Is there really ‘no way to guarantee that internet use at the library will remain private’, and have librarians ‘got the whole privacy thing wrong’, asks Paul Pedley, as he considers what the information profession can and should be doing to protect the privacy of its users.
MELANIE Schlosser writes that ‘libraries have a mission to educate users about copyright’ 1 It got me thinking about whether the information profession considers that it has a similar mission to educate users about digital literacy, and more specifically how they protect their privacy in the online world.
In this article, I want to ask four key questions:
1. are librarians able to guarantee the privacy of their users?
2. what are the risks of a data breach?
3. what can and should librarians be doing to protect the privacy of their users? And finally
4. does it matter?
Are librarians able to guarantee the privacy of their users?
Librarians cannot provide an absolute guarantee to protect the privacy of their users. As Matt Beckstrom says: ‘There is no way to guarantee that internet use at the library will remain private. There are just too many ways for someone to lose their privacy, and too many ways for the advertisers, governments and hackers on the internet to steal that privacy’.
Marshall Breeding makes a similar point: ‘One of the realities of the internet lies in the ability for any third party to intercept the transmissions of information as it travels among devices and servers. Wireless networks are an especially easy target. It has to be assumed today that any information transmitted as clear text across a local network or the internet will be intercepted and used’. For me, that leads on naturally to the issue of encryption. Does your library website, for example, use https://? One resource worth looking at is https://letsencrypt.org which is a free certification authority.
In a recent webinar Mike Robinson said librarians have done a good job of protecting privacy in the print world, but that in the online world they are somewhat lacking (I am paraphrasing, hopefully conveying the sentiment intended).
In a tweet dated 26 June 2016, TJ Lamanna said: ‘We keep talking about how libraries are heralds of privacy, but we are terrible at it’. Meanwhile, Hugh Rundle says: ‘Librarians talk good talk about user privacy but continue to use (and build) software that provides no protection from snooping librarians, contractors or police’, explaining that ‘librarians have tended to prioritise functions that make our lives easier rather than those that make library users’ lives easier’.
Joseph Esposito says: ‘Libraries have, with the best of intentions in the world, taken a strong position on privacy, and they have lost. They got the whole privacy thing all wrong. Rather than participate in the policies of their institutions and the many organisations that interact with them, they have abdicated their role and are now watching as their institutions are being colonized by commercial interests, which are no longer answerable to libraries’.
One thing is clear, copyright and intellectual property rights are far better covered in the literature than data protection and privacy. The analysis in Fig 1 found that copyright was covered 4.5 times more often than privacy.
Figure 1: The chart illustrates the number of articles on ProQuest Library Science as at 26 June, based on the following searches: TI,AB (librar*) AND TI,AB(privacy OR data protection); and TI,AB(librar*) AND TI,AB (copyright OR intellectual property).
Figure 2 is based on the following search on Proquest Library Science: librar* AND (data OR privacy) AND breach*).
What are the risks of a data breach?
There are a number of things which can cause a data breach. I have gathered some examples of incidents affecting libraries in which a data breach did occur, or where the incident could have led to a data breach, and these were attributable to the following causes:
- software upgrade glitch (which left personally identifiable information unintentionally exposed after the upgrade had taken place)
- misconfigured database
- insider threat (for example, an employee stole information about other library employees)
- a hacking attack
- Distributed Denial of Service (DDOS) attacks are becoming a routine strategy used by cybercriminals intent on committing fraud or extortion
- human error
- ransomware.
There are examples of data breaches from the LibraryPrivacyBlog. Vendors serving the library and information sector have also been responsible for a number of data breaches. A few examples include:
- In 2005 Reed Elsevier – owner of LexisNexis reported that social security numbers, drivers license information and addresses of 310,000 people may have been stolen
- There were reports in 2013 that reporters at Bloomberg News used a function that tracks how recently a Bloomberg client has logged in as a way of generating story leads about personnel changes.
- In autumn 2014 there were a number of reports that Adobe Digital Editions was sending back to the Adobe servers in plain (unencrypted) text details including a list of books read
- A tie-in between Overdrive and Amazon led to accusations that their library lending program was ‘anti-user, anti-intellectual freedom, anti-library’ and that libraries have been ‘screwed‘. This was because of concerns over the data about library users’ borrowing practices being in the hands of a corporation
My research has identified other types of example:
- should library users fear that their use of the library will lead to ridicule, or public humiliation? Nearly a decade ago, a library employee, using a pen name, wrote a book based on a number of library users. The names of the individuals weren’t used, but detailed descriptions of their unique characteristics and mannerisms were said to have made them easily identifiable within their small community[i].
- is it right for library users to have anything they search for on the library’s website beamed to the world in real-time? According to the Toronto Metro, the city’s public library uses Google Analytics, pulls the search topics together in a single place and shows this information in real time.
One question that libraries and their parent organisations need to ask is whether they have an internal data breach reporting procedure in place, and if not they should put one in place as a matter of priority. Doing so can help them meet the data breach notification requirements under the General Data Protection Regulation which is due for implementation by May 2018.
What can and should librarians be doing to protect the privacy of their users?
Here are just a few examples of practical steps that librarians can take in order to protect the privacy of their users.
1. Default search engine
Bookmark a search engine which respects user privacy as the home page, such as StartPage or Duckduckgo
2. Default browser
Use a browser which respects privacy such as Firefox rather than Google Chrome or Microsoft Edge
3. https
Websites that don’t use secure protocols such as https expose their users to surveillance and intrusion in the network. The Library Freedom Project had a campaign – the Library Digital Privacy Pledge – to encourage libraries to implement https on their web services.
4. Licence agreements
Check licence agreements and terms of service for privacy statements. When negotiating licences for new products, or organising the renewal of existing licences, use the opportunity to check the wording of privacy clauses and if necessary negotiate for them to be suitably amended.
5. Ad-blocking software
Install ad-blocking software. Some privacy campaigners advise against using Ghostery, whose parent company (Evidon) sells data to advertisers which helps them better formulate their ads to avoid being blocked.
6. Organise a cryptoparty
In May 2016, Newcastle City Library held a cryptoparty. ‘A cryptoparty is an informal gathering of individuals where people discuss, learn and share their knowledge of tools and systems to protect their privacy and electronic communications’. Cryptoparties can cover things like the use of the Tor Browser, PGP and full disc encryption.
7. Area on website dedicated to privacy issues
Create a dedicated area on the website about privacy (see San José Public Library's Virtual Privacy Lab).
8. Digital literacy training
Develop digital literacy training sessions for your users including information on how to protect one’s privacy whilst browsing the web. Matt Beckstrom says ‘teaching patrons how to use the internet, but not how to use it safely is like showing someone how to drive a car, but not where the seatbelt is.’
9. Automatically return library PCs to their native state
Use software such as Clean Slate which lets users simply log off in order to discard unwanted user changes to the desktop, programs, and documents. Another alternative would be Deepfreeze.
10. Carry out a cyber security risk management audit
A recent write up of a cyber security risk management audit, and the criteria used can be found in Code{4}Lib.
11. Privacy impact assessment
When new services are introduced, or any changes are made to the way those services are delivered, and/or when libraries switch technology provider, do they automatically think about the privacy implications.
Does it matter?
In short, yes it does matter. CILIP members are required to abide by the institute’s ethical principles as well as its code of professional practice. Respecting the privacy of our users is one example of how our ethical principles mark us out as being information professionals.
Here are the views of three commentators:
In the late 18th century, Jeremy Bentham designed the Panopticon, a prison with a watchtower, where prisoners could be watched from above, but where the prisoners could never be sure when or whether anyone was actually watching them. The mere thought that they MIGHT be being watched had a chilling effect which led them to behave differently. Here are two examples in a library context:
- A study at Central Michigan University’s Park Library found that LGBT material was borrowed 20 per cent more if done by self-check than using the traditional circulation desk
- A young woman stopped short of printing out her research on sexually transmitted diseases when she learnt that the printer was at the front desk [ii].
Privacy and behavioural change
What occurs to me, though, is that privacy does indeed change behaviour, but not just the behaviour of the person who knows or who thinks that they are being watched, or that their searches and borrowing activity is being closely scrutinised and shared with third parties. What if those who know something about you change their behaviour because they know something that you would rather they didn’t. What if they behaved in a discriminatory manner towards you, all because of what they know (for example, the willingness to offer you a product or service, or if they were to use price discrimination based on the personally identifiable information that they hold about you).
Update Magazine
This article was originally published in CILIP Update Magazine, November 2016.
There are lots of ways for CILIP members to access the full range of articles published in Update, including
Non-CILIP members can subscribe to the digital version of the magazine or join CILIP to get access to the full range of benefits.
Read Update Magazine
