Subject: Re: RFC 6302: "Internet-Facing Server Logging": No Word about Privacy?

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 11 Oct 2011 16:42:17 +0300

Hi Dan, 

I missed your mail. Sorry.

Yes, I understand what the document is trying to say. The insight that the presence of NAT also requires you to log the port number is certainly not a new insight. 

My worry with the document is that if you have to give someone who deploys services such trivial information (as it is done with the draft) then it is quite likely that they also need to be told something about privacy. As the discussion around Web tracking shows there is little understanding of meet the privacy expectations of regulators. 

Cullen had also raised privacy concerns in his review, see http://www6.ietf.org/mail-archive/web/ietf/current/msg65610.html, but his remarks had not been taken into consideration. 

Ciao
Hannes

On Jul 27, 2011, at 9:22 PM, Dan Wing wrote:

>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On Behalf Of
>> Hannes Tschofenig
>> Sent: Wednesday, July 27, 2011 1:52 PM
>> To: [email-masked] IETF
>> Subject: RFC 6302: "Internet-Facing Server Logging": No Word about
>> Privacy?
>> 
>> Hi all,
>> 
>> I just noticed this document about "Internet-Facing Server Logging":
>> http://tools.ietf.org/html/rfc6302
>> 
>> It does not contain any privacy considerations even thought it would be
>> a very natural thing to do.
>> 
>> Does anyone know the history of this document?
> 
> It's trying to say that today, servers routinely log:
> 
>  * timestamp
>  * source IPv4 address
>  * resource accessed
> 
> and that servers, compliant with RFC6302, need to additionally log:
> 
>  * source port
> 
> -d
> 
>> Ciao
>> Hannes
>> 
>> _______________________________________________
>> Ietf mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 11 Oct 2011 16:17:49 +0200

On Tue, Oct 11, 2011 at 04:42:17PM +0300,
 Hannes Tschofenig <[email-masked]> wrote 
 a message of 58 lines which said:

> it is quite likely that they also need to be told something about
> privacy.

For me, the most important mention of privacy is:

   It is RECOMMENDED as best current practice that Internet-facing
   servers logging incoming IP addresses from inbound IP traffic also
   log:

Do note "Internet-facing servers ***logging incoming IP
addresses***". It means that noone recommends to log IP addresses, the
RFC just says that, ***if you do log***, logging the IP address
without the port number is not very sensible.

---

From: Martin Rex <[email-masked]>
Date: Tue, 11 Oct 2011 16:36:16 +0200 (MEST)

Hannes Tschofenig wrote:
> 
> Yes, I understand what the document is trying to say. The insight
> that the presence of NAT also requires you to log the port number
> is certainly not a new insight. 
> 
> My worry with the document is that if you have to give someone who
> deploys services such trivial information (as it is done with the
> draft) then it is quite likely that they also need to be told
> something about privacy. As the discussion around Web tracking
> shows there is little understanding of meet the privacy
> expectations of regulators. 

What this document describes will often be illegal in Germany,
and you risk a fine up to 300000 Euro for doing it on an
"Internet-Facing server".

3.5 years ago there was an illegal data privacy violation of a technically
different kind that made the german news:

 http://content.stuttgarter-zeitung.de/stz/page/1629475_0_9223_-reinigungsrechnung-an-kundin-volksbank-macht-rueckzieher.html

It was about some smelly mess (allegedly dog shit) on the floor near a
bank's ATM, and the bank examined their video surveillance tapes to find
who caused the mess and found out that it was from a 3 year old girl
whose mother had withdrawn money at the ATM (and they got the mother's
name from the ATMs log).  They sent this mother a cleaning bill of 50 Euros.

Besides the fact that childs below the age of 7 can not be legally
held responsible for their actions in Germany--and their parents
(or whoever was in charge of supervision) can only be held responsible
in case of gross negligence, it was a violation of german privacy laws
for the bank to examine the video and ATM logs to determine the
mother's name.  And although the bank back-pedaled the day _after_
this story made the news, their privacy violation resulted in a formal
investigation by the public authorities against the bank.

-Martin

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 11 Oct 2011 17:43:04 +0300

I believe there is room to do better: A quick look at the Fair Information Practices (FIPs) would provide a good starting point: 

   Notice and Consent:  Before the collection of data, the data subject
      should be provided: notice of what information is being collected
      and for what purpose and an opportunity to choose whether to
      accept the data collection and use. 

   Collection Limitation:  Data should be collected for specified,
      explicit and legitimate purposes.  The data collected should be
      adequate, relevant and not excessive in relation to the purposes
      for which they are collected.

   Use/Disclosure Limitation:  Data should be used only for the purpose
      for which it was collected and should not be used or disclosed in
      any way incompatible with those purposes.

   Retention Limitation:  Data should be kept in a form that permits
      identification of the data subject no longer than is necessary for
      the purposes for which the data were collected.

   Accuracy:  The party collecting and storing data is obligated to
      ensure its accuracy and, where necessary, keep it up to date;
      every reasonable step must be taken to ensure that data which are
      inaccurate or incomplete are corrected or deleted.

   Access:  A data subject should have access to data about himself, in
      order to verify its accuracy and to determine how it is being
      used.

   Security:  Those holding data about others must take steps to protect
      its confidentiality.