Choose Privacy Week: Your Library Organization Is Watching You

Choose Privacy Week

T. J. Lamana and I have written a post for Choose Privacy Week. It's mirrored here, but be sure to check out all the great posts there.

Your Library Organization Is Watching You

We commonly hear that ‘Big Brother’ is watching you, in the context of digital and analog surveillance such as Facebook advertising, street cameras, E-Zpass highway tracking or content sniffing by internet service providers. But it’s not only Big Brother, there are a lot of “Little Brothers” as well, smaller less obvious that wittingly or unwittingly funnel data, including personal identifiable information (PII) to massive databases. Unfortunately libraries (and related organizations) are a part of this surveillance environment. In the following we’ll break down two example library organization websites. We’ll be focusing on two American Library Association (ALA) websites: ALA’s Office of Intellectual Freedom’s Choose Privacy Week website (ChoosePrivacyWeek.org) and ALA’s umbrella site (ala.org).

Before we dive too deeply, let’s review some basics about the data streams generated by a visit to a website. When you visit a website, your browser software - Chrome, Firefox, Safari, etc. - sends a request containing your IP address, the address of the webpage you want, and a whole bunch of other information. If the website supports “SSL”, most of that information is encrypted. If not, network providers are free to see everything sent or received. Without SSL, bad actors who share the networks can insert code or other content into the webpage you receive. The easiest way to see if a site has a valid SSL certificate is to look at the protocol identifier of a url. If it’s ‘HTTPS’, that traffic is encrypted, if it’s ‘HTTP’ DO NOT SEND any personally identifiable information (PII), as there is no guarantee that traffic is being protected. If you’re curious about the quality of a sites encryption, you can check its “Qualys report”, offered by SSL Labs., which checks the website’s configuration, and assigns a letter grade. ALA.org gets a B; ChoosePrivacyWeek gets a A. The good news is that even ALA.org’s B is an acceptable grade. The bad news is that the B grade is for “https://www.ala.org/”, whose response is reproduced here in its entirety:

Unfortunately the ALA website is mostly available only without SSL encryption.

You don’t have to check the SSL Labs to see the difference. You can recognize ChoosePrivacyWeek.org as a “secure” connection by looking for the lock badge in your browser; click on that badge for more info. Here’s what the sites look like in Chrome:

Don’t assume that your privacy is protected just because a site has a lock badge, because the was is designed to spew data about you in many ways. Remember that “whole bunch of other information” we glossed over above? Included in that “other information” are “cookies” which allow web servers to keep track of your browsing session. It’s almost impossible to use the web these days without sending these cookies. But many websites include third party services that track your session as well. These are more insidious, because they give you an identifier that joins your activity across multiple websites. The combination of data from thousands of websites often gives away your identity, which then can be used in ways you have no control over.

Privacy Badger is a browser extension created by the Electronic Frontier Foundation (EFF) which monitors the embedded code in websites that may be tracking your web traffic. You can see a side-by-side comparison of ALA.org on the left and ChoosePrivacyWeek on the right:

ALA.org

ChoosePrivacyWeek.org

The 2 potential trackers identified by Privacy Badger on ChoosePrivacyWeek are third party services: fonts from Google and an embedded video player from Vimeo. These are possibly tracking users, but are not optimized to do so. The 4 trackers on ALA.org merit a closer look. They’re all from Google; the ones of concern are placed by Google Analytics. One of us has written about how Google analytics can be configured to respect user privacy, if you trust Google’s assurances. To its credit, ALA.org has turned on the "anonymizeIP" setting, which in theory obscures user’s identity. But it also has “demographics” turned on, which causes an advertising (cross-domain) cookie to be set for users of ALA.org, and Google’s advertising arm is free to use ALA.org user data to target advertising (which is how Google makes money). PrivacyBadger allows you to disable any or all of these trackers and potential trackers (though doing so can break some websites).

Apart from giving data to third parties, any organization has to have internal policies and protocols for handling the reams of data generated by website users. It’s easy to forget that server logs may be grow to contain hundreds of gigabytes or more of data that can be traced back to individual users. We asked ALA about their log retention policies with privacy in mind. ALA was kind enough to respond:

“We always support privacy, so internal meetings are occurring to determine how to make sure that we comply with all applicable laws while always protecting member/customer data from exposure. Currently, ALA is taking a serious look at collection and retention in light of the General Data Protection Regulation (GDPR) EU 2016/679, a European Union law on data protection and privacy for all individuals within the EU. It applies to all sites/businesses that collect personal data regardless of location.”

Reading in between the lines, it sounds like ALA does not yet have log retention policies or protocols. It’s encouraging that these items are on the agenda, but disappointing that it’s 2018 and these items are on the agenda. ALA.org has a 4 year old privacy policy on its website that talks about the data it collects, but has no mention of a retention policy, or of third party service use.

The ChoosePrivacyWeek website has a privacy statement that’s more emphatic:

We will collect no personal information about you when you visit our website unless you choose to provide that information to us.

The lack of tracking on the site is aligned with this statement, but we’d still like to see a statement about log retention. ChoosePrivacyWeek is hosted on a DreamHost WordPress server, and usage log files at Dreamhost were recently sought by the Department of Justice in the Disruptj20.org case.

Organizations express their priorities and values in their actions. ALA’s stance toward implementing HTTPS will be familiar to many librarians; limited IT resources get deployed according competing priorities. In the case of ALA, a sorely needed website redesign was deemed more important to the organization than providing incremental security and privacy to website users by implementing HTTPS. Similarly, the demographic information provided by Google’s advertising tracker was valued more than member privacy (assuming ALA is aware of the trade-off). The ChoosePrivacyWeek.org website has a different set of values and objectives, and thus has made some different choices.

In implementing their websites and services, libraries make many choices that impact on user privacy. We want librarians, library administrators, library technology staff and library vendors to be aware of the choices they are making, and aware of the values they are expressing on behalf of an organization or of a library. We hope that they will CHOOSE PRIVACY.

3,000 Libraries to Power "Big Library Read"

"We want to show publishers how a book can sail around the world on the shoulders of librarians" says Overdrive CEO Steve Potash. The circumnavigating book in the inaugural edition of Overdrive's "Big Library Read" program will be Michael Malone’s The Four Corners of the Sky  published by Sourcebooks. Overdrive customer libraries must sign up for the program by this Friday, May 10, but 3,000 have done so already, according to Potash. Beginning next Wednesday, May 15, and continuing through June 1 the book will be free to patrons of participating libraries, with no limit to the number of simultaneous users. After June 1, the book will be available to libraries for conventional acquisition and one-user-at-a-time e-lending.

It's hard to underestimate the impact this program might have. For the first time, large numbers of libraries will simultaneously introduce one book to their communities. Books are conversations, and the idea of a national conversation sparked by libraries is really exciting. (actually it's the whole world- B.L.R. is available worldwide) If the book is as good as it's supposed to be, it might race up the best-seller lists even before the Big Read is done. Or maybe the huge but brief availability will satisfy reader demand for all time, and Sourcebooks will never sell another copy ever. I'm guessing it will be the former, but I can't say for sure.

We'll all know the answers once the program ends, because Overdrive and Sourcebooks will be sharing sales and lending data from the program. Dominique Raccah, CEO of Sourcebooks, is well known in the book publishing industry for advocating data-driven decisions in what has traditionally been a business fueled by lore, rumor and hearsay. The Big-6 hesitance to offer ebooks to public libraries will be revealed to be either prudent or foolhardy. Should be fun!

In February, I wrote about plans for a similar program that originated in the American Library Association's Digital Content Working Group. As a member of that group, I talked to the various library ebook vendors to see if they could support such a program. Most of the people I talked to thought it was a great idea, but saw road blocks in the implementation. One vendor's system couldn't handle prices below $5 per copy. Another vendor only updated their offerings every six months. Overdrive was different. When I told Steve Potash of the effort, he immediately said they could do it. I've since found out that Overdrive was already doing similar programs on a small scale by private arrangement. Potash has told me that the ALA initiative inspired them to make their program bigger and to make the data public. I'm tickled to have had even a bit part in this.

But really, the credit should go to Overdrive, Sourcebooks, and Micheal Malone. They are using the unique attributes of digital books to do something that CAN'T be done with print books. An infinite supply of Four Corners of the Sky will be created for a short time, and later the copies will vanish. It's the library equivalent of a nationwide flashmob. And it's never been done before.

If Big Library Read is a big success, and I hope it will be, it's quite possible that an ALA version of the program can build on that success. It would be great, for example, if all libraries, not just Overdrive customers, could participate in Big Library Reads. The selection process needs to be more open and sustainable, and it needs to draw all sorts of publishers into libraries.

But let's focus on the present. If you work in an Overdrive-customer library, this is your big chance to experiment with ebooks and build new forms of community engagement. If you're a library patron with access to the book, please join me in reading it, tweet it, facebook it, and get your friends involved. Let's find out together how library ebooks can become a mass media.

With your help, we can out-Oprah Oprah!

P.S. this needs a hashtag. People are using #BigLibraryRead.

Related articles

• OverDrive and Sourcebooks to Launch Ambitious Ebook Data Experiment (lj.libraryjournal.com)
• Sourcebooks, Overdrive Pilot Reshapes Relationships Between Publishers and Libraries (goodereader.com)
• Sourcebooks, Overdrive launch pilot to demonstrate the impact of ebook library lending on sales [GigaOM] (paidcontent.org)
• Big Library Read is coming soon! (tnloveslibraries.wordpress.com)
• The New York Public Library Discusses eBook Pilot Projects (goodereader.com)

One eBook to Prove Them All

I've not written much about it here, but over the past year I've been participating in the American Library Association's "Digital Content Working Group". DCWG is broken up into smaller groups focusing on specific areas. I've been working on "Business Models". At ALA's Midwinter meeting, DCWG sponsored a jam-packed symposium.

The DCWG's meetings at ALA's mid-winter and annual conferences are open for anyone to attend, and they've been covered by the library press. Our recent meeting in Seattle was covered by Library Journal's Matt Enis, and he highlighted an idea that came out of our subgroup, the "One eBook" program:

The American Library Association’s Digital Content and Libraries Working Group (DCWG) has begun exploring an idea that could help publishers better understand the powerful impact that libraries can have for their authors and their bottom line.

I've finally had a chance to write this up for American Libraries' E-Content Blog:

There’s a lot of data suggesting that exposure to books in libraries increases sales for those books. There’s also a lot of data that suggests that many publishers believe the opposite—namely, that the availability of books in libraries depresses sales, and that if libraries improve the ebook lending process, making it easier for library users to substitute loans for sales, then ebook sales will be hurt even more. 

That word “suggests” is the problem. We don’t have controlled experiments that have really measured the broad effect of the library lending of ebooks on ebook sales. ALA’s Digital Content and Libraries Working Group has been examining the situation, and we had an idea. What if libraries all around the country promoted a single ebook for a month? What if that ebook’s publisher offered a special deal so that for that one month, libraries could lend that ebook to as many patrons in their communities as possible without decimating their acquisition budgets? Once the month was over, that specially promoted library ebook deal would end. What do you think would happen?

There are a lot of details to work out of course, but we've had a lot of positive reactions. It's the practical and technical details I'm thinking about right now. For example, how can we make such a program available to as many libraries as possible, regardless of whether they are currently offering ebooks? How can we make the ebooks work on all sorts of platforms? How do we make the one-ebook ebooks expire after a month?

As if I didn't have enough to do...

Digital Content Working Group at ALA

I've been very busy with unglue.it and I'm working on something I'll soon share here. We're thrilled that the unglue.it campaign for Ruth Finnegan's Oral Literature in Africa is at 53% but there are just 9 days to go, so if you haven't yet casted your vote for crowd-funded Creative Commons ebook relicensing, now is the time you most do so.

Since early this year, I've been serving on ALA’s Digital Content and Libraries Working Group (DCWG) commisioned by American Library Association (ALA) President Molly Raphael. Our role has been to advise the ALA leadership about the changes in libraries and publishing associated with the transition to digital content, and we've worked to articulate the concerns of libraries in ways that can be acted upon by the entire digital content ecosystem.

Later this month, I'll be speaking on a panel organized by DCWG at the ALA Annual Meeting in Anaheim.

Access to Digital Content: Diverse ApproachesSunday, June 24, 1:30–3:30 p.m., Anaheim Hilton, California B2012 ALA Annual Conference
              As digital content continues to grow in diversity and importance, libraries must make use of multiple strategies to support access for their users. ALA’s Digital Content and Libraries Working Group has been exploring issues of business models, advocacy, education, accessibility, privacy, and libraries as providers of content.  But innovative approaches to making digital content available are taking place in many arenas.
              Come hear about the latest developments, including an update from Working Group co-chairs Sari Feldman (Cuyahoga County Public Library) and Robert Wolven (Columbia University). Leaders and innovators from the library community will discuss some other major initiatives and developments related to digital content:  Peter Brantley (Internet Archive), Maura Marx (Digital Public Library of America), and Eric Hellman (Unglue.it). Lee Rainie will offer some perspectives based on his work with the Pew Research Center’s Internet and American Life Project, and Robert Wolven will offer final remarks to set the stage for the question and answer period.
              Copies of the new American Libraries publication “E-Content: The Digital Dialogue” will be available.

Also, Unglue.it is going to have a table at the exhibits. You can meet me, Andromeda and/or Amanda in person. We'll be in the "small press and new exhibitors" section, which is usually in the far reaches of the exhibit hall, but there will be unglue.it bookmarks and stickers as your reward if you can find us.