Confirm that zip codes aren't logged about call.mozilla.org HOT 9 CLOSED

I can confirm we are logging zip codes. I believe we'd possibly need to store these for everyday callers, but I'll let @rubbingalcoholic chime in.

21:21:23 web.1 | {address space usage: 309776384 bytes/295MB} {rss usage: 70451200 bytes/67MB} [pid: 18180|app: 0|req: 174/15033] 10.166.48.237 () {42 vars in 1620 bytes} [Thu Feb 5 21:21:21 2015] POST /call_complete?userPhone=3129709080&repIds=SPECIAL_CALL_%7B%22intro%22%3A+null%2C+%22name%22%3A+%22Amy+Bender%22%2C+%22office%22%3A+%22Commissioner+O%27Rielly%22%2C+%22number%22%3A+%22202-418-2300%22%7D&campaignId=fcc-blanket&call_index=0&ip_address=50.178.239.35&saved_zipcode=60181 => generated 291 bytes in 1969 msecs (HTTP/1.1 500) 2 headers in 84 bytes (3 switches on core 90)
Feb 5 21:21:23 i-492ee1a6 app=callcongress-staging: 21:21:23 web.1 | {address space usage: 309776384 bytes/295MB} {rss usage: 70451200 bytes/67MB} [pid: 18180|app: 0|req: 174/15033] 10.166.48.237 () {42 vars in 1620 bytes} [Thu Feb 5 21:21:21 2015] POST /call_complete?userPhone=3129709080&repIds=SPECIAL_CALL_%7B%22intro%22%3A+null%2C+%22name%22%3A+%22Amy+Bender%22%2C+%22office%22%3A+%22Commissioner+O%27Rielly%22%2C+%22number%22%3A+%22202-418-2300%22%7D&campaignId=fcc-blanket&call_index=0&ip_address=50.178.239.35&saved_zipcode=60181 => generated 291 bytes in 1969 msecs (HTTP/1.1 500) 2 headers in 84 bytes (3 switches on core 90)
21:21:23 web.1 | {address space usage: 305917952 bytes/291MB} {rss usage: 66031616 bytes/62MB} [pid: 18182|app: 0|req: 29/15034] 10.28.141.118 () {42 vars in 1251 bytes} [Thu Feb 5 21:21:23 2015] POST /call_complete_status?userPhone=3129709080&ip_address=50.178.239.35&campaignId=fcc-blanket => generated 181 bytes in 1 msecs (HTTP/1.1 200) 2 headers in 72 bytes (3 switches on core 94)
Feb 5 21:21:23 i-492ee1a6 app=callcongress-staging: 21:21:23 web.1 | {address space usage: 305917952 bytes/291MB} {rss usage: 66031616 bytes/62MB} [pid: 18182|app: 0|req: 29/15034] 10.28.141.118 () {42 vars in 1251 bytes} [Thu Feb 5 21:21:23 2015] POST /call_complete_status?userPhone=3129709080&ip_address=50.178.239.35&campaignId=fcc-blanket => generated 181 bytes in 1 msecs (HTTP/1.1 200) 2 headers in 72 bytes (3 switches on core 94)

from call.mozilla.org.

from call.mozilla.org.

from call.mozilla.org.

We're removing the voice instructions on how to get recurring phone calls (one per day) and not using that feature.

Can we please meet in the middle and keep the logs for a day before wiping them? Then we ditch the data, but I still have logs to work from if we have issues.

from call.mozilla.org.

from call.mozilla.org.

Logging happens in the code two ways, through stdout and when writing to a postgres database.
If no database is set up, postgres logging is disabled automatically.

I can make modifications to omit ZIP codes from the logs.

from call.mozilla.org.

There are 3 data practice areas to consider.

1. Collect what we need (least amount of data)
   • I think we need some logging to monitor and maintain the service. That's reasonable.
   • Turning off postgres is a good additional step in minimizing what we collect.
2. De-identify where we can (least identifiable form)
   • If we don't need these for monitoring purposes (@jdotpz to confirm), and we have the ability to filter them out of the logs then we should:
     • zip code
     • IP address (would we need this to address spam?)
     • userPhone (is this the end user or something internal to the system?)
3. Delete when no longer necessary (least amount of time)
   • But, if filtering out those particular fields is not reasonable, or limits our ability to maintain the app, the most important thing is not to keep the logs indefinitely
   • Deletion after 24 hrs is reasonable
     • If we have a use case for storing longer, that's OK so long as we know how long for and why
     • The goal is minimal data, not to be completely blind 😉

And naturally this assumes the remaining practices about storing securely, and limiting access to the data we do collect.

from call.mozilla.org.

I would like to keep IP and userPhone for my daily logs to address spam. Someone can change IP's and/or phone #'s to abuse the call system, so for troubleshooting and catching abuse, that would be ideal. I do not need zip codes in the logs. I'll open an issue for @simonwex to remove the zip code from logging, and another for me to ensure removal of the call logs, pointing back to this issue.

I will only need these on the servers themselves, so I will remove the syslog shipment to loggins for this app, and set a daily job to remove the days logs.

from call.mozilla.org.

I'm going to store a hash of phone number + secret in order to avoid spam, but not store phone number instead.

from call.mozilla.org.