It might be helpful (to prevent uninformed ramblings) if we could have a draft of the proposed confidentiality agreement, or at least a rough bulletpoint of what it would cover. Unless that's confidential ;-) I assume the data processing and handling would be done in Spain? It's certainly much less of a legal headache to shift the data to Europe rather than from Europe...

For a while now, we've been releasing squid log data, stripped of personally identifying information such as IP addresses, to groups at two universities: Vrije Universiteit and the University of Minnesota. We now have a request pending from a third group, at Universidad Rey Juan Carlos in Spain. They are asking if they can have the full data stream including IP addresses, and they are prepared to sign a confidentiality agreement to get it.

On 14/09/2007, Tim Starling <tstarling(a)wikimedia.org> wrote: It might be helpful (to prevent uninformed ramblings) if we could have a draft of the proposed confidentiality agreement, or at least a rough bulletpoint of what it would cover. Unless that's confidential ;-)

I assume the data processing and handling would be done in Spain? It's certainly much less of a legal headache to shift the data to Europe rather than from Europe...

They are asking if they can have the full data stream including IP addresses, and they are prepared to sign a confidentiality agreement to get it.

Currently we let toolserver users process similar data, assisted by Wikipedia administrators who put web bugs on the site. They use it to produce the WikiCharts report. Are we to tell prospective research groups to use the toolserver, rather than their own substantial hardware, for analysis of Wikipedia traffic patterns?

I'm not sure if this would be allowed on the privacy policy, which does mention statistics, but doesn't say who is making them. Maybe the use of web bugs by administrators is already against the privacy policy. In any case, I think the question would benefit from community discussion, which is why I am posting it here.

I wouldn't recommend using a hashed IP address to anyone involved in academic work. I've worked in the academic sector, I know how important it is for data to be above any criticism. Any data using unique IP addresses as an estimate of individual user population would be severely skewed by proxies and NAT.

No comment on your other points, but id hardly consider a university conducting research under a nda 'public' disclosure at all, to the point where i don't think this even breaks the privacy policy, although whether or not to do it should be a community decision.

On 9/14/07, Tim Starling <tstarling(a)wikimedia.org> wrote: Perhaps in order to prevent potentially violating our own privacy policy, we can meet the researchers half-way.

If we can find out the reason they need IP addresses we can craft the data we send them to satisfy their request. For example: a) they could just need the unique addresses to link together browsing patterns, but not care for them to be IP addresses. We could create convert the addresses into a unique number (or a salted hash) and send them the data.

b) they could be looking for network topology information; we could give them the first two or three octets of the IP address.

c) they could be looking for geographical distribution of queries; we could do the geo-lookup of addresses and give them coordinate resolution for each address instead of the address itself.

In a very strong sense, we can 'safely' make no data available.

What I still don't understand is what period this information would be from. Would it only be a UDP stream of new requests, or would it include old log data? At least if it's only new requests those of us who are "mildly paranoid" can make sure we always access WP through tor.

Anthony wrote: I've been passing on questions from this thread to the researchers, and I'm still waiting for their reply. So I won't answer most of the questions just yet, but I can answer this one. It's a UDP stream of new requests, they won't get any old data. There is no old log data for them to have, except at 1/1000 sampling, and even that has gaps in it due to disk-full conditions, and it doesn't go back very far.

Although having this data is a wet dream of mine, I find it unconscionable to release it, and I feel that whoever was responsible for releasing it has already overstepped their bounds.

Although having this data is a wet dream of mine, I find it unconscionable to release it, and I feel that whoever was responsible for releasing it has already overstepped their bounds. We already know from the New York Times analyzing AOL's search logs that persons can be identified from search logs, and we know from Microsoft's Non-Disclosure Agreements with universities around the world for portions of the Windows 2000 source code that these NDAs, even to universities, are not effective in stopping the data from being leaked.

Brian wrote: The data that has been released cannot be used to identify individuals. The AOL search data could be used to identify individuals, because searches were tagged with a pseudonymous identifier. There are no such identifiers in the data we are sending out.

For example, a search for a social security number, by itself, tells you nothing about the individual who made it. Was it the owner of the SSN, an employer, or someone going through the man's rubbish? Or was it a Wikipedian trying to determine if someone's SSN is notable enough to include in an article?

In the unlikely event that someone types their life story into the search box and clicks "go", you still don't know who wrote it, whether it was autobiographical, slander or fantasy.

The AOL search data was NOT tagged with pseudonymous data (by which I'm assuming you mean usernames). It was tagged with random numbers. The way privacy was compromised in the AOL search data scandal had nothing to do with what the data was labeled as and everything to do with what the data was. One could look at all of the searches made by a given person and clue in on who they were - e.g. by looking for local subjects in their searches, see if they searched for anyone by name (maybe themselves or people they knew), see if they searched for any esoteric subjects, etc.

On 2007.09.15 01:38:00 -0400, Gregory Maxwell <gmaxwell(a)gmail.com> scribbled 11 lines: Dramatic maxims are useful for shock value, which is what is needed here

since people seem to be thinking that we can release vast amounts of data and not worry about abuses at all. This attitude shocks me a little, since almost by definition this subject involves releasing even more data than usual, and we've already seen abuses of public data.

Not to mention that you *can't* trust researchers to keep it confidential, any more than you could anyone else.

Every bit of data reduces privacy and anonymity; this is a fact of life

I assume everyone here is intelligent and

The question here is not whether we can mangle the data so there is no danger of privacy violations. It exists, it will always exist. The question is, can we reduce that danger to below the average every-day risks

Right now, I'm not convinced it's worth it.

Even while keeping the pedantic "Every bit of data reduces privacy and anonymity" in mind, there are many types of data extract which pose an exposure level so low that we can fairly classify it as none when speaking English rather than pedantese: For example, no one sane is going to claim that releasing the daily viewership rates for existent articles with some quantization is going to cause an measurable impact to anyone's privacy or anonymity.

Trust and signatures are not enough. How will they react if a government demands the release of private information? If we determine that we will not release it in the absence of a court order, what recourse do we have if the acquirers are not willing to resist a government order in the courts? In some jurisdictions there may be no such right to challenge such an order.

Yes, research is important. Yes, our goal is to spread and increase the sum of human knowledge. But privacy of private data is currently written into policy as being *important*, and I haven't yet seen a compelling reason to change that. This should not be a casual decision. The information security of our editors and readers should be an utmost priority.

My understanding is that, with the information people are considering releasing, it would be possible for someone to work out which editor had which IP address, which would be a serious betrayal of trust.

Yes, I agree that protecting IP address is hard. Just as an example, we have one stalker (and I'm using the word advisedly) who posts links on people's talk pages to what appears to be Wikipedia articles, purportedly asking for advice, but in fact diverting that user to the stalker's own website, so he can pick up the IP. He's also sent e-mails with disguised links that divert people to a blog he has access to. --

The only workable solution I can see is to make it less likely that stalkers will want to target particular admins.

One way to do that would be to set up anonymous admin accounts that multiple admins could use. So for example, if a difficult user needs to be blocked, any admin could access the joint admin account to make the block. The user would only see that User:Admin1 had blocked him. Only trusted people would have access to which admin had made a block with User:Admin1 at time T. I know it would complicate things, and it might make admin abuse a little more likely. And we'd still have the problem of potential leaks, so it wouldn't be foolproof by any means.

The only workable solution I can see is to make it less likely that stalkers will want to target particular admins. One way to do that would be to set up anonymous admin accounts that multiple admins could use. So for example, if a difficult user needs to be blocked, any admin could access the joint admin account to make the block. The user would only see that User:Admin1 had blocked him. Only trusted people would have access to which admin had made a block with User:Admin1 at time T. I know it would complicate things, and it might make admin abuse a little more likely. And we'd still have the problem of potential leaks, so it wouldn't be foolproof by any means.

There are plenty of admins that happily make their real identity public knowledge and apparently aren't so afraid of "stalkers" that they're unwilling to block people. There's probably at least one of them online 24 hours a day. Get one of them to make the block.

If there are some gaps in that 24 hour coverage, hire someone to fill in those gaps. Pay them enough that they can buy a PO box, an alarm system for their house, etc. How does society handle having judges and police and presidents and soldiers and other figures who have to make and enforce decisions that rile up a few nutters? Not by making them unaccountable for their actions. If Wikipedia is a serious project creating a real benefit to society, why shouldn't it do the same thing? Being part of the wikipolice is surely less dangerous than being part of the real police.

On 9/20/07, Thomas Dalton <thomas.dalton(a)gmail.com> wrote: real identity "stalkers" that at least one of the block. would be good to block If someone is known to be dangerous, shouldn't we be calling the police? How would having a pool account help matters? The dangerous person would just go after everyone in the pool, or whoever set up the pool, or Jimbo, or the board members (many of whose home addresses are easily found). Maybe Jimbo would be willing to make the block in those high profile cases. I doubt his doing so would bring him any more attention from stalkers than he already has. someone to fill PO box, an alarm having judges figures who have to nutters? Not by making is a serious shouldn't it do the less dangerous police escorts if equipped to defend would be For volunteers, yes. But if being an admin is so dangerous that enough people aren't volunteering, hiring one or two people to essentially be paid admins would be a possibility. Creating a world in which every single person can share freely in the sum of human knowledge is a big real world task which has costs and risks involved in it. Personally I think there are probably enough volunteers right now to cover the task, and hiring someone would be overkill. The solution is as I said it a month or so ago. If you're not willing to deal with stalkers, don't be an admin, or at least don't be an admin that performs controversial actions. But if the choice is between taking away admin accountability (as suggested by Sarah) and hiring a few body guards, I think the latter is a much better choice. _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/foundation-l

On 9/20/07, David Goodman wrote: Yes, it works only if you click on the link. But the links are disguised to look like something else -- a Wikipedia page, for example.

Stalkers are not a nice thing to deal with and I think you're underplaying the seriousness of the issue. They may be no serious risk of physical threat and thus your comments about bodyguards are appropriate. However, you're not taking into account what it is like when you get death threats by email and snail-mail.

Stalkers are not a nice thing to deal with and I think you're underplaying the seriousness of the issue. They may be no serious risk of physical threat and thus your comments about bodyguards are appropriate. However, you're not taking into account what it is like when you get death threats by email and snail-mail. About 6 years ago I had to deal with the divorce of my current partner when she left her husband after he assaulted her. I was made aware through a third party that he had obtained a shotgun and was looking for me. In the end - thanks to me employing good legal representation and hiding my location - he decided to turn the aforementioned weapon on himself. Don't joke about stalking, it happens. Brian.

-----Original Message----- From: foundation-l-bounces(a)lists.wikimedia.org [mailto:foundation-l-bounces@lists.wikimedia.org] On Behalf Of Matthew Britton Sent: 20 September 2007 16:27 To: Wikimedia Foundation Mailing List Subject: Re: [Foundation-l] Release of squid log data Am I dreaming, or have I wandered into some alternate universe, or has the whole world gone insane, or what? You're talking about a bunch of nerds who edit text on some website here, not judges, police, soldiers... please for god's sake have some sense of perspective. Being an administrator is not "dangerous". There are more than enough people volunteering to help (if you don't think so, stop turning down RfAs for stupid reasons). If someone's too chicken to issue a block, well whoopee-do, that's their problem. Chances are the block wasn't warranted anyway. Administrators do not need body guards, alarm systems in their house or indeed anything other than the common sense not to post their credit card details online. Nobody has ever been murdered in their sleep because they banned someone on the Star Wars forum they moderate. We're talking about the same kind of thing here. Having a lovely time back in reality, -Gurch --- Anthony <wikimail(a)inbox.org> wrote: > On 9/20/07, Thomas Dalton <thomas.dalton(a)gmail.com> > wrote: >> On 20/09/2007, Anthony <wikimail(a)inbox.org> wrote: >>> There are plenty of admins that happily make their > real identity >>> public knowledge and apparently aren't so afraid of > "stalkers" that >>> they're unwilling to block people. There's probably > at least one of >>> them online 24 hours a day. Get one of them to make > the block. >> I agree, that ought to be enough in most situations. It > would be good >> to have something to fall back on if we end up needing > to block >> someone known to be dangerous, though. >> > If someone is known to be dangerous, shouldn't we be > calling the > police? How would having a pool account help matters? > The dangerous > person would just go after everyone in the pool, or > whoever set up the > pool, or Jimbo, or the board members (many of whose home > addresses are > easily found). > > Maybe Jimbo would be willing to make the block in those > high profile > cases. I doubt his doing so would bring him any more > attention from > stalkers than he already has. > >>> If there are some gaps in that 24 hour coverage, hire > someone to fill >>> in those gaps. Pay them enough that they can buy a > PO box, an alarm >>> system for their house, etc. How does society handle > having judges >>> and police and presidents and soldiers and other > figures who have to >>> make and enforce decisions that rile up a few > nutters? Not by making >>> them unaccountable for their actions. If Wikipedia > is a serious >>> project creating a real benefit to society, why > shouldn't it do the >>> same thing? Being part of the wikipolice is surely > less dangerous >>> than being part of the real police. >> Presidents have bodyguards. Judges generally have > police escorts if >> they need them. Police and soldiers are trained and > equipped to defend >> themselves. Giving Wikipedia admins personal protection > would be >> taking things a little too far, IMHO ;). >> > For volunteers, yes. But if being an admin is so > dangerous that > enough people aren't volunteering, hiring one or two > people to > essentially be paid admins would be a possibility. > Creating a world > in which every single person can share freely in the sum > of human > knowledge is a big real world task which has costs and > risks involved > in it. > > Personally I think there are probably enough volunteers > right now to > cover the task, and hiring someone would be overkill. > The solution is > as I said it a month or so ago. If you're not willing to > deal with > stalkers, don't be an admin, or at least don't be an > admin that > performs controversial actions. But if the choice is > between taking > away admin accountability (as suggested by Sarah) and > hiring a few > body guards, I think the latter is a much better choice.

Brian McNeil wrote: Yes, stalking happens. It happens in situations such as that which you describe; this is certainly a problem and such incidents should certainly be taken seriously. But it doesn't happen because someone was banned from a website.

That's another advantage of using Tor. If you accidentally try to edit while logged out, you usually wind up with an "IP is blocked" message!

A solution to an edge case that breaks the normal case is unlikely to gain traction.

On 19/09/2007, Gregory Maxwell <gmaxwell(a)gmail.com> wrote: Mmm. I have, in the past, edited (unintentionally) logged out from three different home addresses, from work, and from a friend's machine *whose IP resolved to her name*. (Seriously. Oh, you have to love badly-designed university networks.)

On 20/09/2007, Matthew Britton <matthew.britton(a)btinternet.com> wrote: Um, in the case of Wikipedia you're factually incorrect. The hard stalking work of Judd Bagley of overstock.com is a counterexample. Stalking on a corporate budget no less!

When did investigation and fact based criticism become synonymous with stalking? I missed that memo. Or is it only stalking when it's someone "we" dislike investigating someone "we" like, and protected free speech the other way around? (like the extensive research that some of the "anti-stalkers" put into Daniel Brandt these last few years) I'm not saying that I agree with the allegations, but to call it stalking when someone investigates something which they reasonably believe to be misconduct just seems wrong to me.

On 9/20/07, Matthew Britton <matthew.britton(a)btinternet.com> wrote: I don't have time to respond in full to this, but I'm afraid it very much does happen because people are blocked or banned, and some of it has been quite serious. Nothing rising to the level of being pursued with a weapon, but very upsetting threats of violence to family members, and attempts to destroy people's careers and reputations. Sarah

On 9/20/07, Matthew Britton <matthew.britton(a)btinternet.com> wrote: As a neutral observer, it looks like a bunker mentality to dispose of WP:Dispute Resolution policy, abandon any pretense to so-called "Accountability", and purge dissenting voices as terrorists making death threats. Rob Smith

Anthony wrote: Until I got to this bit I was going to say, "Oh please, if it's that much of a problem, just give me my sysop bit back and I'll block anyone you tell me to." It's only clicking a button on a website, after all. But if you're offering *money* for my services, perhaps I should hold out for a better deal. I could use a new alarm system...

SlimVirgin wrote: There is stalking, and then there is trolling with intent to cause the maximum amount of fuss and emotional distress. "I'm going to kill your family" is, in terms of emotional distress per word, about as efficient as you can get. It is therefore hardly surprising that it is a common trolling tactic. One or two unfortunate cases aside (which I cannot help but feel were not entirely unprovoked) it is this latter issue, not stalking per se, which Wikipedia is experiencing. Furthermore, the issue isn't limited to administrators -- it's perfectly possible to make enemies on-line without having any such extra abilities (though one could argue it helps) -- so discussion of the problem as though it is a phenomenon unique to administrators, as has been happening in this thread, is hardly useful. -Gurch

Yes, stalking happens. It happens in situations such as that which you describe; this is certainly a problem and such incidents should certainly be taken seriously. But it doesn't happen because someone was banned from a website. Anyone can make a death threat online. Actually carrying out said threat is never in the mind of whoever makes it. Such threats are the product of the trolls who were blocked in the first place. This thread has turned into exactly the sort of over-the-top response they are trying to get. Someone, please... tell me I'm not the only one who can see this?

And by the way, remember that all unencrypted web traffic ends up unencrypted at the Tor exit node, and can be (and sometimes is) sniffed by unscrupulous folks. If you are using Tor you *must* make sure to use only the secure Wikimedia https proxy. Even that is difficult though, because you'll end up clicking a link that takes you to unsecure http pages (such as a diff links), and before you can blink, your admin cookie has gone across the web unencrypted.

Do you have the latest version? I'm getting fairly consistent page loads of less than a second right now. Maybe it's because of the exit node thing. But it seems to me like you must not have the latest version.

Cookies don't get sent to the unsecure pages, and the diff links aren't unsecure.

On 9/15/07, Tim Starling <tstarling(a)wikimedia.org> wrote: [snip] Tim, Your public admonishment to maintain civility is no less a breach of civility than my disagreement and admonishment to maintain a focus on our situation rather than spooky problems elsewhere. My apologies to Gwern if my tone was recieved as excessively harsh, for that was not my intention. I do think the background references would be useful to others, so thank you for that.

Gwern Branwen wrote: It seems to me that a "think skin" is a reasonable path between "thick" and "thin". :-) Ec