LibTechConf 2014: Protecting Library Patron Privacy Online

Presented by Dorothea Salo @dsalo

Pinboard with all the links mentioned during the presentation

https://speakerdeck.com/dsalo/protecting-patron-privacy-on-library-computers

Someone is Watching You

• NSA
• Facebook and ohter social media
• GOogle
• marketing
• hackers, bot nets, etc.

How NSA Got Our Information

• company volunteers to help
• company compiles under legal duress
• company infiltrated
• coerce upstream companies to weaken crypto
• copy traffic off fiber
• brute force cryptography
• compromising digital certificates
• hack computers, steal keys, steal data, sabotage

So What?

• code of ethics covers protect library user’s right to privacy and confidentiality; don’t advance private interests at expense of others
• includes patron Internet access
• protecting patron privacy is part of our job

Unfortunately, can’t stop everything, can’t stop people from their choices, but can still help.

Strategies

• passive
• informational
• blocking
• encryption
• advocacy

Not mutually exclusive.

1. stay up to date
2. don’t keep data (e.g. return computers to neutral state, chat logs, patron specific circ data, website data) – keep as little data as possible
3. Don’t use social media web bugs e.g. Facebook Like button
4. Clear policy & procedure, train staff.
5. Change browser settings e.g. default search engine, security/privacy, cache, cookies, etc.

Browser plugin “grades” website TOSes, blockers, lightbeam, others.

Don’t install Java (unless you have to, but then don’t let it autorun).

Encryption

• better wired, and if you wifi
• password managers
• HTTPS everywhere
• TOR (the onion browser)

Advocacy

• many reforms that can be supported

There was a huge amount of information, so check out the slides too.