Public Library Requirements for Complying with CIPA

Disclaimer

This document is presented for information purposes only. Libraries should consult their own legal counsel for an analysis of any specific policy.

Summary

The American Library Association (ALA) provides a lot of background information about the Children's Internet Protection Act (CIPA) and the Neighborhood Internet Protection Act (NCIPA), which taken together are commonly referred to as "CIPA." (NCIPA is a subtitle of CIPA; NCIPA only affects E-rate applicants.) CIPA requires public libraries to install Internet filtering software on all Internet computers (public and staff) if the library receives federal money from Library Services & Technology Act grants (LSTA) to purchase computers that will access the Internet, or receives federal E-rate (Universal Services) discounts for anything other than services classified as telecommunications.

Brief History

Both CIPA and NCIPA were included in a large federal appropriations bill that passed Congress in December 2000. In March 2001, the ALA, the American Civil Liberties Union (ACLU) and several other groups filed suit to prevent the enforcement of CIPA's filtering requirement in public libraries. This litigation eventually made its way to the U.S. Supreme Court, which upheld CIPA in June 2003.

When must a public library comply with CIPA?

If the library:

• receives E-rate discounts for any item or service classified as Internal Connections or Internet Access; or
• receives LSTA funds to purchase any computers that will access the Internet, or Internet access (i.e. pay an Internet Service Provider);

then the library must be CIPA-compliant.

A library does NOT have to be CIPA-compliant to receive E-rate discounts on the Data Transmission services only, or to receive LSTA money for any other purpose than buying Internet access or computers that will access the Internet.

How to comply

There are three requirements that must be met.

Requirement #1: Use a technology protection measure

"Technology protection measure" means a filter on the Internet that blocks visual depictions that are obscene, child pornography, or harmful to minors (defined as any person less than 17 years of age). The filter need not affect text or audio, whatever the content. "Obscene" and "child pornography" have rather vague definitions in U.S. obscenity law. The CIPA legislation defines "harmful to minors" as nudity and sex without literary, artistic, political, or scientific value. See the Ohio Library Council's CIPA FAQ [pdf] for the complete definition.

You must be able to turn off the filter at the request of an adult "without significant delay."

Possible filter configuration:

If you are using the OpenDNS Web Content Filtering available free from OPLIN, the easiest way to meet this requirement is to select content filtering level "Low," which filters websites in the categories Pornography, Tasteless, Sexuality, and Proxy/Anonymizer (to prevent bypassing the filter). The descriptions of these categories can be found here. . If you want to select your own filtering categories, rather than using the pre-selected categories in the Low level, the Tasteless category is probably not necessary for CIPA compliance.

Note that OpenDNS also has a Nudity category that is not selected in the Low level. CIPA requires blocking images that "appeal to a prurient interest in nudity," and OpenDNS almost always tags websites in the Pornography category with a Nudity tag, too. Websites that only have a Nudity tag and no Pornography tag likely have artistic or scientific value and are not intended to be prurient.

Proving that you have a filter:

E-rate's Program Integrity Assurance (PIA) process for reviewing applications sometimes requests proof that a library has a filter. A screenshot of a filtering log or a purchase order should be sufficient. If you are using the free OPLIN OpenDNS filtering, then the email from OPLIN confirming the establishment of your account would take the place of a purchase order.

Requirement #2: Adopt an Internet Safety Policy

The library must adopt and enforce an Internet Safety Policy that includes the use of a technology protection measure. If the library is applying for E-rate discounts, the policy must address the following items:

• access by minors to inappropriate matter on the Internet and the Web;
• the safety and security of minors when using electronic mail, chat rooms, and other forms of direct electronic communications;
• unauthorized access and other unlawful activities by minors online;
• unauthorized disclosure, use, and dissemination of personal identification information regarding minors; and
• measures designed to restrict minors' access to materials harmful to minors.

Note that the Ohio Revised Code (3375.64-C) already requires that libraries receiving OPLIN Internet connections "…establish and enforce procedures designed to keep juveniles who use the participant's services from having access to materials or performances that may be obscene or harmful to juveniles and to keep persons who are not juveniles and who use the participant's services from having access to materials or performances that may be obscene." The OPLIN office has copies of such policies on file from every Ohio public library.

Requirement #3: Hold a public hearing

The Internet Safety Policy must be adopted after a public hearing, or as the CIPA language says, libraries "shall provide reasonable public notice and hold at least one public hearing or meeting to address the proposed Internet safety policy." [Title 47, §254(h)(6)] The regularly scheduled library board of trustees meeting may be used as the required public meeting, assuming the agenda is made public before the meeting and the meeting allows for public comments.

Declaring CIPA compliance

Libraries must certify their CIPA compliance, and there are several ways to do this. Libraries with OPLIN Internet connections are required to send OPLIN an E-rate Form 479 each year that declares whether or not the library is CIPA-compliant. No additional certification is necessary, but if a library is applying for E-rate discounts, the filing of a Form 486 also confirms CIPA compliance.

Cisco Umbrella first steps

Note: Cisco Umbrella is the new name and branding of Umbrella by OpenDNS
 

1. Send an email to support@oplin.ohio.gov stating that you would like to participate, along with the contact information for the person to whom we should email the account login details.
2. The contact's account will be set to an administrator level for your library account. This user will have the ability to send out additional invitations to other staff members, and also elevate them to administrator status.
3. From now on, your library is in complete control of your account. To get started, see Cisco Umbrella's Getting Started Guide.

 

You will want to use the Umbrella name servers on your network. The IPs for those servers are 208.67.222.222 and 208.67.220.220. If you want to test out the service before making it live on the entire network, you can always change the DNS servers on just your workstation to those two IPs and verify the filtering is working as you want it to. If you're ready to make filtering live, the place to use those two IPs will vary depending on how your network is currently configured.

• If you statically define every workstation with its DNS settings (ex. the state DNS servers at 156.63.130.100) then you would need to change every workstation to use these two new IPs.
• If your workstations point to a local device for DNS (ex. a firewall/router/ActiveDirectory server) then the place you would use the two OpenDNS IPs would be in the forwarders settings of that device. Changing the IPs on a top level device like this will make filtering live for every workstation pointing to said device.

 Questions? Please ask OPLIN Support.