2

People worry about privacy issues of Facebook and Google, but Wikipedia, being the nice and not-for-profit guys that they really are, does not receive much attention. However, if access logs are not properly taken care of, they could be mined and exploited by third parties.

Wikimedia is clearer about what happens when you edit a page, such as keeping IP logs. When it comes to simple access and visualization of a page, it's not so clear. Wikipedia privacy policy says that

When a visitor requests or reads a page, or sends email to a Wikimedia server, no more information is collected than is typically collected by web sites. The Wikimedia Foundation may keep raw logs of such transactions, but these will not be published or used to track legitimate users.

The words 'typically' and 'may' are weasel and raise some questions. For example, what is logged? IP, browser version and OS are typical, is it also logged, as in the edits? For how long is it kept?

It's true that

Wikimedia policy does not permit distribution of personally identifiable information under any circumstances.

But it made me wonder that since selected editors have privileged access to that information it may only take one human error or evil intent to leak it.

Improve this question

1 Answer 1

Reset to default
5

The 'simple English' version of the privacy policy page describes what information is logged on page view: http://simple.wikipedia.org/wiki/Wikipedia:Privacy_policy#Private_logging

64.164.82.142 - - [21/Oct/2003:02:03:19 +0000]
"GET /wiki/draft_privacy_policy HTTP/1.1" 200 18084
"http://en.wikipedia.org/wiki/Wikimedia_projects:Village_pump"
"Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/85.7 (KHTML, like Gecko) Safari/85.5"

This log is said to be sampled but they typically store IP, timestamp, referrer and browser. Some countries do not allow conservation of logs containing IP addresses for more than 6 months (like France). Wikipedia says that "These logs are used to produce the site statistics pages; the raw log data is not made public, and is normally discarded after about two weeks."

Log data may be examined by developers in the course of solving technical problems, in tracking down badly-behaved web spiders that overwhelm the site, or very rarely to correlate usernames and network addresses of edits in investigating abuse of the wiki.

Derived data from this log are not supposed to be released except in the following cases:

  1. In response to a valid subpoena or other compulsory request from law enforcement
  2. With permission of the affected user
  3. To Jimbo Wales, his legal counsel, or his designee, when necessary for investigation of abuse complaints.
  4. Where the information pertains to page views generated by a spider or bot and its dissemination is necessary to illustrate or resolve technical issues.
  5. Where the user has been vandalising articles or persistently behaving in a disruptive way, data may be released to assist in the targeting of IP blocks, or to assist in the formulation of a complaint to relevant Internet Service Providers
  6. Where it is reasonably necessary to protect the rights, property or safety of the Wikimedia Foundation, its users or the public.

So it is again pretty vague...

Note that Wikipedia does not store cookie (tos-dr) and does not host third-party trackers (conf. Ghostery)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .