Alice, a 17-year-old high school student, goes to her local public library and reads everything she can find about pregnancy.
Noticing this, a librarian calls up some local merchants and tells them that Alice might be pregnant. When Alice visits her local bookstore, the staff has some great suggestions about newborn care for her. The local drugstore sends her coupons for scent-free skin lotion. She reads What to Expect When You’re Expecting at the library, and a few months later she starts getting mail about diaper services.
Unthinkable? In the physical library, I hope this never happens. It would be too creepy.
In the digital library, this future could be happening now. Libraries and their patrons are awash in data that really isn’t sensitive until aggregated, and the data is getting digested by advertising networks and flowing into Big Data archives. The scenario in which advertisers exploit Alice’s library usage is not only thinkable, it needs to be defended against. It’s a “threat model” that’s mostly unfamiliar to libraries.
Recently, I read a book called Half Life. Uranium theft, firearms technology, and computer hacking are important plot elements, but I’m not worried about people knowing that I loved it. The National Security Agency is not going to identify me as a potential terrorist because I’m reading Half Life. On the contrary, I’d love for my reading behavior to broadcast to the entire world because maybe more people would discover what a wonderful writer S. L. Huang is. A lot of a library users’ digital usage data is like that. It’s not particularly private, and most would gladly trade usage information for convenience or to help improve the services they rely on. It would be a waste of time and energy for a library to worry much about keeping that information secret. Quite the opposite, libraries are helping users share their behavior with things like Facebook “like” buttons and social media widgets.
Which is why Alice should be very worried and why it’s important for libraries to understand new threat models. What breaches of user privacy are most likely to occur and which are most likely to present harm?
A 2012 article in the New York Times Magazine described a real situation involving the retail store Target. Target’s Big Data analytics team developed a customer model that identified pregnant women based on shopping behavior. Purchases of scent-free skin lotion, vitamin supplements, and cotton balls turned out to be highly predictive of subsequent purchases of baby diapers. Using the model, Target sent ads for baby-oriented products to customers that the company’s algorithm had identified. According to the New York Times, “In one case, an irate father whose daughter had received ads for baby clothes and cribs accused the store of encouraging his daughter to get pregnant. When a manager called to apologize, the father was somewhat abashed. ‘I had a talk with my daughter,’ he said. ‘It turns out there’s been some activities in my house I haven’t been completely aware of. She’s due in August. I owe you an apology.’”
Among the companies collecting Big Data about users are the advertising networks, companies that sit in between advertisers and websites. They use their data to decide which ad from a huge inventory is most likely to result in a user response. If I were a teen, I don’t think I would want my search for pregnancy books broadcast to advertising networks. Yet that’s precisely what happens when I do a search on my local public library’s online catalog. I very much doubt that many advertisements are being targeted based on that searching—yet. But the digital advertising industry is extremely competitive, and unless libraries shift their practices, it’s only a matter of time before library searches get factored into advanced customer models.
But it doesn’t have to happen that way. Libraries have a strong tradition of protecting user privacy. Once all the threat models associated with the digital environment are considered, practices will certainly change.
Building privacy
So let’s get started. Here’s the process of borrowing and reading an ebook and of identifying privacy weaknesses in the processes that advertisers and their predictive analytics modeling could exploit.
1. Most library catalogs allow non-encrypted searches. This exposes ebook searches from our hypothetical teen, Alice, to internet providers between her and the library’s server. The X-UIDH header has been used by providers such as Verizon and AT&T to help advertisers target mobile users. By using HTTPS for their catalogs, libraries can limit this intrusion. This is relatively easy and cheap, and there’s no good excuse in 2015 for libraries not to make the switch.
2. Some library catalogs use social widgets such as AddThis or ShareThis that broadcast a user’s search activity to advertising networks. Similarly, Facebook like buttons send a user’s search activity to Facebook whether or not the user is on Facebook. Libraries need to carefully evaluate the benefits of these widgets against the possibility that advertising networks will use Alice’s search history inappropriately (go-to-hellman.blogspot.com/2014/09/analysis-of-privacy-leakage-on-library.html).
3. Statistics and optimization services like Google Analytics and New Relic don’t currently share Alice’s search history with advertising networks, but libraries should evaluate the privacy assurances from these services to see if they are consistent with their own policies and local privacy laws.
Libraries have a strong tradition of protecting user privacy. Once all the threat models associated with the digital environment are considered, practices will certainly change.
4. When Alice borrows a book from a vendor such as OverDrive or 3M, it monitors Alice’s reading behavior, albeit anonymously. At this date, it’s very difficult for an advertiser to exploit Alice’s use of reading apps from OverDrive or 3M. Although many have criticized the use of Adobe digital rights management (DRM) in these apps, both 3M and OverDrive use the “vendorID” method, which avoids the disclosure of user data to Adobe. At this date, there is no practical way for an advertising network to exploit Alice’s use of these services. Here again, libraries should review their vendor contracts to make sure that can’t change.
5. If Alice reads her ebook using a third-party application such as Adobe Digital Editions (ADE), the privacy behavior of the third party comes into play. Last year, ADE was found to be sending user reading data back to Adobe without encryption. Even today, it’s known to phone home with encrypted reading data. Other applications, such as Bluefire Reader, have a better reputation for privacy, but as they say, “past performance is no guarantee of future returns.”
6. If Alice wants to read her borrowed ebook on a Kindle (via OverDrive), it’s very likely that Amazon will be able to exploit her reading behavior for marketing purposes. To avoid it, Alice would need to create an anonymous account on Amazon for reading her library books. Most people will just use their own (non-anonymous) accounts for convenience. If Alice shares her Amazon account with others, they’ll know what she reads. This is a classic example of the privacy versus convenience tradeoff that libraries need to consider. A Kindle user trusts that Amazon will not do anything too creepy, and Amazon has every incentive to make that user comfortable with its data use. Libraries need to let users make their own privacy decisions, but at the same time libraries need to make sure that users understand the privacy implications of what they do.
7. The library’s own records are also a potential source of a privacy breach. This “small data” threat model is perhaps more familiar to librarians. Alice’s parents could come in and demand to know what she’s been reading. A schoolmate might hack into the library’s lightly defended databases looking for ways to embarrass Alice. A staff member might be a friend of Alice’s family. Libraries need clear policies and robust processes to be worthy of Alice’s trust.
In the digital environment, it’s easy for libraries to be unduly afraid of using the data from Alice’s searches and reading to improve her experience and make the library a more powerful source of information. Social networks are changing the way we think about our privacy, and often the expectation is that services will make use of personal information that’s been shared. Technologies exist to protect the user’s control over that data, but advertising networks have no incentive to employ them. I want my library to track me, not advertising networks! I want great books to read, and no, I’m not in the market for uranium-238.
