ISP data retention issue heading for Congress

The Bush administration plans to approach Congress again this year about the possibility of new rules requiring ISPs to retain information about their subscribers for a certain period of time.

US attorney general Alberto Gonzales said he is continuing to explore such legislation, pertaining not to "data retained by government but [to] data retained by ISPs that could be accessed with a court order", and told a hearing convened by the Senate Judiciary Committee: "I would like to have a discussion with the Congress about that."

Back in 2005, it emerged that Department of Justice officials had begun quietly shopping around the controversial policy move - akin to a set of requirements the European Union has already enacted.

Their intentions grew increasingly public last year. The attorney general suggested "reasonable" data retention is necessary to help investigators of online sex crimes, and members of Congress and state attorneys general voiced support for legislation mandating the practice.

Privacy advocates have long resisted mandatory data retention requirements because they allow police to obtain records of email chatter, web browsing history or chatroom activity that would normally have been discarded after a few months - or in some cases, never kept at all.

Some say that police can already get ample access to the data they need through a federally mandated process called data preservation, which requires ISPs to retain any "record" in their possession for 90 days "upon the request of a governmental entity".

Pointing to private meetings last year with ISPs, privacy groups and victims groups, Gonzales said he was aware many ISPs already retain data for business purposes and are "great partners to the law enforcement community", but he added: "However, for those few cases where we need the information, the question is, how do we maintain that evidence?"

CNET News.com's Declan McCullagh contributed to this report

Anne Broache writes for CNET News.com