Home page logo

nanog logo nanog mailing list archives

Re: Fed Bill Would Restrict Web Server Logs
From: Andy Davidson <andy () nosignal org>
Date: Tue, 14 Feb 2006 16:14:11 +0000

Suresh Ramasubramanian wrote:
On 2/14/06, Jon R. Kibler <Jon.Kibler () aset com> wrote:
"A bill just announced in Congress would require every Web site operator
to delete information about visitors, including e-mail addresses, if the
data is no longer required for a "legitimate" business purpose.
Original posting from Declan McCullagh's PoliTech mailing list. Thought
"When no longer required for business purposes"
Your syslog's logrotate function does that for you already, for all
reasonable purposes .. blows away logs that are say a week old.

Speaking with my e-commerce vendor hat on, server logs (apache, mail, application audit logs) and other information about visitors (especially those who have conducted a purchase transaction with us, or signed up to our newsletter) never stop having a business purpose - it's called referential integrity.

We want to use them to track the behaviour fraudulent users for example.

We also want to learn about how people use our site to make it easier. We want to ensure our mail systems are not approaching capacity. We want to know if our spam filtering is working, and how its use changes over time. etc.,etc.,etc.

These are all business purposes.

It's interesting that the US government is requiring less user data is stored when European politicians are calling for greater data and log retention rules.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]