Is there a law in the U.S. requiring forum owners to log IP addresses of anonymous posts? First let me specify that this question is about U.S. law. My mentions of EU law are just to put everything into perspective. I was reading that 4chan is required by law to log IP. "As required by law, even communities such as 4chan do require the logging of IP addresses of such anonymous posters". source: https://en.wikipedia.org/wiki/Anonymous_post Does anyone know why? Is it because the posts are made by anonymous users? My problem is this. My forum is visited by people from EU as well, and according to upcoming EU regulations, EU is increasingly pressuring it's controllers (like forum owners) to anonymize personal data (because if you don't = good luck to you), so that's what I'm trying to do right now regardless of the varying opinions on the matter, but on the other hand, I'm afraid that laws in the US will require me to store full IP once my users are anonymous which would inevitably defeat the purpose, unless such law (if truly existent) would allow me to store truncated IP addresses? I've searched the web for hours trying to find any info on this, but nothing suggests that there is any such law. Could it be that Wikipedia is simply wrong?
Anyone can say anything on Wikipedia – even they tagged that claim as requiring a citation. There's no way to directly prove that there is no such requirement, but these guys maintains that there are no such laws in the US, and EFF says the same thing. This Wiki page agrees, giving details about a specific bill introduced in the House and also in the Senate in the 111th Congress that did not become a law (it did not survive the scrutiny of the judiciary committee in either case). Another failed attempt was in the 112th Congress.
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.
In the US, the author would be able to wind an infringement lawsuit against the re-publisher. Title 17, the US copyright law codified, grants the author the exclusive right to authorize republication, and does not require that a person use their real name. The argument "It was on the internet, it's in the public domain" is utterly without legal merit. The same goes for the assertion that a person loses his rights if he is uncontactable. The author has stated the terms of the license, so there isn't even a reasonable argument that the infringement is innocent (unknowing: "I thought it was with permission). There is no requirement that you have to allow a potential user to hassle you about the license terms. The one thing that is special regarding anonymous and pseudonymous works is that under 17 USC 302, "copyright endures for a term of 95 years from the year of its first publication, or a term of 120 years from the year of its creation, whichever expires first". For a work whose author is identified, copyright "endures for a term consisting of the life of the author and 70 years after the author’s death". This assumes that the host site has not preempted author's license: Stack Exchange, for example, preempts an author's exclusive right, so you can copy stuff from here accorting to the SE terms of usage.
Art. 15(4) GDPR says: (4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. In addition, Art. 85 GDPR requires member states to: [...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...] So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database). The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail. In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
you can still have a free and open moderation-free internet in a post-Sec 230 world Sure, but remember what moderation-free means: no moderation whatsoever. That means no removal of offensive content like trolling, profanity-laden or racist rants, or even outright spam. Stack Exchange, for example, gets thousands of attempted spam posts a day, despite the fact that very few of them actually get through, and the ones that do are usually quickly removed. Section 230 protects Stack Exchange's ability to do this without incurring liability for what users post. Imagine a Stack Exchange in which spamming was allowed. So I would say that the EFF's statement is substantially accurate, in that the ability of sites to perform such moderation is fairly essential to their ability to function as communities. The fact that they could avoid liability by not moderating is not relevant if it would make the site unable to function properly.
1/06/17 update regarding comments and other answers: You can report criminal intent while reasonably remaining anonymous by using various methods, and this will let you do want to do: take an ethical step and make an effort to report the potential crime. Read below. First of all, using Tor is not illegal. Yes, there is illegal activity on Tor and the dark web it can access, and there is activity that promotes illegal things on Tor and IRL, but that doesn't make you a criminal by default by using a system that can be used by criminals. See Is it legal to use the Tor Network and Tor Software in the United States? The FBI and other law enforcement and intelligence agencies are well aware of Tor and the dark web; see https://en.wikipedia.org/wiki/Silk_Road_(marketplace) . (That may give you pause because some FBI agents were implicated in crimes when the agency investigated the broader crime.) Or should I assume that the proper authorities are already monitoring the site? I wouldn't assume they are already monitoring that particular site, but it's possible; the FBI at least is aware of its existence. It's a good idea to assume they run their own crawlers to index the site, and have agents who are members. Think of all the news stories your read about law enforcement posing as perps online to ensnare people; and then think about how much there is we don't know about these types of activities and their prevalence. If you really want to be paranoid and know that Tor is not perfect security, and that government agencies have serious power, know that the NSA is well-known to run many Tor exit nodes to packet sniff and store metadata and the full text of traffic (as well as clear, non-dark web traffic, too). And, it's an accepted fact that SSL has been cracked (SSL may or may not be in use in your case or technically relevant right now) by them, too, all re: Snowden. Deleting Tor from your PC/Mac means nothing; any 5th grader can do forensic analysis and discover the remnants of the Tor browser. Your local ISP may log Tor traffic, as such traffic has a signature. But again, simply using Tor doesn't not make you a criminal, but it could draw attention to you. And warrants get be gotten for ISPs and your PC. You remaining anonymous overall also assumes that you have not given out any information on that SE clone site that could identify you IRL. If you have, then you need to assess the risks to yourself; that could be your most serious privacy breach to other users beyond any technology (as well as to law enforcement if they for other reasons suspected you of illegal activity yourself.) That said, if you want to report the possible crime - for either legal or ethical reasons - you can remain mostly anonymous via email. Use the Tor browser from public wi-fi (try on a USB stick on a public PC and not from your laptop) and sign up for anonymous email with a fake name (breaking their TOS) at Yandex, which does not require phone verification. (Google, Yahoo, etc., require a phone number; this could be a burner or IP phone, but that's up to you). https://www.eff.org/deeplinks/2012/11/tutorial-how-create-anonymous-email-accounts You could also use one of the various disposable email sites, as pointed out by another user, but some such email domains and services are often automatically flagged as spam or blocked by agencies due to their nature. Try Google for "disposable email". Ditto the anonymous phone call services or email-to-fax services. There are different methods with different anonymity pros/cons. And, you could use snail mail, as was pointed out by another user. Mail a printout in a plain envelope (with no fingerprints) in a public mailbox some distance from where you live and usually use the PO; the USPS records metadata on all mail, but this can be reasonably anonymous, with care. In any case, since you read that the person has already "cased the house" and have a general geographic location, the FBI may take the information (and your tip) seriously and look into the possibility of a crime. If the FBI looks, they may not deem it serious enough - or see enough evidence - to do the work required to find the true IP or other digital forensics to locate the person. I don't know if it would make any difference (because of Tor's anonymizing)... But we don't know the other digital breadcrumbs the alleged perp has left; it's possible they could be tracked more extensively online - and then possibly located IRL - by the FBI. And, if you do send an anonymous tip by any method, you've done what is appears you want to do: take the ethical step and make an effort to report the potential criminal situation. 1/05/17 original answer: Take a look at FBI Forms — Tips - fbi.gov to submit an email tip: Please use this website to report suspected terrorism or criminal activity. Your information will be reviewed promptly by an FBI special agent or a professional staff member. Due to the high volume of information that we receive, we are unable to reply to every submission; however, we appreciate the information that you have provided. And/or there are phone numbers here: Submit a Tip — FBI
You tag the question with "criminal law", suggesting that by "illegal" you mean "is it a crime" -- that would depend on jurisdiction, but in the US or my state, it is not a crime. There are crimes that you could commit with such an account, but violating the TOS is not itself a crime. However, it is illegal, a breach of contract, as you can see from the TOS "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission".
In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE. The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is. Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.