Open like medical gowns, Standard as in oil

Same, same, but different

A couple of months ago I attended a consultation on ...well, it wasn’t enormously clear what we were really being consulted on, but the stated topic was a possible single statewide library management system for Victoria. The session did provide an interesting snapshot of where various services and library managers’ thinking is at, and a sidebar discussion on proprietary versus open-source: it’s fair to say I probably didn’t behave as professionally as I could have at this point, when someone suggested that open source library software was open to ‘hacking’.¹ More on that later. Several people in the room, including me, were fairly unconvinced that a single statewide system is a good idea, and in the rest of this post I will try to sketch out why.

“One LMS” is the default in Tasmania due to all public libraries being run by the State government, and was also rolled out in South Australia recently. Other states, particularly Western Australia and Victoria, have been talking about it on and off, sometimes with options papers from their State Governments. Andrew Kelly from Western Australia recently proposed, in response to the financial pressures on Western Australian libraries and the fact that much of the state is about to move off their Amlib quasi-monopoly, a statewide Koha ILS instance But “One LMS” is the wrong solution to a largely non-existent problem.

Proponents of single statewide library management systems generally argue that it is a necessary precondition for

• a single ‘use anywhere’ library card; and
• easy inter-library loans; and/or
• a statewide collection; and
• up to date technology and customer-friendly features available to all libraries in the state;

For the purposes of this post, I’m going to leave aside the question of a statewide collection. This is because it’s not really a technical question, but more a political one - and that’s for another time.

Medical gowns

A great deal of library software as currently written, installed, and used is like a medical gown: closed at the front, open at the back. Our systems are sloppy in the way they handle authentication, often lack the most basic encryption of user data, and have a long history of hostility to bibliographic and other public data being easily accessed or repurposed by other systems.

Over several years, Eric Hellman has devoted a great deal of time to documenting the many ways user privacy and security is compromised by various software systems used by libraries. Passwords are stored in plain text, medical journals let ad networks spy on their readers, and library catalogues squirt user information around like water sprinklers. When library systems are hacked (as they, inevitably will be) our users’ home addresses, dates of birth and borrowing history are all exposed. My thought experiment “Tinfoil“ was an attempt to outline one part of the solution, with a system that allows for personalised reading suggestions without compromising privacy.

At the same time we leak all of this data about users, data about our collections is locked up in individual MaRC files and hard-to-integrate proprietary catalogues. In the last few years this problem seems to finally be getting some attention, and I’m much more hopeful than I was when I proposed that we simply burn it all down. But it’s extremely slow going, and as it stands virtually all library metadata is locked into the same formats and standards we’ve been using for decades. It’s only very recently that some libraries stopped blocking search engines using robots.txt, and a great deal of ‘integration’ still involves screen-scraping.

Let’s work as a team, and do it my way

Just as academic publishers have seamlessly moved from “university pays for reading” to “university pays for writing” models and called the result “open”, there has been a great deal of open-washing in the library software market. Every one of the ever-shrinking number of library software companies now boasts that their product is “open” because they have APIs. Now don’t get me wrong, well-documented web APIs where the library can provide access to certain data for integration with other services is a great thing and certainly a big leap forward from where we were. The problem is that each s