How a small New Hampshire library stirred up a digital rights debate

A pilot project to use computers in the Lebanon, N.H., library as servers for the anonymous Tor browser was celebrated by online privacy advocates but raised concerns among law enforcement. 

It was almost an hour into the public meeting and the room was getting warmer by the minute. The basement of a small library in Lebanon, N.H., was packed with newcomers – few of the 40 people who showed up Tuesday night had ever been to a meeting for the Lebanon Public Library Board of Trustees.

Lined with children's books and stuffed animals, the space was an unlikely place for a discussion that attracted the attention of national civil rights groups and online privacy activists. But the board had become the focus of an online campaign in favor of using library computers to bolster the anonymous Web browser known as Tor.

Earlier this summer, Lebanon was selected to be the testing ground of a program for libraries to volunteer resources to extend the Tor network because of its previous interest in privacy issues. But after agreeing to participate in the Tor project, the effort was put on hold over concerns from law enforcement agents of how Tor is used to hide online criminal activity.

Following strong vocal support for the effort from residents of Lebanon and neighboring towns, the library agreed to allow the program go forward, making it the first library in the country to run a Tor server. “It came to me that I could vote in favor of good, or against the bad,” said Fran Oscadal, board chairman. “I’d rather vote for the good.”

Tor has become popular with many organizations such as victims' rights groups or activists who need to keep their information anonymous online. It's also used by journalists to guard particularly sensitive information. It works by bouncing Web traffic between many servers, which are also called “relays,” to obscure the information. The final server where the traffic ends up is called an “end node.”

The Lebanon Tor project has been months in the making. Alison Macrina, founder of the Boston-based Library Freedom Project, began working with Lebanon's Kilton Library earlier this year to train librarians on digital privacy protection tools such as Tor.

Because libraries often have unused bandwidth, Ms. Macrina’s group hopes to have public libraries host relays and end nodes. This is different from installing Tor browser on computers, which allows people to access the anonymous service. Libraries are also not subject to the Digital Millennium Copyright Act, protecting them from any liability associated with any copyright-abusing traffic that passes through the server and allowing them to run the servers.

Macrina was impressed with what she considers important security steps at the Lebanon libraries, which factored into choosing Kilton. For example, unlike many libraries, Lebanon's computers run on the open source GNU/Linux operating system instead of Windows. According to a blog post Chuck McAndrew, information technology librarian at Lebanon Public Libraries, wrote for Macrina’s organization, Linux is cheaper, doesn’t monitor library patrons’ activity online, and allows updates on software to minimize any vulnerabilities.

Libraries’ reach in their communities are one of the reasons Macrina’s organization chose them for the project. If a library participates in the program, it can educate its community about anonymizing services and digital privacy rights.

“One of the reasons we picked libraries for this project was because they are essential to their community,” said Nima Fatemi, an independent security researcher and Tor developer working with Macrina. “As we educate and give resources to libraries, they can educate and share the knowledge with their communities. That includes law enforcement.”

The project ran into a delay this month when the Lebanon Police Department and city officials requested to meet with library administrators to explain some of the downsides to running a Tor relay. Namely, criminals, such as child pornographers, could use the Tor browser to hide their online activities. The library decided to hold off on their relay efforts until the issue could be discussed at the Tuesday board meeting. 

Safety was not a consideration Lebanon residents overlooked. For Mary Sorens, protecting her daughter is a job she takes "very seriously." But she also values the safety that Tor can bring to those who use it. “I would not want to take away the freedom of a lot of people in the world on the off chance that something awful happens to my child,” she said during the public comment portion of the meeting. 

Lebanon police said they were alerted to the relay project by the New Hampshire Internet Crimes Against Children task force, who were in turn alerted to the program by a Boston agent of the Department of Homeland Security. Many inside and outside the Lebanon community interpreted this as an attempt by law enforcement to strong arm the library. At the library meeting, trustees said this was not the case.

Alerting the task force to Kilton's Tor program, said Shawn Neudauer, a spokesman for the DHS's office of Homeland Security Investigations, was not meant to shut the project down. It was a single agent sharing a news story he thought was interesting, the "DHS equivalent of an FYI," he said. 

"We know Tor isn't just used for criminal activity. We get it,” said Mr. Neudauer, "I get very weary about using Facebook and sites that have tracking. I can see why someone would want to be anonymous." 

Moving forward, Macrina said, the press around the event has made recruiting new libraries for the project significantly easier, Macrina said. “One said, ‘We don’t even care if the relay gets shut down. We want to be a part of the project to make a statement,’ which we were just floored by,” she said.

The next step for the Library Freedom Project will be continuing to support the Lebanon Public Libraries and begin the program at other locations. For libraries who follow in their footsteps, Mr. McAndrew recommends educating their communities first. If he had to do it differently, McAndrew said, he would have reached out to the community initially about the project so when he spoke to police, he could cite the support they received.

"We've gotten a lot of support since the articles came out,” McAndrew said. “It would have been useful to mention when the police came."

Deborah Caldwell-Stone, deputy director of the American Library Association's office of intellectual freedom, says the ALA doesn't take sides in individual libraries decisions to offer or stop offering services. But they do take a side in whether or not those decisions are the library's to make.

"Libraries should serve their users," she said. "They are not a law enforcement agency."