End of open Wi-Fi? Data retention endangers digital participation

Just at the beginning of October, Federal Minister of Justice Stefanie Hubig (SPD) once again emphasized her intention to present a draft law for a $(LB4964934:new edition of the data retention that has been controversial for years|_blank) in the near future. She sees an "urgent need for action," she explained. The internet is being "flooded" with depictions of child sexual abuse. IP addresses are often "the only lead" to identify perpetrators. However, even before Hubig presented her preliminary draft, criticism of the plan contained in the coalition agreement is growing louder.

For example, Freifunk Munich, a provider of infrastructure for numerous open WLAN-Hotspots in a recent statement is urgently warning of the far-reaching and negative consequences of the repeatedly announced surveillance measure. An applicable draft law from the Bundesrat provides for no exceptions for non-profit or non-commercial providers like Freifunk or municipal Wi-Fi access, it states. The association therefore wants to alert politicians early to the technical, data protection, and societal problems that particularly affect open and non-profit Wi-Fi structures.

According to the submission, the technical challenge begins with the fact that the required storage presupposes the unambiguous assignment of an IP address to a user and the logging of this assignment. In modern public Wi-Fi networks, this is now only possible with great difficulty. A significant concern lies in the functionality of IPv6 addresses: modern end devices generate these identifiers themselves using a procedure called SLAAC (Stateless Address Autoconfiguration). This means that the operator does not actively assign the addresses. In addition, there are "Privacy Extensions", which cause IPv6 addresses to change regularly.

End of anonymity on the net

However, even in older IPv4 operation, many end devices from manufacturers such as Android, Apple, or Windows today rotate their MAC addresses to make tracking more difficult. As a result, even DHCP assignments – i.e., the allocation of addresses by the network operator – can no longer be permanently assigned to a specific device.

The serious consequence, according to Freifunk: The implementation of the storage obligation would only be possible through mandatory user identification with the collection of personal data. Such a compulsion to register would significantly complicate spontaneous and low-threshold Wi-Fi usage.

The collection and storage of personal user data would also confront operators of public Wi-Fi networks with significantly stricter data protection requirements, the association complains. These would go beyond existing data protection concepts, order processing contracts, and technical protective measures. Extended precautions for data security and accountability would also be necessary. This would lead to higher ongoing costs for maintenance, compliance, and security infrastructure. In addition, the risk of data breaches and official requests for information would increase.

Industry associations sound the alarm

This additional economic and organizational effort is hardly affordable for many voluntary, municipal, or small commercial operators, explain the operators of open networks. The result would be a decline in free Wi-Fi offerings and thus a significant restriction of digital participation in public spaces.

The impact on accessibility and digital inclusion would also be fatal, the association points out. Open Wi-Fi networks are essential, especially for people without expensive mobile data plans, for socially disadvantaged groups, or for foreign guests. Mandatory user identification or complex registration procedures would massively complicate barrier-free access to the internet in public spaces.

If the law looks similar to the Bundesrat's draft, it could lead to "Freifunk no longer existing in its current form," Dieter Winkler, board member of Freifunk Rheinland, told heise online. Even the control and recording contradict the basic idea of a free network. Ultimately, the effort would be "neither temporally nor financially feasible."

Industry associations share the objections. The German Federal Bar Association (BRAK) also describes the indiscriminate retention of IP addresses as legally and technically problematic and points to significant risks for data protection and fundamental rights. The eco association of the Internet industry recently sounded the alarm that a blanket storage obligation would represent "a step backward in digital policy." It also emphasizes the economic burdens for infrastructure and network operators as well as the risks for data protection and legal certainty.

(wpl)