Legal:Guidelines for modifying CheckUser logs

CheckUser is a MediaWiki extension that allows additional metadata (such as IP address and User-Agent) to be stored on a per-action basis and queried by privileged users.

Some staff members of the Wikimedia Foundation have access to modify or delete log entries of CheckUser activity (CU log entry). Although rare, a staff member with such access may occasionally be asked to modify or delete a CU log entry. These guidelines describe the circumstances and process under which a staff member may do so.

When may I modify or delete a CheckUser log entry?

A Wikimedia Foundation employee may modify or delete the logs of CheckUser activity only if there is a legitimate privacy concern. A legitimate privacy concern includes, but is not limited to:

• When "personal information" (as defined by the Wikimedia Foundation privacy policy) about a user is revealed in a CU log entry, the information is not the kind ordinarily included in a CU log entry, and the information was obtained through routes other than the use of the CU tool; or
• When information identifying a user as a minor (under 18 years old) is revealed in the CU log.

Here are some examples of instances that do involve legitimate privacy concerns:

• The home address of a user is accidentally included in a CU log entry. Because addresses are considered "personal information" under the Wikimedia Foundation privacy policy and are not usually included in CU log entries, the home address may be removed from the CU log entry.
• A CU log entry reveals that a user is 15 years old. Because the CU log entry reveals that a particular user is a minor, it may be removed from the CU log entry.

Here are some examples of instances that do not involve legitimate privacy concerns:

• A CU log entry reveals a user's real name, but the user regularly refers to herself by her real name in talk pages. Because the CU log entry reveals information that is already public, it is not considered "personal information" under the Wikimedia Foundation privacy policy and the CU log entry may not be deleted or modified.
• A CU log entry includes a user's IP address. Although IP addresses are considered "personal information" under the Wikimedia Foundation privacy policy, because IP addresses are usually included in CU log entries, the CU log entry may not be deleted or modified.
• A CU log entry reveals that a user is 27 years old. Because the CU log entry does not reveal that the user is a minor, it may not be deleted from the CU log entry.

Should I note when a CU log entry has been modified or deleted? How?

Yes, you should note in the affected CU log entry that an entry has been modified or deleted.

• For example, a CU log entry may indicate that it has been modified in the following way:

01:00, 1 March 2014, Username1 got edits for Username2 (talk | contribs) [modified]

• For example, a CU log entry may indicate that it has been deleted in the following way:

[log entry removed]

Who should I tell if I want to modify or delete a CU log entry?

Before you modify or delete a CU log entry, you must at least inform:

• The Ombudsman Commission;
• Your direct supervisor or department head; and
• An attorney in the Wikimedia Foundation legal department or the Director of Community Advocacy. When informing a Wikimedia Foundation attorney or the Director of Community Advocacy, please include a copy of what the affected CU log entry currently looks like and what it will look like after you modify or delete it.

If I modify or delete a CU log entry, will there be a record of the old version retained anywhere?

The decision as to whether the old version of the CU log entry should be preserved in a secured location for future reference is solely at the discretion of the Wikimedia Foundation. Once a CU log entry is modified or deleted, the old version is permanently erased. For this reason, it is important to include a copy of what the affected CU log entry currently looks like and what it will look like after you modify or delete it when you notify a Wikimedia Foundation attorney or the Director of Community Advocacy. Providing this information will allow the Wikimedia Foundation to make an informed decision as to whether a record of the old version should be retained in a separate secured location.