The introductory presentation (linked from the article) suggests what should be logged: - customer ID - start and end times of the 'event' - source IP addres

The introductory presentation (linked from the article) suggests what should be logged: - customer ID - start and end times of the 'event' - source IP address and port (the port is used to avoid a NAT at the ISP level) - destination IP address and port - volume of data transferred in each direction - name of internet service connected to - the URL https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/504192/Operational_Case_for_the_Retention_of_Internet_Connection_Records_-_IP_Bill_introduction.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... There is a sample provided on the next page, which dumbs it down enough so that it sounds rather compelling.