April 19, 1995 - hacking and security

Back in 1985, I worked for a library that was among the first in the country to set up a dial-in line for folks with home computers.

Library software wasn't as sophisticated in those days as it is now. There were (in retrospect) some fairly obvious security loopholes.

But it's also true that the NUMBER of people using computers in those days was a lot smaller, and their equipment was about as unsophisticated as our software. Most of these folks used Commodore computers and 300 baud modems.

But I was a little worried about the security issue. So what I did was to contact all the computer clubs in town, and ask to speak to them. I offered them all packets of information about how to connect to the system, how to search it efficiently, and how to gracefully disengage from it.

I reminded them that this was a service the library was offering absolutely without charge, because we believed that people had a right to free information, and we were committed as a local library, and as a profession, to making use of the latest technologies to ENSURE that people had access to information.

Then I gave them another talk: I needed their help. I needed their consciences and their collective good behavior. I said our belief in freedom of information was hedged by some other important ethical considerations: the confidentiality of patron information and the reliability of the data. That argument made sense to them. And why not? It was based on simple respect, for them as much as anyone.

I said If I had to start battling viruses and attempts to compromise the security of library records, I'd have to shut the access down. Then all of us would lose.

Well, it worked. There were definitely some hackers in the crowd, at least one of whom had already discovered the phone line before I'd announced it, and left some digital footprints to prove it. But here's the good news: after I assured those early computer users that the library LIVED by the hacker ethic -- free information -- those attempts abruptly ceased.

It is now ten years later. I'm struggling to bring up a new software tool to provide access to the much ballyhooed World Wide Web. And I'm running about 6 weeks behind my own schedule.

What's slowing me down? For one thing, the software is a lot more sophisticated these days, which means there are a lot more options for connections, as well as ways to break those connections. I'm depending on some expert (and volunteer) help, and some additional software utilities that didn't come with our system and have been hard to track down. I'm also trying to do some stringent testing of the security of the whole set-up.

I suppose it shouldn't surprise me that there's been a jump in electronic vandalism in recent years. Computer users are no longer dedicated enthusiasts reading obscure magazines. They're a big consumer market. In some ways, the trend is not encouraging. When I browse computer stores, I almost always find machines where some twerp has erased or re-formatted the hard drive. Har. Har.

It's a sad comment on our times, the dawn of the digital age. No librarian can appeal to the common good and threaten the loss of a service that will shortly become indispensable to our communities. The hacker ethic has gone retail -- which means that many information providers now have to deal with the electronic equivalent of shoplifting and graffiti.

So I'm taking the extra time to do the thing right. Despite the hassles, I still believe that putting some of the newer technologies to the task of delivering information is an important part of the library's job, and that most folks both deserve, and will not abuse it.