I started a small experiment. I put up a few servers on digital ocean and I started logging all the failed login attempts. They were numerable.

The dataset after a week is a fun one to play with. I'd love to use it in trainings or even share it on my blog. Is there any reason why I wouldn't be able to do this legally?

The dataset contains a datetimestamp, an ip adress, a username for the attempted login and the location of my server.

1 Answer 1


There are privacy laws in the EU that could prevent you from doing this, because you can't publish personal information, pursuant to current and new rules (GDPR) effective in 6 weeks. This includes an IP address:

Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, your posts on social networking websites, your medical information, or your computer's IP address. The EU Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet.

Whether or not someone will come knocking on your door to arrest or sue you is hard to tell, but the odds are good that somebody else whose computer system you are using will care (because they do business with the EU), and they will make you stop.

  • Hmm, I'm not sure if attempting to commit a crime counts as "private, professional, or public life". But, maybe it does.
    – dsolimano
    Commented Apr 7, 2018 at 20:22
  • The ip address also the username is what relates to "private, professional, or public life". There isn't an exception about information that you think might have come from an attempt to commit a crime, even if you're certain that the failed login was a criminal attempt and not fat fingers.
    – user6726
    Commented Apr 7, 2018 at 21:26
  • Does that mean Spamhaus and other anti-abuse vendors can now be required to delete all of their anti-abuse data sets upon the request of the abusers?
    – dsolimano
    Commented Apr 8, 2018 at 2:02
  • 1
    Isn't there an exception for legitimate business purposes that would cover them? Nevertheless, uh, ask that as a question, @dsolimano ?
    – Stackstuck
    Commented Apr 9, 2018 at 5:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .