If you don’t know any librarians, you might be surprised to learn that they are fierce defenders of privacy. Alison Macrina is a librarian and internet activist who works to demystify privacy and security topics for ordinary users. She is also the founder of the Library Freedom Project which aims to resist public surveillance and restore privacy to local communities. Science Node caught up with Macrina recently when she gave the second annual IU Women in Cybersecurity Talk at Indiana University.
What does digital privacy mean for an ordinary person using the internet?
Every single person has something that we call in the privacy world, a threat model. It sounds scary, but essentially it means that you have things that you need to protect based on who you are and who might want to exploit those things about you.
If you are somebody doing political activism, a set of people might want to exploit your privacy in order to get in the way of the work you’re trying to do. Or you might be an elderly person who goes online to check email and your threat model includes scammers, phishing attempts, things like that. The main thing is that everybody has a relationship to privacy.
What are the top three privacy threats online right now?
Scams and fraud are still probably number one. Malicious websites, malware, ransomware…these things have real effects, and you can get basically no help if something like this happens to you. Most people don’t have a lot of understanding of how their computer works, or how the internet works, or how to tell a phishing scam from something real.
I’m also very concerned about how much information advertisers are able to get with no knowledge or consent from us. They are accumulating this massive infrastructure of information at almost no cost, and we have no real meaningful regulatory environment to do anything about it.
For the third one, I’m concerned about the amount of surveillance technology that is available to the police—both local and federal—the budgets that exist for it, and the complete lack of attention paid to our fundamental rights. Law enforcement is able to use this technology in a mass surveillance way, and they’re not under a lot of obligations to talk about how this technology works. We’re all getting spied on by them in violation of our rights, and that has real material consequences.
Are you in favor of regulation?
Yes, definitely. But with some important caveats — I don’t want the government to suddenly have all the data that Google has. We aren’t prepared for the world that we live in now when it comes to technology. Our regulatory agencies have thought about consent and, to some degree, antitrust monopolization issues. But they were completely unprepared for privacy.
We should require companies to meet certain standards of security, consent, and disclosure in order to rein in how much information they’re allowed to accumulate about people, who they’re allowed to sell it to, and how they have to negotiate that with the end-user. I think that we’re not going to get those standards unless we force them by law.
Who should we be more worried about? The government or tech companies?
That’s a really good question. The government can put you in prison for your data. But corporate surveillance can completely manipulate us psychologically and does. When we have this environment where a truly evil company – and I say that Cambridge Analytica is evil because I think manipulating people psychologically without their consent is an evil thing to do – they are able to accumulate all this data from Facebook with no violation of Facebook’s policies and then use it to shape the geopolitics of the world.
Sometimes I think that the corporations are worse because at least, ostensibly, we’re supposed to have some democratic control, even if it doesn’t work quite that way. But corporations are beholden to their shareholders and that’s it. So we’re talking about a tiny pool of people who are making decisions for the entire world— starting with your data.
You have a lot of criticisms. Are you anti-technology?
I love technology. I’m very interested in computers and how they work and getting to understand my machine better. What I want is technology that respects the autonomy of the user.
Technology has changed our lives for the better in so many ways. Even big data can change our lives for the better, but we need to have control.
The cyborg utopia is still possible, but it’s not that now, and we’re going to have to do a lot of work to get there.
What can we do?
One of the biggest things I would love to see people doing is getting their local legislators interested in the privacy problem. If you can win some goals locally, that’s how you get a movement for bigger laws that can happen at the state or federal level.
For me, the collective responses are the most important because I want us to all benefit. But, individually, we can take some steps to protect our privacy. I recommend using a password manager and two-factor authentication on everything. There’s a great texting app called Signal for encrypted texting, it’s free and really easy to use. And if you want a lot of privacy when you browse the web, you can use Tor browser.
If we all decide to adopt privacy technology, whether we really feel like we need it or not, we’re helping those people who do really need it.