Krafty Librarian

When RA21 was brought to my attention I was concerned because it was coming from a lot of publishers and vendors familiar with their world and the world of large academia but completely unfamiliar with the medical and hospital world.

In my post Medlibs Needs RA21 on Their RADAR, I briefly described RA21 and some of the concerns I had with moving towards this method of authentication and I was extremely concerned that the people talking about it hadn’t the faintest clue about library resources, usage, and IT in the hospital and academic medical world.

While I still have a lot of concerns about RA21 I am pleased to announce the creation of the RA21 Hospital/Clinical Access Working Group.  Their objectives are to “survey, identify and define the use cases/problems for accessing licensed resources from within a hospital/healthcare system that are involved with RA21 adoption and are related to RA21’s authentication use cases.”

In an effort to understand hospital and medical library authentication issues and needs they have created a survey  https://www.surveymonkey.com/r/RA21_Survey of 20 questions that they would like any librarian serving in a hospital or health care institution or academic health care institution to take. (If you participate you can also enter into a raffle for an Amazon gift card.) *The survey closes March 1, 2019!!

I encourage every qualifying librarian to take this survey so that the working group has a clearer picture of the issues and needs regarding access to information.

The working group was started in July 2018 and the website says it will complete its work by the end of February 2019. Hmm…. I hope they plan to continue their work.  If they continue, I hope they will include some non-vendor people on the working group from medical libraries familiar with IT issues. The co-chairs are from the vendor community and while I am sure they are lovely people, they are not in the library dealing with IT and hospital policies and restrictions.  The RA21 team does have some people from large academic institutions, but is still very vendor heavy and has no representation from the medical or hospital community.

Wow it has been a while since I have published. Hopefully, I won’t have that kind of blogging break again.

As librarians we all know there are many ways to get scientific articles, some are legit while other methods are illegal. SciHub is one of the illegal methods.  For those of you who haven’t heard of SciHub, think of it as Napster for scientific articles. Alexandra Elbakyan, participated in research forums where scientists asked each other for research papers.  Elbakyan created SciHub as an automated method to share those papers. The process made it easier for people without access to paywalled papers or difficult to find papers to download them.  Sound familiar? Napster was founded by Shawn Fanning and Sean Parker as a peer to peer sharing service “for music enthusiasts to download copies of songs that were otherwise difficult to obtain.”

As with Napster there seems to be an anti SciHub group (which obviously includes the publishers) and a pro SciHub group who want easier access to materials that are hard to obtain or they don’t want to pay for.  As an individual it can be very easy not to care about the publishers who are profit driven making money on the backs of poor researchers and academic institutions struggling to deal with publisher price gouging rate increases.  While it is easy to think that way, there are many layers to the problem that has led us to this SciHub situation. Publishers, libraries, users, changes in society, technology, politics, and money are all to blame for the evolution of SciHub.

Until recently Elbakyan has been basically untouchable by the U.S. and European courts. While there have been several lawsuits that have gone against her and SciHub, she lives in Russia and has said she plans to ignore the lawsuits. Blocking SciHub doesn’t work either, it switches domains and mirror sites.  It is kind of like playing online Whack-a-Mole, you hit one site and another pops up elsewhere.

Well it seems as if things in Russia might be changing.  According to an article in Chemistry World, SciHub is now blocked in Russia following a Russian court ruled against the site.  Moscow City Court ruled the site should be blocked in Russia following complaints from Elsevier and Springer Nature over intellectual property infringement.  As a result of the ruling, several Sci Hub and Library Genesis domains are now inaccessible by Russian internet service providers.

An article from TorrentFreak.com says “Sci Hub is no to blocking efforts” and probably has other domains “up its sleeve.” TorrentFreak says those other domains can be targeted by rights holders and Elbakyan is encouraging users to “use tools to circumvent Internet censorship – which you can search for in Google or by using the bot in Telegram.”

So it looks like Elbakyan and Sci Hub may be touchable in Russia after all. I don’t think Elbakyan is a hero nor a villain. My hope is that through all of this Sci Hub  evolves like Napster did. Napster is now into the on-demand streaming business. Even if we aren’t using Napster directly as our streaming service, many  are using the pieces of Napster and don’t realize it.  The iHeartRadio All Access app is powered by none other than Napster. It took a Napster to bring about changes in online music. Hopefully Sci Hub can be the catalyst to bringing change to the scientific online paper world so that more papers are easily available and legally.

A recent article in The Guardian “Predatory publishers: the journals that churn out fake science” reported on an investigation (in collaboration with German broadcaster Norddeutsher Rundfunk) into predatory publishers and fake science.

According to the article more than 175,000 scientific articles have been produced by the five largest “predatory open access publishers”  and 5,000 scientists at British universities have published in predatory publications in the last 5 years.  The article mentions that many of the researchers were “exploited by the publishers, who aggressively seek new business from academics who don’t know their reputation.”

Predatory publishing has been on the minds of librarians for quite some time, I often feel like it is old news.  Unfortunately, I think is still new news to many researchers and STEM authors.  I can point to examples of clinicians looking to publish a paper who didn’t even understand the difference between open access and traditional access.  In their mind a journal like NEJM appears open access to them because they are able to access it freely using the library subscription.

So when you have this access perception problem it isn’t hard to see how some can be fooled by predatory publishers.  Their game is more difficult to spot than the Nigerian Prince who just needs you to send him $1,000 for you to receive $10,000.  The problem isn’t just with publications. There at predatory conference promoters.  Back in May I posted about receiving an invitation to speak at a conference in China.  Considering I have been asked to speak in Ireland and other places it isn’t all that far fetched to think somebody from China would be interested.  After getting my hopes up momentarily, careful review led me to realize this was predatory conference spam mail.

I think as librarians we need to remember that there are still many authors who are unfamiliar with the concept of open access and as a result unfamiliar with appropriate open access article submission guidelines and expectations.  Lists of predatory publishers will come and go, we need to work with people to be able to better identify the red flags.  We need established publishers to step up their game and help with the education process. We need database providers to establish criteria for inclusion, rather than including any research article that was publicly funded.

Only by working as group can we have a hope at turning the tide.

We have heard of the donut hole for Medicare prescription drug coverage where people experience a coverage gap for their prescription drug coverage.  I think there is a donut hole for medical information. There are doctors, nurses, researchers who are affiliated with an institution (but not officially part of the institution) or they are private practice who have privileges but are not employed by the hospital.  These people often fall in the donut hole for access to medical information.

There are more and more of these people as universities buy hospitals but the university doesn’t/can’t provide library resources to the hospitals.  Hospital systems are buying other hospital systems and wrongly assuming the library resources will be cheaper (bulk discount) or that they don’t have to pay for library resource because “aren’t we all just one system now that you bought us and we want what you have.”

Library resources are expensive and when met with the surprise cost (when a new system is acquired) administrators often do not understand the basics of library resource licensing and costs. Why would they?  The amount of a library’s budget is not even on their radar when it comes to the budget of the entire hospital.  Unfortunately, they want across the board cuts and the department manager must enforce those cuts. We have little data that says medical libraries save lives and save money in the long run.  What little data we do have hasn’t made it to the minds of administrators.

IMHO the donut hole of information access is growing.  I have people who call for access because they are doing research with somebody in my system. I can give the person in my system access but I can’t give the partner, who is outside of my system, access.  This is met with confusion and dismay.  This is one of the reasons ICanHazPDF and SciHub exist.

As hospital libraries are disappearing and budgets are shrinking, the donut hole will get bigger.  The perception that all is available free on the Internet still exists among many people and when hit with the reality they are flabbergasted by the true access costs causing them to dig their heels in deeper and not pay for anything.  I know of 2 hospitals that didn’t have libraries who were seeking to get library resources only to immediately scuttle the idea completely when faced with the costs. No concept of baby steps and ramp up to more resources. Nope, in their minds the costs are just too astronomical for resources they thought would be cheaper because they are tailgating onto another library.  They totally bail and go back to the idea that everyone will just get by use PubMed and Google, or maybe one expensive (but not as expensive as a whole library) point of care tool.

So, how do we stop the donut hole from growing? Pricing isn’t going down. (When does it for anything…cars, houses, etc.?) Our value is not on the minds of administrators. It will probably be a multi pronged approach requiring cooperation from both publishers and librarians.  What are your thoughts?

I attended remotely, the RA21 webinar Friday morning and it was interesting.  I hope they recorded it and will make the recording available for everyone because this needs to be on the radar of medical and hospital librarians…now. Those attending MLA in Atlanta there will be session Sunday 4-4:20 Leading Easy Access to Content: RA21 Pilots Transform Researcher Productivity and Privacy in the Hyatt Regency Embassy C.

Why should medlibs care? The publishers are looking to do away with the current method of online resource authentication, IP validation.  There is a whole slew of reasons as to why IP validation has problems, one of the biggest is piracy like SciHub.

What is RA21? The RA21 website goes into further details, but it is basically an initiative to facilitate seamless access to online resources while preventing piracy and improving authentication methods.

This is big, because right now many hospital and medical libraries use IP validation, EZ Proxy or both to authenticate users.  RA21 seeks to eliminate IP validation from your on campus IPs as well as your EZ Proxy.

There are privacy issues that concern many people. I am not going to focus on that. I am going to focus on just implementation issues in hospitals.

I don’t understand all of the technical nuts and bolts to RA21 but here is what I learned from the webinar and why hospital librarians need start paying attention.

• Publishers are pushing to eliminate IP validation and the method for authentication.  This means you won’t be able to give your hospital’s IP ranges or your proxy server and have your patrons automatically access library resources (without passwords).
  • Patrons will not be able to click and access a resource simply by just being on campus.
• RA21 will require people to validate themselves and sign into the resources.  So a doctor will click on Wiley’s Cochrane Library and be asked to login, even when on campus.
  • They mention that the doctor will only have to login once because the system will know him/her.  What doctor do you know stays in one place and uses one computer? Doctors will have to login multiple times through out the day.
• RA21 follows the user not the user’s location. So there will need to be some database of approved users.
  • Librarians will need to maintain that. They are the one who will have to add users and delete users.
  • Some libraries are set up to be able to do this through their ILS patron database. However, other ILS systems can’t share patron database info.
  • Additionally, A LOT of hospital libraries don’t have an ILS, they still have sign out cards!
• EVERYONE, academic medical libraries and hospitals will need something like Shibboleth or OpenAthens to be able to implement RA21.  This is not good. There are A LOT of hospital libraries who can barely afford their journals let alone OpenAthens or another product to manage online access.
• Libraries with walk up access via their computers will have to figure out how to time out people.  The doctor is not going to logoff of a journal when they leave.

Now I am admittedly fuzzy on what authentication methods they are using.  Whether they have a database of approved users who have created their own ID and password or they have something else. Some groups seem to be talking about email addresses while other groups talk about login IDs and two factor authentication.

However, every user must authenticate. There will be no more pass throughs via IP. So every time a doctor wants to use an online resource they will have to login.  Now as many hospital librarians know, the doctors are not going to want to login to access an online resource.  I believe I heard one medical librarian say her doctors will have kittens if they had to have yet another username and password to remember just to get journal articles.  We have an online resource that contains both ejournals and ebooks within it.  The ejournal articles allow IP validation to access the PDF. The online resource used to require doctors to use a username and password to access the PDF of the books. Our doctors absolutely refused to use any of the ebooks from that product.  They didn’t want to bother with logging in. Requiring a login to view the PDF of those books impacted usage. IMHO RA21 in a hospital environment will impact usage.

What about single sign-on? RA21 keeps talking about single sign-on. Most likely hospitals will not allow us (or anyone) to tie our library login to their network login.  So there is no real “single” sign-on.  They will need to remember 2 different usernames and passwords, one to get onto the hospital network and one to get library resources. What do you think will happen?  Doctors will use the same network passwords as the passwords for the library.  That’s not good.

Hospitals tend to have extremely locked down IT environments, some hospitals more than others. I know of hospitals that can’t provide off campus access to the ejournals because their IT forbids them from using proxy access (even if it is outsourced and off site).  The folks at RA21 kept talking about working with our IT departments and it is clear that none of them have had to deal with hospital IT.  The hospital IT department does not care about the library. The hospital IT only cares about the EMR and locking everything down as tight as possible from the outside world…including medical publishers.  I know a librarian at a government healthcare agency library that routinely loses access to PubMed due to IT restrictions. Yes, a government healthcare agency library loses access to a government database because the government agency IT has things extremely locked down. So IT is not going to be on board. It isn’t in their interests which is the total security of the hospital network….not STEM piracy prevention or user experience.  This change will fall to the library staff to handle.

Now I agree that IP validation is a flawed system and we need something better.  However, I have concerns as to how it can be implemented in hospital libraries.  Not one of the RA21 Steering Committee is from a hospital library.  They are all big STEM and research and have tested it in the academic library environment.  When I asked for examples of implementation or testing in hospitals I heard nothing.  I don’t think they realize how different hospitals are.  After all, they kept presenting the idea that we can tell IT that it will be a better user experience.  IT is does not care about user experience.

I think your major hospital systems will be able to adapt.  Sure the docs will have kittens about the login requirements and usage might go down because they don’t want to bother logging in for something quick. But I really worry about the hospitals that aren’t big.  I worry about the ones with budgets that are little more than pennies.  I worry about the ones that aren’t allowed to use any outsourced resources to provide journal authentication.  I worry about the solo librarians with no contacts in IT.  How are those hospitals going to handle things?

We need to pay attention so that we can be an active partner in trying to make RA21 or whatever method for authentication something that is feasible for medical libraries.

I just read the post “Silent Librarian: More to the Story of the Iranian Mabna Institute Indictment” and it was very eye opening.  The United States Justice Department, FBI, New York FBI, and US Treasury announced charges against nine Iranians for conducting a huge cyber theft campaign.  Prosecutors state the nine Iranians worked for the Mabna Institute and stole more than 30 terabytes of academic data and intellectual property from universities, companies, and governments around the world.  That is roughly the equivalent to 8 billion double sided pages.

There were more than 750 phishing attacks identified targeting more than 300 universities in 22 countries, however most the targets were located in the US, Canada, UK, and Australia.  Its not just universities that are getting hit. Medical librarians will recognize these institutions PhishLabs identified as also being targeted, Memorial Sloan Kettering Cancer Center, Ohio State Wexner Medical Center and Thomson Reuters.

The PhishLab post provides a more detailed picture on the impact of phishing campaign which targeted university professors, students, faculty, and medical institutions dating back to 2013.  The phishing attacks profiled are designed to look like emails from the institutions’ email.  The fake emails contained spoofed sender email addresses (making it appear as if it was sent from a legit institutional account) telling the target their library account has been expired and in order to reactivate they must follow the link and login with their credentials.  The URLs for the link in the email are similar looking to the correct institution’s URL.

The example they give: (note the XXXX intentionally redacted data)

• Legit American University Library URL: http://login.ezproxy.lib.XXXXX.edu/login
• Fake URL: http://login.ezproxy.lib.XXXX.edu.reactivation.in/login

The landing pages of the fake site is identical to the legit site (as shown on the PhishLabs post)

These stolen credentials are then sold online where buyers ask to buy specific university passwords.  Passwords to the “best” universities and rare journals are the most expensive.

Phishing attacks involving the IRS, bank accounts, and credit cards get the most press these days. While I was aware this sort of thing happened in library resources I was unaware to its extent.  It makes you realize why publishers are looking at RA21 as the answer to better authentication.  I’m not sure if RA21 is the answer.  But I will be virtually attending the FREE RA21 seminar Friday April 27th to learn more about it and see what it means for medical and hospital libraries.

Learning more about RA21 and other ways to prevent library phishing is something we need to be more involved in.  On a simple level, perhaps we need to educate our users to call us directly (like they do the banks) if they have a question about a library email account.

Submit Virtual Projects for JMLA Virtual Projects Section by March 31, 2018

The Journal of the Medical Library Association (JMLA) Virtual Projects Section Advisory Committee is seeking current, innovative and notable technology projects in health sciences libraries for the 2018  JMLA Virtual Projects Section. The previous Column format for JMLA Virtual Projects is transitioning into a Section format this year, which will appear on an annual basis in the October issue of JMLA.

To be considered for the Virtual Projects Section, please submit a 200 word abstract of your virtual project, including why it is innovative/notable, and provide a link to your project web page (if possible) that describes or demonstrates the project. Send your submissions to Susan Lessick, AHIP, FMLA, [email protected], by MARCH 31, 2018.

Technology projects must have been implemented within the past two years. Submissions of virtual projects may demonstrate either the implementation of a new technology or a new application of an older technology. Focus areas for technologies of special interest to the Committee include (but not limited to) the following:

• artificial intelligence (AI) and AI-enabled applications
• blockchain technology for libraries
• augmented reality applications
• open textbooks initiatives
• research impact tracking tools
• social media outreach
• voice control technology (Amazon Echo, Apple Siri devices, etc.)
• wireless charging
• chatbots or intelligent agents
• patron satisfaction tracking technologies

Please consider sharing your knowledge and experience with implementing virtual projects in your library to inspire and encourage your peers, partners, and communities!

JMLA Virtual Projects Section Advisory Committee:

Patricia Anderson
Emily Hurst, AHIP
Michelle Kraft, AHIP
Susan Lessick, AHIP, FMLA
Dale Prince, AHIP
Elizabeth Whipple, AHIP