A late April Hive Mind: Security and surveillance practices in special collections and archives institutions

Today’s post summarizes an a Hive Mind by the SAA’s Issues and Advocacy Group on April 26, 2024, based on notes by fellow I&A Board member Jacqueline Devereaux, and was adapted into a blogpost by Burkely Hermann, Metadata Librarian for the National Security Archive and current I&A Blog Coordinator. The working group mentioned in this post has a ListServ which anyone can join.

Surveillance video cameras above marina in Gdynia, Poland, originally posted by Paweł Zdziarski on Wikimedia Commons on April 6, 2007.

Late last month, on April 26th, the Issues & Advocacy Group held a one hour Hive Mind centered on a discussion of special collections and archives security and surveillance practices with guests from the Abolition in Special Collections Working Group (ABSC). In all, twenty-three people attended! ABSC is a collective of library workers in collections and archives which are interested in disrupting involvement of libraries and libraries, with policing, armed response, surveillance, and the prison industrial complex. The organization aims to determine how to approach work differently, by connecting connecting political and ideological frameworks, has many projects including a 2021 survey on special collections and security practices with the goal to promote more inclusive practices for workers.

During the discussion, the guiding questions for each of the areas the aforementioned survey focused on, specifically administrative policies on law enforcement, use of surveillance technologies, and administration policies, and experience of archival and special collections workers, and mention of the questions themselves, which were:

  • Does your workplace maintain a regular relationship with a local law enforcement and/or security presence (e.g., campus police, state/local police, Capitol police, etc.)? If so, is that relationship made transparent by administrative policies or public policies? 
  • Does your workplace rely on law enforcement intervention in case of particular emergencies? If so, is there a policy that makes transparent which situations will trigger law enforcement intervention? 
  • Do administrative policies provide suggestions for de-escalation in addition to, or as an alternative to, law-enforcement? 
  • What do you consider to be surveillance technology in your workplace?
  • What surveillance technologies do you have in place at your workplace? Did you select any of them or were they already in place when you arrived?
  • What do you see as benefits of having surveillance technologies?
  • What are the drawbacks of having surveillance technologies?
  • What data are you directed to attain from your users/patrons/scholars?

It was noted that RBMS (Rare Books and Manuscripts Section) suggested that institutions maintain a regular security presence in special collections as part of their policies. It was also noted that in some cases there were local security, with an unknown relationship with local law enforcement, noting an example when a student fainted at a large public university, called 911 and a police officer came rather than paramedics. Some participants mentioned that in their university settings, there is campus security, with administration interfacing with them, and some have special security contracts.

Otherwise, it was noted that in some cases, a security officer will walk by the entrance of the special collections library, but typically the officer does not go in. Some participants noted that for “incidents,” one policy states what would constitute involving law enforcement instead of campus security that is included in the general library use policy. In certain instances, certain participants noted, security cameras are governed by university wide policy and are maintained by campus police. Often this was said to depend upon the type of institution. For instance, a federally-funded institution might have a relationship with local police.

Some participants noted that sometimes staff get a free pass from because “security knows them” but that statistically, it is more likely to have staff members initiate theft than others. In response to a follow-up question about written policies about security and specific forms,there was mention of any type of form,some noting a Special Collections security policy but not recalling recall law enforcement being mentioned. This same participant said that security guards and their responsibilities, for their institution, are in that policy.

As one example, here’s an excerpt from the researcher rules laid out by the National Archives and Records Administration on their website

There was also discussion about how policies often discuss theft, or bomb/gun threats, but  that people at the front desk often times didn’t have any policies centering on the well being of staff and employees at institutions from the survey! It was further noted that some university libraries rely on law enforcement because library staff are not trained in de-escalation. One participant the main choice was to call security if you feel threatened. As such, it was noted that little is available on de-escalation at most library settings.

At the same time, one participant noted that in the public library they work in, they would have a code word if there was a tense situation. Others noted that reference staff can informally support each other and figure out how to handle situations oftentimes for these situations student workers. Most recently, as some participants noted, public libraries added onsite security later because of dangerous patron situations/ issues, but had no specific training or internal library policy. In those cases, libraries and police tied together because they both worked for the city. Following this, there was the creation of a flowchart for deciding how to handle a variety of situations, including an incorporation of de-escalation training for student workers and staff who work at smaller universities.

In terms of surveillance technologies, some noted video cameras and supervised use of non-circulating material. Others described registration forms which used to be against policy to shred registration for ACRL (Association of College and Research Libraries) until recently. Others noted surveillance practices include taking IDs, having cameras, and staff monitoring in our reading room. Others have security cameras, registration, and ID requirements (although we allow homeless patrons to register for 1-hour computer use only without IDs), or signing into Aeon.

Other participants noted that visitors have to enter through the security entrance rather than main entrance. In those cases, visitors sign in with security, while elevator access to the reading room is restricted, and there is full time security staff, and cameras over each reading room table, bag checks, and lockers.

Some participants noted that surveillance escalated after publicized instances of theft. In those cases, due to insurance issues, it means the library administration insists on increased surveillance. However, after 2020, in light of social movements, library staff members, as described by some participants, shared that the security measures felt oppressive.

Risk Management Elements in an image extracted from Systems Engineering Fundamentals. Defense Acquisition University Press, 2001, and posted on Wikimedia Commons. This image, since it was an original work from a U.S. government report, is in the public domain.

There was also description of an ongoing question of prioritizing the safety of collections or prioritizing communities and staff members well being in the library. One participant describing weigh archival folders, and if the weight changes then you are suspect, describing how this was offered as “a solution” by risk management!

Later in the discussion, in response to a question about surveillance technologies in the workplace, said security practices were already in place, when they started, noting employee background checks! It was described how some places have policies that employees working with special collections have stricter background and even credit checks. It was noted that while this is possibly for insurance/number-crunching risk profile reasons, there is disconnect with HR about what a “background check” entails. This becomes, as some participants noted, a hurdle for those who were formerly incarcerated, with some noting that background checks are done by a third party, and it’s unclear what they check and how it affects hiring.

Other participants noted that credit and background check is common for museum collections staff, describing this as a difference between the museum world and archives world. Another noted that when their institution got Aeon they debated about whether to make patron photos a requirement for researchers’ accounts, and went with a middle ground of making it optional.

Otherwise, one participant gave an example of how, early in their career they introduced a patron registration form to better serve the patrons. However, they faced backlash from a particular patron who didn’t want anyone to know what they were researching. As a result, the form did not continue. One participant noted that staff are fingerprinted.

In response to questions about benefits and drawbacks of surveillance technologies, one participant noted that Aeon does host data. It was noted that some institutions host servers, but the Aeon company does not touch the data, unless it involves support question and will reach out to the institution. Instead, it is up to the customer to decide how they will interact with state and law enforcement. Others described background checks thinking the staff/faculty divide.

Examples of how personal information is obtained and used to commit identity theft, a chart excerpted from a U.S. GAO report entitled “Identity Theft Services: Services Offer Some Benefits But are Limited in Preventing Fraud”, posted on Wikimedia Commons in April 2017.

In response to a question about what data is gathered from users, patrons, and scholars, one participant said that the data collected included letters of reference, passports, drivers license, and Aeon requirements. According to participants, the most common fields used are:

  • name
  • email
  • phone
  • address information
  • user status (grad, undergrad, faculty, staff, etc)
  • organization
  • department
  • research topics

As such, there is a determination of what data is collected and the security policy. Also there was discussion about the collection of name, address, and student/faculty data, asking why researchers are they coming in, and Local versus permanent address.

Some participants said that a form helps keep track of what researchers were looking at. Others noted that their institution collects local address, phone number, email, with a photo ID presented annually. Another said their institution collects name, address, and contact information, with registration forms noting that the institution has the right to ask for an ID, but we doesn’t generally ask for it, as users give their information, but it is not checked. Another said that for the institution’s own statistics, the only identifying information kept is their affiliation with the school and whether they are in or out of the community.

Beyond this, during the discussion, there was description of how registration forms, used by one institution, also note anything a user has taken an image of or reproduced the materials, while with a public library, where one participant works, as having a strict non collection of information from really only name and address for mailing. There was also description of the aforementioned survey which stated that 14% of institutions hold IDs as collateral!

One participant noted that the institution they worked for added a registration form after they started in the department, noting it states the handling of a collection and then sign off on a copyright disclaimer, which is a blanket statement because most things are still under copyright). Another said their institution used software to help aggregate data but doesn’t include any personal identifying information. In addition, one participant was curious about how people balance gathering collection use information for the betterment of the organization and providing services and privacy/security of individuals’ collection use information

There was also discussion about how collection of an address was helping versus affect on unhoused or temporarily housed populations in an institution’s user base. As such, it said there is an issue of local versus permanent address, and stating that apart from personal information (name, address, email, phone) some institutions are also directed to keep track of their research/project descriptions, what institutions they’re affiliated with, and specific research questions they asked. Another participant said they could see how it’s useful & interesting insight into how collections are being used & how we can support novel research, but weren’t sure whether it was made clear to readers that we retain all this information, and wasn’t sure how long it was maintained or by whom.

During the Hive Mind there was also resistance to relax the requirement for providing a local address and photo id, specifically with resistance to relaxing both of those requirements within those institutions. There was description of how paper registration form indefinitely held in the archives, paper call slips, and not separate boxes from the requests given, asking whether data can be pulled separate from the personal identifying information itself?

In the process it was noted that in Aeon the capability to add in the identifying number of the passport or license as well, and discussion about information you think your institution are collecting versus what you are actually collecting.

For future Hive Minds, please contact the SAA’s Issues and Advocacy Group.

Leave a Reply (Note: The Issues & Advocacy Roundtable is committed to providing a welcoming environment for everyone who participates in its online spaces. All comments must honor the SAA Code of Conduct: http://www2.archivists.org/statements/saa-code-of-conduct.)