Library Technology Guides

Securing the actions performed on a web-based service via HTTPS has become well established and may soon become the expected norm. Organizations dealing with financial data, medical records, or other confidential information routinely implement security via HTTPS. Social networks such as Facebook and Twitter, all the services offered by Google, and most news sites now operate entirely over HTTPS. Consistent with this growing expectation for security and privacy, many web browsers, such as Chrome, now display information or warning indicators for any site not using HTTPS.

As a follow-up to the May/June 2016 issue of Library Technology Reports on “Privacy and Security for Library Systems,” which included data gathered in the last quarter of 2015, we have surveyed the websites of several libraries noting whether selected services use HTTP or HTTPS. The sites reviewed included the members of the Association of Research Libraries (ARL) and a selection of large public libraries. These organizations would more likely have the technical and financial resources to manage their webbased services according to current expectations for privacy and security. As some of the largest libraries in North America, they are also most likely to have adopted privacy policies and the technical expertise to implement them.

For each of the organizations selected, we tabulated the status of the library's main website, the primary online catalog, and discovery service. These services remain within the control of the library and can be considered key indicators of the level of privacy possible as patrons make use of the library's online services. Especially for academic libraries, some may offer a link to the online catalog of their ILS as well as an index-based discovery service. The concept of the online catalog does not apply to those using products such as Alma or WorldShare Management Services. The discovery interface provides access to both local holdings and article-level content. There are a small number of academic libraries among those reviewed that offer an online catalog but not a discovery service.

Our review of the web-based resources of these libraries (shown in Tables 1 and 2 on the following page) reveals improvements beyond what was observed in 2015, but shows that the majority continues not to enforce encryption to protect patron privacy. Out of the 124 ARL member libraries considered, only 42 percent present their website using HTTPS. Out of the 25 major public libraries considered, only 36 percent deploy their website using HTTPS. Table 3 breaks down Table 2, revealing the 25 major public libraries in the United States and looking at the security of each library's catalog and website. The following two charts on page 6 shows the percentage of ARL member libraries employing each of the different catalog and discovery services available.

In the context of the prevailing expectation that reputable websites are deployed using HTTPS, libraries lag behind other types of organizations in a wholesale shift toward providing this level of privacy and security for their web-based services. This observation is surprising given the concern libraries state regarding patron confidentiality and privacy. As libraries work to improve their technical infrastructure, those that value the privacy of their patron's use of the online services will want to give high priority to the implementation of HTTPS for the systems under their control.

Beyond the values of the library profession to protect patron privacy, the urgency of this change is also driven by upcoming changes in the way that browsers flag page security. Google's Chrome browser already displays an informational message for sites presented through HTTPS: “your connection to this site is not secure.” Although no specific date has been set, Google states that future versions of its browser will elevate the warning with a conspicuous red “Not secure” indicator. I would urge libraries to move rapidly toward comprehensive use of HTTPS for their web-based resources in advance of this change if they want their resources to be perceived as trusted and reliable.