CUDN traffic data to and from 69.63.176.0/20

Josh Walker made this Freedom of Information request to University of Cambridge

The request was refused by University of Cambridge.

From: Josh Walker

18 October 2008

Dear Sir or Madam,

I would like to know:

(a) For each 10 minute period on Sunday 12th October 2008,

(i) how many packets left the CUDN with a destination IP address in
the range 69.63.176.0 to 69.63.191.255?

(ii) what was the total number of bytes in the packets referred to
in (a)(i)?

(iii) how many packets entered the CUDN with a source IP address in
the range 69.63.176.0 to 69.63.191.255?

(iv) what was the total number of bytes in the packets referred to
in (a)(iii)?

To make the question more clear I envisage your answer will take
the form of a spreadsheet:

Time || Packets out || Bytes out || Packets in || Bytes in

00:00 to 00:10 || <insert numbers here> ...

00:10 to 00:20 || <insert numbers here> ...

...

(b) For each 10 minute period on Monday 13th October 2008,

(i) how many packets left the CUDN with a destination IP address in
the range 69.63.176.0 to 69.63.191.255?

(ii) what was the total number of bytes in the packets referred to
in (b)(i)?

(iii) how many packets entered the CUDN with a source IP address in
the range 69.63.176.0 to 69.63.191.255?

(iv) what was the total number of bytes in the packets referred to
in (b)(iii)?

If at the time you answer this request you no longer hold the
traffic data for the dates stated above, then please could you
answer the questions above in relation to an adjacent Sunday and
Monday of your choosing, and tell me which Sunday and Monday you
have chosen.

Yours faithfully,

Josh Walker

Link to this

From: FOI
University of Cambridge

10 November 2008

Attachment FOI 2008 126 Walker.pdf
45K Download View as HTML

Dear Mr Walker,

Further to your request for information, please find enclosed the University's response.

Kind Regards
FOI Team

--------------------
University of Cambridge
Secretariat, The Old Schools
Trinity Lane, Cambridge, CB2 1TN

T: (01223 7)64142
F: (01223 3)32332
[email address]

show quoted sections

Link to this

Julian King left an annotation (10 November 2008)

The response from the University of Cambridge is factually inaccurate. The University of Cambridge does have the information requested. Whether or not it is possible to extract it in an appropriate timescale is, of course, a different matter.

The response should be challenged.

Link to this

From: Josh Walker

10 November 2008

Dear Sir or Madam,

I am unhappy with the service I have received in relation to my
request.

As I'm sure you are aware Section 16 of the Freedom of Information
Act 2000 requires that is the duty of a public authority to provide
advice and assistance to persons who have made requests for
information to it. Your terse response: "We do not hold the
information requested." neither provides advice nor assistance on
what similar information you may hold, or indeed why you do not
hold the information requested.

When I submitted my request, I strongly believed that the Cambridge
Computer Emergency Response Team (CamCERT) [1] had access to the
information that I requested. Furthermore, I believed that it was
very likely that the information, or a backup of the information,
would still be held at the deadline for responding to my request.

If I am mistaken, and this information was never held by the
University, the University Computing Service, CamCERT, etc then I
expected you would of provided the reasonable advice of informing
me of this. If this is the case, please could you provide this
reasonable advice to me.

I appreciate that if the information was held at 10 minute
granularity (and every backup of that that you might of made), they
may have all been routinely deleted before my request was received,
or indeed between my request and your reply, and hence you would
not be able to provide the information at the granularity I asked
for. I expected that if this was the case, you would of provided
the reasonable advice of informing me what granularity would be
available, so that I could make a follow-up request. Could you
please provide this reasonable advice to me.

This is considered best practice as described in a practical
guidance document issued by the Information Commissioner's Office:
Destruction of requested information [2]. It says: "If information
was destroyed before a request was received, you can say that you
do not hold it but should explain why it was destroyed and advise
the applicant of any other available information."

Furthermore it goes on to say that "If information is held when a
FOIA request is received, you may be able to lawfully say that you
do not hold it if it would normally be destroyed before the
deadline for responding. However, you should as a matter of good
practice suspend any planned destruction and consider disclosure as
usual." I would also like to encourage you to follow this good
practice with future requests.

Yours sincerely,

Josh Walker

1. http://www.cam.ac.uk/cs/security/cert.html

2.
http://www.ico.gov.uk/upload/documents/l...

Link to this

From: Josh Walker

26 November 2008

Dear Sir or Madam,

As I'm sure you are aware Section 45 of the Freedom of Information
Act 2000 refers to a Code of Practice issued by the Secretary of
State. This Code of Practice states: "Any written reply from the
applicant (including one transmitted by electronic means)
expressing dissatisfaction with an authority's response to a
request for information should be treated as a complaint". It also
states: "In all cases, complaints should be acknowledged promptly
and the complainant should be informed of the authority's target
date for determining the complaint."

Over two weeks ago now I expressed dissatisfaction with your
response to my FOI request. I have received no acknowledgement that
you are treating that dissatisfication as a complaint.

It is now clear to me that you are not following this Code of
Practice, and therefore please consider this email to be me
explicitly making a complaint regarding the University of
Cambridge's handling of my FOI request 'CUDN traffic data to and
from 69.63.176.0/20'.

Please pass this on to the person who conducts Freedom of
Information complaints.

A full history of my FOI request and all correspondence is
available on the Internet at this address:
http://www.whatdotheyknow.com/request/cu...

Yours sincerely,

Josh Walker

Link to this

From: FOI
University of Cambridge

27 November 2008

Attachment FOI 2008 126 Walker reply.pdf
44K Download View as HTML

Dear Mr Walker,

Please find attached a response to your email of 10th November.

Please accept my apologies for any perceived delay in this reply; as I'm sure you'll appreciate, we
are a diverse organisation, and as such a number of parties from across the University are consulted
on such matters as these FOI requests.

Rest assured, I shall pass on your email to the relevant party.

Kind Regards
FOI Team

--------------------
University of Cambridge
Secretariat, The Old Schools
Trinity Lane, Cambridge, CB2 1TN

T: (01223 7)64142
F: (01223 3)32332
[email address]

show quoted sections

Link to this

Julian King left an annotation (27 November 2008)

"The University does not hold the statistical information which you requested. In order to comply with your request, the University would need to create the information by writing a script/program to process raw traffic logs. However, a public authority is not required to create new information to comply with a request under the Freedom of Information Act 2000
(FOIA)."

Argh! I cannot believe that the University is giving this reply. Firstly it is factually incorrect. You are not asking for new information, you are asking (even if not explicitly) for anonymised data that we already hold. Secondly I have spoken to the specific people who hold the data and the only question was how much time it would take to process the data.

I don't have enough information to be able to work out if the University can process the information within the constraints of a reasonable amount of time, but this answer is completely inappropriate!

Link to this

Francis Irving left an annotation (18 March 2009)

The IP addresses that this question is about appear to all be owned by Facebook, Inc.

See, for example http://ws.arin.net/whois/?queryinput=69....

This explains partly what the request is about, but I wonder what the full story is.

Link to this

Julian King left an annotation (18 March 2009)

The University worked this out. More than that, the range is advertised by facebook as being the range they will use.

Link to this

Josh Walker left an annotation (18 March 2009)

I was interested in how popular Facebook was with University of Cambridge students.

Although the University's reply doesn't state it explicitly, they are relying on: http://www.justice.gov.uk/guidance/foi-p...

This states:

"You may receive requests for information that would require the analysis or manipulation of information that you hold in order to create the requested information.

In many cases, it will be very simple to create the new information and you should consider doing this. For example, you might be asked for a list of the top five buildings in terms of the number of staff based there. You may not hold a list of buildings ranked by the number of staff, but if it is simple to produce, you may wish to do so in the interests of openness and customer service. However, you are not required to create new information to comply with a Freedom of Information request."

:(

Link to this

Bruce Beckles left an annotation (20 March 2009)

Note that if the University are indeed relying on the MoJ guidance that "you are not required to create new information to comply with a Freedom of Information request" as stated in:

http://www.justice.gov.uk/guidance/foi-p...

...they are incorrect to do so.

Paragraphs 27-8 of the following Decision Notice by the ICO:

http://www.ico.gov.uk/upload/documents/d...

state:

"27. The Commissioner acknowledges that public authorities will often
receive requests made under the Act for lists of information. In many
cases this will not be information which the public authority holds in list
form but the constituent data parts, instead, will be held in a database
or other disparate sources. A common response to such requests is
that the information is simply not held, because, as noted above, the
public authority is not in possession of a physical list, as requested. A
number of public authorities have further claimed that responding to
such a request would involve the creation of new information.

28. The Commissioner does not accept this position and instead is of the
view that where a database or other electronic source contains
recorded information identified in a request, the information is held, and
the public authority is under an obligation to provide it (unless it is
exempt). Further, the Commissioner considers that the actions
required to access the specified information constitute information
retrieval or extraction rather than the creation of new information,
because, simply, the information is held, albeit embedded within a
broader resource of data. As the Act provides a right of access to
recorded information, and such information is recorded, the difficulty of
the retrieval or extraction process is irrelevant to the question of
whether the information is held. However, the complexity of this
procedure, in terms of the time it would take to locate and extract the
requested information is clearly relevant to the consideration of costs
under the Fees Regulations."

This complaint is particularly relevant as it concerns a case in which "The Commissioner found that the requested information was recorded in an electronic database and that, in order to locate, retrieve and extract this, the [public authority] would need to write and run a report. The Commissioner does not accept that the level of difficulty involved in performing these activities has a bearing on the question of whether information is or is not held by a public authority. ... The Commissioner required the [public authority] to either provide the complainant with the requested information or provide valid reasons for not doing this.". Although not identical to the case here, it seems to me that your request is sufficiently similar that the ICO would almost certainly find in your favour were you to complain.

I believe the University is clearly in breach of the Act in this case and their refusal to provide the information should be contested (which would now mean complaining to the ICO, I guess).

FYI, the ICO's position on this issue is more fully articulated in this Decision Notice by the ICO:

http://www.ico.gov.uk/upload/documents/d...

...which has been upheld by the Information Tribunal on appeal:

http://www.informationtribunal.gov.uk/Do...

Link to this

Things to do with this request

Anyone:
University of Cambridge only: