Alison Macrina alison@torproject.org wrote:
Hi AJ,
Thank you for supporting Tor! I think it's a great idea to try to work with your university library to run a relay. I run the Library Freedom Project which helps libraries understand and use privacy tools (libraryfreedomproject.org). I can give you some advice based on my experience.
William Denton:
On 1 October 2017, AJ Jordan wrote:
However I've just started college at the University of Rochester, which obviously presents a great opportunity to set up a relay on a really great network. I'm planning to reach out to the library with the following email and would love some feedback:
Scott Bennett had excellent advice,
+1
Academic libraries can be very experimental in some of their work, but they are generally risk-averse. (This is good, because they're in the business of preserving knowledge and cultural artifacts for decades and centuries.) There is, I'm afraid, close to zero chance they would let a non-employee student run a server on their network---and running Tor, even a non-exit relay, makes the chances even lower.
However, don't give up. I suggest thinking about this as a long-term project that could get you involved with the library, faculty and campus IT. There must be people on campus interested in privacy issues, who know about Tor, and perhaps who have been thinking about running a relay. These people could be librarians or they could be professors or grad students in political science, communcations, journalism, computer science, privacy studies, etc. Find out who they are and approach them! Perhaps there is a student club interested in the same issues---if not, you could start one. Students and student groups advocating for a Tor relay or exit, while demonstrating the importance of Tor and how it fits in with the library's and university's mission, would very much help the project be successful.
William's advice is good. You definitely need to begin by building a relationship with the library. Don't be discouraged by the amount of work this may take; the payoff might end up being a cultural shift wherein the library, university IT, and CS departments all work on this as a project together!
You'll want to approach the library by showing that Tor is an excellent way to uphold the values of librarianship, which are privacy, intellectual freedom, and access. Really, be explicit about it; don't assume that they'll just get why you think it matters. Here's something I wrote about intellectual freedom + Tor Browser a while ago and you can borrow the arguments I've made: https://www.scribd.com/document/272919852/Alison-Macrina-The-Tor-Browser-and...
As William said, libraries are mostly risk-averse, so you also need to be ready to answer their questions about legal and technical concerns. LFP has collected some resources to help with all of that here: https://github.com/LibraryFreedom/tor-exit-package/blob/master/resources.md.
Before you email the university librarian, I'd start by talking to some of the regular academic librarians about your ideas and gauge their responses. Ask them if they've heard of the Library Freedom Project and feel free to send them any of our resources. See if they think the administration would be receptive to you offering a presentation about Tor to library staff (even better if you can make it open to students and faculty, too, because that can get you more support). You are welcome to adapt these slides for that presentation: https://libraryfreedomproject.org/allabouttor/. Make sure to show them this academic library that has used their Tor relay as a teaching tool for students: https://boingboing.net/2016/03/16/first-ever-tor-node-in-a-canad.html.
I second all of the above by both Bill and Allison, and I am grateful that they were able to express better and in far greater detail much of what I was trying to say, while adding their own ideas in similar detail. Reading Bill's and Allison's followups stimulated an idea of another, and possibly better, approach that I hope AJ will consider and that may even be more likely to be approved and have greater effect in the long run. If he discovers that neither his campus library nor the university as a whole is already officially running at least one relay, this may be a better way to teach them. If, rather than going for a relay, which is quite likely to scare them until they understand more and better about tor, AJ were instead to campaign to get the library to install the tor browser bundle onto its publicly available computers, that alone would be a terrific coup and might engender a great deal of student support for tor on campus over time. (The library would, of course, need to find a way to lock down the settings of the installed bundle, so that it couldn't be turned into a relay by users, but that should not be difficult to do.) If he succeeded in getting the tor browser bundle added to the library's most likely tightly limited list of applications available on its public machines, he could then wait a while to see what the staff members thought of it. If they decided after watching it in use for a while that it was a good thing to have made available to their users, you might then approach another department that operates a student computer lab to try to get TBB installed there. If the library employees liked it, they might give the prospective department a positive recommendation. If AJ played it right and it usually turned out well, he might eventually cover much of the campus with TBB installations. In any case, getting the TBB installed would educate far more people about anonymity and privacy issues than merely getting a relay installed that most people would never be aware of. Getting the student population behind tor could help in several ways. 1) They would tell their friends elsewhere about it. 2) Some of them might want to run relays themselves off campus. 3) Students might even initiate a push for the university to run an official relay, so *AJ* might not even need to do any convincing at that point to get the university to run one or more relays. Universities typically have unique, public IPv4 addresses for every machine on campus, so they can be good places for many relays to run that would be managed by different individuals/departments. Circuit paths would still be subject to the /16 rule, but that wouldn't stop any of those nodes from helping the worldwide tor user community. Although it has already been mentioned, a university will almost surely be concerned about resource consumption (electricity, CPU time, LAN congestion, WAN traffic volume, especially as a fraction of the total available to the university's net, staff time for training and for maintenace of the software, and always, always, and ultimately money). AJ should be prepared to deal with questions and arguments about resources when asking a university employee to expend university resources of something AJ wants. Universities, especially state universities, live on incomes that are set in concrete for at least a year at a time, although occasionally they may be told during the fiscal year that some of the money previously allocated to them has been rescinded, thus sending administrators scrambling to deal with lack of funds to meet commitments. This establishes a zero-sum environment, where a decision to spend resources on Thing A, means those resources are no longer available for use by Things B, C, D, etc. If they don't have unallocated resources available for tor, they can only run it if they can somehow shuffle and transfer resources around with other uses in order to get some unallocated resources, or they have to decide that they want to spend the resources on tor *more* than they want to spend them on the other things. If the library were to start running a relay that placed a sufficiently heavy load on the campus network that other campus users began to notice sluggish response times, I guarantee you that their complaints would cause some adjustments to be made to the tor node's allocated resources. One last thought is that, whatever AJ decides to do about tor at his university, he should prepare at least a cursory list of other universities that have already done/are doing what he wants his to do, so that he can show it to the people he needs to convince. Where possible, his list should include contact information for someone at each institution on his list who is knowledgeable about the institution's tor policy and history and preferably in a position with authority to deal with any problems the institution has encountered with having tor on its system(s). Such a list will demonstrate that doing what he wants his university to do is something that other universities are already doing, and it will make it easier for the person(s) he is trying to convince to find out more about it from those with relevant experience.
Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at sdf.org *xor* bennett at freeshell.org * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************