Privacy

Apple and the FBI: Why is this relevant to libraries?

Why is this relevant to libraries? I think it’s past time that we start paying very close attention to the details of our data in ways that we have, at best, hand-waved as a vendor responsibility in the past. There have been amazing strides lately in libraryland in regards to the security of our data connections via SSL (LetsEncrypt) as well as a resurgence in anonymization and privacy tools for our patrons (Tor and the like, thank you very much Library Freedom Project).

Data about our patrons and their interactions that isn’t encrypted at rest in either the local database or the vendor database hosted on their servers (and our electronic resource access, and our proxy logins, and, and, and…) is data that is subject to subpoena and could be accessed in ways that we would not want. It is the job of the librarian to protect the data about the information seeking process of their patrons. And while it’s been talked about before in library circles (Peter Murray’s 2011 article is a good example of past discussions) this court case brings into focus the lengths that some aspects of the law enforcement community will go to in order to have the power to collect data about individuals.

From Apple, the FBI, and Libraries | Pattern Recognition

Why is this relevant to libraries? I think it’s past time that we start paying very close attention to the details of our data in ways that we have, at best, hand-waved as a vendor responsibility in the past. There have been amazing strides lately in libraryland in regards to the security of our data connections via SSL (LetsEncrypt) as well as a resurgence in anonymization and privacy tools for our patrons (Tor and the like, thank you very much Library Freedom Project).

Data about our patrons and their interactions that isn’t encrypted at rest in either the local database or the vendor database hosted on their servers (and our electronic resource access, and our proxy logins, and, and, and…) is data that is subject to subpoena and could be accessed in ways that we would not want. It is the job of the librarian to protect the data about the information seeking process of their patrons. And while it’s been talked about before in library circles (Peter Murray’s 2011 article is a good example of past discussions) this court case brings into focus the lengths that some aspects of the law enforcement community will go to in order to have the power to collect data about individuals.

From Apple, the FBI, and Libraries | Pattern Recognition

Online Privacy and the Invisible Market for Our Data.

Abstract: Consumers constantly enter into blind bargains online. We trade our personal information for free websites and apps, without knowing exactly what will be done with our data. There is nominally a notice and choice regime in place via lengthy privacy policies. However, virtually no one reads them. In this ill-informed environment, companies can gather and exploit as much data as technologically possible, with very few legal boundaries. The consequences for consumers are often far-removed from their actions, or entirely invisible to them. Americans deserve a rigorous notice and choice regime. Such a regime would allow consumers to make informed decisions and regain some measure of control over their personal information. This article explores the problems with the current marketplace for our digital data, and explains how we can make a robust notice and choice regime work for consumers.

From Notice and Consent – Schneier on Security You can read the Paper Here.

Abstract: Consumers constantly enter into blind bargains online. We trade our personal information for free websites and apps, without knowing exactly what will be done with our data. There is nominally a notice and choice regime in place via lengthy privacy policies. However, virtually no one reads them. In this ill-informed environment, companies can gather and exploit as much data as technologically possible, with very few legal boundaries. The consequences for consumers are often far-removed from their actions, or entirely invisible to them. Americans deserve a rigorous notice and choice regime. Such a regime would allow consumers to make informed decisions and regain some measure of control over their personal information. This article explores the problems with the current marketplace for our digital data, and explains how we can make a robust notice and choice regime work for consumers.

From Notice and Consent – Schneier on Security You can read the Paper Here.

February 26, 2016 by Blake Internet Legal Issues Privacy

Yahoo Webscope: A reference library of interesting and scientifically useful datasets

The Yahoo Webscope Program is a reference library of interesting and scientifically useful datasets for non-commercial use by academics and other scientists.

All datasets have been reviewed to conform to Yahoo’s data protection standards, including strict controls on privacy. We have a number of datasets that we are excited to share with you.

Yahoo is pleased to make these datasets available to researchers who are advancing the state of knowledge and understanding in web sciences. The datasets are only available for academic use by faculty and university researchers who agree to the Data Sharing Agreement.

From Webscope | Yahoo Labs

The Yahoo Webscope Program is a reference library of interesting and scientifically useful datasets for non-commercial use by academics and other scientists.

All datasets have been reviewed to conform to Yahoo’s data protection standards, including strict controls on privacy. We have a number of datasets that we are excited to share with you.

Yahoo is pleased to make these datasets available to researchers who are advancing the state of knowledge and understanding in web sciences. The datasets are only available for academic use by faculty and university researchers who agree to the Data Sharing Agreement.

From Webscope | Yahoo Labs

February 26, 2016 by Blake Internet Librarians Libraries Privacy Yahoo

IFLA issues Statement on Right to be Forgotten

IFLA urges library professionals to participate in policy discussions about the right to be forgotten, while both supporting the right to privacy for individual citizens and assisting individuals in their searches for information. To this effect, library professionals should:

Raise awareness among policy makers to ensure that the right to be forgotten does not apply where retaining links in search engine results is necessary for historical, statistical and research purposes; for reasons of public interest; or for the exercise of the right of freedom of expression.

From IFLA issues Statement on Right to be Forgotten

IFLA urges library professionals to participate in policy discussions about the right to be forgotten, while both supporting the right to privacy for individual citizens and assisting individuals in their searches for information. To this effect, library professionals should:

Raise awareness among policy makers to ensure that the right to be forgotten does not apply where retaining links in search engine results is necessary for historical, statistical and research purposes; for reasons of public interest; or for the exercise of the right of freedom of expression.

From IFLA issues Statement on Right to be Forgotten

February 25, 2016 by Blake Libraries Privacy

Don’t Panic Making Progress On The “Going Dark” Debate

We’re not being asked to choose between security and privacy. We’re being asked to choose between less security and more security.

This trade-off isn’t new. In the mid-1990s, cryptographers argued that escrowing encryption keys with central authorities would weaken security. In 2011, cybersecurity researcher Susan Landau published her excellent book Surveillance or Security?, which deftly parsed the details of this trade-off and concluded that security is far more important. Ubiquitous encryption protects us much more from bulk surveillance than from targeted surveillance. For a variety of technical reasons, computer security is extraordinarily weak.

If a sufficiently skilled, funded, and motivated attacker wants in to your computer, they’re in. If they’re not, it’s because you’re not high enough on their priority list to bother with. Widespread encryption forces the listener – whether a foreign government, criminal, or terrorist – to target. And this hurts repressive governments much more than it hurts terrorists and criminals.

From Don’t Panic Making Progress On The “Going Dark” Debate [PDF]

We’re not being asked to choose between security and privacy. We’re being asked to choose between less security and more security.

This trade-off isn’t new. In the mid-1990s, cryptographers argued that escrowing encryption keys with central authorities would weaken security. In 2011, cybersecurity researcher Susan Landau published her excellent book Surveillance or Security?, which deftly parsed the details of this trade-off and concluded that security is far more important. Ubiquitous encryption protects us much more from bulk surveillance than from targeted surveillance. For a variety of technical reasons, computer security is extraordinarily weak.

If a sufficiently skilled, funded, and motivated attacker wants in to your computer, they’re in. If they’re not, it’s because you’re not high enough on their priority list to bother with. Widespread encryption forces the listener – whether a foreign government, criminal, or terrorist – to target. And this hurts repressive governments much more than it hurts terrorists and criminals.

From Don’t Panic Making Progress On The “Going Dark” Debate [PDF]

February 25, 2016 by Blake Legal Issues Privacy

LIBRARIES NEED TO PRIORITIZE PATRON PRIVACY & SECURITY IN A DIGITAL WORLD

Over the past few months, we have been approached by groups leading a charge to recognize patron security and privacy as an important part of library purchasing responsibility. The facts are that many of the platforms licensed by libraries today do not prioritize and sometimes neglect basic steps to ensure libraries can protect patron security and privacy. The reason is simple: Libraries do not demand it.

From LIBRARIES NEED TO PRIORITIZE PATRON PRIVACY & SECURITY IN A DIGITAL WORLD — Medium

Over the past few months, we have been approached by groups leading a charge to recognize patron security and privacy as an important part of library purchasing responsibility. The facts are that many of the platforms licensed by libraries today do not prioritize and sometimes neglect basic steps to ensure libraries can protect patron security and privacy. The reason is simple: Libraries do not demand it.

From LIBRARIES NEED TO PRIORITIZE PATRON PRIVACY & SECURITY IN A DIGITAL WORLD — Medium

February 24, 2016 by Blake Libraries Privacy

NH bill would explicitly allow libraries to run Tor exit nodes

Inspired by the Library Freedom Project’s uncompromising bravery in the face of a DHS threat against a town library in Kilton, NH, that was running a Tor exit node to facilitate private, anonymous communication, the New Hampshire legislature is now considering a bill that would explicitly permit public libraries to “allow the installation and use of cryptographic privacy platforms on public library computers for library patrons use.”

From NH bill would explicitly allow libraries to run Tor exit nodes / Boing Boing

Inspired by the Library Freedom Project’s uncompromising bravery in the face of a DHS threat against a town library in Kilton, NH, that was running a Tor exit node to facilitate private, anonymous communication, the New Hampshire legislature is now considering a bill that would explicitly permit public libraries to “allow the installation and use of cryptographic privacy platforms on public library computers for library patrons use.”

From NH bill would explicitly allow libraries to run Tor exit nodes / Boing Boing

February 20, 2016 by Blake Libraries Privacy

Everything you need to know about the Apple versus FBI case

Summary
This issue is much bigger than just Apple providing access to a single device, it’s much bigger than the encryption debate and it’s much bigger than just the US. There are angles to this we haven’t thought about yet and it’ll continue to be sensationalised by the press, misrepresented by the government and rebuked by Apple.

The ramifications of them actually complying with this court order would likely spread well beyond just compromising a device that’s in the physical possession of law enforcement. A precedent the likes of Apple being forced to weaken consumer protections will very likely then be applied to other channels; what would it mean for iMessage when the authorities identify targets actively communicating where they’re unable to gain physical access to the device? It sets an alarming precedent and all the same arguments mounted here by the FBI could just as easily be applied to end to end encryption.

But let me finish on a lighter note: this also has the potential to result in greater consumer privacy for everyone. In part because if Apple successfully defends their stance then they’ll have the precedent the next time the issue is raised. In part also because this incident may well prompt them to tie their own hands even further and indeed this appears to be the case with the newer generation of device. And finally, because the world is watching how this plays out and it will influence the position of other governments and tech companies outside the US. If sanity prevails, we may well all be better off for having gone through this.

From Troy Hunt: Everything you need to know about the Apple versus FBI case

Summary
This issue is much bigger than just Apple providing access to a single device, it’s much bigger than the encryption debate and it’s much bigger than just the US. There are angles to this we haven’t thought about yet and it’ll continue to be sensationalised by the press, misrepresented by the government and rebuked by Apple.

The ramifications of them actually complying with this court order would likely spread well beyond just compromising a device that’s in the physical possession of law enforcement. A precedent the likes of Apple being forced to weaken consumer protections will very likely then be applied to other channels; what would it mean for iMessage when the authorities identify targets actively communicating where they’re unable to gain physical access to the device? It sets an alarming precedent and all the same arguments mounted here by the FBI could just as easily be applied to end to end encryption.

But let me finish on a lighter note: this also has the potential to result in greater consumer privacy for everyone. In part because if Apple successfully defends their stance then they’ll have the precedent the next time the issue is raised. In part also because this incident may well prompt them to tie their own hands even further and indeed this appears to be the case with the newer generation of device. And finally, because the world is watching how this plays out and it will influence the position of other governments and tech companies outside the US. If sanity prevails, we may well all be better off for having gone through this.

From Troy Hunt: Everything you need to know about the Apple versus FBI case

February 18, 2016 by Blake Legal Issues Privacy

The dark side of big data

For now, assume that all your digital data is accessible by a single instance, say your government. In this case you provide your government with incredible control over yourself and also your relatives. A mere measurement of how defiant you are could be dangerous for you, depending on where you live. Furthermore, someone gazing at your data is not required to remain inactive. One might try to manipulate your opinion by placing solely the content on (social) media platforms that you are supposed to see.

From The dark side of big data

For now, assume that all your digital data is accessible by a single instance, say your government. In this case you provide your government with incredible control over yourself and also your relatives. A mere measurement of how defiant you are could be dangerous for you, depending on where you live. Furthermore, someone gazing at your data is not required to remain inactive. One might try to manipulate your opinion by placing solely the content on (social) media platforms that you are supposed to see.

From The dark side of big data

February 15, 2016 by Blake Privacy

Library boards need independence

The ability of a library board to act free of political influence is imperative in maintaining the local public library as a trusted community institution, one that provides information without discrimination. Libraries and their independent boards work diligently to protect the rights of confidentiality, privacy and the freedom to read.

From Midlands Voices: Library boards need independence – Omaha.com: Opinion