response 1 of 184:

Sep 3 15:41 UTC 2002

It seems to be a matter of compulsive data retention, which is a common
problem for a lot of businesses.  Any personal information that has
fulfilled its purpose should be deleted, *especially* things like credit
card numbers.  I'd be pretty annoyed if I bought something at a store and
discovered they still were keeping my CC # on file six months later.  That's
just asking for trouble, and it's completely unnecessary.  Once Grex has
gotten payment and used the number to verify the person is who they say they
are, there's no reason to keep it after that.

response 3 of 184:

Sep 3 16:14 UTC 2002

I think its a spin-off of item 123.

response 5 of 184:

Sep 3 16:49 UTC 2002

Does Grex have any guidelines for what data the treasurer is to keep and for
how long?

response 7 of 184:

Sep 3 17:17 UTC 2002

Apparently the treasurer is, or that's the impression I got in item #123.

response 9 of 184:

Sep 3 17:50 UTC 2002

Well, I think that jp2 is ascribing to Grex some Machiavellian
intentions that it doesn't have, but the issue of grex maintaining
personal financial information for some members is a real problem, and
does exist.  Mark has said that he's doing this in order to ease the
burdern for lapsed members who re-join, and I believe him, but I still
think it's a bad idea, and should change.  Marcus brought up the issue
of not adding to Mark's burden, which I also agree with.  Allow me,
a non-member, to humbly propose the following as a point of policy:

Grex should collect ID from it's membership, but once that ID has
been verified, it should be destroyed.  Current members who let their
memberships lapse beyond the grace period, and who later rejoin, take
it upon themselves to provide ID to grex again at the time they renew
their membership.

I think this would lessen the burden on the treasurer, as s/he doesn't
have to keep anything at all.  This still upholds the spirit of grex's
bylaws as membership is still authenticated (albeit crudely), but enhances
the current situation because privacy is maintained.

response 11 of 184:

Sep 3 19:08 UTC 2002

What does a sysadmin intend to do by "finding" an individual being accused
of "net abuse"?
I think disabling a member's account is sufficient enough in such an event.
That in mind, destroying an ID after validation of said individual to the
account should be adequate.  Otherwise, Grex is expected to disseminate a
privacy statement to each member annually, amongst other hassles the treasurer
is sure to not appreciate.  I also think that a re-validation of ID is not
too much to ask of expired members, considering information may change from
time to time.  That may also bring into question if a records retention
schedule should be implemented which requires a renewal for existing
members..maybe on a 5 year cycle? 2 years? etc..

response 13 of 184:

Sep 3 20:05 UTC 2002

Regarding #10; well, grex can certainly retain a record of the individual;
for instance, keep a copy of his or her name and address, maybe a phone
number.  Keeping a copy of their actual ID is gratuitous.  Think for the
former as contact information, the latter as verification (again, crude)
of that information.

response 15 of 184:

Sep 3 21:13 UTC 2002

Maintaining the information on IDs to "track people down" is in fact putting
Grex in the position of liability.  A double edged sword is being produced
when you state that IDs are kept for "finding" people.  Rather than declaring
a statement of limited liability on behalf of Grex, a statement of liability
is being endorsed simply by practice.
Does that make sense what I'm saying?
If I'm a third party, and someone originating from the Grex domain appears
to be doing damage to my network, then I might be able to hold Grex liable
with the expectation that Grex would seek to prosecute the someone in
question.  On the other hand, if Grex has a standard of not requiring ID from
the member base, it can be safely assumed Grex will not be able to produce
sufficient data on that someone.

Then, on an even slipperier slope is the question of privacy and security.
At which point will you be expected to follow the Computer Fraud and Abuse
Act, Electronic Communications Privacy Act, Computer Security Act, National
Infrastructure Protection Act, Privacy Act, etc etc once you have opened the
pandora's box of admitting any level of monitoring or auditing on a membership
basis?  At that point, whom in the Cyberspace heirarchy will be the ultimate
responsible party to answer for any shortfalls a law enforcement request might
produce?

response 17 of 184:

Sep 3 22:59 UTC 2002

If you guys have some specific laws in mind, you probably ought to quote
them instead of just giving their names, which doesn't tell me much.

Grex has always had a policy of requiring ID from its members, for the two
reasons I mentioned.

response 19 of 184:

Sep 4 01:05 UTC 2002

If you don't like our practices, I suggest you do one of two things:    

        * Become a member and propose a specific change, or

        * Don't become a member, in which case they don't apply to you.

Since there is a blatant attempt underway to confuse issues regarding our 
membership and recordkeeping practices, I strongly suggest that we take 
with a grain of salt any suggestions or implied threats by anyone not 
directly affected.

response 23 of 184:

Sep 4 03:03 UTC 2002

Handy with the hyperbole, aren't we?