<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><div><div><font color="#000000"><span style="background-color: rgba(255, 255, 255, 0);">On 4 Oct 2017, at 20:02, Paul Templeton <<a href="mailto:paul@coffswifi.net">paul@coffswifi.net</a>> wrote:<br><br></span></font></div><blockquote type="cite"><font color="#000000"><span style="background-color: rgba(255, 255, 255, 0);">The extent of data retention obligations for your relevant service would relate to the extent to which elements of the data set “visible” to you. For example, where a provider does not have “visibility” of a customer’s IP address, it is likely that the IP address was assigned as part of a different relevant service.<br>For example, if you have a record of the MAC addresses of users who access your network then this information must be retained for the required period. You are not obliged to retain the identity of the user if this is not information to which you have access.</span></font></blockquote><span style="background-color: rgba(255, 255, 255, 0);"><br></span><div><span style="background-color: rgba(255, 255, 255, 0);">Tor Guards have access to client IP addresses.</span></div><div>So I'm not sure if you gave inaccurate information to the department,</div><div>or they misunderstood what you said.</div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">But, even if you know the client IP address, you may be exempt under</span></div><div><span style="background-color: rgba(255, 255, 255, 0);">section 4.3 of the FAQs, because the IP address is allocated by the</span></div><div><span style="background-color: rgba(255, 255, 255, 0);">client's ISP, and you don't know the destination.</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">4.3. If provider offers an internet access service, is it required to retain IP addresses allocated by other providers?</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">If the service in question only offers connection to the internet, a service provider will not be required to retain IP addresses allocated by other providers.</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">However, if a provider offers an additional OTT service, such as VoIP, it will be required to retain the relevant destination communication information.</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">For example, if a provider operates both an internet access service and an OTT service—it will be required to retain destination information only for the OTT service.</span></div></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><a href="https://www.ag.gov.au/NationalSecurity/DataRetention/Documents/DataRetentionIndustryFAQS.pdf">https://www.ag.gov.au/NationalSecurity/DataRetention/Documents/DataRetentionIndustryFAQS.pdf</a></div><div><br></div><div>But I'm not a lawyer, so you should get your own lawyer.</div><div>Or run a relay outside Australia.</div><div><br></div><div>T</div></body></html>