2

I am creating a website where users can have anonymous discussions about personal topics. In order to protect our users, I would like to avoid keeping Apache logs. This way, even if the website is hacked, everyone will still remain anonymous.

Is it legal to not keep any logs?

Improve this question
3
  • 1
    I would ask a lawyer for that kind of info. One based wherever you host the server, I imagine. But then, I'm not a lawyer.... – Holocryptic Feb 28 '11 at 15:52
  • By the way, if the server is "hacked", there's nothing stopping an attacker from creating logs of connections. They just wouldn't get information up to that point, and if your users have logins they could still get access to your database for other data to mine... – Bart Silverstrim Feb 28 '11 at 16:00
  • 4
    What country is this for? – Brian Carlton Feb 28 '11 at 16:07
1

to my knowledge for the UK the answer is that it is fully legal not to retain logs (assuming your not in financial sector etc)

on the flip side however, it may be considered breach of the Data Protection Act to keep them beyond a reasonable time

be aware that without logging if there are application problems you wont be able to track down errors as easily

Improve this answer
1
  • We're using Django and all application errors are emailed to the dev team. – Natan Yellin Feb 28 '11 at 15:55
1

As a general statement what you log is pretty much up to you, however you should definitely consult an attorney if you have any questions. You may also want to have a written policy regarding logging & stick to it, otherwise if some government goons come to you seeking logs it may be difficult to convince them you don't have them / never kept them.

The legality of retaining logs varies based on
(a) What you are logging,
(b) Where you are, and
(c) What you do.

For example, in the Great State of New York it is perfectly legal for me not to keep server logs of any kind (Where we are). However my company is required by US Federal Law to retain certain logs (access to healthcare information -- What we do).

Similarly some places may ostensibly make it ILLEGAL to keep server logs -- In the Great State of Pennsylvania there are some pretty strict laws about recording conversations (wiretap), so if your intent is to record every interactive session you could conceivably run afoul of that law.

Improve this answer
0

It is legal, unless you are governed by something like USDA etc... which may require a retention period for things like logs, and email. There are plenty of traffic logs behind your own server to satisfy whatever party may want them.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.