Protecting Patron Privacy

Libraries are failing to use HTTPS

By Marshall Breeding | May 31, 2016

Libraries value patron privacy. Yet a scan of current practices reveals uneven activation of the basic technology to secure web-based library systems. Encryption of data presented in online catalogs, discovery services, and other resources is essential to protect privacy. Without encryption, the content that patrons search for, view, or download is easily intercepted. These online streams of communications deserve the same protection granted to circulation records, but few libraries are taking even minimal steps to encrypt this data.

Secure communication on the web provides two important benefits:

identifying the website authoritatively
enabling encrypted communications between the user’s browser and the server that provides the resource

Encryption algorithms transform the data into a seemingly garbled form that, if intercepted, cannot be deciphered.

The use of a secure communication protocol (HTTPS) provides the best approach available today for protecting patron privacy. With HTTPS, a page remains encrypted from the time it is transmitted by the web server until it is displayed on the user’s browser. The information remains impervious to eavesdropping throughout its route, even if it passes through unsecured wireless networks or other points of vulnerability. The use of HTTPS has expanded from securing passwords and credit cards to all types of online services, and it is now widespread among commercial services, including Facebook, Twitter, and all Google services.

Enabling encryption on web-based resources has never been easier. Encryption with the HTTPS protocol requires minimal computing resources and is not difficult to implement. The user’s browser will indicate that the transmission is secure. Chrome, for example, identifies a fully valid and secure site with a green padlock and shows HTTPS in the URL; clicking on the padlock displays the details of the certificate.

Out of 124 ARL member libraries, only 16 (13%) use HTTPS on their main websites.

My Library Technology Report. Privacy and Security for Library Systems (vol. 52, no. 4), aims to assess the extent to which libraries use encryption to secure their patron-facing interfaces. In December 2015, I inspected the websites of representative groups of libraries, including members of the Association of Research Libraries (ARL) and the largest 25 public libraries in the US. These libraries are the most likely to have the technical capability and financial resources to implement secure systems. The data represents a snapshot of current practices and a baseline to measure changes that are taking place. Here are some of the key observations:

Out of 124 ARL member libraries, only 16 (13%) use HTTPS on their main websites.
Out of the 95 ARL member libraries that feature an online catalog search on their websites, only 12 (14%) default to HTTPS for search activity.
Out of the 100 ARL member libraries that feature a discovery service on their websites, only 17 (17%) default to HTTPS for search activity.
Out of the 25 large public libraries, only two (8%) use HTTPS on their main websites, and only seven (28%) default to HTTPS for catalog search activity.

The results of this study are alarming. My vendor survey of library automation systems shows that all have the technical capacity for encrypted secure communications. Only a small percentage of libraries have implemented encryption for their online catalogs or discovery services. Similarly, few implement their websites with security, which is also a standard capability of commercial and open-source web servers or content management systems.

We could attribute this lapse to gaps in awareness or a lack of expertise to reconfiguring implementations. Vendors and libraries can partner to reshape the security landscape quickly if this is identified as a priority.

MARSHALL BREEDING is an independent consultant and editor of the website Library Technology Guides. He is the author of the May/June Library Technology Report Privacy and Security for Library Systems.

Tagged Under

Two-time Newbery Medal–winning author Kate DiCamillo is the 2016 Collaborative Summer Library Program National Summer Reading Champion.

Newsmaker: Kate DiCamillo

Two-time Newbery Medal winner talks about being a Summer Reading Champion

To raise awareness of sex trafficking, posters were designed for bus stops and billboards.

Out of the Shadows

San Diego Public Library combats child sex trafficking with a bold new campaign

Latest Library Links

13h

Max Eddy writes: “It’s a nightmare scenario: You’ve protected all of your online accounts with two-factor authentication (2FA), but then your phone is broken, lost, or stolen, and you’re locked out of everything. Past You’s effort to protect Future You has made Present You’s life a living hell. 2FA is supposed to keep attackers and scammers out of your online accounts, but what if something happens to your second factor? With a little planning, you can reduce that risk and still keep your accounts safe.”

New York Times Wirecutter, Apr. 12
17h

Nik Altenberg writes: “About 100 librarians and their supporters rallied outside San Francisco Public Library’s Main Library on April 9 to demand the city hire security guards for every branch. Workers decried a lack of security at most of the city’s branches and said they are often forced to de-escalate volatile situations and step into the role of providing security themselves. The rally is the latest in a series of union actions [from 10 unions representing more than 25,000 city workers across city departments] seeking to draw attention to what they say is a pervasive understaffing crisis.”

KQED-TV (San Francisco), Apr. 9
2d

“Two years after Brooklyn Public Libraries’ (BPL) launch of Books Unbanned, an initiative to protect the freedom to read for young people, In Their Own Words: Youth Voices on Books Unbanned gives new insight into the impact of censorship on teen and young adults across the US and how restrictions and other barriers to access build upon and reinforce each other. The new report, published April 11 by BPL and Seattle Public Library, analyzes 855 stories shared by young people who signed up for a free Books Unbanned ecard from April 2022 through December 2023.”

Seattle Public Library, Apr. 11
2d

Samantha Guss, Sojourna Cunningham, and Jennifer Stout write: “Recruitment and retention are both critical to diversity, equity, and inclusion efforts in academic libraries, and failing to improve retention has and will continue to derail these initiatives. Research that addresses retention tends to focus on proposed strategies, such as stay interviews (structured interviews aimed at strengthening employee and employer relationships) and mentorship programs. But there is no agreed-upon definition of retention that would allow us to assess these strategies. We should recognize that involuntary staying can be just as negative an outcome for the individual and the organization as leaving, setting the stage for legacy toxicity.”

In The Library With The Lead Pipe, Apr. 10
3d

Jackie Edwards writes: “As spring rolls around, seasonal allergies can flare up among library workers, resulting in symptoms like sneezing; runny or stuffy nose; itchy eyes, ears, and nose; coughing; and asthma. Not only are these symptoms detrimental to well-being and productivity, but they can also mean you’re less able to provide excellent customer service to library users. Fortunately, by purifying the air, preventing mold, and keeping your work area clean, you can improve indoor air quality and combat allergies in your library.”

Library Worklife, Apr.
3d

In Episode 94, Call Number celebrates Preservation Week, to be held this year April 28–May 4. The week’s events aim to raise awareness of the role libraries and cultural institutions play in protecting historic and culturally significant collections. Segments include Traci Sorell, honorary chair of this year’s Preservation Week, discussing the role of preservation through storytelling; Kathleen Monahan, special collections public services supervisor at Boston Public Library, addressing the importance of security in preservation; and Rosie Grayburn and Melissa Tedone, cofounders of the Poison Book Project, talking about their research on potentially toxic bookbinding materials from the 19th century.

AL: The Scoop, Apr. 15
4d

Leigh Kunkel writes: “The legalization of marijuana in many states and municipalities in recent years has created a newly legal industry and budding entrepreneurs who can benefit from the expertise of business librarians. As soon as Washington state introduced an initiative to legalize recreational cannabis use in 2012, Seattle Public Library librarian Jay Lyman started fielding questions from potential entrepreneurs. Since then, 24 states and the District of Columbia have legalized recreational cannabis use, and 14 more have legalized medical use of cannabis. This cultural shift brings a new opportunity for libraries to step in with support services.”

American Libraries Trend, Mar./Apr.