Tor and library freedom

The Tor project is working in concert with another non-profit organization in a push to bring private and anonymous browsing to public libraries. In particular, the two projects are collaborating on setting up Tor exit relays in libraries, beginning with a pilot program at a library in New Hampshire.

Spearheading the effort is the Library Freedom Project (LFP), a partnership that focuses on educating librarians about privacy and surveillance issues and equipping them with tools to address the challenges. In February, LFP won the "Knight News Challenge on Libraries" grant competition, and has been using the resulting funds to provide privacy education at libraries throughout the US and Canada, the UK and Ireland, and Australia, with more destinations still to come. A look at the resources (with more here) that LFP hosts for libraries provides some insight into its work—issues from password strength to PGP encryption to privacy-themed browser extensions are covered.

In July, though, LFP Director Alison Macrina announced the start of a more proactive project: to set up Tor exit relays on library networks. While all Tor nodes contribute to the health (and bandwidth) of the Tor network, exit relays are of particular importance because they are the gateway nodes through which traffic flows between Tor and the public Internet. Consequently, exit relays are at the highest risk for interference from ISPs or authorities that find some part of the traffic objectionable or that want to track users. See this recent story at BoingBoing for one account of how running a Tor exit relay can attract unwanted attention.

In the announcement, Macrina called libraries well equipped to handle the potential headaches that accompany running an exit relay, noting that:

In addition, she cited the American Library Association's (ALA's) Core Values of Librarianship, Freedom to Read Statement, and Code of Ethics as supporting a commitment to intellectual freedom and privacy. "Libraries serve a diverse audience; many of our community members are people who need Tor but don't know that it exists, and require instruction to understand and use it."

In the first stage of the program, LFP worked with Nima Fatemi from Tor to set up a middle (i.e., non-exit) relay at the Kilton Library in Lebanon, NH. The IT librarian at Kilton, Chuck McAndrew, already administers the library's public computers, which run Linux and are configured with Tor access plus a variety of other privacy measures.

The initial relay setup consists of a desktop PC running Debian and configured to use 10MB/s of the library's bandwidth. The relay is named LebLibraries and, as is the case with most Tor relays, interested parties can check its current status and recent performance on the Tor Globe site. According to the Globe statistics, LebLibraries first appeared online on July 20, then went offline before coming back online in more permanent fashion on the 22nd. Although it is hard to generalize from that small of a sample, the relay has more or less remained online, with just one incident of downtime between July 22 and publication time.

At any given moment, over 6,000 Tor relays are running, on average, of which about 1,000 are exit relays. The ALA estimates that there are over 119,000 public libraries in the US. Naturally, if even a small percentage of that total ran relays it would mark a substantial increase in the Tor network's capacity.

The relay running in the Kilton Library is just the first step. LFP said it intends to run the relay as a middle relay for about one month before reconfiguring it to serve as an exit relay, just to ensure that it does not interfere with the running of the rest of the library's network. Once the exit-relay transition happens, the project is likely to get its first test of how the non-technical side of managing a Tor relay impacts the library. If there are complaints from law enforcement, DCMA take-down requests, or other forms of criticism, other interested libraries will get to see how the Kilton staff and the LFP handle them and what the fallout is.

Moving forward, LFP plans to continue its campaign of privacy training for librarians, part of which includes providing help with setup for Tor Browser and related tools. Macrina commented that this training can be the first step toward convincing a library to run a relay, saying: "For libraries that have already installed Tor Browser on library PCs, running a relay is the obvious next step toward supporting free expression in their communities and all over the world."

It is also worth noting, though, that running a Tor relay may not be a viable option for every library at a technical level. The Kilton Library still required the expertise provided by Fatemi to set up and fully secure its test relay, and its IT librarian already had experience with Linux systems administration and Tor itself.

In an email, Macrina said that the availability of staffers to maintain relays would be a roadblock for some libraries, while others might be limited by their available bandwidth. Still, she added, the popularity of the LFP training program indicates that there is widespread interest in the subject. "Librarians are ready to take action against surveillance, and we see this as the necessary next step." She noted that a "not insignificant" portion of the librarian community was already quite familiar with Tor, although it is still a minority. But many more librarians without prior exposure to Tor have proven capable of understanding the technical details of running a relay—some just need a bit of assistance setting it up.

An assessment of the Kilton library's experience with its Tor relay should come in the next month or two, Macrina said, depending on her and Fatemi's schedules. In the meantime, LFP is inviting interested librarians to get in contact by filling out a questionnaire that covers various aspects of the library's network, hardware, and software organization—including whether or not it is already providing access to services like Tor. The concerns of public libraries may have a natural alignment to those of the Tor project, but it is good to see the interested parties making an active effort to reach out and work with one another.