Editor’s Column: Information Literacy & Privacy/Security
Megan Lowe, University of Louisiana at Monroe
	For the duration of my career as reference/instructional librarian, information literacy has been a significant focus of my efforts, both at the reference desk and in the classroom. From the moment I first realized, as an undergraduate student worker (long before I ever even considered becoming a librarian), that people didn’t understand how to look for information or evaluate its appropriateness for their research needs, I have attempted to make that process make sense for others, to underline its importance. When I began graduate school to obtain my MLIS, I was exposed to the formal notion of information literacy. It made complete and perfect sense to me. When I was offered the opportunity to be an intern in the university library reference department, which would entail teaching bibliographic instruction, I jumped at the chance to learn how to formally teach others to become information literate. I was aghast at how many of my classmates during undergraduate had no clue how to effectively and efficiently conduct research. 
This was in the late 1990s, so the challenge of counteracting Google hadn’t quite yet emerged. However, by the time I started library school in the fall of 2001, Google had begun to arise, leading people to begin questioning the necessity of librarians. I was told my job would disappear in five years. I will soon celebrate my 13th anniversary at my library – seems my job failed to disappear in 2006. This signals to me that librarians are still very much relevant and still very much serve a purpose. As far as being a reference/instructional librarian, I see my purpose as teaching the principles and skills which enable patrons to become information literate – to be responsible, ethical, evaluative, efficient, and productive consumers of information. 

From The Daring Librarian Blog by Gwyneth A. Jones (2013)

Of late, though, I’ve begun to wonder if it’s enough to simply teach users to be responsible, ethical, evaluative, efficient, and productive consumers of information. Is that the whole of information literacy, in a nutshell? I mean, it’s a lot, sure – but is it enough? Is that all it takes to be a savvy consumer of information?
The issue that has prompted these questions is the notion of privacy. While unquestionably librarians are QUITE pro-privacy – consider the profession’s at-large response to the Patriot Act – are we communicating the importance of privacy to our users? This goes hand-in-hand with the idea of security – are we communicating the importance of security to our users? While both of these notions have relevance to information science, I’m more concerned about the understanding of users regarding their own privacy and their own security when it comes to virtual environments. It goes without saying that the fields of computer science and computer information systems are still very much concerned with security and privacy especially as the era of cloud computing unfolds (Poremba, 2015). According to Amir Naftali, who co-founded FortyCloud, a cloud infrastructure security broker, “The data in the cloud is more accessible to anyone – not just the enterprise; therefore, hackers attacking a cloud can reach a much greater number of resources than when targeting a physical data center” (cited in Poremba, 2015). This should concern EVERYBODY, not just companies that handle sensitive, confidential information. The average individual who is using cloud storage for their data is just as much at risk as someone whose information is saved on physical servers. 
Concerns regarding privacy and security go beyond the cloud, though. They should theoretically permeate every aspect of an individual’s online transactions, from simple social media postings to Internet banking. But is this permeation something that information literacy is teaching? A search of the Association of College and Research Libraries’ (ACRL) (2016) Framework for Information Literacy for Higher Education only reveals one instance of the word privacy: “Learners who are developing their information literate abilities” will consequently “make informed choices regarding their online actions in full awareness of issues related to privacy and the commodification of personal information” (ACRL, 2016). It contains no instances of the word security. This surprised me. A quick search of my library’s databases revealed a not-so-satisfactory list of results regarding either privacy or security in the context of information literacy. There were some results, such as McBride’s (2011) article on redesigning an info lit class in which “the class spoke about online privacy and the types of information we share on our social networks and when the ethical use of certain types of information may come into question” (p. 296). Zimmer (2013) found that while the library literature did reflect some overlap of information literacy and privacy, it did so mostly in a passing manner, leaving scholars “more often than not” with “no real solutions or roadmaps for dealing with these vital ethical issues” (p. 35). Zimmer’s (2013) findings suggest that we in the profession are not necessarily sure of how to address privacy and security in the context of info lit. 
The topics of privacy and security seemed to arise more frequently in the context of discussions about digital literacies rather than information literacies. While information and digital literacies are necessarily interrelated, they are not interchangeable. Social media literacy also comes into play, as a specific and highly relevant subset of digital literacy which has significant implications for privacy and security (Bridges, 2012). In 2008 a study in Canadian libraries discovered that even when library patrons were definitely computer and/or information literate, they did not appear to have sufficient skills with regard to privacy concerns (Julien & Hoffman, 2008) which suggests that information literacy programs may well be lacking in terms of digital (and by extension, social media) literacies. 
Why is that? It’s not that librarians can claim ignorance of privacy and security issues when it comes to patrons or their access and use of information. There are significant legal and ethical issues tied to those ideas (Anday, Francese, Huurdeman, Yilmaz, & Zengenene, 2012). And the ever-increasing number of digital libraries, online-only college programs, institutional repositories, and, as always, the ever-present and exponentially growing content of the Internet raise more and more questions and concerns about who has access to what and in what way. Larger questions of copyright aside, the protection of an individual’s intellectual property, whether that takes the form of personal pictures or text-based content, is important; that individual should take necessary steps to secure their rights, up to and including taking pains to address issues of privacy and security. The Framework for Information Literacy for Higher Education even focuses on the importance of intellectual property, attribution, and copyright. And yes, the law does provide certain protections, but as the old adage goes: an ounce of prevention is worth a pound of cure. 
So, why is there is a dearth of research on info lit and privacy/security? Are privacy and security a part of information literacy or digital literacy? If they’re a part of digital literacy, is that the purview of librarians? The Framework for Information Literacy for Higher Education has a footnote regarding participation digital environments but otherwise does not necessarily address digital literacy. If one accepts that the Framework is the standard for information literacy for academic librarians, it seems that digital literacy and social media literacy are not the purview of academic librarians, absolving us of the responsibility of teaching such things except where they pertain to intellectual property, attribution, and copyright (i.e., the ethical use of information and the avoidance of plagiarism and intellectual property theft).
But I do not believe this. I do not believe we are absolved or should consider ourselves absolved of teaching our users about privacy and security. And I believe that many librarians feel the way that I do: that we have a responsibility to teach such skills and concepts to our users. In fact, just last week I received an email across a list-serv from the Library Information Technology Association (LITA) regarding three different (but related) webinars on privacy and security. One focuses on using software to secure the privacy and confidentiality of one’s email; one focuses on using the Tor network to secure patron confidentiality; and the third emphasizes “strategies on how to make you, your librarians and your patrons more secure & private in a world of ubiquitous digital surveillance and criminal hacking” (A. Goben, personal communication, May 12, 2016). All three of these sessions focus on teaching librarians the skills they need to protect the privacy and security of their libraries and users’ data as well as how to facilitate users’ understanding of such notions. What is interesting is that these webinars are coming from the technology branch of the ALA and not the information literacy branch! This seems to suggest that such issues are regarded as technology-based concerns and not necessarily information-related concerns – a subtle distinction which I think is counterproductive.
I don’t think there really is a question of whether issues of privacy and security fall within the parameters of information literacy or not. The competent consumption and production of information should by necessity include ways of securing that information to protect the rights of the producer and to ensure the integrity of the information. It seems rather de facto therefore that privacy and security are info lit topics. What is now needed are more strategies for incorporating these topics effectively and meaningfully into info lit programming and curricula and ways of assessing the effectiveness of those aspects of the programming. Obviously, there is some research out there (Julien & Hoffman, 2008), but more is needed in order to ground practice and establish best practices.
I invite you, dear readers, to consider these issues and to ask yourself how your information literacy programs are (or are not) addressing them. I ask you to incorporate these issues into your programming in a deliberate and mindful way, not as an afterthought. I ask you to delve into the literature and consider conducting your own research on this topic. It is only through such efforts that we broaden and clarify our understanding of such issues which in turn leads to solutions which support our efforts and our users. This should be less about ticking a box on our ethical to-do list and more about helping our users learn to protect themselves.

References
Anday, A., Francese, E., Huurdeman, H. C., Yilmaz, M., & Zengenene, D. (2012). 
Information security issues in a digital library environment: A literature review. Information World / Bilgi Dunyasi, 13(1), 117-137.
Association of College and Research Libraries. (2016). Framework for information 
literacy for higher education. Retrieved from http://www.ala.org/acrl/standards/ilframework 
Bridges, L. M. (2012). Librarian as professor of social media literacy. Journal of Library 
Innovation, 3(1), 48-65.
Jones, G. A. (2013). Who needs a librarian when you have Google? [image]. The Daring 
Librarian. Retrieved from http://www.thedaringlibrarian.com/2013/04/who-needs-librarian-when-you-have-google.html 
Julien, H., & Hoffman, C. (2008). Information literacy training in Canada’s public 
libraries. Library Quarterly, 78(1), 19-41.
McBride, M. F. (2011). Reconsidering information literacy in the 21st century: The 
redesign of an information literacy class. Journal of Educational Technology Systems, 40(3), 287-300.
Poremba, Sue. (2015). Why cloud computing security is no longer an oxymoron. 
Forbes/Business. Retrieved from http://www.forbes.com/sites/sungardas/2015/05/20/why-cloud-computing-security-is-no-longer-an-oxymoron/#2bc698b3cd1d 
Zimmer, M. (2013). Assessing the treatment of patron privacy in Library 2.0 literature. 
Information Technology & Libraries, 32(2), 29-41.