DataPrivacyNY, part 1: introductions + NYPL

I was very lucky to be invited by the Carnegie UK Trust to a study trip to New York on public libraries and online data privacy, which took place 15 to 19 May. For me, it was an amazing opportunity to learn from the people we met but also from the other members of our group.
You can look up the tweets under the hashtag #DataPrivacyNY and there will be articles on the Carnegie UK Trust blog from each member of our group.
Here I will simply try to tidy up my notes in a series of three (possibly quite long) posts. (I seem to have a lot of notes!) Usual disclaimer: my notes are a reflection of my personal understanding of what I think people said.


On the first day we had an introduction to the topic of online data privacy as well as an overview of US public libraries, before going on to hear from the team at the New York Public Library.

For our first session we were greeted at the Carnegie Corporation of New York offices by Geri Mannion, who heads the Corporation's US democracy programme. Geri explained that many US public libraries are active in this area: for example with a "citizenship corner" in the library, a place where people - immigrants and US citizens - go to learn about their rights. Some libraries also run sessions to help people apply for naturalisation.

Joel Rosenthal, president of the Carnegie Council for Ethics in International Affairs, then led a discussion on privacy and ethics especially in the United States.

The Carnegie trusts are involved in education, democracy, citizen empowerment, libraries... all areas and institutions that are about "giving each individual person the opportunity to think for his- or herself".

We all have a need for privacy ("something to hide"), be that in our personal life (we all have curtains in our house!) or professional life (you might need to talk about an issue with your supervisor but not share it with everyone else). Some professional roles are restricted, where you have to be careful what you share or do because people can find out about it (e.g. you've donated money to an organisation and your name appears on a public register) and it might discredit your professional activities.

There seems to be different sensibilities regarding privacy in the USA, in the UK, and in the rest of Europe.
The right to privacy has been used against the registration of people on matters relating to health or immigration: why should the government have a list of such people? In the US that same argument has also been used against the registration of individuals who own firearms.
Privacy is a question of choice: making an informed choice about giving away personal information. But sometimes we have to give away our personal information in order to access an online service (e.g. Facebook) or further information.
On public computers in libraries there is a default browser, which may not be the best one to help users protect their online privacy - where is the choice there? It was pointed out that librarians traditionally have the role of selecting what is "best" e.g. in terms of curating book collections and sources of information - does this need to apply to online tools on public computers too?
Internet companies protect their data very well - how do we turn this situation over and get citizens to access that information, and control their own information themselves?

Next Pam Sandlian-Smith, director of Anythink Libraries (public library service near Denver, Colorado) and President-Elect of the Public Library Association gave us an overview of public libraries in the country.

"The sense of confidentiality is part of our DNA in libraries."

The Public Library Association (PLA) is a branch of the American Library Association (ALA). Some of PLA's initiatives include: digital literacy (developing staff skills first), Every child ready to read (helping parents develop their child's literacy in their early years), Project Outcome (making sure library services are counting the right things to show their impact).
In the USA there are over 16,000 public libraries, including over 10,000 in rural areas. There are similar perceptions and support for public libraries from residents in the US as in the UK (as highlighted in the Carnegie UK Trust's Shining a light report). But there are also similar challenges with some communities having an outdated image of their library and not wanting it to change.
Public libraries around the US have set up a wide range of initiatives, activities and services: some offer summer lunch programmes, others have been working on rethinking the library space, children summer reading programmes, ballet in the library, festival to pass on (transgenerational) skills, social workers inviting homeless people and library staff to enjoy a concert and breakfast together...



Anythink Libraries has recently invested in a new campaign to promote the library and its services. "The public library is your place" video (see above) will be aired on TV and there will be posters inside buses. Pam said that devoting money to do this is hard because of budget constraints but absolutely essential since it's about trying to help the community understand everything the library has to offer (as it's about much more than books...) Anythink will also be encouraging the local community to share their stories on social media about how and why they use their library - it's a much more powerful message when it's citizens rather than librarians saying "the library is wonderful!"


From an overview of public libraries in the USA to an overview of online data privacy: next was David Greene, Director Civil Liberties at the Electronic Frontier Foundation (EFF).
EFF "promotes and fights for the rights of users of digital technologies". It is composed of three main teams: lawyers, activists, technologists.

(I was very excited to get a new sticker for my laptop!!)

There is some information online that we knowingly transmit - e.g. when we give our details on an online form - and some that we don't - e.g. our location: we're not always aware we are sharing it.
Metadata (like the location, the time, the recipient) and content (what the message actually says) are treated differently in law and by individuals. David said he doesn't like the term metadata because it makes it sound like it's not important; however metadata about communications can reveal a lot about a person, even without having the content.
In the US there is something called the "third party doctrine": if you have willingly given information such as metadata to a third party then law enforcement can access it. This started a long time ago and applied to letters, phone calls via a human operator... but now it also applies to the Internet, which raises huge problems for privacy.

"There's no such thing as the Internet of Things - it's just putting lots of other people's computers inside your house."

Tracking means the user loses control of their information: we don't know who else on the Internet is also going to get our information.
HTTPS and Tor are tools that can be used to keep some information hidden. By using HTTPS (i.e. encryption) all anyone sitting between the Internet user and the website they are sending that information to will get is the "to" (the name of the website) and "from" (the user's location). The user does have to trust that the website also has good privacy practices. Tor will mask the user's location. See Tor and HTTPS for diagrams of what information can be retrieved by eavesdroppers when using the tools - image 1: when you use neither; image 2: when you use HTTPS; image 3: when you use Tor; image 4: when you use both.

What eavesdroppers can and can't see when you use HTTPS
(Cropped - original image published by EFF under a Creative Commons Attribution licence)

Thoughts for librarians:

• Targeted and vulnerable communities may feel discouraged from using libraries because of data sharing i.e. libraries' inability to guarantee their privacy.
• Libraries like to offer customers "Amazon-like experiences" but at the same time librarians don't like to share their customers' information. So if you want to offer these types of services you need to: give people the option to opt in and educate them about what they're giving up when they sign up; be transparent about how their information is being used and who it is being shared with.
• "Collect as little as possible and then retain even less".
• Build privacy as a feature.
• Produce transparency reports.

Later we met with Tony Ageh, Michelle Mayes and Bill Marden of the New York Public Library (yes, in a meeting room at the iconic Stephen A. Schwarzman building!) The New York Public Library (NYPL) network is composed of 4 research libraries and 88 branch libraries across Manhattan, Staten Island and the Bronx (Brooklyn and Queens each have their own public library network). NYPL is partly funded by the City of New York and by private donations.

NYPL published its revised privacy policy in November 2016. Revising the policy has meant revisiting and harmonising practices; during the review, the team considered the following questions, among others:

• What information do we collect?
• How long for?
• What do we do to protect it?
• Where is the data stored? Is it on the institution's servers or on a resource provider's server, and if the latter in which country?
• What control do we have over data held by a resource provider?
• Do all our online systems use HTTPS?
• Which of our services are opt-out and may need to be changed to opt-in? [In Europe the law points to services being offered by default as opt-in, rather than opt-out.]

The revised policy is supported by internal privacy principles that all staff have signed up to. A group of librarians meets quarterly to review anything new that may affect privacy, for example new software or online services that libraries want to subscribe to.

The NYPL team have recognised a need to educate members of the public about what they're giving away when using a particular third-party platform (e-book provider, database, etc.) the library subscribes to - when customers are using a platform, they are under that vendor's terms and conditions.

[For more information, do read Bill Marden's post The path to creating a new privacy policy : NYPL's story on the Choose Privacy Week blog.]

At NYPL borrowing history data is deleted as soon as the person returns the book!

There is sometimes a tension between the data department, which collects information to understand how the library is used or perceived, and privacy issues.

NYPL offers classes, in multiple languages, for residents to learn about privacy. However, the City has now announced that at every branch library there will be a member of staff able to help residents protect their privacy. [An extract is provided below, though the full text of the announcement is worth reading.] The challenge for NYPL and the other library services is now to roll out training to all staff for them to understand privacy principles, and for some of them to be able to answer all types of security and privacy questions.

"The City, in partnership with our libraries, will support residents throughout all five boroughs who have questions about how to use the internet safely and securely. Librarians and other staff — at least one person at every branch — will be trained to respond to patrons’ questions and will incorporate new lessons into their digital literacy trainings.

Librarians are already on the front lines of digital inclusion and they are a trusted source of information in our communities. This collaboration with the Brooklyn Public Library, New York Public Library, Queens Library and the Metropolitan New York Library Council builds on the achievements of the Data Privacy Project."

Extract from Safeguarding Internet privacy in service to the public by Miguel A. Gamiño Jr., NYC Chief Technology Officer

Commons are forever

This article is the write-up of a talk entitled Empowering users about their rights to use creative works I gave at the National Acquisitions Group (NAG) conference on 14 September 2016. This write-up is also to be published in the Winter edition of NAG's journal Taking stock - which is why it's a bit more formal than my usual posts!

Did you know that Selma, the film about an episode of Martin Luther King’s life released in January 2015, does not use his actual speeches? It is because of copyright issues.

Have you ever tried watching a music video on YouTube, and instead it showed you a message: “This video contains content from … who has blocked it on copyright grounds”?

Copyright is everywhere and even celebrities seem to get embroiled in infringement cases – in these conditions, how can we expect library customers and the wider community to know what they can and can’t do with copyrighted works, especially online videos and images?

Copyright criminal by Alec Couros [cropped]
licensed under Creative Commons BY-NC-SA (Source: Flickr)

What role do libraries have to play in this?

Libraries exist to defend people’s right to enrich and improve their own lives, their environment and society. We library and information professionals make this happen by facilitating access to and the sharing of information, knowledge and culture. Therefore we should be helping our customers discover works they have a right to use freely, such as works in the public domain e.g. that belong to them.

The Commons are forever project at Newcastle Libraries

My role at Newcastle Libraries is within the Business & IP Centre. My colleagues and I are certified by the UK Intellectual Property Office to provide inventors and entrepreneurs information on patents, designs, trade marks and of course copyright. I often feel like people leave us feeling a bit scared about using intellectual property (IP), as we have to tell them to be careful when using IP that may belong to others. What I wanted to do is to invert this situation entirely, and instead tell library users: “yes, it's fine, you can use this without fear of infringement”.

What gave me the impetus I needed was the Carnegie UK Trust Library Lab programme, which aims to support innovation and leadership in public libraries. A call for projects was issued in September 2014 and I was lucky enough to be selected as part of the first cohort of Partners. Thanks to the programme I was able to access funding to develop my project and was supported by a mentor – artist and curator Dominic Smith.

The project became known as Commons are forever. It aimed to empower members of the public about their rights to use creative works that are free of copyright, e.g. in the public domain, and to in turn share what they create with others. It took the form of a series of events that ran at Newcastle City Library from April 2015 to Autumn 2016; the events being a mean of engaging citizens in learning about copyright and enabling them to be creative and actually re-use works.

Rebecca Moosavian and Cory Doctorow at Newcastle City Library
Image by Steve Brock under Creative Commons BY-NC (Source: Flickr)

“Discover and re-use creative works at your library”

Commons are forever was launched with a talk entitled "Copying – right or wrong?" with local law lecturer Rebecca Moosavian and author and activist Cory Doctorow. With this event we sought to both attract attention as Cory Doctorow is a well-known science-fiction and young adult writer but also to get people to understand what copyright is and the potential issues with the current system. It was certainly thought-provoking, with Cory Doctorow proposing that copyright on a work last only 12 years (compared with the duration of the life of the author plus 70 years currently!) with the possibility to be renewed but only by the creator.

Other events in the series were developed in collaboration with local digital media artists and focused on remixing public domain or openly-licensed works. There were an “archive cut-and-paste” session using images from the City Library's local history collections; a film remix workshop where participants re-recorded dialogues from public domain films; a live-coding session using sounds that have been published under an open licence... New creative works made by participants during the events were shared via the Newcastle Libraries' Flickr account.

We also ran in both 2015 and 2016 a photography competition called "We Love Monuments!" based on the Wikimedia Foundation's Wiki Loves Monuments but restricted to pictures of listed buildings and monuments within the borders of Newcastle City Council. Participants had to upload their entries to Wikimedia Commons, where all content is either in the public domain or under an open licence. They therefore learned about the licences and discovered Commons as a collaborative repository for such content. The pictures uploaded now contribute to promoting Newcastle's history and heritage on Wikipedia and engaged the community in making a record of the local area.

Old and New Newcastle by Alan Warriner - winner of We Love Monuments! 2015
Published under a Creative Commons BY-SA licence (Source: Wikimedia Commons)

From creative works to open data

Several of the events involved coding or other digital literacy skills – during the project we were able to test out these types of activities which now form part of the legacy of Commons are forever at Newcastle Libraries. Another part of the project's legacy is the work we have been doing around open data. 

Commons are forever was originally focused on re-using creative works: works created by others - the type that in libraries we facilitate access to e.g. books, images... But our library service also collects and creates information and content: we therefore wanted to open these up and get citizens to re-use them as well. 

We published as much of Newcastle Libraries' statistics and data sets that we could under an open licence on the Council's open data pages, and invited members of the community to have a play at our first mini-hackathon – Wuthering Hacks – in April 2016. We continue to work on updating and expanding the data sets we make available, and finding ways to engage our local community in using and re-using the information.

Impact of the overall project

• 53% of event attendees who filled in a feedback form say the event has improved their understanding of how they can use open licenses and what the public domain is. (40% said they already had a good understanding.)
• Before the events, 14% of attendees said they felt very confident about using work either in copyright or out of copyright correctly while 25% said they did not feel confident doing so at all. After the event, 36% now felt very confident and the ones who did not at all were 4%.
• 53% of participants said the event they attended has contributed to improve their image of public libraries (47% already valued public libraries).
• 86% of event participants strongly agree that the library is a place for the exchange of knowledge and sharing of culture (10% slightly agree). 
• Through the project we have worked with three local artists, a local lecturer, a local photography group, a local arts and heritage project and the local open data community; none of whom the library service had ever engaged with before.

Mimi and Eunice sketch - Copyleft Nina Paley

Do the same in your library 

I believe opening up library collections and information and empowering citizens about their rights to use and re-use works is part of the mission of libraries and our role as professionals. Libraries should be part of the open movement as we have a similar ethos; librarians should be contributing to open source tools if we can and promote the use of open content, tools and resources to their local community.

To do that might be more of an organisational change: it is not just about empowering library users but about empowering staff, and changing the policies relating to library content to make it “open”.

Another lesson from Commons are forever would be: be cunning in your event planning – organise something fun and creative to teach something as dry as copyright!

And finally: do not be afraid, just try things and see what happens.

MozFest, part 3: everything else

Last month I went to MozFest - the Mozilla Foundation's Festival for an open internet. I started sharing my notes in a first post about all the sessions on open data I attended, then a second post on sessions related to copyright and remixing public domain works, and now here is, well, everything else.

GitHub's Patchwork
Introductory session to GitHub, using the Patchwork learning module.

Let's encrypt : someone could listen

The facilitators started the session by trying to make us understand the principle of encryption with a simple exercise. It involved us splitting into groups subdivided into three teams: teams A and C decide on an encryption method (e.g. letter replacement); A write a message - the encrypted version goes to team B who try to decipher it. Then C get the message and decipher it using the key previously agreed with A. If B manage to crack the encryption they win.

After this, the facilitators mentioned a few tools, including:

• Panopticlick, which checks how secure/private your browser is, and advises on how to make it better;
• Lightbeam, a Firefox add-on which lets you visualise how your data is being shared by a particular website with others, and who these other parties are.

A bit of painting using stencils

Ok, so that's not the title of a session, but I did some of that too! It was fun, and there were some Creative Commons stencils...

Photo by @biblioluke; used here with permission

Dialogues & debates: Katherine Maher, Chris Soghoian and Ashe Dryden 

Over the week-end there was also a series of talks. In the session I went to Katherine Maher of the Wikimedia Foundation asked how communities can be called open if the issue of online harassment exists, Chris Soghoian of the American Civil Liberties Union talked about privacy and Ashe Dryden discussed the ethics of unpaid labour in open source.

Here are some points made by Chris Soghoian during his talk:

• Before Snowden's revelations "we the tech community have been a bit lazy: we knew how to encrypt, but we weren't." Now encryption is finally used in mainstream consumer products: iMessage, WhatsApp... You do not need to be able to understand and use complex systems like PGP anymore to communicate securely.
• Governments are now trying to force companies to weaken or remove encryption, because they can't spy on people. In the countries where putting this into law is not happening governments are also looking at hacking software.
• There are privacy issues but also some human rights issues: we are not equally vulnerable to surveillance. Not everyone can afford an iPhone - "security shouldn't be a luxury, but it is." We need to do a better job of ensuring it's just as hard for authorities to watch deprived people as wealthy ones.
• "Android is rubbish for security" [polite version!] Unlike iPhones, Android phones don't use encryption by default and often don't get security updates.

A comment from the audience pointed out surveillance techniques were not just used against "terrorists" but also children pornography.

Unleash the creator in you

"Whether we like it or not, realise we are doing it or not, we all create something, every single day."

In this session the facilitator made us break into groups of 5-6 people before taking us through a (very accelerated!) process of creating a product. She had prepared product ideas - each group picked one at random and got started straight away. Here are the stages we went through and the time we were allocated for each:

• Brainstorm (10min) - we have what we want to do, what is the challenge of that product or idea?
• Research (10min) - get user feedback on ideas. Sometimes you need to pitch your idea to the user: "Would this work for you?"
• Mock up (5min) - designing a visual representation of the product on paper.
• Prototype / model (10min) - that's the bit where we used Play-Doh!
• Code / pseudocode (5min)
• Presentation

My group was given the task to develop a device that regulates the temperature of the room around a person. In the brainstorming we talked about ways this could work, as well as issues arising when several people are in the room, each with their own temperature preference or need! For the research we presented our ideas and issues to the other team and listened to their feedback and questions.

It was great fun, and also showed what you could achieve working as a team with different areas of expertise and backgrounds!

And that's it (finally) for MozFest 2016 - roll on 2017?!

MozFest, part 2: copyright & public domain remix

Last month I went to MozFest - the Mozilla Foundation's Festival for an open internet. I started sharing my notes in a first post about all the sessions on open data I attended, and here is a write-up from two sessions related to copyright and remixing public domain works.

Reform EU copyright: what's wrong with it, and what you can do
What better way to start the festival than with a session on copyright - right?! Plus it took place in the library... 😍

Inside the library at Ravensbourne - with CC cushions for the occasion!

The facilitator explained that the European Commission has now handed the draft copyright law to the European Parliament - "MEPs are elected by citizens, and they will listen, if we're loud enough". Each speaker outlined a particular issue in the draft.

• Caroline (Copyright for Creativity) made us do a quick quiz to see how well we knew copyright exceptions in Europe - "Is it legal to quote a picture, a film, ... ?" "Those of you who said yes, you live in Finland!" She was dynamic and frank in her way of speaking; after the quiz question around the copyright exception for text and data mining and the circumstances in which it is legal, she made the comment: "As soon as it's too efficient, it's illegal"!
• Alek (Centrum Cyfrowe and Communia) discussed copyright and education - "Ask yourself which of the two is a basic human right, and I hope the answer is obvious". Education is so important, it is good that a copyright exception was included into this reform but the proposal is not enough. The text and data mining exception includes a non-contract override but not the education exception - which to Alek does not make sense.
• Karolina (IFLA) gave more details on the proposed text and data mining exception in the draft: it would only apply to research organisations and for research purposes, whereas libraries want text and data mining to be allowed both for non-commercial AND commercial purposes. It is important that we don't let culture, research and enterprise be limited by arbitrary restrictions.
• Dimi (Wikimedia Foundation) talked about the need to strengthen the commons. For example, laws in Germany and Spain are inconclusive when it comes to copyright in copies or digitised versions of public domain works - this is true to an extent even in the UK. "We're afraid that our public domain is being carved out. We believe there should be a clause to safeguard our public domain in the copyright legislation."
• Tim (Creative Commons) explained the proposal on ancillary copyright for press publications. This type of copyright has already been tried in Spain, where people realised it wasn't working the way it was supposed to. In fact the web traffic to press websites decreased and Google News just decided to shut down. But "the publishers need Google News more than Google News needs the publishers". Another problem is that the proposal would not affect only articles, but also snippets on social media, potentially articles under open licenses; it would apply to scientific publishing too, threatening current open access models. Tim's view was that ancillary copyright (also called "link tax") goes above and beyond copyright, and the draft law does not make clear who that right applies to, potentially making it dangerously broad.
• Diego (EDRi) described the proposed copyright upload filters on user content as a "massive attack on the Internet", YouTube's Content ID but worse, a "censorship machine". The Commission wants to prevent the availability of content by monitoring uploads, shifting the responsibility of enforcing copyright to the content platforms.

So, what can we do about all this?

• Tune in to the #FixCopyright hashtag and find out what will happen;
• join Wikimedia, Creative Commons or another organisation involved in pushing for copyright reform;
• "Your voice matters!" - feedback during consultations, sign petitions, email your MEP;
• play the numbers: the more we shout the more we'll get heard.

And finally:

• We need to have these complicated conversations with people who may be unexpected allies.
• Libraries need to advise users on how copyright works, because people don't know what they can and can't do with creative works. [Not my words, the speaker's!!]

Remix your own historical narratives

This session was delivered by three librarians from New York State - Nate, Davis and Matthew. They were clear from the start: "We're using you as guinea pigs!" They explained they are aiming to run this type of sessions for librarians to gain some web literacy skills, and for them to in turn run sessions in their libraries.

"There's a tremendous push from galleries, libraries, archives and museums to put collections online e.g. images" though some are locked down with copyright while some are open. In this workshop people learn some basic HTML and discover sources of free-to-use historical images by remixing and manipulating media to produce a zine or a comic.

The zines and comics can be created "in hard copy" by printing pictures and using paper and glue to put them together (which is what I did during the session!) but the aim is to use the zine-o-matic and comic creator templates. Using Mozilla Thimble to remix projects, you simply need to edit the code to make your own comic/zine by inserting the URL of pictures that are in the public domain or openly licensed and by changing the captions.

I loved the session as it was exactly the type of things I've been trying to do these past couple of years with the workshops part of my Commons are forever project: getting people to be creative and remix works that are freely and legally accessible while making them aware of public domain and open licences... And now I have two new tools to try out in a future workshop in my library!

The zine I created during the session... brought to you as a GIF

Notes from the remaining sessions will be published in a third blog post.