[prev in list] [next in list] [prev in thread] [next in thread] 

List:       qmail
Subject:    Re: Compliance with EU Data Retention Directive
From:       Markus Stumpf <lists-qmail () maexotic ! de>
Date:       2009-04-21 18:10:52
Message-ID: 20090421181052.GH44737 () server ! thinkof ! de
[Download RAW message or body]

Hoi,

sorry this took so long ...

On Fri, Apr 10, 2009 at 10:37:33PM -0400, John Simpson wrote:
> so are you saying that the existing patches out there, my own  
> included, which add the sending IP and AUTH information to the headers  
> of every message received via SMTP, are somehow illegal in the EU?

I don't think this is limited to EU data protection laws only, but IANAL.

I looked at a lot of mails and their headers in my mailboxes and collected
a few examples (all IDs, names, IP addresses modified). 

I don't think there are problems as long as the information added
(like the id used for AUTH) is already contained elsewhere in the
message:

    Return-Path: <joe@example.com>
    Received: from [10.0.0.1] (helo=mx.example.com)
        by mxout.example.com with esmtpa (ID joe@example.com) (port 25)
        (Exim 4.69 #79) id 1LoyT3-0004zc-IV
        for jack@example.com; Wed, 01 Apr 2009 13:18:50 +0200

or
    Return-Path: <joe@example.com>
    Received: from [10.0.0.1] (helo=pc34)
        by mx.example.com with esmtpa (Exim 4.69)
        (envelope-from <joe@example.com>) id 1LovfR-0003uz-Sq
        for jack@example.com; Wed, 01 Apr 2009 10:19:26 +0200

Some providers add pseudo anonymized information. There are a lot of
different headers for that. Although the header names change the values
all look similar (ie. some uu/base64-like encoding)

    X-Provags-Id: V01T2FsdGVkX1/U10RidJkPSRiFiWMAe3WX/Zg/LI/fANAZNBUcv6bz/ajgG
      9gA97xLkvMxcZl77aUQW6ACf/vnUvMt0ppa2OsG73BLmQn6oO81YqRDveY8Hg==

while it looks anonymous one can find with a search engine that the same
string was added to different mails of the same user sent to various
mailing lists.
So if the user would use different personalities he could nevertheless
be identified by this always the same header information added by his ISP.

One german provider (t-online) adds headers like:

    X-ID: ZBRoL2ZlohM9FDJ2CStJZud4dKDwrShFZ4EWnhrjEkEI6dg1xIG+RDeXBHFU7Lvwd9
    X-TOI-MSGID: 5ef9a32a-0c53-4f3b-a08e-d268e64c4ba1

where different mails from the same user have different values in those
headers. This is IMHO a save approach that allows the ISP to track each
user and message by this unique id. However I don't know how this is
constructed and if the information about the user is self contained or
if it is irreversible and stored in a kind of database or only in the
eg. logfiles (it at all).

What I also found and think never should happen is:

    Return-Path: <joe@example.com>
    Received: from alice@example.net
        by mx.example.com  (mail_out_v39.1.) id e.bc1.4ce7844a (37569)
         for <jimmy@example.com>; Mon, 6 Apr 2009 11:17:49 -0400 (EDT)

I've seen this a lot with small companies - one AUTH account and some
different mailboxes. All clients AUTH with the same account at the
mailserver of the ISP for sending, but use different email addresses
for the various people in the company.

I don't know about IP addresses. This is required routing information
as per RFC and some courts have decided that IP addresses are not
suited to personal identification, so I think it is ok.
But this may change e.g. with IPv6 and everyone having a static IP address.

	\Maex

[prev in list] [next in list] [prev in thread] [next in thread]