741810 - [Privacy Review][Action Item] Logging Policy

Status: RESOLVED WONTFIX

(mozilla.org :: Security Assurance, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

A formal, published log retention policy is needed for public review on what we do with logged data.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

This is blocking the following privacy reviews

https://wiki.mozilla.org/Privacy/Reviews/CaseConductor
https://wiki.mozilla.org/Privacy/Reviews/BrowserID.org
https://wiki.mozilla.org/Privacy/Reviews/AccountProvisioner

Comment 2

[Eric Parker [:parker]]

Curtis, don't know if this what you are looking for:
https://mana.mozilla.org/wiki/display/INFRASEC/Logs+and+Privacy+Policy

Thought I'd bring it to your attention.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Yeah, we have seen that, what privacy wants is a public policy anyone can access.

Comment 4

[Yvan Boily [:ygjb][:yvan]]

How far away are we from:
https://mana.mozilla.org/wiki/pages/viewpage.action?pageId=20973178
and
https://mana.mozilla.org/wiki/display/INFRASEC/Logs+and+Privacy+Policy

Being something we can make public?

Comment 5

[Joe Stevensen [:joe]]

I recommend finishing the logging policy first, and then extracting any of our security specific info that is not appropriate for public consumption.

The logging policy is a Q2 goal for OpSec. I don't think it would be very difficult to produce a public version as well.

Comment 6

[Mark Banner (:standard8)]

Setting privacy-review-needed as this doesn't seem to have gone anywhere...

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Joe, what is the status of the policy you mention in comment 5?

Comment 8

[Joe Stevensen [:joe]]

The policy at 

https://mana.mozilla.org/wiki/display/SECURITY/Logs+and+Privacy+Policy

looks complete now.

I don't see anything in it that needs to be *private*.

Comment 9

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Can we move this to the wiki or make it so it is visible publicly?

Comment 10

[Joe Stevensen [:joe]]

Check with mcoates.

Comment 11

[Michael Coates [:mcoates] (acct no longer active)]

Where is our proposed location for public policies? Organization is key here.

Comment 12

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Michael Coates [:mcoates] from comment #11)
> Where is our proposed location for public policies? Organization is key here.

That is an obvious discussion as of now I don't think we have any policies like this in public view do we?