May 4, 2015

Choose Privacy Week 2015: Patron Privacy in Online Catalogs and Discovery Services

By Marshall Breeding
Crossposted from Choose Privacy Week

Concern for keeping records related to the details and borrowing activity of patrons has been a longstanding priority for libraries. We expect integrated library systems and related applications to include features to handle any data that specifically identifies a patron securely. As with any computer application, security features should be in place to prevent unauthorized intrusion. Beyond industry-standard security practices, libraries have an additional set of requirements related to protecting the identity and privacy of their patrons, especially related to any materials or electronic content borrowed or consulted.

Many libraries require the ability to remove links or data related to items charged out to a patron out of concern for privacy. Should a library receive an order from law enforcement or should an intrusion attempt succeed, only a minimal amount of data related to reading history would be available. This approach of anonymizing circulation transactions addresses privacy concerns, retains statistical data needed for creating reports describing collection use, but also limits the capability to use previous search and borrowing history to deliver personalized services to community members. Online catalog or discovery services might enable borrowers to set a preference to preserve their borrowing or search history, but few may be aware of the option or its implications. In the context where commercial entities aggressively collect personal data, individuals may both have concerns about the invasion of their privacy, but also appreciate personalized services.

Scrubbing circulation transaction histories, however, only scratches the surface of the larger set of vulnerabilities that library systems must address to effectively manage patron privacy. A variety of other security features must be employed related to the storage and transmission of patron details and activity.

In support of circulation, integrated library systems manage records for each library patron, including a variety of personal details. Although these records may not include credit card numbers, they do contain information of considerable interest to identity thieves. When stored as clear text, any intruder to the system gains easy access to these sensitive details. Encryption technologies provide an additional layer of protection that keeps data secure even when an unauthorized entity gains physical access. Computer applications regularly use encryption to protect the files that contain usernames and passwords, credit card data, or other categories of sensitive data. While most library systems follow industry practices to encrypt login credentials, encrypting the patron files themselves is not a common practice.

Beyond the internal storage of data files, how systems transmit patron sessions over the web represents one of the most troubling vulnerabilities for privacy. In today’s environment, it should be assumed that any text sent over the web as clear text can be intercepted and used by any unknown third party. The session of a patron searching and viewing items through a library’s catalog or discovery service includes potentially sensitive data regarding content consumption, including any queries typed by the user, items displayed in response to that query, and those selected, viewed or downloaded. If logged in, any text displayed form their account profile, including items currently charged, fines owed, or personal details would likewise be exposed. Other clues can tie session data to a particular individual, including their IP address, geolocation data, serial numbers from their devices, or data gleaned from e-mail or other applications that might transmit personal details.

As with the internal storage of sensitive of files, encryption provides a high level of security to text transmitted via the Internet. It is universally expected that Web pages involving credit card payments and user-logins be delivered securely. By now, we all know to check for the padlock on our Web browsers before entering a credit card number on any Web site.

Use of encryption for patron session in library catalog or discovery services can be employed to vastly improve the privacy of patrons. In current practice, many library systems use selective encryption, primarily for log-in sequences and for the display of patron profiles. Encryption of the entire session to protect queries, results, and selections has not been widely deployed.

In the past, encryption of Web pages required considerable hardware and software resources, and was activated only for sensitive transactions. Now encryption consumes only a small increment of resources. Major destinations including Facebook, Google, Twitter employ encryption comprehensively, as would e-banking and any other site involving financial, proprietary, or financial data.  Libraries can close a major vulnerability in patron privacy through the use of comprehensive encryption for their entire Web presence, especially their online catalogs or discovery services. Making this change requires only a moderate level of technical difficulty and involves obtaining digital certificates and changing Web server configuration. In many cases, the library may need to work with the vendor that provides the product to make these changes. Encrypting patron sessions addresses a significant vulnerability, but shouldn’t be considered the only area of concern. Libraries and their system vendors need to diligently analyze and assess all aspect of their systems and services to discover and close any other cracks from which patron details may leak.

See the January 2015 issue of Smart Libraries Newsletter published by ALA TechSource for more detailed discussion and results of a brief vendor survey on how the major online catalogs and discovery services handle security and patron privacy.

Marshall Breeding is an independent consultant focusing on the strategic use of technology in libraries and related organizations.  He is the creator of Library Technology Guides and is the editor of Smart Libraries Newsletter published by ALA TechSource.   He also writes the Library Systems Report published by American Libraries and a monthly column for Computers in Libraries magazine, and has authored or edited seven books and hundreds of articles and essays. Breeding was the 2010 recipient of the LITA LITA/Library Hi Tech Award for Outstanding Communication for Continuing Education in Library and Information Science.

May 3, 2015

Choose Privacy Week 2015: Strong Passphrases for Privacy and Security

By Alison Macrina
Crossposted from Choose Privacy Week

I’m sorry to be the one to tell you this, but your password sucks. I know you use the same one for everything, and it probably contains some personally identifiable information – your dad’s birthday, your pet’s name, the year of your anniversary. Even if you think you’ve got a good password strategy, if it contains any kind of pattern – a famous quote, a song lyric – it’s can very easily be cracked. Consider how much access that password — the one you’re using for everything – gives to your private life. Whether you’re worried about exploits from criminal hackers or rogue government intelligence agencies, weak passwords put your private data at risk.

xkcd on password_strength

With thanks to xkcd .com

It’s not your fault you have such a terrible password – we’ve been taught a lot of bad rules about making passwords. This xkcd comic sums it up well; in fact, this comic spawned something that’s often called the “xkcd method” of creating strong passphrases – using four or five random words for a passphrase, resulting in something both strong and easy to remember. One of the simplest ways to come up with an xkcd-style passphrase is with dice and the Diceware word list, which Micah Lee of The Intercept recently wrote about. In brief, you role a die 5 times and choose the Diceware word represented by that number. Repeat this process 4 or 5 times total and you’ve got a high-entropy, easy to remember passphrase of random words.

You can use the method Micah wrote about to create a passphrase for a password manager like KeePassX. Using an in-browser password manager is placing a lot of trust in “the cloud”, which is really just an ethereal-sounding way of saying “a server that you do not control”. KeePassX lets you create an encrypted password database that is stored locally on your computer. It’s also free and open source software (FOSS), which allows the user to examine or modify the source code, making it much more difficult for, say, a government agency to place a backdoor in that software. If there is a backdoor, it’s not just being used by the intelligence agencies – you can guarantee that other people will find it and use it to exploit your private data(for more on FOSS and privacy, watch Jacob Appelbaum’s keynote from LibrePlanet 2014). Using a strong passphrase to log in to KeePassX, you can store more xckd-style passphrases in the database, or use the passphrase generator built into the software.

Another method for storing strong passphrases is with the Yubikey a small piece of hardware that fits in your USB drive and can also function as a two-factor authentication token. I use Yubikeys in static password mode which allows me to store two high-entropy passphrases. You press the button on the Yubikey when you need to retrieve your password – an additional measure of protection against exploitation, since passwords can be stolen by keyloggers. I use a prefix with the passphrases I store on a Yubikey – I type in the prefix, then I tap the Yubikey for the remainder of the passphrase. This way, if someone steals my Yubikey, they still don’t have my whole passphrase. If you are using Yubikey with a passphrase that you don’t memorize, be sure to back it up (you should back up the passphrases that you DO memorize, too – your memory is fickle, I promise). If you’re a GNU/Linux user, you can store the passphrase in an encrypted LUKS volume. You can also write the passphrase on a piece of paper and store it somewhere safe.

You’ll get used to this passphrase strategy pretty quickly once you’ve set it up. When you’re comfortable using it, consider how you could teach it to patrons in computer classes or technology help sessions. You may want to use or modify my course slides for a basic online privacy class, or incorporate passphrase strategies in existing computer instruction courses. Our patrons already look to us for help in learning to use their computers; this passphrase strategy is just one of many ways we can help our patrons take back some control of their online privacy and security.

Alison Macrina is the founder and director of the Library Freedom Project, an initiative that aims to make real the promise of intellectual freedom in libraries. The Library Freedom Project trains librarians on the state of global surveillance, privacy rights, and privacy-protecting technology, so that librarians may in turn teach their communities about safeguarding privacy.

May 2, 2015

Choose Privacy Week 2015: Raganathan and the Five Blind Librarians

By Eric Hellman

I’ve heard it told that after formulating his famous “Five Laws of Library Science“, the great Indian librarian S. R Raganathan set about thinking about privacy. Here’s what I remember of the tale.

It turns out that in India at the time, there were five librarians renowned throughout the land for their tremendous organizational skills, formidable bibliographic canny, and the coincidental fact that each of them was blind. It was said that “S” could identify books by their smell. “H” could classify a book just by the sound of the footfalls of a the person carrying it. “T” was famous for leading patrons by the hand to exactly the book they wanted; the feel of a person’s fingernails told him all he needed to know. “P” knew everything there was to know about paper and ink. “C” was quick with her fingers on a keyboard and there was hardly a soul in his city she had not corresponded with. But these 5 were also sought out for their discretion; powerful leaders would consult them, thinking that their blindness made them immune to passing on their secrets of affairs and of state.

So of course, Raganathan asked the five blind librarians to come to him so he could ask them about privacy. The great librarians began talking as they sat outside Raganathan’s house.

“On my way through the countryside I encountered a strange beast”, said librarian H. I can’t say what he was, but he had a distinctive call like a horn: Toot-to-to-toooot…” and librarian H recited a complicated sound that must have had at least 64 toots.

“By that sound, I think I encountered the same beast.” said librarian T. “I reached out to touch him. He was hard and smooth, and ended in a point, like a great long sword.”

“No, you are wrong”, said librarian P. I heard the same sound, and the strange beast is like a thick parchment, I could feel the wind when it fluttered.

“You fellows are so mistaken.” said librarian C “You touch for a second and you think you know everything. I spent 15 minutes playing with the beast; she is like a great squirming snake.”

“I know nothing of the beast except by smell,” said librarian S. “But what I do know is that the beast had just eaten a huge feast of bananas.”

At this, a poacher who had been eavesdropping on the five librarians picked up his rifle and ran off.

Just then, Raganathan emerged through his door. Surprised at seeing the poacher run off, he asked the librarians what they had been talking about.

When librarian S recounted the banana smell, Raganathan became alarmed. The poacher had run in the direction of a grove of banana trees. Before he could do anything, they heard the sound of a powerful shotgun in the distance, and then the final roar of a dying elephant.

With tears in his eyes, Raganathan thanked the 5 librarians for their trouble, and sent them home. Though the Raganathan’s manuscript on privacy has been lost to time, it is said that Raganathan’s 1st law of library privacy was something like this:

“Library Spies Don’t Need Eyes.”

Eric Hellman blogs at https://go-to-hellman.blogspot.com/ where he publishes his own research on how well vendors follow privacy practices.

May 1, 2015

Choose Privacy Week 2015: CPW Activities Around the United States

Crossposted from Choose Privacy Week

Libraries and schools around the country are observing Choose Privacy Week 2015 with a variety of activities.   Here’s a sampling of what libraries are doing:
Multnomah County Library Privacy Option flyersm

 

The Multnomah Public Library will observe Choose Privacy Week on Saturday, May 2 with “Is Privacy an Option?” a talk led by Mark Alfino, professor of philosophy at  Gonzaga University.  Alfino will discuss issues around privacy, transparency and why individual privacy choices matter.  Multnomah will also be offering patrons an opportunity to attend  classes to learn about “Privacy and Safety Online” on May 9.

 

CIPRCPW2015

 

On May 4, the University of Wisconsin at Milwaukee’s Center for Information Policy Research will welcome Washington University law school Professor Neil Richards for a talk about his new book, Intellectual Privacy: Rethinking Civil Liberties in a Digital Age in celebration of Choose Privacy Week.

 

The Douglas County Public Library in Georgia will offer teens a class on protecting their online privacy on May 7, while the Upper Arlington Public Library will be offering three different classes on privacy, including a May 2 class on “Simple to Advanced Privacy DIY,” a May 6  class,”Security First,” on password privacy, and a May 7 class, “Privacy on Your Mobile Device“.

The Greene County Branch of the Jefferson-Madison Public Library  published an article in their local paper promoting Choose Privacy Week that included a bibliography of  several books about privacy and government surveillance.   The University of Tennessee at Knoxville library marked Choose Privacy Week with a blog post while the Jefferson College library created a Choose Privacy Week libguide.  Portland Community College also created an  online resource for Choose Privacy Week for their users.

Does your library have plans for Choose Privacy Week 2015?   Let us know at oif@ala.org!

April 30, 2015

Choose Privacy Week 2015: Who’s Reading the Reader?

By Michael Robinson
Chair, ALA-IFC Privacy Subcommittee
(Crossposted from the Choose Privacy Week blog.)

It feels like online privacy has taken a step closer to center stage in libraryland in 2015. For years, a number of librarians have been advocating that libraries and the ecology of vendors and publishers they do business with need to do a better job of protecting the online privacy of our patrons. We will hear again from some of them in this year’s fantastic series of blog posts for Choose Privacy Week. Despite these voices of concern, privacy really did take a backseat as libraries struggle to deliver econtent, embrace the modern Web, and provide a better user experience.

Snowden’s revelations (was it just 2 years ago?) increased public concern over online privacy and many people feel increasingly powerless to protect themselves. Libraries stepped up to the plate and offer programs and classes around protecting your online privacy. But there is still a disconnect between what our ethics and policies are concerning online privacy and what our common practice has become. We offer classes on how to protect yourself as a consumer from commercial surveillance but cannot ensure that a reader’s privacy is protected when they access online content at the library.

Last October we were confronted with the extent of data that Adobe’s Digital Editions collects about users and their reading habits. These revelations are, in one sense, the library profession’s mini-Snowden. It exposed what some suspected all long and heightened concerns among a broader audience. It leaves us with questions about the patron data collection practices of the vendors and publishers we rely on. Questions which brings us to the theme of this year’s Choose Privacy Week, “Who’s Reading the Reader?”

As online privacy moves more towards center stage, there are a number of encouraging trends:

•The ALA Intellectual Freedom Committee published a revised Privacy Toolkit last year which describes policy issues and best practices.
• A Patron Privacy Technologies Interest Group recently formed within LITA.
• The ALA Digital Content Working Group which negotiates with ebook providers is showing increased interest in privacy issues.
• The Library Freedom Project won a Knight News Challenge grant to provide librarians and their patrons with tools and information to better understand their digital rights.
• The San Jose Public Library won a Knight News Challenge grant to develop online tools to help individuals better understand privacy.
• NISO is beginning work on a Consensus Framework to Support Patron Privacy in Digital Library and Information Systems.
• A new initiative called Let’s Encrypt that will provide a free and easy way for websites to move to HTTPS.

Libraries, vendors, and publishers must work together to tackle the issues of online privacy and develop practices that respect the core value of reader confidentiality. Individually, its overwhelming, but together we can do it. I encourage you to join us in the discussion this week by reading and commenting on the upcoming blog posts.

Michael Robinson is an Associate Professor at the Consortium Library, University of Alaska – Anchorage. In addition to serving as chair of the ALA-IFC Privacy Subcommittee, he serves as chair of the Alaska Library Association’s Intellectual Freedom Committee.

April 28, 2015

OIF protests removal of Absolutely True Diary from Waterloo, Iowa classrooms

Absolutely-True-Story-of-a-Part-time-IndianBarbara Jones, director of the Office for Intellectual Freedom joined the Iowa Library Association’s Duncan Stewart (president) and Michael Wright (Intellectual Freedom Committee chair) in asking the Waterloo School District to adhere to its school board-approved reconsideration policy instead of pulling The Absolutely True Diary of a Part-Time Indian by Sherman Alexie from all of their middle school classrooms.

In preparation for a school board meeting, a letter has been to the school board members, the superintendent, and the original challenger, executive director of K-12 curriculum. Click on the images below to read the text of the letter.

ala.waterlooala.waterloo2

 

 

 

 

 

The local newspaper, WCF Courier, reported on the controversy at the beginning of April. The superintendent is claiming that the district doesn’t need to follow policy because it wasn’t an official challenge. Many teachers disagree.

OIF will continue to monitor this situation. Follow us on Twitter at @oif for updates.

April 22, 2015

Banned Books Week celebrates Young Adult books in 2015

BBW Coalition Logo

BBW Coalition Logo

ALA's Banned Books Week Graphics

ALA’s Banned Books Week Graphics

 

Young Adult books will be the focus of Banned Books Week in 2015, the event’s national planning committee announced today. Banned Books Week, the annual celebration of the freedom to read, will run from September 27 through October 3, 2015, and will be observed in libraries, schools, bookstores and other community settings across the nation and the world.

“Young Adult books are challenged more frequently than any other type of book,” said Judith Platt, chair of the Banned Books Week National Committee. “These are the books that speak most immediately to young people, dealing with many of the difficult issues that arise in their own lives, or in the lives of their friends. These are the books that give young readers the ability to safely explore the sometimes scary real world. This Banned Books Week is a call to action, to remind everyone that young people need to be allowed the freedom to read widely, to read books that are relevant for them, and to be able to make their own reading choices.”

In recent years, the majority of the most frequently challenged books in libraries have been Young Adult (YA) titles. Six YA titles were on the list of the Top Ten Most Challenged Books of 2014, according to the American Library Association. Attempted bans on books of all kinds also frequently occur under the guise of protecting younger audiences.

Banned Books Week celebrates the freedom to read by encouraging read-outs, displays, and community activities that raise awareness of the ongoing threat of censorship. Last year, tens of thousands of people participated in Banned Books Week online. More than 500 videos were posted in a virtual read-out, and thousands participated in hundreds of events in bookstores, libraries, and schools and universities across the country.

BannedBooksWeek.org is a hub for information about how individuals and institutions can get involved. The website also includes resources and activities provided by event sponsors.

Banned Books Week is sponsored by the American Booksellers Association, American Booksellers for Free Expression, American Library Association, American Society of Journalists and Authors, Association of American Publishers, Comic Book Legal Defense Fund, Freedom to Read Foundation, National Association of College Stores, National Coalition Against Censorship, National Council of Teachers of English, People For the American Way Foundation, PEN American Center, and Project Censored.

Contact: Nanette Perez (nperez@ala.org) or Maggie Jacoby (mjacoby@gmail.com) for more information.

April 17, 2015

2014 Most Frequently Challenged Books List

The Office for Intellectual Freedom released it’s top most frequently challenged books list of 2014 as part of the State of America’s Library report. In 2014, the OIF received 311 reports regarding attempts to remove or restrict materials from school curricula and library bookshelves. Eight of the ten books featured on the 2014 Top Ten List of Frequently Challenged Books reflect diverse authors and cultural content.

The 2014 Top Ten List of Frequently Challenged Books include:

1) “The Absolutely True Diary of a Part-Time Indian,” by Sherman Alexie
Reasons: anti-family, cultural insensitivity, drugs/alcohol/smoking, gambling, offensive language, sex education, sexually explicit, unsuited for age group, violence. Additional reasons: “depictions of bullying”

2) “Persepolis,” by Marjane Satrapi
Reasons: gambling, offensive language, political viewpoint. Additional reasons: “politically, racially, and socially offensive,” “graphic depictions”

3) “And Tango Makes Three,” Justin Richardson and Peter Parnell
Reasons: Anti-family, homosexuality, political viewpoint, religious viewpoint, unsuited for age group. Additional reasons: “promotes the homosexual agenda”

4) “The Bluest Eye,” by Toni Morrison
Reasons: Sexually explicit, unsuited for age group. Additional reasons: “contains controversial issues”

5) “It’s Perfectly Normal,” by Robie Harris
Reasons: Nudity, sex education, sexually explicit, unsuited to age group. Additional reasons: “alleges it child pornography”

6) “Saga,” by Brian Vaughan and Fiona Staples
Reasons: Anti-Family, nudity, offensive language, sexually explicit, and unsuited for age group. Additional reasons:

7) “The Kite Runner,” by Khaled Hosseini
Reasons: Offensive language, unsuited to age group, violence

8) “The Perks of Being a Wallflower,” by Stephen Chbosky
Reasons: drugs/alcohol/smoking, homosexuality, offensive language, sexually explicit, unsuited for age group. Additional reasons: “date rape and masturbation”

9) “A Stolen Life,” Jaycee Dugard
Reasons: drugs/alcohol/smoking, offensive language, sexually explicit, and unsuited for age group

10) “Drama,” by Raina Telgemeier
Reasons: sexually explicit

2014 Book Challenges reported to ALA/OIF

Click for Full Size

 

April 15, 2015

Response Concerning the 2015 Banned Books Week Poster

Over tBBW_2015_MiniPoster_200x300he past week, the Office for Intellectual Freedom has reviewed and carefully considered the comments posted to social media, blogs, and listservs concerning the poster for the 2015 Banned Books Week campaign, as well as the two comments sent directly to the office. We also discussed the issues raised by the commenters with many members and others who are part of the library community.

Commenters are concerned that the poster might be insulting to Muslim communities our nation’s libraries serve and that any resolution should prioritize ALA’s important commitment to diversity.  Others are concerned because they do not interpret the poster in that way at all, and do not want ALA to compromise longstanding principles of intellectual freedom.  Still others believe that the poster has generated an important discussion about race and religion that ALA should foster and continue. We have also received many thoughtful statements from members who would like OIF to find a balance between these important values.

We intend to take the following actions:

  1. Provide another poster that does not use the image of a person for those who want an alternative to the current poster.
  2. Retain the current poster as an option for those who want to use it.
  3. Promote the “make your own poster” template that uses the layout and graphic elements of the current poster that offers libraries the opportunity to create their own posters featuring persons of different ages and backgrounds.
  4. We have spoken to the Task Force on Equity, Diversity, and Inclusion and have asked them to consider engaging in community discussions addressing diversity, race, and religion.

We have reviewed our proposal with members of the Intellectual Freedom Committee; the Committee on Professional Ethics; Executive Director Keith Michael Fiels; the Office for Diversity, Literacy and Outreach Services; ALA Graphics; and other affected offices and ALA staff, and they agree with the Office for Intellectual Freedom that the above resolution is one that fairly addresses all the concerns raised by members and the library community while balancing and upholding the values of our association and the profession.

April 14, 2015

How Do We Design a Banned Books Week Campaign?

As we continue to review the questions raised by the controversy regarding the 2015 ALA Banned Books Week poster, we wanted to answer the question about how a poster campaign is selected. We welcome your feedback on this process as we make decisions on the current campaign.

Our design process is as follows:

  1. We contract with an outside design firm to produce 4 or 5 ideas. The vendors we consider are ones who employ a diverse design team, as part of our commitment to diversity within the association. We’ve learned that diverse design teams provide new perspectives on the issue of censorship.
  2. We set a meeting with OIF staff and an outside librarian to review the proposed designs. We also consult with other offices within ALA on the design. The first design concept we review is the poster. Once we reach consensus on the poster, the designers then use that image to create the additional merchandise in the campaign. The merchandise typically used in the campaign includes buttons, bookmarks, and t-shirts.
  3. New to this year is the customizable PSD file where people can use their own image rather than that of the model represented in the 2015 poster.
    BBW_2015_MiniPoster_200x300
  4. Once the design has been finalized, we go to print and feature the products in the Spring/Summer catalog.

Like any promotional campaign, there can be unanticipated reactions. OIF is committed to listening to everyone:  the design team who created the image and message; those who object strongly to the design and those who strongly support it; ALA members and non-members who have expressed concern about our commitment to inclusion and diversity. OIF is trying to listen and acknowledge the entire conversation.