Security quotes of the week

Under the EU Data Retention Directive (2006/24/EC), all EU telecommunication providers must log the time, place, sender and receiver of every communication for every customer, for a period of at least six months.

The usual interpretation of "every communication" is "every text message, every phone call, every e-mail sent via SMTP, and every IP packet", though the IP logging is sometimes reduced to e.g. every TCP stream or every 500 IP packets, due to the massive amount of log data otherwise produced.

Information logged includes name and address of the subscriber, any internal user ID, phone number, IMEI (handset) and IMSI (SIM) numbers, cell tower ID and geographical location, IP address and email address, as applicable.

According to Wikipedia, only Sweden has not yet implemented the directive (apparently sticking to NSA-style secret network edge-surveillance for now), while the directive has been found unconstitutional in Romania, Germany and the Czech Republic. All other EU countries implement the directive.