Recommended
Recommended
More Related Content
Similar to Protecting Privacy in the Library
Similar to Protecting Privacy in the Library (20)
Recently uploaded
Recently uploaded (20)
Protecting Privacy in the Library
- 1. PART I PROTECTING PRIVACY IN THE LIBRARY Elizabeth Mens Technology Initiatives Consultant Southern Ontario Library Service
- 2. introductions IN THE CHAT WINDOW: ● your name and library ● whether your library has a privacy policy ● whether you are here to address a specific question, or to get the lay of the land.
- 10. What we’ll cover: ● current Canadian climate re: patron information and privacy ● library’s responsibilities ● where to learn more
- 11. BETH MENS, MI @ElizaMens Councillor, OLITA Hobbies: cycling, libraries, trying to not blow up my MacBook as I force it to undergo various experiments, baking, chocolate. Latest projects: italian meringue frosting, baguette, creating a first Tails drive, a blog for SOLS.
- 12. why SHOULD LIBRARY STAFF BOTHER? ● library staff: stewards of information ● libraries: information providers
- 24. MFIPPA WHEN CAN WE DISCLOSE? • If a patron identifies specific personal information can be • In the course of conducting business (as opposed to responding to an access request • For the purpose for which it was obtained
- 25. MFIPPA WHEN CAN WE DISCLOSE? • if the disclosure is made to an employee of the library, who needs the records in order ot perform their job • if the disclosure is to an institution or a law enforcement agency in Canada*
- 26. MFIPPA WHEN CAN WE DISCLOSE? * If there is no search warrant, the library may exercise its own discretion.
- 27. • personal information should be retained for one year after use • allow patrons to access their own personal information • under 16’s legal guardian can exercise access rights OTHER OBLIGATIONS MFIPPA
- 28. • collection notices if log files assoc w indiv users are kept (computer activity) • take reasonable measures to prevent unauthorized access to records OTHER OBLIGATIONS MFIPPA
- 32. PGP
- 34. … the internet has not evolved into an idyllic zone in which people are free from the limitations of the embodied world. Teens are struggling to make sense of who they are and how they fit into society in an environment in which contexts are networked and collapsed, audiences are invisible, and anything they say or do can easily be taken out of context. They are grappling with battles that adults face, but they are doing so while under constant surveillance and without a firm grasp of who they are. In short, they’re navigating one heck of a cultural labyrinth. - It’s Complicated: The Social Lives of Networked Teens, by danah boyd
- 36. For the record... Waffles articulated a sentiment that I usually saw expressed through an eye roll: teenagers, acutely aware of how many adults dismiss their engagement in social media, have little patience for adults’ simplistic assumptions about teen privacy. - It’s Complicated: The Social Lives of Networked Teens, by danah boyd
- 37. HOW DID WE GET HERE?
- 38. a condensed history of the internet inspired by: Maciej Ceglowski
- 40. SO WHO KNOWS WHAT? WHO CAN WE TRUST?
- 48. Next time... ● what can you do? ● tools, tips & tricks ● answers to any questions you ask this week
Editor's Notes
- My colleague Gelja will help me review any questions, and she’ll be in charge of deciding whether to interrupt me, or leaving things to the end. But in the next 45 minutes, hopefully I answer some of what you ask. The rest I’ll do my best to answer at the end, and if I don’t know the answer, I’ll find out and get in touch with you. So you’re going to (hopefully) tell me why you’re here. I’ll tell you why I think it’s great that you are! Side note: the presentation will be available on slideshare. You can look for an announcement on the SOLS news feed.
- 2/3rds of canadians are concerned about the protection of their privacy. These statistics were collected in 2012, and published in a report for the IPC of Canada in 2013. So relatively recent. The purpose of the survey was to explore Canadians’ awareness, understanding and perceptions of privacy related issues. I’m just going to highlight a few key findings.
- As well, the majority (56%) are not confident that they have enough information to know how new technologies affect their personal privacy, which is the highest expression of a lack of confidence for this question since tracking began in 2000.
- We’ve resolved this in the last year or so with new Anti-Spam legislation, which undoubtedly most of our libraries (and us) have had to cope with. Really, it was a very good excuse to look at how and why we are sending email - and to who.
- Canadians were less concerned about law enforcement or national security agencies collecting their personal information for use in a specific investigation with a warrant. However, levels of concern were much higher if these same bodies collect Canadians’ personal information for general surveillance purposes without a warrant (55% very concerned).
- Oddly enough, we then have a lot of public support for this act, which is in the HoC right now. Couch a bill in rhetoric and you get a different answer to that last question. The House of Commons debate over Bill C-51, the anti-terrorism bill, began recently with strong opposition from the NDP, disappointing support from the Liberals, and an effort to politicize seemingly any criticism or analysis from the Conservative government. With the government already serving notice that it will limit debate, the hopes for a non-partisan, in-depth analysis of the anti-terrorism legislation (in the house) may have already been dashed. Great in-depth analysis is already available for us - on Michael Geist’s blog. The Globe and Mail also released a good report on it. The legislation will also override privacy protections in multiple pieces of legislation to increase information sharing between government agencies, which has prompted the federal Privacy Commissioner to speak out. It also greatly expands the domestic powers of CSIS. Most experts agree that targeted intelligence is more effective than dragnet surveillance of entire population, but this legislation appears to further encourage reckless sharing of our sensitive private information rather than providing a clear path for effective targeted action.” We are getting more legislation that will place Canadians’ private lives under the microscope of secretive and unaccountable government agencies like CSIS and CSE (even though it contradicts existing legislation intended to protect our privacy). But there is nothing as of yet in this bill discussing increased accountability and oversight - the lack of these has already led to issues with CSIS and CSE - and now we have a bill that will enhance their powers. The liberals say we’ll deal with this once it’s passed. How likely do you think it is that that conversation will come to pass.
- Protection of privacy - it’s an ongoing issue. And considering the huge shift we’ve seen in how and where our information is held, you’d think our government would work to keep up and make sure our legislation applies to the issues we are facing today. PIPEDA (The Personal Information Protection and Electronic Documents Act) has been on the government’s agenda to revise for the last nine years, and just this month it’s finally come up in front of the Standing Committee on Industry, Science and Technology. For the most part, this webinar, and the next will focus on privacy in the digital world. However - I think we know it’s just as important to think about it IRL. And much of the principles I discuss are just as relevant in the human world as they are in the digital. This is a hideous horrible picture, but i did what I could.
- So that’s the beginning of the webinar. The teaser, so to speak. This is my very first webinar, and I read a tip sheet that said not to bother introducing myself until after I grabbed your attention - and if I haven’t yet, I apologize. Hopefully you won’t keel over of boredom by the end. This is my lovely headshot from OLA Superconference this year. Maybe you saw me running around.
- So how do I make this leap to say libraries are responsible for educating patrons about privacy? Libraries play a huge role in the fight for intellectual freedom. We make a point of carrying books, whether members of our communities submit complaints about them or not in order to ensure that any person can learn about ideas they may be curious about - whether we disagree or agree with those ideas is our personal prerogative. We are stewards of this information. And to a large extent, we work to connect patrons with information in any way we can. For example, by providing public access points to the internet. It’s already a given for us, that what patrons borrow is private. Likewise, what they browse on the web should also be private. So I’d argue, that part of that librarians are in an obvious position to help educate local communities about how to protect their privacy from unwanted surveillance online - or at least give them notice that what they are doing on the internet is not private. To me, this is even more important because we serve communities who have less than full trust of government and organizations. They are communities who have often been historically underserved or under-represented. Those who live below the poverty line, queer people, people of colour, political avtivists, the formerly incarcerated. And all these groups, as a general rule have been subjected to more than their fair share of surveillance already. If this isn’t convincing enough to you, consider that our library organizations have signed on to various statements, or made some of their own about intellectual freedoms and privacy.
- the lyon declaration, drafted by the international federation of library associations calls on member states of the UN to make intentional committment to use the post-2015 development agenda to ensure that everyone has access to and is able to understand, use and share the information that is necessary to promote sustainable development and democratic societies. Section 6 of this declaration makes an explicit reference to respecting individuals’ privacy. Signatories include CLA and OLA.
- In their 2013 Statement on Telecommunications Privacy, CLA reaffirmed that: ‘Canadian libraries have a longstanding commitment to privacy, intellectual freedom, and helping citizens develop information literacy skills. Librarians play an important role in helping students, clients, customers and citizens in ensuring that they are aware their social media activity is being actively monitored by government so that this knowledge is factored into their decision-making about what they wish to share and how they choose to use media tools and platforms.” Further to that, the CLA’s position statement on Access to Information and Communication Technology states that “consent should be required for the collection of personal information and the subsequent use or disclosure of this information.” And that such data should not be traded or sold “without the express written permission of the individual affected.” The CLA calls for a public and legislative dialogue on privacy. They explicitly encourage Canadian librarians and allies to advance the library communities core principles by engaging in work to provide information, to promote education, to protect the civil liberties and privacy of law-abiding citizens and as well, to enable dialogue on how these issues affect democratic life. And it’s surprising how easy this can actually be.
- I won’t re-hash this again. What you need to know, you know. Libraries believe in intellectual freedoms. A major part of that, is the freedom to read/create etc without feeling the need to self-censor because you are concerned about being tracked/surveilled/watched etc.
- When you loaded this page on your home computer, quite a few things happened very quickly. Your computer first asks a domain name server to translate this website’s URL into an IP address so it knows what server to try to talk to on the internet. Once it knows the server’s address it then sends a message in the HTTP language requesting the contents of the website. The internet by design tries to use the quickest route between your computer and the server in terms of bandwidth, physical location, and errors in the system. Routers, the hubs internet traffic flows through, keep an eye on each other and know which hubs are being slow and should be avoided. Your request bounces around between a number of routers before it gets to its destination server and those routers could be located anywhere on earth. When your computer’s HTTP message requesting the website arrives at the adobe server an automated program is triggered. The server then sends back to your computer the files that make up this webpage. The files required to load this page include a number of CSS stylesheets, a bunch of jQuery files, some more javascript, some images, and the HTML file it is all contained in. Add a little piece of javascript into a webpage, and we can track where you’re coming from, you ISP. Even more information can be gathered - name, address, gender. Google analytics does this, but so do a number of other programs. And cookies are the exact same - plus they remember us to make our lives easier. We don’t have to continuously fill in those pesky forms/passwords etc.
- Even simpler than all that bouncing around is this. These are called boomerang routes, and the majority of our internet traffic travels like this. A boomerang route is a data packet path that starts and ends in Canada, but travels through the USA for part of the journey. An organization based out of UofT found that often, Canadian internet traffic is routed this way, even when starting and ending in the same city. What’s more, much of this boomerang traffic passes through suspected U.S. National Security Agency (NSA) surveillance sites. At some of these sites they’ve actually installed tech called ‘splitter cables’ that copy your data and send one set over to NSA servers, the other travels on as per usual. And we shouldn’t imagine that Communications Security Establishment (what used to be known as CSEC) isn’t doing this too.
- A number of tools exist to keep an eye on who is tracking you on websites, including [disconnect] and [ghostery]. But once you’ve plugged that hole, here’s another: imagine a malicious person takes control of a router, one of those hubs in the internet, and monitors all the traffic that goes through it. Thanks to various tricks, this router may convince your computer to send all your traffic through it instead of the most efficient route. All you will notice would be a possible lag in your internet speed, but they will be able to watch your every click. We’re going to discuss all of these and a lot more next week - but each of these tools is an opportunity for a conversation started with a patron. Why was disconnect installed on my computer? What was that weird stop sign in my toolbar for? Why was there a post-it note over the camera on the laptop I borrowed?
- Canada’s leading surveillance agency is monitoring millions of Internet users’ file downloads in a dragnet search to identify extremists, according to top-secret documents. The covert operation, revealed Wednesday by CBC News in collaboration with The Intercept, taps into Internet cables and analyzes records of up to 15 million downloads daily from popular websites commonly used to share videos, photographs, music, and other files. I was speaking about this with a friend just yesterday, and she reiterated the argument that she had nothing to hide. But this issue isn’t about that. Our Charter of Rights and Freedoms states that we must be presumed innocent until proven guilty. These monitoring processes ask us to accept the opposite. We are guilty, until we prove our innocence with our mouse and keyboard. Whether we want to give up this right or not, is a discussion that should be had with the public - in clear terms.
- Drafted in 2000 - last amendment in 2011. But no real revision since the new millenium hit - and there’s been a lot of change since then. In any case however, for us, this is eclipsed by …. (pipeda is for private sector orgs, the federal privacy act is for federal government bodies)
- Last amended in 2014. The Act creates a privacy protection scheme which the government must follow to protect an individual’s right to privacy. This includes rules regarding the collection, retention, use, disclosure and disposal of personal information in its custody or control. Together with PIPEDA it outlines basic rules, which are then essentially repeated in more local and directly applicable legislation...
- Public library boards are institutions governed by the municipal version of fippa. Personal information is what we are obligated to protect. In libraries this can include info on a patron’s borrowing habits, as well as information related to one’s computer use, including sign up sheets and information on any internet use. We are able to collect information in the first place because of the public libraries Act, for the administration of library operations. So, for library cards, we require names and addresses. Makes sense.
- It also tells us outright that releasing personal information, other than in some circumstances, would violate the Act.
- So what are those circumstances when we can disclose?
- So what are those circumstances when we can disclose?
- So what are those circumstances when we can disclose?
- Personal information can be held for a shorter period if that’s been defined by the library board in a bylaw or resolution. And there are some exemptions to when a patron is allowed to access their personal information, but it’s when the info in question is a research or statistical record. There is more about this in MFIPPA. I again think a library staff member could be reasonable with this - I’m not a lawyer, but I’m guessing if a patron wants to know how many books they’ve borrowed that year and we’ve got numbers - we’d probably be able to tell them.
- Personal information can be held for a shorter period if that’s been defined by the library board in a bylaw or resolution. And there are some exemptions to when a patron is allowed to access their personal information, but it’s when the info in question is a research or statistical record. There is more about this in MFIPPA. I again think a library staff member could be reasonable with this - I’m not a lawyer, but I’m guessing if a patron wants to know how many books they’ve borrowed that year and we’ve got numbers - we’d probably be able to tell them.
- In October of last year, we learned that software provided by Adobe that is commonly used in the delivery of ebook content by libraries was contravening library privacy standards.
- The blog you see above was one of the first to start alerting library staff to the fact. Adobe Digital Editions 4, the software frequently used to manage eBooks and DRM (digital rights management) was transmitting unencrypted data about patron reading history to Adobe servers. Most libraries that lend ebooks that have publisher - imposed DRM restrictions in place are obligated to advise patrons to use Adobe Digital Editions if they use computers to manage their eBooks. Essentially, the middle man, between Overdrive and library eBooks was sending way more data to Adobe than it should have been. Adobe’s error in transmitting unencrypted data about library patrons compromises libraries’ commitment to citizens to keep their information secure and undermines our stated values. We keep our patrons regular borrowing records private, shouldn’t we do the same for their digital ones?
- But, enough librarians made a fuss that ADE released an update to correct the problem within a few weeks. Now that data is encrypted. But eBook services still aren’t perfect because encryption isn’t perfect.
- The most popular encryption program is actually called Pretty Good Privacy. Pretty good. Not perfect. Still vulnerable.
- The new Overdrive App gets around this by not requiring users to have an ADE account. But it still isn’t perfect. And the Adobe scandal is just the tip of the iceberg. Libraries sign contracts with technology companies to bring services to patrons all the time, and those contracts are not always favorable to library patrons. Whether it’s an agreement with an ISP to provide the library with Internet access, the publisher of a database of scholarly articles and primary source documents, or a children’s educational game vendor, these contracts are both commonplace and a relatively new development. But problems arise when those contracts allow vendors to collect large amounts of user information, especially where, as we’ve seen recently, companies don’t always handle that information responsibly. And if digital library resources are available only via companies that collect user data, it’s easy for government agencies and corporations to simply get that information from vendors - even if we as library staff and libraries are working to not store and keep this data.
- A text heavy slide, but I really like how danah boyd frames this issue. She wrote a book recently about how teens interact and act on the web. And while I won’t put any of us into the same shoes as teens (thank goodness), I will say that we are also working to navigate these different social contexts. We are wondering who our audiences are as we tweet and post into the ‘void.’ We hope our statements aren’t taken out of context, and police ourselves to make sure we aren’t. A simple tweet on a topic that’s been hotly debated takes half an hour to draft - I’ve been there. And in many cases - as we are in positions of privilege (working in the library, not patrons of the library), we should be monitoring ourselves for this. We want to make sure we aren’t inadvertently exclusive of a subset of our communities (and not just because we’ll be called out on it). danah references the fact that the web hasn’t evolved into an idyllic zone, and i’ll talk more about that in a little bit. For now, I want to point out that this book is fantastic. And the chapter this statement pre-ceeds is all about privacy, teens and their online identities.
- I’m going to go back to danah boyd, because in her chapter on teens she outlines the major problem with our world wide web. It’s that it is public by default. In order to make it private, we have to work at it. We have to find the Settings tab, whose location seems to change monthly. The default is public. Conversely, in most interpersonal conversations, even those that take place in public settings, is that interactions are private by default, public through effort. We have to be recorded to really make a conversation public. We might be paraphrased later, but the conversation has no real static ‘record’.
- Danah interviewed a number of teens about privacy, and one articulated a sentiment that most others communicated non-verbally. A seventeen year old, (code name Waffles) about privacy balked at the idea that his participation in these networked publics signals that he doesn’t care about privacy. “Just because teenagers use internet sites to connect to other people doesn’t mean they don’t care about their privacy. We don’t tell everybody every single thing about our lives. So to go ahead and say that teenagers don’t like privacy is pretty ignorant and inconsiderate honestly, I believe, on the adults’ part.” danah goes on to express that ‘The idea that teens share too much—and therefore don’t care about privacy—is now so entrenched in public discourse that research showing that teens do desire privacy and work to get it is often ignored by the media.’ And she is right. They just aren’t as concerned about the government or corporations. They’re worried about us. Their parents, their educators, their supervisors at work.
- http://idlewords.com/bt14.htm Maciej Ceglowski is the founder and sole employee of Pinboard, a personal web archive and bookmarking site with an emphasis on user privacy. He's been an outspoken advocate of small pay-for-service websites as an alternative to the hype and impermanance of Silicon Valley startup culture.
- The interstate highway system was built over the latter half of the last century as part of the American “car” for every family experiment. You can think of the Interstate as an Internet for cars, a nationwide system unifying thousands of local road networks into an overarching whole. The Interstate made it possible to build things no one had imagined before. Like McDonald's! With a nationwide distribution network, you could have a nationwide, standardized restaurant chain. We have online banking. We can deposit cheques with our mobile phones. Postwar car culture also gave us the landscape we call suburbia. To early adopters, the suburbs were a magical place. You could work in the city while your spouse and children enjoyed clean living in the fresh country air. Instead of a crowded city apartment, you lived in a stand-alone house of your own, complete with a little piece of land. The suburbs seemed to combine the best of town and country. And best of all, you had that car! The car gave you total freedom. As time went on, we learned about the drawbacks of car culture. The wide-open spaces that first attracted people to the suburbs were soon filled with cookie-cutter buildings. Our commercial spaces became windowless islands in a sea of parking lots. We discovered gridlock, smog, and the frustrations of trying to walk in a landscape not designed for people. When everyone has a car, it means you can't get anywhere without one. Instead of freeing you, the car becomes a cage. The people who built the cars and the roads didn't intend for this to happen. Perhaps they didn't feel they had a say in the matter. Maybe the economic interests promoting car culture were too strong. Maybe they thought this was the inevitable price of progress. Or maybe they lacked an alternative vision for what a world with cars could look like. We’re in the same stage with the internet. The build process began in the 80s, and now, enough time has passed that we're starting to see the shape of the online world to come. It doesn't look appealing at all. At times it looks downright scary. So how do we start making sure the internet develops into the place we want? This is going to be the focus of next week. Hint: open source everything! And in the meantime, if you want to learn more:
- Michael Zimmer, PhD, is a privacy and Internet ethics scholar. He is an Associate Professor in the School of Information Studies at the University of Wisconsin-Milwaukee, where he also serves as Director of the Center for Information Policy Research. With a background in new media and Internet studies, the philosophy of technology, and information policy & ethics, Zimmer’s research focuses on the ethical dimensions of new media and information technologies, with particular interest in online privacy, social media & Web 2.0, Library 2.0, and internet research ethics.
- Glenn Greenwald was one of the first reporters to see — and write about — the Edward Snowden files, with their revelations about the United States' extensive surveillance of private citizens. In this searing talk, Greenwald makes the case for why you need to care about privacy, even if you’re “not doing anything you need to hide."
- Dr. Michael Geist is a law professor at the University of Ottawa where he holds the Canada Research Chair in Internet and E-commerce Law. Dr. Geist is a syndicated columnist on technology law issues with his regular column appearing in the Toronto Star, the Hill Times, and the Tyee.
- Alison Macrina recently received a Knight Foundation grant to develop the Library Freedom Project, It’s a partnership among librarians, technologists, attorneys, and privacy advocates which aims to make real the promise of intellectual freedom in libraries. By teaching librarians about surveillance threats, privacy rights and responsibilities, and digital tools to stop surveillance, we hope to create a privacy-centric paradigm shift in libraries and the local communities they serve.
- The Information Policy Research Program [IPRP] is an on-going program of research examining key public policy issues, notably access, and privacy. These issues are studied particularly in relation to rapid Canadian developments in information/communications infrastructure and the 'knowledge-based economy/society' generally.
- This is the goal. But until we’ve got this: we educate ourselves, we educate our patrons. And we do our best to toggle those settings and create more private environments for us to work in. That’s what we’ll focus on next week. Ann Cavoukian, our previous privacy commisioner did a lot of campaigning in tech circles about creating services that adhered to Privacy by Design principles that she developed.They’re all available on that IPC site.