PyPI Was Subpoenaed

The PyPI blog: In March and April 2023, the Python Software Foundation (PSF) received three (3) subpoenas for PyPI user data. All three subpoenas were issued by the United States Department of Justice. The PSF was not provided with context on the legal circumstances surrounding these subpoenas. In total, user data related to five (5) PyPI usernames were requested. The data request was: "Names (including subscriber names, user names, and screen names);" "Addresses (including mailing, residential addresses, business addresses, and email addresses);" "Connection records;" "Records of session times and durations, and the temporarily assigned network address (such as Internet Protocol addresses) associated with those sessions;" "Length of service (including start date) and type of services utilized;" "Telephone or instrument numbers (including the registration Internet Protocol address);" "Means and source of payment of any such services (including any credit card or bank account number) and billing records;" "Records of all Python Package Index (PyPI) packages uploaded by..." given usernames "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possible. In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data. I, as Director of Infrastructure of the Python Software Foundation, fulfilled the requests in consultation with PSF's counsel. We have waited for the string of subpoenas to subside, though we were committed from the beginning to write and publish this post as a matter of transparency, and as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023.

PyPI Was Subpoenaed

Admin

0 Response to "PyPI Was Subpoenaed"

Post a Comment

ad

Search Your Job