Problem: Oversighted revisions often contain non-public personal information, which can be accessed to arbitrarily by oversighters. There is a risk of oversighters being bribed to search for oversighted information, in order to dox someone.
Proposed solution: Each access to oversighted contents should generate a private log entry, and thus abnormal information collections could be detected. It's not applied to recent oversighted contents for review convenience.
Who would benefit: People who have personal information oversighted.
I agree. However, I think that checkuser log, and oversight log should be publicly logged in order for normal users to find abnormal actions of the checkuser or the oversighters. Thingofme (talk) 15:33, 15 January 2022 (UTC)[reply]
IP access is soon going to be logged, so this seems like a reasonable request. Pretty sure it's not what I would want the team to spend time on though. --Izno (talk) 00:22, 17 January 2022 (UTC)[reply]
And maybe, logging any deleted view access? I still do not think arbitrary people would be able to see the logs per the privacy policies... that said, not sure of the size of this request. Izno (talk) 00:24, 17 January 2022 (UTC)[reply]
@Izno I don't think logging any deleted views would be useful, since they don't generally contain any sensitive data (unlike oversighted material and IP addresses after they are masked). ~~~~ User:1234qwer1234qwer4 (talk)20:14, 7 February 2022 (UTC)[reply]
A public OS log would not be permitted - and at times would be actively counterproductive. In regards to Thingofme's comment, a public CU log would be catastrophically counterproductive - think how orangemoody would have done if the editors in question could have known the noose was tightening. Nosebagbear (talk) 13:15, 18 January 2022 (UTC)[reply]
The CUs on enwiki have explained quite well why the CU log is private: they check some accounts and decide that there was a violation. They then check all the accounts' IP addresses to look for additional socks, and any account they find on the said IPs for confirmation that it is in fact a sock (and frequently decide some aren't). If the check log were public, that would be a huge amount of private data revealed to the public. 2.55.185.24618:52, 22 January 2022 (UTC)[reply]
In case of legal need, I am pretty sure HTTP access logs already allow WMF or legal authority to check all log accesses. -- Pols12 (talk) 13:44, 29 January 2022 (UTC)[reply]
I'm not sure how long the HTTP access logs are kept. This proposal will let other volunteers (oversighters & stewards) be aware of permission abuse, before a WMF investigation. Lt2818 (talk) 16:05, 29 January 2022 (UTC)[reply]
To respond to those saying we should "trust functionaries" - that attitude is simply naive. "Who watches the watchmen?" It's a basic principle of human nature that oversight needs oversight. Everyone needs accountability, no-one is perfectly trustworthy, and even if they were, it doesn't hurt to prove it. ··gracefool☺22:13, 4 February 2022 (UTC)[reply]
We should trust them, because they have got to where they are by showing that they are suitable for the role by many years of work and have earned the trust granted to them over years, and often more than a decade of service. They will have been through community approval (such as Request for Adminship), likely several times over. Their real identities are all known by the WMF as well. Mako001 (talk) 03:16, 5 February 2022 (UTC)[reply]
Support After my edit suggestion, I think I do not understand about the proposal. It would mean to limit the abuse, with the abuse reported to cawikimedia.org. Thingofme (talk) 14:09, 29 January 2022 (UTC)[reply]
Oppose This and any derivative of it, would, first, risk undermining the privacy policy (and could actually expose the WMF to legal issues). Second, functionaries have got to where they are by years of valuable contributions, and have earned the community trust over many years. They will have been in the hotseat to obtain community approval several times, and are by far the most universally trusted users. This is at best, unnecessary, and at worst, harmful. Mako001 (talk) 03:26, 5 February 2022 (UTC)[reply]
Oppose for the privacy reasons raised above, but also because we don't need our CUs hesitating over every action in case they get dragged to some noticeboard by a disgruntled troll. SpinningSpark12:48, 6 February 2022 (UTC)[reply]
Support I'm surprised this doesn't exist yet. A private list that logs views of oversighted data makes sense for the same reason that a private list of CU views. There have been cases of checkusers loosing the tools because of misuse, so the argument that no-one needs to watch the watchmen doesn't apply even in practice. Uanfala (talk) 15:47, 7 February 2022 (UTC)[reply]
Support I was quite surprised recently when I found out that this didn't exist yet, and Uanfala pretty much sums up what I was going to say. Also, "no need to watch the watchmen" is objectively not consistent with procedures of projects having an arbcom or comparable institution. ~~~~ User:1234qwer1234qwer4 (talk)20:30, 7 February 2022 (UTC)[reply]
Support a private log of views of OS data. We have had cases of private information misuse by editors in very high positions in the past. A tool for accountability is not the same thing as distrust. — Bilorv (talk) 12:29, 9 February 2022 (UTC)[reply]
I can't tell whether this is suggesting that the log (including info on if a lookup happened at all, not just the contents) would be only visible to the relevant functionaries. If so, then Support and I'm also surprised this doesn't already exist. --Yair rand (talk) 23:39, 10 February 2022 (UTC)[reply]
Support --NGC 54 (talk｜contribs) 22:55, 28 January 2022 (UTC)
Oppose OOS for Community Wishlist, why not just report via ca
wikimedia.org for abusing of Oversight rights? --Liuxinyu970226 (talk) 07:50, 29 January 2022 (UTC)
