3 ms·

"apt-get install apache2" violates GDPR (logs IPs). It's not a difficult line to cross at all.

by jimmaswell 8y ago

unilynx 8y ago
Why would it violate GDPR? Logging IPs, especially short-term, is pretty easy to justify
- jimmaswell 8y ago
  There's debate on if it's PII.
  - Spearchucker 8y ago
    If an IP can be tied to a data subject's identity it's PII. If it can't, it's not. This isn't a debate.
    - testvox 8y ago
      So the answer is yes, they are PII. But that doesn't actually answer the question of whether or not collecting them without consent is illegal under the GDPR > “Processing shall be lawful only if and to the extent that at least one of the following applies: […] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” And > “The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.”
      - contem 8y ago
        It depends on the purpose / if you have a legitimate need to store them. Are you storing IP's for a certain time, so you can discover and investigate attacks? > include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. Are you storing IP's for a certain time, so you can run analytics? > Further processing for [...] statistical purposes should be considered to be compatible lawful processing operations. Are you doing direct marketing to your customers? > The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. [Legitimate interest] There is a relevant and appropriate relationship between the data subject and the controller [...], such as where the data subject is a client or in the service of the controller. If you are not big enough to have a law department look at this, you don't need to worry so much about a weblog.
      - tetha 8y ago
        I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and tracking a person attacking my network. Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.
    - floatboth 8y ago
      But what counts as "can be tied"? Does asking the ISP that owns the address count? What about correlating with logs from other services you have access to?
      - contem 8y ago
        If the police can tie the IP to a person, then it "can be tied". Some courts decided before GDPR that IP addresses can't convincingly be enough to tie a person to a crime committed with that IP address, but that is not to say it isn't PII, or can't be tied to a person.
hyperman1 8y ago
Lets try the law on this one: Is the IP personal data for the GDPR? If I read the GDPR, the Debian foundation is not capable to pinpoint 1 person so it seems to me it is not (An ISP or someone receiving an IP to person mapping from them is something different): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Furthermore, the Debian foundation has a legitimate interest in monitoring their machines and protecting them against attacks. Logs containing IPs are a common practice, so there is a legal base for processing IPs even if they would be personal data: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. All of this assuming they use the IP for apache logs only, and don't send these logs to third parties for data mining or whatever.
- yorwba 8y ago
  Debian also has a privacy policy where they explain what kind of data they log and how long it is retained https://www.debian.org/legal/privacy https://www.debian.org/legal/privacy However, I can't recall ever having seen this privacy policy before now. IANAL and don't know what kind of notice needs to be given for necessary data usage, if any, but maybe apt-get should display the privacy policy on first use.
  - jimmaswell 8y ago
    I meant you're violating GDPR by letting that apache2 server run with its default config, not that the apt maintainers are violating it.
    - hyperman1 8y ago

"apt-get install apache2" violates GDPR (logs IPs). It's not a difficult line to cross at all.

unilynx 8y ago

Why would it violate GDPR? Logging IPs, especially short-term, is pretty easy to justify

jimmaswell 8y ago
There's debate on if it's PII.
- Spearchucker 8y ago
  If an IP can be tied to a data subject's identity it's PII. If it can't, it's not. This isn't a debate.
  - testvox 8y ago
    So the answer is yes, they are PII. But that doesn't actually answer the question of whether or not collecting them without consent is illegal under the GDPR > “Processing shall be lawful only if and to the extent that at least one of the following applies: […] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” And > “The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.”
    - contem 8y ago
      It depends on the purpose / if you have a legitimate need to store them. Are you storing IP's for a certain time, so you can discover and investigate attacks? > include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. Are you storing IP's for a certain time, so you can run analytics? > Further processing for [...] statistical purposes should be considered to be compatible lawful processing operations. Are you doing direct marketing to your customers? > The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. [Legitimate interest] There is a relevant and appropriate relationship between the data subject and the controller [...], such as where the data subject is a client or in the service of the controller. If you are not big enough to have a law department look at this, you don't need to worry so much about a weblog.
    - tetha 8y ago
      I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and tracking a person attacking my network. Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.
  - floatboth 8y ago
    But what counts as "can be tied"? Does asking the ISP that owns the address count? What about correlating with logs from other services you have access to?
    - contem 8y ago
      If the police can tie the IP to a person, then it "can be tied". Some courts decided before GDPR that IP addresses can't convincingly be enough to tie a person to a crime committed with that IP address, but that is not to say it isn't PII, or can't be tied to a person.

hyperman1 8y ago

Lets try the law on this one: Is the IP personal data for the GDPR? If I read the GDPR, the Debian foundation is not capable to pinpoint 1 person so it seems to me it is not (An ISP or someone receiving an IP to person mapping from them is something different): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Furthermore, the Debian foundation has a legitimate interest in monitoring their machines and protecting them against attacks. Logs containing IPs are a common practice, so there is a legal base for processing IPs even if they would be personal data: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. All of this assuming they use the IP for apache logs only, and don't send these logs to third parties for data mining or whatever.

yorwba 8y ago
Debian also has a privacy policy where they explain what kind of data they log and how long it is retained https://www.debian.org/legal/privacy https://www.debian.org/legal/privacy However, I can't recall ever having seen this privacy policy before now. IANAL and don't know what kind of notice needs to be given for necessary data usage, if any, but maybe apt-get should display the privacy policy on first use.
- jimmaswell 8y ago
  I meant you're violating GDPR by letting that apache2 server run with its default config, not that the apt maintainers are violating it.
  - hyperman1 8y ago