What's Next? Strengthening Our Communities Ahead of the Incoming Administration

source

I'll admit it. I've been lax about some things in the time since I became a library director. In my defense, the list of things I needed to do when I first started was intimidatingly long and I focused on things that were major conflagrations - opting to leave the fire hazards in place because there's only so much time in a day and only so much energy in a person. But now those fire hazards, those small sparks, need attention since the incoming administration seems to want to pour gasoline over all of us.

Here are a few things I've been meaning to do that will be at the top of my list, along with some things I've been doing all along but that will get even more attention.

1. Privacy Audit. I've been meaning to do this for years now. I printed out and read a bunch of materials, such as this checklist from ALA, but there was always something that got in the way of execution. No more. This will be at the top of my priority list.
2. Disaster Preparedness, Including Active Shooter Response Training. I made some progress on this project, but again things got in the way. I need to make this a priority, so I will probably invoke liability to get people's attention. I found Library As Safe Haven helpful when I did have a chance to do this work, and will pull it back out now that I'm making it a priority.
3. Inclusive Collection Development, Programs, and Outreach. I've talked before on this blog about how we will do displays about and for disadvantaged groups, but we make a point of doing it beyond the typical time frame. For example, we had a display on protest culture and civil rights activists, yes, but not in February. Also, I'm planning to spend a good chunk of our collection development budget on beefing up our resources for and by underrepresented voices.
4. Safe Space Building. I went through Safe Space training recently, and the facilitators talked about how it's possible to have your entire building or department be designated a Safe Space. It means everyone who works in the building has to go through the training, so it's going to be a reach, but I want to try. If any building on this campus should be a Safe Space, it's the library.
5. Adding Language to Our Mission/Vision/Values Statements. Our goal of being inclusive (which does not mean neutral... you all know that, right?) is woven throughout our guiding documents, but it isn't stated anywhere explicitly. It needs to be.

So that's what I know I can do. What I think we should all do. But I know there is more, so please comment with what you're doing and what we call can do.

Constant Vigilance, by Galen Charlton

source

Constant vigilance! CONSTANT VIGILANCE!

Mad-eye Moody’s catchphrase in Harry Potter and the Goblet of Fire expresses his view of the primary requirement to defend against the Dark Arts: continually paying attention to potential threats.

Moody’s dictate is something I keep in mind as I do my job. Many of us run catalogs and discovery systems and are audacious enough to put them on the web, for anybody to search. Absolutely anybody – including the script kiddies, crackers, and botnet operators could take our servers over for their own ends – or simply vandalize them for the lulz.

That’s a threat that the people behind every public-facing server must either attempt to prevent or ignore, of course. But in libraries we’ve also taken upon ourselves a greater responsibility: to safeguard the privacy of our patrons.

Reader privacy isn’t something to take lightly, unless we choose to take our profession lightly. The freedom to read, one of our core tenets, is curtailed if the reader has to worry about somebody looking over their shoulders or judging them. The freedom to read can sometimes be a life-or-death matter. I’m not just talking about readers in war zones or politically unstable areas: a teenager trying to figure out their place in life, or their very sense of self may find succor in a library; to have what they are reading to find themselves be revealed to the wrong people can be deadly. It’s not always a life-and-death matter, of course, but it’s sufficient to recognize that what a patron is reading is nobody ’s business but their own.

Here are some ways to protect patron privacy that I, a library technologist who also wears the hats of programmer, system administrator, and manager, have learned along the way. (There’s a lot more to each of these ideas, but I wanted to give you an overview.)

There’s no point in giving up. It’s commonly expressed that privacy is either dead, impossible to protect, or unwanted. No! It has become more difficult to protect; modern software and the urge to automate all the things and store all the data makes it easier to gather and collate information about people and their activities. Libraries can resist that, though. And if you think that teens don’t care about privacy, you’re wrong. (For research, click the danah boyd link below.)

Think carefully about what data you collect. For instance, U.S. libraries should never be in the business of collecting Social Security Numbers. If a public library’s policy for establishing proof of residence requires gathering SSNs, it’s time to go to the library board and get that changed.

Protecting confidential data – or losing it - depends on people. There are lots of technical and software measures that can hide, destroy, or encrypt patron information -- but they can be for naught if a clerk isn’t trained to refer every law enforcement request to the appropriate administrators.

There is a lot to learn. Here’s one example: it’s a terrible, no good, very bad thing if a patron calls up the circ desk, tells you that they’ve forgotten their password, and for you to be able to tell them what it is. Don’t know why? Read up on “password hashing.”

There is a lot to teach. Like it or not, one of the roles that many libraries serve is as community tech support. This is also an opportunity: via programs, classes, and one-on-one interactions, you can help patrons learn to better protect themselves online.

You will mess up. Some libraries have had their patron databases breached; many others have had their OPAC servers get pwned. Some libraries have kept too much circulation data and had to hand it over to law enforcement for dubious fishing expeditions – and worst of all, they can be legally bound to say nothing.

This is why I say protecting reader privacy is an ongoing, continuous improvement project. Aim to get better incrementally, learn from your mistakes, and take heart: even Mad Eye Moody’s vigilance failed him, but in time he was freed and able to continue his fight against Voldemort. Don’t take it just from me. Some folks to read on the topic: Alison Macrina of the Library Freedom Project, danah boyd, Barbara Fister, Gary Price, Eric Hellman, and as well as folks outside of the library profession such as Latanya Sweeney. Want to join the discussion? Subscribe to the LITA Patron Privacy Technologies IG’s mailing list. There are also numerous resources available; a good starting point is ALA’s Privacy Toolkit.

And remember... constant vigilance!

Galen Charlton is a developer and manager at Equinox Software, where he spends his time helping libraries to use and improve the open source integrated library systems Koha and Evergreen. He was named an LJ Mover & Shaker in 2013, which he took as an opportunity to sneak Tux the Penguin onto the pages of Library Journal. He can be found on Twitter as @gmcharlt; if you want to send him an encrypted message, check out https://keybase.io/gmcharlt.