# Moderators can view emails and export user lists
**URL:** https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114
**Category:** Support
**Created:** [January 3, 2017, 5:27pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114 "2017-01-03T17:27:09Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@justeat](https://meta.discourse.org/u/justeat)
#### Post date: [January 3, 2017, 5:27pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/1 "2017-01-03T17:27:09Z")
This is… insane.
In any forum, moderators can see the emails of users and even less the possibility of exporting them and downloading them to a csv file.
This is a huge security hole. While promoting someone as a moderator means that you have confidence in that person, but it is crazy to think that that person can have access to a list of users with data and even that you can download them.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 3, 2017, 5:37pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/2 "2017-01-03T17:37:18Z")
Viewing emails is logged and requires a click on a button to display. Similarly export is logged.
If you don’t trust your moderators, demote them to trust level 4 users.
---
### Author:  [@justeat](https://meta.discourse.org/u/justeat)
#### Post date: [January 3, 2017, 6:21pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/3 "2017-01-03T18:21:23Z")
> [@codinghorror](#):
>
> Viewing emails is logged and requires a click on a button to display. Similarly export is logged.
>
> If you don’t trust your moderators, demote them to trust level 4 users.
That worked, thanks.
It is not a question of trust, it is that a moderator should not have those privileges. A moderator is a person who helps in a forum, editing, editing, moderating.
But that does not mean that you can have full access to download user listings. Even if you trust someone, they can deceive you.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 3, 2017, 6:28pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/4 "2017-01-03T18:28:04Z")
Yep, turns out, nobody can be trusted. Including yourself.
---
### Author:  [@justeat](https://meta.discourse.org/u/justeat)
#### Post date: [January 3, 2017, 6:53pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/5 "2017-01-03T18:53:34Z")
---
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [January 3, 2017, 7:35pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/6 "2017-01-03T19:35:58Z")
Moderators need to investigate possible spammers, duplicate accounts, forgot my login/password, etc. Checking email addresses is important for many of those tasks.
---
### Author:  [@Silvanus](https://meta.discourse.org/u/Silvanus)
#### Post date: [January 4, 2017, 10:11pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/7 "2017-01-04T22:11:57Z")
There seem to be varying definitions of moderators. As far as I know:
- In Discourse, trust level 4 is what most people call moderators. They **moderate the discussion** in the forum.
- What Discourse calls moderators are people, who have nearly administator rights. They are _staff_ of the forum. They have rights to flags, they can ban, they can suspend, they can almost everything, except change the basic structure of the forum (which is up to admin). In short, Discourse’s moderators are **moderators of the site** , not the discussion.
---
### Author:  [@modius](https://meta.discourse.org/u/modius)
#### Post date: [March 9, 2018, 1:20am UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/8 "2018-03-09T01:20:15Z")
> [@codinghorror](#):
>
> Viewing emails is logged and requires a click on a button to display. Similarly export is logged.
I can see where email inspection is logged.. but for the life of me I can’t seem to find where exports are logged.
Wouldn’t it make sense to be under Logs \> Staff Actions?
I exported the entire user base but I can’t see an entry in **Staff Actions** and I don’t see anything that looks like **Export** in the filter.
Any help much appreciated.
---
### Author:  [@modius](https://meta.discourse.org/u/modius)
#### Post date: [March 9, 2018, 1:29am UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/9 "2018-03-09T01:29:58Z")
While I can’t find an evidence trail in logs, I have found a work around.
As **System** sends an export email, you can locate the user and review the **Sent** archive for **Data export complete**.
Hope that helps someone 😉
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [September 18, 2018, 11:13am UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/10 "2018-09-18T11:13:28Z")
> [@codinghorror](#):
>
> Similarly export is logged.
Are you sure? If so, when is the log action supposed to occur: when the export is requested or when the file is actually downloaded?
I’m asking because we have a log of a moderator deleting a PM entitled “user-list-data-export-complete” and that PM contains a link to a .csv.gz-file for download. There is no log of any export, though.
Does this mean that the export was requested but the file never downloaded (which means that the export is only logged if the file is downloaded)?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 18, 2018, 8:40pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/11 "2018-09-18T20:40:00Z")
You’re right, we _don’t_ log user list export from Admin, Users, Export. I just tested this myself and I see nothing in Staff Action Logs. ☹ Can you add this to your high priority list @vinothkannans?
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [September 18, 2018, 9:48pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/13 "2018-09-18T21:48:22Z")
In that case, I’d like to suggest that the action is logged when the list is actually downloaded, not when the download is requested. Forensically, it makes more sense.
Not sure how it is handled with other downloads like backups etc, but I suppose the same logic should apply there.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [September 18, 2018, 10:01pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/14 "2018-09-18T22:01:16Z")
It’s done as per below commit. Currently it’s logging when the download is requested.
[https://github.com/discourse/discourse/commit/9281b72308c7844396d41d67d61305b93d148236](https://github.com/discourse/discourse/commit/9281b72308c7844396d41d67d61305b93d148236)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 18, 2018, 10:47pm UTC](https://meta.discourse.org/t/moderators-can-view-emails-and-export-user-lists/55114/16 "2018-09-18T22:47:03Z")