At the recent Orwell 2003 event in Washington, DC (http://www.orwell2003.org/), Both Bruce Schneier (security expert) and Judy Krug (expert librarian) were panelists.

Judy mentioned that the Patriot Act bars librarians from even mentioning that the FBI had been there. She indicated that an idea some librarians had been playing with is to immediately put up a sign that says "The FBI has not been here." When the FBI comes by, the sign is then removed. So... watch for a state transition between a sign there / sign not there.

Bruce Schneier elucidated a cogent set of questions to evaluate security plans:

1. What are the assets you are trying to protect?
2. What are the risks against those assets?
3. How well does the security system mitigate those risks?
4. What problems does the solution introduce?
5. What are the tradeoffs being made?

With respect to libraries, the answers to these questions are probably something like:

1. We're trying to protect the nation's populous and critical infrastructure.
2. The risk is that a "bad guy" will learn how to build a bomb, poison gas, etc. from reading books in the library.
3. The solution (of tracking people's reading habits) probably does a relatively poor job of determining who has checked out books on bomb-making unless all books on the subject have the title "how to build bombs."
4. The risks/tradeoffs being made are a. you've got to pay for a system of codifying the contents of books (i.e. - you've got to get a lot of people around to rate the terrorist potentiality of books contents) b. you've got to pay for a system of tracking people's reading habits diverting money from other security measures (like paying for more security guards around nuclear power plants,) and c. you scare the livin' bejesssus out of the population that some book they are reading now or have read over the past 15 years will be put on the "banned" list.
5. The tradeoff is that you will discourage citizens from using their libraries, a move that will ultimately be detrimental to American society.

There's also the issue of false positives. What if we decide that someone is a terrorist based on their reading habits. What then? I would imagine that they would be put on a watch list or rounded up and sent to camp X-Ray. What is the accuracy of this system? Let's assume that one in 10,000,000 people is a terrorist (which is probably a consirvative estimate) and that the system has a false positive rate of 1 in 10,000 (which is a VERY conservative estimate), we still get something like 1,000 false positives. Is there perhaps a better way to target evildoers?