Library trustees in the tiny Lebanon Public Library (LPL), NH, agreed on September 15 to resume their association with the anonymous web searching service Tor. The project was halted a month earlier after it drew attention from the federal Department of Homeland Security and concern from local law enforcement.
When the summer began, few if any Internet privacy advocates or library professionals outside the state had ever heard of Lebanon, NH. Located about 15 minutes from Dartmouth College, the community is home to about 13,600 residents. LPL operates two branches, Kilton Public Library and Lebanon Public Library.
LPL’s decision whether or not to continue its suddenly controversial pilot program quickly became a national cause célèbre for privacy advocates, computer scientists, and library professionals dedicated to tailoring their mission for the digital age. The trustees were caught off guard by a wave of Internet publicity but at the same time heartened by near-unanimous community support.
LPL remains the nation’s first public library to host a Tor node, which helps protect user privacy on the Internet. Journalists and political dissidents living in repressive regimes frequently use Tor to surf the web without fear of detection. The U.S. Department of State Bureau of Democracy, Human Rights, and Labor is one of its major funders. But other governmental departments are not so enthused: some law-enforcement officials fear what criminals could do when using public computers anonymously. Documents leaked by Edward Snowden show that the National Security Agency has made repeated efforts to break Tor’s encryption.
Strong support
About 50 people turned out for a highly anticipated September 15 LPL board of trustees meeting, and more than a dozen speakers voiced their support for the project, with no dissenting opinions heard during the hour-long discussion. That night, trustees agreed by consensus to stand by their original July vote to work with the Tor project. Another formal vote was not considered necessary.
“What happened tonight at #kiltonlibrary was historic,” Alison Macrina, who heads the Library Freedom Project and is a 2015 LJ Mover & Shaker, tweeted after the meeting. “This was a public referendum about privacy, free speech, and what libraries do.” Macrina had driven from Boston to attend the session in Lebanon.
The library’s Tor relay was reactivated that night. “I started it up before the meeting was even over,” Chuck McAndrew, LPL’s IT librarian, told Library Journal.
Asked to comment on the trustees’ decision, Michael French, interim police manager in Lebanon, said only, “The trustees received information from a number of different sources and made a decision based on that information.” Asked about potential dangers involved with the Tor network, French added, “The project has some benefits and it also has some risks.”
Library officials interviewed for this story said the August 12 decision to suspend the program was made primarily to give patrons and other community members a chance to weigh in on the matter. This pause, and the subsequent media attention, spawned dozens of phone calls and emails—many from interested observers, computer specialists, and librarians across the country. McAndrew described this feedback as “98 percent” in favor of continuing the Tor project
“It was very clear that the level of support for the Tor network is much higher than we imagined,” Francis Oscadal, chairman of LPL’s board of trustees, said after the Sept. 15 meeting.
Not a command performance
Before the meeting, one LPL patron displayed a sign that read, “DHS is not the boss of my library.”
The Department of Homeland Security, for its part, denied applying any pressure on the library. “I’d like to make it very clear that there was no request from DHS…to suspend the use of the Tor service in New Hampshire. To be very clear—that is absolutely false,” Shawn Neudauer, a spokesman for Homeland Security Investigations (HSI) said in an email to LJ.
Neudauer said an HSI agent sent an “FYI email” to a colleague at the New Hampshire Internet Crimes Against Children Task Force in Portsmouth, NH. “At no time did he ask for any action to be taken as a result of this email,” the spokesman added.
The agent’s email was soon forwarded to the Lebanon police department. The city manager’s office was then contacted, and a meeting was set up with library officials and police officials to gather information about LPL’s Tor project.
“I recommended that we put a halt to it,” Library Director Sean Fleming said.
Macrina said of the HSI email and the involvement of law enforcement, “I do think it’s harassment.” She told LJ that concern over future criminal use of Tor is the same as the city planning to build a road, and having police object to the plan on the grounds that some people could possibly drive drunk on it.
Joining the network
In the spring, McAndrew attended a Library Freedom Project workshop in Hooksett, NH, where he met Macrina. The session dealt with methods for strengthening online privacy, and McAndrew later asked Macrina to conduct a similar training in Lebanon, where more library professionals in that part of New Hampshire could attend.
Macrina agreed, and the session was held in May. McAndrew used the opportunity to show off the various computer privacy initiatives he had already established at LPL. Macrina met with Nima Fatemi, a Tor project manager working with the Library Freedom Project on the fledgling public library initiative, and they decided to approach Lebanon library officials with a proposal to start a Tor pilot program there.
For Macrina, it seemed like LPL was a good match for her plan to help bring Tor to public libraries. Although small, the system had already demonstrated its forward-thinking nature as far as privacy technology, and trustees seemed open to the idea. They voted unanimously in July to host the pilot program.
That month, LPL became the first library in the United States to activate a Tor browser. The project began with an interim step; only a middle relay was activated in July, which allowed Tor users around the world to bounce their Internet traffic through the library, thus helping to mask their locations. After a month or two, LPL planned to upgrade to an “exit relay.” According to the Electronic Frontier Foundation (EFF), “An exit relay is the final relay that Tor traffic passes through before it reaches its destination. Exit relays advertise their presence to the entire Tor network, so they can be used by any Tor users. Because Tor traffic exits through these relays, the IP address of the exit relay is interpreted as the source of the traffic.”
Things appeared to be running smoothly. On July 30, Ars Technica publicized Tor’s library initiative with a long piece.
Exit strategy
Macrina anticipated that the eventual transformation to an exit relay at the library would trigger red flags among federal law enforcement agencies, including Homeland Security. LPL officials had even been briefed on that possibility, she told LJ. “What we were not prepared for,” Macrina said, “was a pre-emptive strike. And that’s what happened.”
In its email to Portsmouth police, the HSI officer included a link to the Ars Technica article. Without that to tip them off, Macrina said, law enforcement almost certainly would have not been aware of Lebanon’s Tor involvement. At that point, the exit relay was still at least a month or two from going online. (Right now, the LPL exit relay is still in the planning stages, although it could go live in a month or two, LPL officials said.)
Once the Lebanon police department saw the HSI officer’s email, a meeting with city and library officials was set up for August 12. “For all the good that a Tor may allow as far as speech, there is also the criminal side that would take advantage of that as well,” Lt. Matthew Isham of the Lebanon Police Department told propublica.org. “We felt we needed to make the city aware of it.”
That day, library officials agreed to suspend the Tor program until public input could be sampled.
To gather public input from beyond the local area, Macrina’s site started an online petition in support of using Tor, and the EFF also took up the cause, hosting an online petition that attracted 4,332 signatures from around the country in only a couple of weeks. The letter of support was cosigned by Macrina, the ACLU offices in New Hampshire and Massachusetts, the Free Software Foundation, and the Freedom of the Press Foundation, among others.
Soon, Fleming said, it became “all Tor all the time” for LPL officials. Fleming and McAndrew received dozens of calls backing their use of Tor, and they conducted several media interviews. Newspapers around New Hampshire, NPR, and Popular Science were among the media outlets that covered the story.
Oscadal said the matter probably would have been resolved earlier, except that the trustees didn’t meet in August because of scheduling conflicts. The extra month gave the issue time to go viral.
“A lot of libraries contacted us about using Tor,” Fleming told LJ. “They were interested, but they didn’t want to be the first. Now I know why.”
They may not have wanted to be first, but a lot of libraries want to be second, apparently: Macrina told Motherboard that as a result of the publicity, “This has catalyzed additional libraries and community members.… We’ve heard from probably about a dozen who are interested in joining this.”