0

I started a small experiment. I put up a few servers on digital ocean and I started logging all the failed login attempts. They were numerable.

The dataset after a week is a fun one to play with. I'd love to use it in trainings or even share it on my blog. Is there any reason why I wouldn't be able to do this legally?

The dataset contains a datetimestamp, an ip adress, a username for the attempted login and the location of my server.

|improve this question
1

There are privacy laws in the EU that could prevent you from doing this, because you can't publish personal information, pursuant to current and new rules (GDPR) effective in 6 weeks. This includes an IP address:

Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, your posts on social networking websites, your medical information, or your computer's IP address. The EU Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet.

Whether or not someone will come knocking on your door to arrest or sue you is hard to tell, but the odds are good that somebody else whose computer system you are using will care (because they do business with the EU), and they will make you stop.

|improve this answer
  • Hmm, I'm not sure if attempting to commit a crime counts as "private, professional, or public life". But, maybe it does. – dsolimano Apr 7 '18 at 20:22
  • The ip address also the username is what relates to "private, professional, or public life". There isn't an exception about information that you think might have come from an attempt to commit a crime, even if you're certain that the failed login was a criminal attempt and not fat fingers. – user6726 Apr 7 '18 at 21:26
  • Does that mean Spamhaus and other anti-abuse vendors can now be required to delete all of their anti-abuse data sets upon the request of the abusers? – dsolimano Apr 8 '18 at 2:02
  • 1
    Isn't there an exception for legitimate business purposes that would cover them? Nevertheless, uh, ask that as a question, @dsolimano ? – Stackstuck Apr 9 '18 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.