[tor-relays] Feedback wanted: letter to my university's library

[Scott Bennett]

Alison Macrina <alison at torproject.org> wrote:

> Hi AJ,
>
> Thank you for supporting Tor! I think it's a great idea to try to work
> with your university library to run a relay. I run the Library Freedom
> Project which helps libraries understand and use privacy tools
> (libraryfreedomproject.org). I can give you some advice based on my
> experience.
>
> William Denton:
> > On 1 October 2017, AJ Jordan wrote:
> >
> >> However I've just started college at the University of Rochester,
> >> which obviously presents a great opportunity to set up a relay on a
> >> really great network. I'm planning to reach out to the library with
> >> the following email and would love some feedback:
> >
> > Scott Bennett had excellent advice,
>
> +1
>
> > Academic libraries can be very experimental in some of their work, but
> > they are generally risk-averse.  (This is good, because they're in the
> > business of preserving knowledge and cultural artifacts for decades and
> > centuries.)  There is, I'm afraid, close to zero chance they would let a
> > non-employee student run a server on their network---and running Tor,
> > even a non-exit relay, makes the chances even lower.
> >
> > However, don't give up.  I suggest thinking about this as a long-term
> > project that could get you involved with the library, faculty and campus
> > IT.  There must be people on campus interested in privacy issues, who
> > know about Tor, and perhaps who have been thinking about running a
> > relay.  These people could be librarians or they could be professors or
> > grad students in political science, communcations, journalism, computer
> > science, privacy studies, etc.  Find out who they are and approach
> > them!  Perhaps there is a student club interested in the same
> > issues---if not, you could start one.  Students and student groups
> > advocating for a Tor relay or exit, while demonstrating the importance
> > of Tor and how it fits in with the library's and university's mission,
> > would very much help the project be successful.
>
> William's advice is good. You definitely need to begin by building a
> relationship with the library. Don't be discouraged by the amount of
> work this may take; the payoff might end up being a cultural shift
> wherein the library, university IT, and CS departments all work on this
> as a project together!
>
> You'll want to approach the library by showing that Tor is an excellent
> way to uphold the values of librarianship, which are privacy,
> intellectual freedom, and access. Really, be explicit about it; don't
> assume that they'll just get why you think it matters. Here's something
> I wrote about intellectual freedom + Tor Browser a while ago and you can
> borrow the arguments I've made:
> https://www.scribd.com/document/272919852/Alison-Macrina-The-Tor-Browser-and-Intellectual-Freedom-in-the-Digital-Age
>
> As William said, libraries are mostly risk-averse, so you also need to
> be ready to answer their questions about legal and technical concerns.
> LFP has collected some resources to help with all of that here:
> https://github.com/LibraryFreedom/tor-exit-package/blob/master/resources.md.
>
> Before you email the university librarian, I'd start by talking to some
> of the regular academic librarians about your ideas and gauge their
> responses. Ask them if they've heard of the Library Freedom Project and
> feel free to send them any of our resources. See if they think the
> administration would be receptive to you offering a presentation about
> Tor to library staff (even better if you can make it open to students
> and faculty, too, because that can get you more support). You are
> welcome to adapt these slides for that presentation:
> https://libraryfreedomproject.org/allabouttor/. Make sure to show them
> this academic library that has used their Tor relay as a teaching tool
> for students:
> https://boingboing.net/2016/03/16/first-ever-tor-node-in-a-canad.html.
>
     I second all of the above by both Bill and Allison, and I am grateful
that they were able to express better and in far greater detail much of
what I was trying to say, while adding their own ideas in similar detail.
     Reading Bill's and Allison's followups stimulated an idea of another,
and possibly better, approach that I hope AJ will consider and that may
even be more likely to be approved and have greater effect in the long run.
If he discovers that neither his campus library nor the university as a
whole is already officially running at least one relay, this may be a better
way to teach them.  If, rather than going for a relay, which is quite likely
to scare them until they understand more and better about tor, AJ were
instead to campaign to get the library to install the tor browser bundle
onto its publicly available computers, that alone would be a terrific
coup and might engender a great deal of student support for tor on campus
over time.  (The library would, of course, need to find a way to lock down
the settings of the installed bundle, so that it couldn't be turned into
a relay by users, but that should not be difficult to do.)  If he succeeded
in getting the tor browser bundle added to the library's most likely tightly
limited list of applications available on its public machines, he could then
wait a while to see what the staff members thought of it.  If they decided
after watching it in use for a while that it was a good thing to have made
available to their users, you might then approach another department that
operates a student computer lab to try to get TBB installed there.  If the
library employees liked it, they might give the prospective department a
positive recommendation.  If AJ played it right and it usually turned out
well, he might eventually cover much of the campus with TBB installations.
In any case, getting the TBB installed would educate far more people about
anonymity and privacy issues than merely getting a relay installed that most
people would never be aware of.
     Getting the student population behind tor could help in several ways.
1) They would tell their friends elsewhere about it.  2) Some of them might
want to run relays themselves off campus.  3) Students might even initiate
a push for the university to run an official relay, so *AJ* might not even
need to do any convincing at that point to get the university to run one or
more relays.
     Universities typically have unique, public IPv4 addresses for every
machine on campus, so they can be good places for many relays to run that
would be managed by different individuals/departments.  Circuit paths would
still be subject to the /16 rule, but that wouldn't stop any of those nodes
from helping the worldwide tor user community.
     Although it has already been mentioned, a university will almost surely
be concerned about resource consumption (electricity, CPU time, LAN congestion,
WAN traffic volume, especially as a fraction of the total available to the
university's net, staff time for training and for maintenace of the software,
and always, always, and ultimately money).  AJ should be prepared to deal
with questions and arguments about resources when asking a university
employee to expend university resources of something AJ wants.  Universities,
especially state universities, live on incomes that are set in concrete for
at least a year at a time, although occasionally they may be told during the
fiscal year that some of the money previously allocated to them has been
rescinded, thus sending administrators scrambling to deal with lack of funds
to meet commitments.  This establishes a zero-sum environment, where a
decision to spend resources on Thing A, means those resources are no longer
available for use by Things B, C, D, etc.  If they don't have unallocated
resources available for tor, they can only run it if they can somehow shuffle
and transfer resources around with other uses in order to get some unallocated
resources, or they have to decide that they want to spend the resources on
tor *more* than they want to spend them on the other things.  If the library
were to start running a relay that placed a sufficiently heavy load on the
campus network that other campus users began to notice sluggish response
times, I guarantee you that their complaints would cause some adjustments
to be made to the tor node's allocated resources.
     One last thought is that, whatever AJ decides to do about tor at his
university, he should prepare at least a cursory list of other universities
that have already done/are doing what he wants his to do, so that he can show
it to the people he needs to convince.  Where possible, his list should
include contact information for someone at each institution on his list who is
knowledgeable about the institution's tor policy and history and preferably
in a position with authority to deal with any problems the institution has
encountered with having tor on its system(s).  Such a list will demonstrate
that doing what he wants his university to do is something that other
universities are already doing, and it will make it easier for the person(s)
he is trying to convince to find out more about it from those with relevant
experience.


                                  Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet:   bennett at sdf.org   *xor*   bennett at freeshell.org  *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good  *
* objection to the introduction of that bane of all free governments *
* -- a standing army."                                               *
*    -- Gov. John Hancock, New York Journal, 28 January 1790         *
**********************************************************************