Privacy

Practical Tips For Online Privacy

This is Part Two in my many part series on IT Security In Libraries. In Part One I tried to lay the foundation for security. This week we’ll talk privacy, and up next will be a general “Staying Safe Online” that will cover a million and one tips on how to keep you and your computer safe.

Privacy is a relative term. That is, the things that I consider important to my privacy, someone else might not care about. As librarians we usually key in on Confidentiality Threats. We want our patrons records safe. We also don’t share that information with ANYONE else. In general, we are fierce about protecting our patrons’ privacy. This is something that has always set us apart from everyone else. Amazon won’t do it. Google won’t do it. Do I even need to say Facebook won’t do it? People who come into the library or use our web sites don’t worry about what’s going to happen with their information (or at least they shouldn’t need worry about it). They should know we are doing our best to guard their privacy. Keeping all our IT resources secure should be a large part of guarding that privacy.

There are no big events, dead bodies or explosions in privacy violations. It’s something that is slowly eroding over time. The troubles are more subtle and are caused by errors, or intential misues and a shocking lack of transparency, accountability and security. We don’t think about privacy much, we only think about it when things are going wrong. Most people tend to think privacy isn’t very important, and don’t give it a second thought. Most companies make money by keeping our information as free as possible so it can be used, shared, and sold.

Let’s start this section with some general arguments FOR privacy, some reasons why privacy is so highly valued in our profession:

  • Invading a person’s privacy can give you access to information about them which you can then use against them, even if that information is not objectively illegal, immoral or unethical.
  • With privacy comes more freedom.
  • People invading your privacy are not infallible. They will overstep their bounds.
  • We don’t know how our information is used or stored.
  • We don’t know who has access to it.
  • We don’t know how or when we can fix mistakes.
  • We don’t know how long it’s stored
  • We don’t know what it’ll be used for in the future.
  • We don’t know how it may be distroted or manipulated
  • It can easily be misused on purpose or accidentally.
  • It can be stolen.
  • Privacy is not about hiding bad/illegal things.*

*This is the old “If you have nothing to hide then there is no reason for me to look” argument against privacy. The problem with the “nothing to hide” argument is the underlying assumption that privacy is about hiding bad things. Agreeing with this assumption concedes far too much ground and leads to an unproductive discussion of information people would likely want or not want to hide. It may indeed you have nothing to hide, but all the information that is being collected on all of us can certainly cause trouble.

I think that most librarians would agree with this statement from “The Eternal Value of Privacy”

“Privacy is an inherent human right, and a requirement for maintaining the human condition with dignity and respect. For if we are observed in all matters, we are constantly under threat of correction, judgment, criticism, even plagiarism of our own uniqueness”

So then what about when we are online?

More than ever we are being tracked & followed online, and what we do is used to build a database of personal information. So much of our communication is electronic, and so much of that leaves behind a trail, and that trail is recorded, and then bought and sold. We are volunteering an amazing amount of information online, through cookies and other tracking information, and we have no choice but to hope those databases are safe and secure. Your printer is spying on you, your passport Can Be Read from very long distances, your iPhone is recording where you go, Google is spying on you, Facebook is spying on you… it seems like it never ends.

Facebook is leading the way with its more permissive privacy settings. Mark Zuckerberg famously said, “There are new social norms now.” Facebook believes people are okay with reduced privacy, and that people don’t mind putting Facebook in control of their personal information. Facebook seems to think it gets to decide if you’re safe, secure and private. In general Facebook will default to openess and sharing of your information, because this is how they make money. Their “recommended settings” tend to share MORE rather than LESS. It recently became widly known Facebook is sharing cellphone numbers between Facebook friends, and one would be well advised to ask who else.

In a particularly egregious example of a total disregard for its users privacy, LinkedIn amended their 6000+ word “privacy” policy in a way that allows them to use your name and picture in social advertising. So LinkedIn will watch what you do, figure out what you might sell for them, and then use your name and picture in an endorsement they make for some crap they’ll stick on your friends pages. They also allowed your private information to be shared with unknown “third parties” for unknown purposes.

Other sites like Spokeo & Intelius can also take publicly available information about all of us and tie it together. The result is a frighteningly accurate picture of who we are, for sale to anyone.

There are ways to opt-out of most major tracking companies. However, a study by Stanford University Law School’s Center for Internet and Society has found that many online advertising networks are not adhering to their own privacy policies and continue to rely on and push out Web tracking cookies even after users have indicated that they do not wish to be tracked. Half of 64 online advertising firms did not remove their tracking cookies from the computers of consumers who had opted out of behavioral ad targeting. More recently, researchers at U.C. Berkeley have discovered that some of the net’s most popular sites were using a tracking service that can’t be evaded, even when users block cookies, turn off storage in Flash, or use browsers’ “incognito” functions.

And what about privacy on your cell phone? Do you know (or care) that your phone could be giving it away? Most applications get to decide what they have access to. We are given few choices and usually aren’t even aware of what the applications might be sharing. Fine grained control is lacking, and we are left with a take it or leave it situation when as app wants to have access to our phone. This can be used to access your phones location and identifiers to give advertisers and others insights into your habits.

We can begin to address issues of online tracking by considering some practical advice related to Facebook. Since it’s one of the more popular social sites that people use, it’s one of the more important sites to focus on. How can you make Facebook safer and more private?

  • Check your settings.
  • Be cautious of apps and links and anything shared by anyone.
  • Use https.
  • Never share anything that you don’t want read everywhere by everyone.
  • Know your friends. Do you really know who all your “friends” are?
  • Always watch for changes to your privacy settings by facebook.

Now in general, how can we all work to be more private online? Remember that YOU should decide what information about yourself to reveal, when, why, and to whom.

  • Turn on cookie notices in your Web browser, and/or use cookie management software.
  • All browsers have privacy settings: get to know them and change them to be more private.
  • Keep a “clean” e-mail address, one that is never given to anyone but trusted friends.
  • Don’t reveal personal details to strangers or just-met “friends”.
  • Check privacy (and https) settings on all social networks.
  • Realize you may be monitored at work: avoid sending personal e-mail to mailing lists, and keep sensitive files on your home computer.
  • Beware of sites that offer some sort of reward or prize in exchange for your contact information or other personal details.
  • Do not reply to spammers, for any reason.
  • Examine privacy policies and seals on sites you use.
  • Use BCC when forwarding emails.
  • Be careful with passwords (I’ll post an entire essay on passwords soon)
  • Check for unintentional content/metadata in photographs you post online (e.g. geotagging, pictures of credit cards, etc.)
  • Think about what you’re telling everyone by “checking in” on social sites.
  • Don’t overshare.
  • If you’re really serious, use anonymizers.

Another interesting battle involving issues of online privacy can be described as that of “Transparency vs Anonymity”. We can choose to write and contribute as ourselves in a completely transparent way (e.g. I am Blake here on LISNews) or to be more or less anonymous (e.g. bibiliofuture is obviously a pseudonym and chooses to remain more or less anonymous) or somewhere in between (e.g. birdie is well known to regular readers as Robin). I believe anyone should have the option to be anonymous here at LISNews. Two popular websites that serve as prime examples of this battle are Facebook and 4chan. The folks behind Facebook believe that we should always be ourselves. Facebook thinks it best we are all identifiable in what we write on the web. 4chan and its founder are strong believers in anonymity. I believe there are solid arguments on both sides of this debate:

  • When you’re really you, you’re willing/obligated to accept failure and criticism, and this will make you less likely to speak up or take controversial viewpoints, or disagree.
  • With one identity, whatever you do and whatever you say or write, is always associated with you, so it makes you accountable for your behavior, and probably prevents slander, flamewars, etc…
  • If you’re anonymous, you’re unfiltered and raw. You have expression without repercussions; it fuels creativity and experimentation, and makes what you do more authentic.
  • If you have more than one identity, or if you’re hiding behind anonymity, you’re being inauthentic and cowardly.

I won’t choose a side here, I’ll let you decide if you believe there is more good in being anonymous or transparent. For many people be anonymous, or at least using a pseudonym doesn’t mean they are trying to hide, but rather they are finally abe to be themselves. They can be real about themselves but not use their real name. Having a pseudonym, or being anonymous, allows what we say to be judged on its merit alone, with no preconseptions.

There is an arms race between those who want to track, and those of us who wish to opt-out. Who will win this race may be determined by Congress. So far, the United States has no comprehensive law protecting consumer privacy. We have a patchwork of laws, and some self-regulation. We should hope any new law would force companies to allow us to know exactly what is happening to our information. This may be changing, as a recent NYTimes Report says, the F.T.C. has endorsed a related idea — that companies collect only the data they need about people and keep it no longer than necessary. If businesses minimize data collection from the get-go, there may be less need for an eraser button later, says Jessica Rich, deputy director of the F.T.C.’s bureau of consumer protection.

I think that we, as librarians, need to consider a few questions:

Are there really new social norms now?
Are people okay with less privacy now?
Should this make any difference to your library policies?

Finally, something to think about… In theory, all your emails could become public, or are already public.

August 10, 2011 by EBooks Google Internet IT Security in Libraries Legal Issues Libraries Privacy School Libraries Technology

IT Security For Libraries First In A Series

IT Security In Libraries
8. Social Media Security
7. Practical IT Security
6. Integrating IT Security In Your Library
5. 20 Common Security Myths
4. How To Stay Safe Online
3. Passwords
2. Privacy
1. IT Security Foundations

Today’s post is long on theory. I’ll argue that most any library can be a target, and present some ideas on how to make things more secure in your library.
My first post will cover privacy, because I think it’s closely related to security, and it’s something we as librarians take seriously. Then I’ll cover a bunch of ways to stay safe online, how to secure your browser, PC and other things you and your patrons use every day. I’ll also cover some common security myths. Then we’ll talk passwords: everything has a password now, and I want to make sure we all understand what it takes to make your password as secure as possible. Then we’ll talk network security for a bit, followed by hardware and PC security. Then I’ll focus on security issues that you’ll find in your library. And last, but not least, some things I think you’ll find interesting that sysadmins do with servers to make things safer for you, and that you’ll never see as an end user.

One way to begin thinking about security for your library is by asking yourself few questions:

What do you have to lose?
What does your library & patrons have to lose?
What are the bad guys after?

Coming up with even a few quick answers to these questions can be helpful, I think, because it’s important to remember we all have something to lose, and that we all have a part to play in keeping ourselves and our libraries safe.

It’s also important to know that, ultimately, there is no such thing as a secure computer. Nothing we do can make things 100% safe. We can just make things safer than they were before. All of the security work we do is about reducing risk. It’s about knowing what we’re up against. We want to reduce the possible frequency of loss (by securing things as much as possible, given our resources) AND we want to reduce the potential magnitude of loss (by limiting what can be lost as much as possible).

To help set the stage for success we should keep in mind 2 things. “Any lock can be picked”, and people are the weakest link in security chain. First, people:

People choose bad passwords, we write them down, we share them, we reuse them,
People email things we shouldn’t
People post things on twitter or Facebook.
People click on links without knowing what’s behind them.
People don’t update our computers and programs.
People plug in USB drives w/o knowing where they came from.

Of course, we all want our computers to work. We don’t want to worry about all this security. We just want things to be safe. We have better things to do. We do insecure things because we’re tired and busy. We write down passwords because our brains are full. We have better things to do than update our computers and programs. It’s not (only) because people are lazy. It’s because every layer of security we add causes more work for them. Much of this advice, many of these things we want them to do just costs too much in terms of a daily burden when so few of them will really be harmed by evil doers. There is generally low motivation and poor understanding of why this could be important. People choose the easiest and quickest way to get things and hope for the best.

So even though we have better security than ever before, there are also more ways to defeat it than ever before. To make matters worse, we are now in the era of “steal everything.” We all have something a hacker is interested in stealing. And to make things even worse, barriers to this particular type of theft are lower than ever.

Frequently, hacking requires little training or knowledge or investment of time. Hackers have moved beyond banks and are now stealing more mundane things that you have. These are all worth money, or can be used to cause trouble and spread malware. There are bad guys who will pay for email passwords, Facebook logins, trojaned PCs, game logins, nearly anything you have. Our libraries are no exception. They become targets because of what we have inside our ILSs, our public access machines, the OPAC, the databases and more.

What I’m hoping to do is in this series highlight ways to help reduce your exposure. That, in itself, could help make you safer because many hackers are just looking for easy targets, and they will move on if the common security holes are closed. To beat them you need to be proactive and know how the bad guys think.

The bad guys we’re up against have many goals. Some are simply common criminals, others are spammers or doing blackhat SEO, they could be APT agents, corporate spies, or just hactivists. They are all over the world, and they are hard to find because they hide behind proxies and botnets. In a recent survey of 583 U.S companies conducted by Ponemon Research on behalf of Juniper Networks, 90 percent of the respondents said their organizations’ computers had been breached at least once by hackers over the past 12 months. Now, remember that first question I asked? About what you had to lose? Security is a real issue, and hopefully this series of posts will help you reduce your risks.

The posts will be broken up into these main topics:
-Privacy
-Staying Safe Online
-Passwords
-Network Security
-Hardware Security / PC Security
-Security In Your Library
-Server Side Security

You can check out the new posts Here and also subscribe to this topic in your feed reader Here.

August 2, 2011 by EBooks Internet IT Security in Libraries Libraries Privacy Technology

Privacy Main Issue At Stake in Santa Clarita Library Suit

While a nonprofit group (Save Our Libraries) dedicated to keeping the Santa Clarita libraries within the County Library system continues to subpoena former and present City officials in an ongoing lawsuit, the attorney assigned to the matter, Donald Ricketts, maintains that unwarranted access to the public’s information is the primary issue.

“What the lawsuit says is you can’t put the library into the hands of a private company,” Ricketts said, “because to do so you would have to give them information which is confidential and which they need to run the library.”

After City Council voted 4-1 on August 24 to secede from the County of Los Angeles Public Library – and inevitably award a contract to Library Systems and Services, LLC to run the City’s three branches – 12 people sent a letter to City Council alleging a Brown Act violation had occurred.

Essentially, the Brown Act prevents California governmental bodies from holding secret workshops and study sessions where decisions concerning the public could be made without its attendance.

Question: Is there a way to insure that a private corporation wouldn’t take advantage? And should we assume that they would take advantage of acquiring confidential information?

KHTS Hometown Station reports.

October 22, 2010 by Legal Issues Librarians Libraries Privacy

Bookseller of Kabul Author Sued for Breach of Privacy

A court in Norway has ordered Åsne Seierstad, author of the Afghanistan-set bestseller The Bookseller of Kabul, and her publisher, Cappelen Damm, to pay 250,000 kroner (£26,276) in damages to a woman portrayed in the book.

Oslo district court ruled that the Norwegian author and journalist, whose book was based on the three months she spent living with a bookseller and his family, had breached the privacy of Suraia Rais, wife of bookseller Shah Muhammad Rais, and included inaccurate information in her account.

“The information [in the book] about Rais’s thoughts and feelings is sensitive,” the Oslo district court ruled, according to a report in the Dagbladet newspaper. “They are attributed to her as true, and neither Seierstad nor Cappelen Damm can be considered to have acted in good faith to ensure they were correct and accurate.”

Mr Rais – the bookseller of the title – has always disputed its contents, which portray him as a tyrannical head of the household. He claimed that the book was distorted, revealed family secrets and put his family in danger, to the extent that his two wives both fled the country to live in exile in Canada and Norway. In 2007, Mr Rais wrote his own account of his life Once Upon a Time There was a Bookseller in Kabul. Last year he signed a deal with Indian distributor Motilal Books to sell his books into the UK.

Guardian UK.

July 27, 2010 by Authors Books EBooks Privacy

ACLU threatens to join Amazon customer privacy fight

The American Civil Liberties Union of North Carolina is telling the state Department of Revenue to back off on a request for “constitutionally protected private information” of Amazon.com customers.

In a letter Thursday to Revenue Secretary Kenneth Lay, the group says it will join an existing lawsuit brought by the online retail giant if the department “persists in its demand” for North Carolina customers’ names and addresses.

Full article here.

May 20, 2010 by Amazon Internet Legal Issues Privacy

Teaching Children and Young Adults How to Choose Privacy

It’s becoming ever more critical day by day; today marks the beginning of Choose Privacy Week (School Library Journal).

“The point of Choose Privacy is to spark a nationwide dialogue of what privacy means to us, and what the privacy laws are today in the digital space,” says Angela Maycock, assistant director for ALA’s Office for Intellectual Freedom.

For children, protecting those rights is even more critical as young students often aren’t sophisticated enough to grasp what is appropriate behavior on the Web. School librarians can play a crucial role in helping to steer children towards tools they can use to protect themselves, say experts.

“Certainly we know young people are intuitively and naturally interested in social networking and other tools online,” says Maycock. “And so school librarians play a really important and critical part in this effort as they’re a starting gate in learning how to access information, and do it responsibly and safely.”

Yet how school librarians approach these lessons can vary, especially depending on a student’s age. A kindergartener may have a different understanding of cookies than a junior in high school and so teaching tools often need to start with very rudimentary examples and behavior models.

May 3, 2010 by Internet Legal Issues Libraries Privacy School Libraries

How Privacy Vanishes Online

If a stranger came up to you on the street, would you give him your name, Social Security number and e-mail address?

Probably not.

Yet people often dole out all kinds of personal information on the Internet that allows such identifying data to be deduced. Services like Facebook, Twitter and Flickr are oceans of personal minutiae — birthday greetings sent and received, school and work gossip, photos of family vacations, and movies watched.

Computer scientists and policy experts say that such seemingly innocuous bits of self-revelation can increasingly be collected and reassembled by computers to help create a picture of a person’s identity, sometimes down to the Social Security number.

Full story

March 17, 2010 by EBooks Internet Privacy School Libraries

LISNews Archives