As terrorists and serious organised criminals exploit cyberspace to accelerate and facilitate their real-world crimes, so European Communications Service Providers (CSPs) are coming under increasing pressure to retain communications data to enable public authorities to investigate, detect and prosecute crime.

New legislation
Directive 2006/24/EC, issued by the European Parliament in 2006, requires mobile and fixed line CSPs to retain records of all telephone calls and internet data for up to 24 months. The Directive also requires CSPs to provide retained data in a timely manner to law enforcement and government agencies whilst preserving evidential integrity and complying with data protection legislation. The Directive already has been, or will soon be, signed into law across all European Union member countries.

Although the required data records already exist in CSPs’ estates, they tend to be fragmented across a number of systems in the ‘switch-to-bill’ chain and the marketing domain. Locating, correlating and extracting the appropriate data in response to a law enforcement request is both labour-intensive and time-consuming.

Masses of data
However, this in turn presents new challenges. For a large CSP, the the database will need to store tens of Terabytes of data for call records alone. When IP data is included, the storage requirement will increase substantially given the anticipated growth in IP traffic. In addition to storing a considerable amount of data and ensuring secure destruction of the data at the end of the retention period, CSPs will also need to respond quickly and confidentially to data access requests from law enforcement and government agencies. There may be potentially hundreds of such enquiries per day and the most urgent ones will need to be satisfied in minutes.

CSPs are therefore faced with the task of building and operating a significant data storage and retrieval system in order to comply with the new legislation. Difficult economic conditions and the fact that data retention compliance generates no revenue, means there is a strong business need for CSPs to minimise the capital and operating costs involved.