My users' mail logs

[Recursion]

One of my side jobs is running a server that handles email for some small businesses. At this point, I'm several fish below the people NSA is dealing with (my bandwidth provider's bandwidth provider's bandwidth provider is the sort of outfit they are snooping -- though that includes all the data I send through them, apparently).

But another thread got me thinking about this: who owns my users' mail log data? Me or them? I've always been under the assumption that it's me, and DU seems to viscerally disagree.

Whenever one of my user sends or receives an email, that fact is logged into a big file, /var/log/mqueue. This log contains the sender email address, recipient email address, and the intermediate servers it has been routed through, as well as internal processing information, like which filters my servers applied to get it to the correct mailbox -- these can actually be rather complex, and most were hand-programmed by me.

The user's actual mail lives in their spool directory, /var/mail/(the business's mail domain name), and I think of that as "theirs". This has their emails' content, subjects, attachments, etc. As the sysadmin I'm technically capable of reading their mail, but as an ethical point I would never read that without their requesting me to (this does happen sometimes, when an email gets corrupted and they ask me to see if I can fix it). Just as a technical point, they have computer permissions to "see" their mail but not others', and they don't have permissions to see their mail routing logs.

While I wouldn't read their emails, I read the mail logs all the time. Like every day, as part of my regular maintenance, looking for signs of abuse or hacking. I also make retention and deletion decisions about these data without any input from or explanation to my users. I wouldn't share the mail log with anyone, but then again the basis for that is protecting my privacy and security as an administrator, not theirs.

Who owns what data here? The privacy agreement I have with my users only mentions "emails", not "logs", and I'm not a lawyer anyways, nor am I looking for legal advice on DU, just a broader philosophical question here.

(Also, I've never had a warrant served, so I've never had to use my LLC's legal retainer to find out what my actual legal obligations here are.)

[geckosfeet]

1. Interesting. All those log files on every computer in the world. Who owns them?

The larger point being simply that they (logs files) exist. On every computer. And they contain so much data and information that it would make your head spin.

[Recursion]

2. Just as an idea of the amount of data we're talking here

I'm an absolute pissant in the email hosting world, and I have about 12 gigabytes of log data, with for a rough count 400 million individual entries, and this data is for the past 6 months or so.

[bunnies]

3. as the server admin, its your data.

At least thats how Ive always looked at it. Seems to be the consensus in the field, afaik. Your server, your data created by your server. Your clients dont even have access to it. Imagine giving them access to server logs? It'd be a nightmare.

[Recursion]

4. The mind shudders, indeed (nt)

[geckosfeet]

11. OK. So I am a system user and am debugging something. I need access to error logs at a minimum.

Probably more than just the error logs, but that's enough to make the point. Unless you as the server admin want to debug every ones work in the organization, it's not just your data. It seems as if it is the collective data of the users groups. They at least need read access.

[bunnies]

13. Youre right.

I agree with you. Thanks for pointing that out.

[warrior1]

5. if you and others didn't do this work

wouldn't the whole system eventually break down?

[Recursion]

6. Which work?

And which whole system? (Just want to be clear what you're asking)

[Aerows]

7. I work with several thousand more than you do

and the data belongs to the user. I would snoop in someone's mailbox as soon as I would crash it on purpose. You are to be a priest or priestess with that data - it's not yours, and you don't snoop without probable cause.

That's the way I've always looked at it, and that's why my users trust me.

And besides, there are some things I don't want to know, a la Harriet the Spy.

[Recursion]

8. Did you read my post?

I'm talking about the logs in /var/log that record the email traffic to and from my server.

I said I wouldn't look in their mailboxes.

[Aerows]

9. It's a different issue

You are a private person that is maintaining a mailbox. People can opt not to work with you. They can't opt to not be under surveillance of the US Government. That's the difference.

One has the ability to provide you with a livelihood, the other has the ability to take your life away. That's what makes the difference to me, in my mind. And your /var/log records can glean far more information than just knowing a person or working with them, and we both know it.

I don't entertain horseshit arguments that logs don't provide more information than a user ever intended, and that's why we have to be careful about it. Web logs provide enough data because users use the same password over and over again that it would stun them. That doesn't mean I have to get on board with the "violate your privacy" train.

[Laelth]

10. To me, it's not a question of who "owns" the data.

It's a question of whether the government has the right to compel delivery of the data. The PA and the FISA Amendment say that it's perfectly legal for the government to seize (compel delivery of) the data. Whether or not that violates the 4th Amendment is the question, and we desperately need some new guidance from the SCOTUS on that question.

Personally, I don't think the FISA warrant leaked by Snowden meets the test of the 4th Amendment. Before such data can be Constitutionally seized, the government must procure a warrant issued "upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The warrant that the NSA uses to collect all this data is far too broad to meet the 4th Amendment's test, imho.

-Laelth

[geckosfeet]

12. But that leads directly to the question of who owns the data. Data, bits of information, is simply

records of activity on a a machine. No different than if you wrote notes or a report of your work activities or logged your project time on a piece of paper and passed it in to HR or whoever. As far as I can see it is simply a different mechanism.

But here is the issue, data logs are so very efficient, so very capable of recording such minute detail, that people construe it as a breech of privacy. I think that the real issue is people are simply unaware of the extent to which computers record their activities. And are unable to prevent other people from accessing that data.

I guess the bottom line is that the data effectively belongs to whoever can access it. Not that I think that is right, but technical know how seems to be the trump card.

As far as it (the accessing of log files) being in violation of the fourth amendment, I am not sure. On the one hand surreptitiously accessing data on a private machine would in itself be a breech. But if the company I work for agrees to allow government access to all employee machines then I have no reasonable expectation of my log files being protected by the fourth amendment.

[FarCenter]

14. I think that the logs are owned by you as records of your business.

They can be subpoenaed as business records.

Depending on your user's contracts, you may have an obligation to deliver RFC 822 header info to POP and IMAP mail clients. Webmail? I'm not so sure. Probably the user has no expectation of getting header information.

After 6 months, if the user has not retrieved and removed the email contents, it is now abandonded and it is yours. After 6 monts it is your business records. There was a court decision to that effect that you can look up.