-proofing 

The boundary between communications data and content is likely to be revisited. 

One area where the government might look at the possibility of reining back powers is a reduction in the number of public authorities who are able to access communications data and for what purposes.  That is in any event likely to be affected by the restriction on purposes for which mandatorily retained data may be accessed following the DRIPA judicial review judgment (subject to any appeal).

Professional and journalistic privilege should be addressed more robustly than by the current Code of Practice guidance, with at least the promised implementation of the Interception Commissioner’s recommendation for the introduction of judicial authorisation for demands aimed at identifying journalists’ sources. The DRIPA judicial review judgment may result in a broader requirement for judicial or other independent authorisation in any event, at least for mandatorily retained data.

There is room for more stringent constraints on the quantities of data covered by a single authorisation or notice. At the moment a notice could cover communications made from an e-mail address over an hour or two or over a year or more.  There are no limits other than the duty on those involved to satisfy themselves of the proportionality of the demand. Thus the Acquisition of Communications Data Code of Practice states:

“3.54. Designated persons should specify the shortest possible period of time for any authorisation or notice. To do otherwise would impact on the proportionality of the authorisation or notice and impose an unnecessary burden upon the relevant CSP(s).”

Some selected recommendations from many in the Anderson report (which was published before the judgment in the DRIPA judicial review):

Anderson

Public authorities with relevant criminal enforcement powers should in principle be able to acquire communications data. It should not be assumed that the public interest is served by reducing the number of bodies with such powers, unless there are bodies which have no use for them. There should be a mechanism for removing public authorities (or categories of public authorities) which no longer need the powers, and for adding those which need them. (Recommendation 50) The requirement in RIPA 2000 ss23A-B of judicial approval by a magistrate or sheriff for local authority requests for communications data should be abandoned. Approvals should be granted, after consultation with NAFN, by a DP of appropriate seniority within the requesting public authority. (Recommendation 66) In recognition of the capacity of modern communications data to produce insights of a highly personal nature, where a novel or contentious request for communications data is made, the DP should refer the matter to ISIC for a Judicial Commissioner to decide whether to authorise the request. (Recommendation 70)

The Coming UK Surveillance Debate: Communications Data Retention, Part 4

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Communications Data Retention, Part 3

Next: Communications Data Acquisition

Mandatory data retention purposes. The July 2015 High Court decision in the Davis/Watson judicial review of DRIPA followed the CJEU DigitalRights Ireland case in April 2014, which invalidated the EU Data Retention Directive.  In July 2014, three months later, the UK government rushed DRIPA through Parliament in a few days as emergency legislation, replacing the previous secondary legislation which, since it implemented the now invalid Directive, was itself vulnerable to challenge.

The government did not claim at the time that DRIPA addressed every aspect of DRI. DRIPA made some accommodations, for instance enabling data retention notices served on communications service providers to specify different periods up to 12 months for retention of different classes of data.  However the government could not rely in the court case on the newly flexible time period.  Since it declined to give any details of DRIPA notices given to CSPs, the court had to assume that any notices that may have been given required retention for the full 12 months.

The CJEU in DRI set out a list of reasons why the Data Retention Directive did not comply with the Charter.  However it left room for doubt as to whether every ground was a self-standing reason for invalidity, or whether only the cumulative list as a whole justified invalidating the Directive.  The High Court had to grapple with this issue and decide which grounds, if any, were meant to be independent conditions for Charter compliance.

It decided that three requirements were stated with such emphasis as to be intended to be self-standing:

-           the legislation must lay down clear and precise rules governing the scope and application of the measure; and imposing minimum safeguards sufficient to give effective protection against the risk of abuse and against any unlawful access to and use of the data (paragraphs 52 and 54);

-           access to and use of data retained under a general retention regime must be strictly restricted to the purpose of preventing and detecting precisely defined serious offences or of conducting criminal prosecutions relating to such offences (paragraph 61);

-           "Above all", access must be dependent on a prior review by a court or an independent administrative body whose decision seeks to limit access to the data and their use to what is strictly necessary for the purpose of attaining the objective pursued, and which intervenes following a reasoned request of those authorities (paragraph 62).

Following this judgment (subject to appeal) there is now a question mark over the purposes for which mandatorily retained communications data may be accessed, even if the government can devise an otherwise EU Charter-compliant retention regime. 

While Article 15(1) of the EU Privacy and Data Retention Directive mentions national security as well as investigation of criminal offences as grounds to restrict certain of the privacy protections in the Directive, the CJEU DRI judgment was framed entirely in terms of crime or serious crime.  The order made by the High Court disapplied DRIPA in the following terms, which exclude national security:

“in so far as access to and use of communications data retained pursuant to a retention notice is permitted for purposes other than the prevention and detection of serious offences or the conduct of criminal prosecutions relating to such offences”.

The High Court noted in its judgment:

“In their submissions on remedy following receipt of our draft judgment counsel for the [UK government] raised for the first time the question of whether access to retained data for national security reasons is within the scope of EU law. This was not raised in the oral or written arguments previously addressed to us and we decline to allow it to be raised at this late stage. Whether national security cases should have different provisions for authorisation of access to communications data will no doubt be the subject of careful thought when the new legislation is being drafted.” [123]

National security apart, the purposes for which communications data may currently be accessed under RIPA are considerably broader than either national security or serious offences and, subject to any appeal against the High Court judgment, will have to be revisited at least for mandatorily retained data.

Prior independent authorisation. The method of authorisation of access at least to mandatorily retained communications data will need to be reconsidered in the light of the DRIPA judicial review judgment (subject to appeal), so as to put in place prior authorisation by a court or independent administrative body.

The Coming UK Surveillance Debate: Communications Data Retention, Part 3

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Communications Data Retention, Part 2

Next: Communications Data Retention, Part 4

Retention of weblog data. Perhaps the most contentious and confused aspect of communications data retention is the debate over so-called weblog data. Anderson said:

“What is meant by web log in this context has caused some uncertainty, and independent experts to whom I have spoken criticise the term, and those who use it, on the basis of imprecision (as well as the inapplicability of the term to non-web based services).” [9.53]

The confusion around weblog data is heightened by the fact that the definitional boundaries are different for mandatory retention under DRIPA, voluntary retention under ATCSA 2001 and access to communications data by public authorities under RIPA.

RIPA drew the original line between communications data and content.  A machine identifier (such as an IP address or a URL up to the first slash) was communications data, but a URL after the first slash was content.  As Anderson observes, there are arbitrary elements to the core definition.  So www.bbc.co.uk is communications data, www.bbc.co.uk/sport is content, but sport.bbc.co.uk is communications data (Anderson, 9.54, fn 32).

The Home Office seems to want to extend mandatory retention to include URLs up to the first slash, but not full URLs. That appears from the definition of weblog data that it provided to Anderson:

“Weblogs are a record of the interaction that a user of the internet has with other computers connected to the internet. This will include websites visited up to the first ‘/’ of its [url], but not a detailed record of all web pages that a user has accessed. This record will contain times of contacts and the addresses of the other computers or services with which contact occurred.” [9.53]

Weblogs limited in that way could still, Anderson observes, “reveal, as critics of the proposal point out, that a user has visited a pornography site, or a site for sufferers of a particular medical condition, though the Home Office tell me that it is in practice very difficult to piece together a browsing history.” [9.54]

The Home Office description of weblog data is also intended to cover data such as destination IP addresses, DNS server logs, http ‘GET’ messages and IP service use data. [Anderson 9.54, fn 32] The inclusion of GET messages is odd. A GET message requests a page from the web server. Unless truncated it would be the equivalent of retaining a full URL.

Anderson reports law enforcement apparently pressing the case for compulsory retention of weblog data less strongly than to the Joint Committee in 2012:

“In short, it was not submitted to me, as it was in 2012 to the [Joint Committee], that “access to weblogs is essential for a wide range of investigations”. [9.61]

 However he added:

“it was clear from my conversations with the most senior officers that law enforcement does want a record to exist of an individual’s interaction with the internet to which it can obtain access. Ultimately it would argue for the retention of web logs, subject to safeguards to be determined by Parliament, if this was identified as the best way to meet its operational needs. But it would expect all avenues to be explored before reaching a final view on the best solution.” 

Recommendations of the three Reviews in relation to weblog data retention are:

ISC	No recommendation
Anderson	Full consideration should be given to alternative means of achieving those purposes, including existing powers, and to the categories of data that should be required to be retained, which should be minimally intrusive. If a sufficiently compelling operational case has been made out, a rigorous assessment should then be conducted of the lawfulness, likely effectiveness, intrusiveness and cost of requiring such data to be retained. No detailed proposal should be put forward until that exercise has been performed. (Recommendation 15)
RUSI	No recommendation

Given the confusion over what is and is not weblog data, I have set out in the table below a tentative analysis (others may have different interpretations and I reserve the right to change my mind!) of the current position on retention and access to some types of communications data. References to ‘Schedule’ are to the Schedule annexed to the Data Retention Regulations 2014 (S.I. 2014/2042) made under DRIPA.

Three points should be borne in mind when reading the table.  First, a ‘Yes’ answer does not mean that that type of data is necessarily covered in all circumstances.  It has at least to satisfy the conditions in rows 2 and (for CTSA 2015) 3 of the table. Second, I have given the benefit of the doubt to CTSA’s difficult definition of relevant internet data (set out in row 3). Third, CTSA can only apply to data that is not already covered by the DRIPA Regulations.

Datatype	Mandatory retention possible under DRIPA?	Mandatory retention possible under CTSA S21?	Can disclosure be required under RIPA Pt I Chapter II?	Comment
	Applies only so far as the data is generated or processed within UK by a public telecommunications operator in the process of providing a telecommunications service (DRIPA S. 2(1)).		A telecommunications operator can be required to disclose communications data in its possession and to obtain and disclose it if not in its possession
		Applies only to the extent that the data can identify, identify, or assist in identifying, which IP address or other identifier belongs to the sender or recipient of a communication
At customer’s ISP
Source static IP address	Yes (Schedule, 13(1)(b))		Yes
Source dynamic IP address.	Yes (Schedule, 13(1)(b))		Yes
Source shared IP address (within ISP e.g. CG-NAT)	Yes (Schedule, 13(1)(b))		Yes
Source port number	No	Yes	Yes
Weblog data: destination IP address	No	Probably excluded by S.21(3)(c)	Yes
Weblog data: destination URL (up to first ‘/’)	No	No (excluded by S.21(3)(c))	Yes (traffic data within S. 21(6))	ATCSA 2001 Voluntary Code provides for retention for 4 days
Destination URL (after first ‘/’)	No	No (excluded by S.21(3)(c))	No (excluded by last para of  S.21(6))	Excluded from ATCSA 2001 Voluntary Code
At public wi-fi point
Source MAC address	No	Yes	Yes
At webmail provider or other public host				DRIPA confirmed webmail as a telecommunications service
IP address allocated by user’s ISP	Yes		Yes
Port number allocated by user’s ISP	No	Yes	Yes