Everyday Privacy

EVERYDAY
PRIVACY

Falling Water River
Regional Library
2019

Bryan Jones and Megan Adovasio-Jones
Nashville Public Library

ETHICS

UN Declaration of Human Rights

Code of Ethics for Librarians and Other Information Professionals, Item 3: Librarians and other information workers respect personal privacy, and the protection of personal data, necessarily shared between individuals and institutions.The relationship between the library and the user is one of confidentiality and librarians and other information workers will take appropriate measures to ensure that user data is not shared beyond the original transaction. Librarians and other information workers support and participate in transparency so that the workings of government, administration and business are opened to the scrutiny of the general public. They also recognize that it is in the public interest that misconduct, corruption and crime be exposed by what constitute breaches of confidentiality by so-called ‘whistleblowers’.

IFLA Code of Ethics for Librarians
& Other Information Workers

US Constitution
Amendment #4

ALA Code of Ethics
Article #3

TLA Core Values
Value #2

TLA IF
Committee
charter

ETHICS

& THE LAW

warrant

no warrant
WHAT!

subpoena

national
security
letter
WHAT!

Remember two things:

more privacy
= more work

consider the source

FLOSS

Free / Libre / Open Source / Software

Operating
Systems

Linux

Apple

Settings > Privacy

Settings > Privacy

Phones,
Oh, Phones

Purism Librem5

Lineage OS

F-Droid

Know your settings

Android

iOS

PASSWORDS

POLP!

principle
of least
privilege

yr pw is bd

"diceware"

KeePassXC

LastPass, etc

Two Factor Authentication
2FA

FreeOTP

Yubikey

ENCRYPTION

HTTPS://

VPNs
Virtual Private Networks

Disk Encryption

LUKS
Linux Unified Key Setup

FileVault
(OSX)

BitLocker
(Windows)

Veracrypt

iOS

Android

Threat models are a way to think about what information you need to protect and how you are going to protect it. If we are talking about people and data about them, we often use the term Personally Identifiable Information or PII. PII is info that can identify individual people. It can do this by itself or in combinations with other info. When you think about what you collect, or who you share it with, think about PII which is sensitive information. Protecting it is important! But back to threat models. There are some questions you can ask to help clarify your threat model. 1) What do you want to protect? 2) Who do you want to protect if from? 3) How likely is it that you will need to protect it? 4) How bad are the consequences if you fail? 5) Houw much trouble are you willing to go through to prevent the consequences? Exercise 2: "Let's answer these questions for ourselves... " Exercise 3 Break into groups and think about sample patron threat models

THREAT MODELS

DATA MINING

What is it?

dark patterns

What's bad about it?

malware / phishing / doxing

What does this have
to do with libraries?

crappy vendor contracts

public internet

public nets

more public nets

What can we do about it?

gnarly vendor contracts

Google Analytics

- General Data Protection Regulaton (GDPR) in the EU. Must pseudonymize or anonymize personnel data, max privacy must be the default, "data subjects" must know what is collection and request it for review or deletion. - Data Care Act, companies that hoard data and datamine should be held to fiduciary standards.This would primary be down by the FTC. Feelings about this were mixed. Largely seen as a response to stricter state laws like those past in California. - The Honest Ads Act (S. 1989) would apply the Federal Election Campaign Act of 1971 requirements to online ads. This was bipartisan. Data Care Act - Carpenter v. United States. You need a warrant for cellphone location data more than two weeks old. - Data creation and collection is inevitable, but is necessary we assert our rights. This is a big question of libraries and society.

data and the law

"Privacy policies are legal statements to get us out of our ethical obligations."

I love and respect my mom. My mother is senior citizen with a highschool education. She uses a hand-me-down Android tablet that no longer gets security updates. She does not deserve annoying ads, malware, identity theft, fake news, or a loan with really bad terms. My mother has a human right to not be surveilled. You love and respect your patrons, and your communities. Patrons trust us. If we don't protect patrons privacy, we violate that trust. We have a professional and ethical obligation to mitigate risk to our patrons. When someone says privacy is dead ask them for their password. Now some privacy nihilists are going to say, "The ship has sailed. It's over. Everything is collected." I agree that current state is bad, but does that mean we stop fighting for what is better. This issue is bigger than libraries. If we are heading towards climate disaster does that mean we just shrug our shoulders? A handful of famous men of have fired for sex crimes, does mean we've solved the problem of sexual harassment? Grand juries almost never recommend charges again police officers, does that mean we are going to stop fight for justice in our communities? Of course not, we're librarians. We are not complicit. We resist. Also, because we are librarians, here are some references.

I love and respect my mom.

Exercise: Colored stickers on Venn diagrams 1) Privacy vs. security - Example: employer scanning email for content Features List: (GREEN) Facial recognition-enabled, internet linked CCTV cameras (PURPLE) Ability to remotely turn on or off items in a home and check their usage (YELLOW) The ability to remotely turn on apps that can locate a device (BLUE) The ability to sign on to devices or access locations with biometrics (like fingerprints) 2) Risk vs. Reward (Is the risk worth the reward?) - Example: Features List: (ORANGE) The ability to tag other people in photographs (RED) Facial recognition technology that automatically scans photographs and suggests people in them (BLACK) Map or GPS software/apps that store common travel patterns (PINK) Advertising customized to your interests, based on search and purchase history (BROWN) Single sign-on to multiple websites or services (for example, linked to a social media account)

privacy
&
security

desktop BROWSERS

Tor Browser

Know your settings

Firefox

Privacy Badger

HTTPS Everywhere

uBlock Origin

Multi-Account Containers

Brave

PHONES

Signal

Orbot
(Android)

Orfox
(Android)

Onion Browser
(iOS)

We hope you choose privacy.

megan.adovasio-jones@nashville.gov
bryan.n.jones@nashville.gov