LastPass and Clubhouse and Virginia, Oh My!

A grey tabby cat curled up and sleeping between newspaper sheets. — It’s hard to get started on a Monday morning… image source: https://www.flickr.com/photos/cyawan/2325855567/ (CC BY 2.0)

A lot happened in the privacy world last week! Let’s go over a couple of news items that affect libraries and library patrons alike.

LastPass Free Tier Woes

The popular password manager LastPass announced changes to their free tier accounts last week that could leave many libraries and library patrons scrambling for an alternative. Starting March 16^th, LastPass will require free account users to choose where to use LastPass: mobile or computer. Free account users will also lose access to email support to troubleshoot any problems with the password manager. For many free tier account users, being forced to choose to have their primary password manager only installed on one platform severely limits the usefulness and protection of their chosen password manager.

If you have a LastPass free tier account and don’t want these restrictions, your options are limited:

If you have room in your budget and want to stay with LastPass, you can upgrade to a paid account. This option not only avoids migrating your passwords to another manager and instead unlocks additional features, such as encrypted file storage. While we’re used to having “free” accounts, it might be time to make peace with the fact that it’s time to start paying for password managers.
You can migrate to another password manager. There are several choices in the marketplace; however, not many have free tier accounts, which means you might end up paying for a password manager anyway. Bitwarden, an open-source password manager, does have a free tier account that allows for syncing between multiple devices if you need a free account. KeePassXP is another free option for the more technically-inclined who can self-host their password manager.

You can read more about the basics of password managers in our Obligatory Password Manager post from April 2020.

Clubhouse Is Not Your Library’s New Social Media App

So… Clubhouse, that new shiny app that everyone’s talking about. You’re curious about it, aren’t you? You’re wondering if you can add it to the family of social media accounts for your library when you get an invite to join.

Let us stop you right there.

In addition to being exclusive to iOS, being inaccessible, and being a free-for-all for harassment, Clubhouse’s privacy practices are almost non-existent. Literally – the privacy policy did disappear for a while! Nonetheless, the privacy policy is up, and it’s one of the more invasive privacy policies that should make you pause before using the product for any library program, service, or process. We’ve rounded up several articles that describe these invasive data privacy practices in detail:

Some folks will say that other social media companies engage in some of the same practices. However, the overall poor quality and construction of the privacy policy combined with privacy practices that violate several privacy laws in the US and the EU, the best way to protect patron privacy while using Clubhouse at your library is to not use Clubhouse.

Virginia Getting a New Data Privacy Law?

Virginia libraries! You might have heard about a new data privacy bill that currently sits on the governor’s desk at the time of this writing (it might be signed by the time this post is published!). What is the library tl;dr of the Virginia Consumer Data Protection Act?

The bill provides similar data rights as California’s two new privacy regulations, CCPA and CPRA, including rights for consumers to request access and deletion of personal data, as well as the right to opt-out of businesses selling their data.
The bill’s scope is also similar to CCPA’s and CPRA’s scopes, targeting for-profit businesses doing business in the state who meet certain thresholds, such as controlling or processing data from 100,000 consumers. Non-profits and higher education institutions are exempt.

Once this bill is signed into law, library vendors who do business in the state and meet the scope thresholds will need to comply with the new law. Library vendors who already comply with CCPA have a head start, but libraries might find themselves with vendors who have to play catchup. It might be time to start reviewing contracts and vendor privacy policies as well as the Act to determine what data rights your patrons have and how they can exercise those rights with those vendors.

LDH in The News

LDH is proud to announce that our founder, Becky Yoose, will give the Keynote Address at the Evergreen International Online Conference on May 25^th, 2021! This annual conference draws Evergreen users, developers, advocates, vendors, and others interested in the Evergreen ILS or open-source software community from around the library world and beyond. This year’s conference is online and registration is now open! If you want to join in on the presentation fun, the call for proposals is open until March. We look forward to seeing you at the conference!

February 16, 2021February 16, 2021

Canaries and Reports – Transparency at The Library

A puffy canary sitting on a small tree branch. — Image Source: https://www.flickr.com/photos/starr-environmental/24899952889/ (CC BY 2.0)

Snow has come to Seattle and with it comes the covered evergreen trees, cars slipping and sliding on the many hills, and skiing down major roadways. The shift to remote work, schooling, and services has morphed traditional snow days into “work at home if the snow hasn’t knocked out power” days. We talked about protecting patron privacy while working from home or traveling in previous posts, but we haven’t covered much around possible changes to communicating to patrons about library privacy. Now that the dust (snow) has settled, there’s one aspect of shifting to virtual library operations that needs some attention – transparency around law enforcement requests for library data.

The Canary in The Library

This year marks the 20^th anniversary of the passing of the USA PATRIOT Act. While this bill passed almost unanimously through Congress, public outcry over the bill’s erosion of privacy rights was strong throughout the bill’s lifespan and the bill’s successor, the USA Freedom Act. Libraries did not escape the PATRIOT Act’s reach, with Section 215 of the Act allowing for warrantless searches for “tangible things” which the section listed “books, records, papers, documents, and other items” as some of these tangible things. ALA and many US libraries voiced their concerns about the Act’s threat to patron privacy, and many libraries changed policies and procedures to reduce the amount of patron data retained that could be seized under the Act.

There was another part of the Act that changed how libraries communicated to patrons about their privacy. The PATRIOT Act allowed gag orders to be attached to National Security Letters, preventing library workers from disclosing that they received an NSL. An example of such a gag order was the lawsuit brought forward by the Connecticut Four, successfully challenging the validity of the gag order of receiving an NSL for records identifying patrons who used library computers.

The prospect of a gag order led libraries to explore ways to notify patrons about receiving an NSL without violating the gag order that came with it. One way to get around the gag order was a warrant canary. You might have seen some warrant canary signs designed by Jessamyn West posted in various libraries, including this one:

The FBI has not been here

(watch very closely for the removal of this sign)

The canaries popped up at libraries throughout the years, and the public took notice, making warrant canaries one of many ways that libraries communicated about patron privacy.

Shifting to Digital Canaries and Transparency Reports

While libraries have incorporated digital resources and services in library operations for decades, the rapid shift to virtual operations and services due to the pandemic raises some questions about library-patron communications. Physical types of communications such as signs, handouts, and pamphlets have limited reach with reduced physical services and hours. For libraries that use warrant canary signs, this restriction of in-building services limits the signs’ effectiveness. An option to work around this limitation is a digital version of the warrant canary on the library website, either as a separate page or as part of the library’s privacy notice page.

However, warrant canaries are specific to one type of government request for patron data. Tech companies such as Google, Apple, and Microsoft have started publishing transparency reports, providing a more comprehensive listing of the number and type of governmental request for user data. These reports can provide the number of requests that were fulfilled by the company as well as how many were not. Like any other public report, the data published in the report should be aggregated to reduce the risk of reidentification, the level of which depends on the size of the data set and the number of unique data points included in the set. Transparency reports can also be a place where libraries can reiterate their commitment to patron privacy, including how law enforcement request policies and procedures protect patron data.

Digital canaries and transparency reports provide greater reach in virtually communicating with patrons while in-person services are reduced due to the pandemic. Nonetheless, these communication tools will still be effective once restrictions on in-person services are lifted. Not only do they provide patrons information around governmental requests for library data, but they also serve as a way for libraries to hold themselves accountable in ensuring that patron data is not unnecessarily disclosed outside of regulation and policies.

February 8, 2021February 8, 2021

Upcoming Library Privacy Trainings

A grey and white tabby cat laying down on top of a binder of handwritten notes sitting on a table. — The cat wishes to discuss your professional development plans for 2021. Image source – https://www.flickr.com/photos/donabelandewen/3543134442/ (CC BY 2.0)

It’s already the second month of 2021 – have you had some time to figure out your 2021 professional development goals? Here are a couple of privacy training opportunities for you or to pass along to your colleagues!

Library Data Privacy Fundamentals (February 16 – March 15, 2021) – This month-long course (taught by Becky Yoose of LDH) will go through the foundations of library data privacy for library workers who are new to the library world or wish to strengthen their core understanding of library data privacy. We’ll cover the basics of the data lifecycle, privacy policies and procedures, and vendor privacy management. The course will also explore the “what” and “how” in communicating privacy to both patrons and library colleagues, including administrators.

Library Freedom Project Crash Courses – The Library Freedom Project will be offering a pair of free two-month courses during the summer and fall of 2021. Their first Crash Course, Systems & Policies (May -June 2021), will dive into privacy and data governance policies, privacy audits, vendor privacy management, and working with IT. The second Crash Course, Programs & Training (September-October 2021) will cover how to teach privacy to patrons and library staff alike, including creating privacy programs. These courses are free, but there is an application process. Applications for both courses will open in March 2021.

PLP Data Privacy and Cybersecurity Training for Libraries – Hello to all the Pacific Library Partnership (PLP) member libraries reading right now! You might have attended one of the trainings last year as part of the Data Privacy Best Practices for Libraries project. If you want to learn more about how to train your library in data privacy and security, you’re in luck – thanks to continued funding through LSTA, we are happy to announce our second year of the project and our Train-the-Trainer series!This year we are offering two month-long training series on Data Privacy (offered in March and April 2021) taught by Becky Yoose of LDH and Cybersecurity (offered in April 2021) taught by Blake Carver of Lyrasis.

Don’t fret if the course dates don’t work for you – we will keep you posted throughout the year of additional library privacy-related professional development. Stay tuned!

February 1, 2021February 1, 2021

Privacy at ALA Midwinter – 2021 Recap

Patron privacy had several moments in the spotlight at last week’s ALA Midwinter Conference. If you missed the conference or the news updates, no worries! Here are the highlights to help you catch up.

A big moment for privacy resolutions

ALA Council passed two major privacy resolutions during ALA Midwinter, moving the organization and the profession to make a more deliberate stance against surveilling library patrons through facial recognition software and behavioral data tracking. You can read the full text of the original resolutions at the end of the Intellectual Freedom Committee Midwinter Report, but here are the actions called for in each resolution:

Resolution in Opposition to Facial Recognition Software in Libraries

opposes the use of facial recognition software in libraries of all types on the grounds that its implementation breaches users’ and library workers’ privacy and user confidentiality, thereby having a chilling effect on the use of library resources;
recommends that libraries, partners, and affiliate organizations engage in activities to educate staff, users, trustees, administrators, community organizations, and legislators about facial recognition technologies, their potential for bias and error, and the accompanying threat to individual privacy;
strongly urges libraries, partners, and affiliate organizations that use facial recognition software to immediately cease doing so based on its demonstrated potential for bias and harm and the lack of research demonstrating any safe and effective use;
encourages legislators to adopt legislation that will place a moratorium on facial recognition software in libraries; and
~~directs the ALA Executive Director to transmit this resolution to Congress.~~ [This clause was removed by amendment before the final vote in Council]

Resolution on the Misuse of Behavioral Data Surveillance in Libraries

stands firmly against behavioral data surveillance of library use and users;
urges libraries and vendors to never exchange user data for financial discounts, payments, or incentives;
calls on libraries and vendors to apply the strictest privacy settings by default, without any manual input from the end-user;
urges libraries, vendors, and institutions to not implement behavioral data surveillance or use that data to deny services;
calls on libraries to employ contract language that does not allow for vendors to implement behavioral data surveillance or use that data to deny access to services;
calls on libraries to oversee vendor compliance with contractual obligations;
calls on library workers to advocate for and educate themselves about library users’ privacy and confidentiality rights; and
strongly urges libraries to act as information fiduciaries, assuring that in every circumstance the library user’s information is protected from misuse and unauthorized disclosure, and ensuring that the library itself does not misuse or exploit the library user’s information.

[Disclosure – LDH participated in the Behavioral Data Surveillance Resolution working group]

Each resolution is a strong indictment against surveillance technology and practices, but the resolutions will have limited impact if no further action is taken by the organization or its members. While ALA and its vast array of committees start updating and creating policies, standards, and guidelines to assist libraries in enacting these resolutions, individual libraries can use these resolutions to guide decision-making processes around these technologies on the local level. Library workers can use these resolutions to start conversations about how their libraries should protect patrons against these specific surveillance technologies and practices.

Dystopian future, or dystopian present?

The Top Tech Trends session explored the dystopian aspects of technologies including deepfakes, surveillance practices normalized during the COVID-19 pandemic, and the connection between prison libraries and biometric technologies. The recorded session is available to Midwinter registrants, but if you do not have access to the on-demand video of the session, the American Libraries article on the session summarizes each aspect and the impact it can have on patron privacy and the ability for libraries to serve patrons. Take a moment to read the summary or watch the session and ask yourself – Is your library on its way toward a dystopian tech future, or has it already arrived? What can you do to protect patrons against this privacy dystopia at the library?