Hacker News Reader

Comment by sillysaurus | Hacker News Reader

The worst case (that I can talk about) I saw involved requiring a specific employee be demoted due to improper care of a company's systems.

Would you expand on this? Are you saying that a court was meddling directly with an individual company's hierarchy?

View on HN

(Forgive a 5-year-old memory of one of many cases -- I probably have the numbers wrong) It went something like this: The director of engineering approved a log retention plan that kept access logs for 7 days or something. They wanted to reduce costs and issues with log files were the top reasons for getting called to support the service. The government needed to demonstrate that someone had accessed the service 14 days ago, and the government could not understand why the 'minimum' of 30-day access logs were not present. I think something else was missing, too. There was a back-and-forth, and since the company couldn't produce the logs as requested the government got a contempt of court with the understanding that the director would be demoted to an IC and not be anywhere near the production service. I think the company lawyers agreed to the conditions to make a worse outcome go away.

If it's not clear, there were strong personalities involved. One way to tell the story is the director went out of his way to poke a bear and got mauled. Another way to tell the story is that a bear went walking down main street looking for trouble ("How do we know you didn't change the retention policy to protect the individual?"). In both cases the guy lost his hand and the bear is still loose.

Is there a legal precedent for minimum time that logs must be kept, say for an email service or messaging service? I'm talking about US policy, if that makes it more clear.

Generally speaking unless you are specifically required to keep records for a regulatory purpose (i.e. tax), you don't have to keep logs at all. Lavabit used to keep logs for a limited time (I think a week?).

More concerning are key disclosure laws [1] and their crazy penalties that seem to be creeping in all over the world.

[1] https://en.wikipedia.org/wiki/Key_disclosure_law

No, but you must follow your own policy.

You also need to take reasonable measures to preserve relevant data when you have reasonable cause to suspect that litigation or an investigation will begin.

Not having a policy can hurt you. If you have no deletion/retention policy, and happen to destroy data for some random reason when a litigation begins, you or your company may be in trouble.

Note: IANAL, and different industries or data categories have specific legal requirements or best practices for retaining things.

It was likely agreed on (possibly via contract) to meet the compliance policy of the government agency. So I could see breach of contract. I don't know about legal precedent for logs per se, but there is precedent for retention of other files. For instance HIPAA involves some well known regulations around keeping and destroying medical data.

Software/technology is quickly becoming a place full of dangerous legal landmines.

so no matter how good encryption gets, government will simply ratchet up the penalties; financial and/or prison time; to keep pace.

we simply can be guilty hiding the nothing we have to hide

Don't be so bleak. If you're going to do something that will get the attention of any government, here's a simple rule to follow. Don't use 3rd parties. And if you must, do it in a way that can never be traced back to you in the "real world". It isn't hard and it isn't even illegal.

http://www.amazon.com/How-Be-Invisible-Protect-Children/dp/1...

Step 1: Don't buy a book called "How to be Invisible" from Amazon.

Reply on news.ycombinator.com