If you are a Rails developer and interested in the selective-path CloudFlare Turnstile approach discussed, please see the bot_challenge_page gem for Rails apps, which is now pretty stable, well-tested, with I think good developer ergonomics, and working well. https://github.com/samvera-labs/bot_challenge_page

Mr Michael Carlozzi,
Greetings!!

TrackRef is really helpful and appreciate your kind efforts in this regard. I am also trying to use TracRef for my library. This is to say thanks to you.,

Request you to mail me your further thoughts. I may need your help making use of this tool.

Thank You,
Beeresh, Bangalore, India

Some named entities have multiple locations. E.g. London, England and London, Canada. Let’s say that you also had Bristol as a NER. How would you ensure that London, England is picked for GIS rather than London, Canada? Do you have an algorithm for that?

Thank you for this article and for providing your code. I’m curious though–how did your institution come to select ContentDM as a DAMS over DSpace? It surprises me since most libraries over the past decade seem to be adopting DSpace, and I’d read a few articles that seemed to suggest folks had previously found ContentDM problematic (ie. ‘Breaking up with ContentDM’, Code4Lib 2013, Gilbert & Mobley; ‘ContentDM to Digital Commons’, Journal of Archival Organization 2018, Mita, Pelli, Reamer & Ince). Has ContentDM added any interesting features to their platform or corrected any existing issues? Thanks for any info you can provide!

Apache/2.4.9 (Win64) PHP/5.3.12 Server at localhost Port 80

Best regards,
Anna

Thanks for the comment. The tracking numbers are reported at the bottom of the article (admitted that it is provided like a footnote):
For instance, the total number of clicks for the Unpaywall link is 53,361 during the calendar year of 2021. That number jumped to 60,534 for the first six months of 2022 until OSU migrated its discovery interface to Primo VE.

We also get some feedback from the patrons that they like the Unpaywall link because it is easy and fast to use.

Any library worker making such a statement must reexamine their commitment to protecting a patron’s right to privacy at the library. The decision to sum up these critical privacy issues as an “implied endorsement of a cavalier attitude toward patron data” indicates that the editorial board places little to no value on privacy. Instead, they chose to champion code over all else, patrons and professional ethics be damned.

As the editorial states, this is the *second* article to have significant patron privacy issues. After the publication of the first article, the editorial committee made a statement that they would “pull in outside experts to comment on articles.” [1] When I was called to review the article with a very short turnaround (the email stated that the article was slated to be published later that week), I thought there was some progress in incorporating privacy checks in the review process. Instead, the article was published as-is with one little note on the top of the article stating that there were concerns. In addition, it was implied later on that I would be more than welcome to clean up my feedback to turn it into a more formal, publishable article.

I would say that the editorial process is broken, but perhaps it’s working by design.

The more I learn about the editorial process in the journal, the more concerned I am about the ability of the editorial committee’s commitment in creating meaningful, substantial change to the process. It is standard for many library journals to ask authors to revise and resubmit articles. I recommended that the article be heavily edited to address the multitude of privacy issues if the article is published at all. [2] However, the current editorial review structure seems not to accommodate revise and resubmit.

The implied expectation that I would contribute a rebuttal of my own in the form of article submission or other publication completely misses the point about why this article shouldn’t have been published as is in the first place. *It describes in detail how to violate professional ethics and patron privacy*. A debate in the scholarly literature doesn’t undo the harm of such an article in the scholarly record. Even if the original article was framed in the context of privacy and ethics, any debate would not and must not be a substitute for an ethics review during the review process.

Disregarding a patron’s right to privacy seems to be becoming a pattern here, particularly when you brought someone to point out the privacy red flags only to ignore them. I have been aware that the editorial committee is revising guidelines for guest editors; however, I am not optimistic that this revision for “guests” would solve the root issues present in the overall editorial process. I ask that the editorial committee make the following changes:

1. Create a code of ethics or ethical guidelines for submission authors – technology isn’t neutral. Librarianship has a code of ethics. Patrons have rights in the library. Anyone working in library technology has to recognize all of this and reflect this in their scholarly output.

2. Create a rubric or other mechanisms to evaluate submissions on their adherence to professional ethics, including the patron’s right to privacy – library technology journals are not neutral, either. What is and is not published here shapes the library technology discourse. People in the profession consider this journal as the prestige library technology journal. If this journal doesn’t reflect the profession’s ethics or protect the rights patrons have in the library, it codifies this disregard of ethics and patron rights in the scholarly record.

3. Make more use of “revise and resubmit” during the review process, or make more decisions not to publish if the ethical issues in the original submitting ultimately cannot be resolved or adequately addressed in the submission.

4. Revise the process for bringing in external reviewers – please, for the love of everything good and holy, do not bring in external reviewers four days before schedule publication, only to ignore their input. Ideally, the ethics review would trigger a need for external review early in the editorial process.

Some people have called for the editorial committee to apologize to me for the treatment I received during this process. I do not want an apology. I want fundamental changes to the submission and editorial processes. If the editorial committee is committed to meaningful change, an excellent first step would be a full retraction of the article in question. Only then any progress on ethical guidelines for submissions and reviews can start in earnest.

[1] https://journal.code4lib.org/articles/15340#comment-2745195
[2] https://journal.code4lib.org/articles/16087#comment-2745444

The feedback below is a combination of technical and data privacy factors that makes this proposed method of electronic resource use assessment of particular concern if published without additional context around risk and potential privacy harms to patrons (if published at all). Here’s a list of those factors in no particular order or rank of importance:

1. Behavioral tracking – the article describes a process where several scripts clean up a daily log that (theoretically) is scrubbed daily and creates a CSV file that is kept for reporting purposes. The data in the CSV is not in the aggregate – the barcode or institutional user ID links a patron’s use of a platform. The article describes keeping these CSV files to create reports on the annual use of electronic resources, meaning that the library has a record of the daily behavior of identifiable patrons that otherwise would not exist.

2. Lack of clear, explicit user consent and privacy policy issues – I have not had time to review York University Libraries’ privacy policy or the University privacy policy. However, if the policy allows for statistical analysis of aggregated user data, this particular use case would fail to meet that reserved right to use the data due to the identifiable data in the CSV. It could also be that patrons are not aware of behavioral tracking that is happening in this article. The article does not state if consent or notification was given to patrons.

3. Unprotected identifiable data – this one is pretty self-explanatory. Storing CSVs that have identifiable information – barcode or institutional ID – tied to the use of library resources and materials is a privacy risk. One way of mitigating this risk is through pseudonymization of the patron PII to create a unique ID that breaks the direct link between behavior and identity; however, in this use case, I would argue that pseudonymization won’t do much in protecting patron privacy, leading to the next point…

4. Re-identification risk due to assessment focus and characteristics of certain patron groups – we are looking at assessing the unique use of electronic resource platforms. Electronic resource platforms range from multidisciplinary (JSTOR) to niche, specialized areas of research. Even if you pseudonymize the barcode or institutional ID data, I can with some level of certainty identify individuals based on behavioral patterns based on the reports combined with a public school directory that contains major/minor concentrations or other public data sources available through the university or elsewhere. This assessment’s granularity and focus make it nearly impossible to use de-identification methods to mitigate privacy risks.

4.1 On a side note, transforming the barcode to the institutional ID makes this dataset even more identifiable and possible for misuse through secondary use of the dataset or improper access or combination of this dataset with another sensitive dataset on campus (and most likely without the student’s knowledge).

4.2 Side note #2 – The statement “It produces anonymized aggregate data with all personally identifiable information gone.” isn’t really true, even if you pseudonymized the barcode/institutional ID because the platform analysis is still granular enough that aggregation can’t protect the privacy of those using niche or specialized resources based on the number of patrons doing work in those areas.

4.3 Side note #3 – this is the obligatory reminder that proper anonymization is nearly impossible https://georgetownlawtechreview.org/re-identification-of-anonymized-data/GLTR-04-2017/ is an excellent place to start. I can also get into the specifics of how l-diversity and k-anonymity can also point out the privacy risks with the dataset, but I’ll spare you the math!

5. Report data lifecycle – according to the Privacy section of the article, “These reports can be kept and used after the source data has been wiped. Whether they are shared outside the library depends on institutional openness about collection usage statistics, but there are no user privacy reasons preventing it.” We still have the daily CSV reports hanging around. Where are they stored, who has access to them, and how long are they retained?

6. Choice of assessment harmful to both desired assessment outcome and patron privacy – this is more of a concern in the area of “using data to address an issue that can be more effectively addressed with other methods that are less privacy-invasive.” Suppose we are interested in how patrons use specific resources or how different groups use these platforms. Why are we not talking to these patrons about their use of said resources? There are better ways to assess collection use than violating patron privacy through the process described in the article. In addition, other more qualitative research methods, such as interviews with students and faculty, can produce more meaningful data that can more accurately reflect the value of the databases in question since the value is not very easily derived through data alone without making dangerous and inaccurate assumptions about the use data itself. Flawed data leads to flawed assessment.

I had whether you have (or considered) using any additional metatada related to the chat message. For example, do you have information on time, day of the week of the chat?

I haven’t worked with library chat systems but wonder if they follow some patterns i.e. more questions about when the library closes come later in the day and some times of year may have more questions related to dissertations. If this information is given to the model it may be able to use it to help make predictions without having to hand craft these rules.

There are some example of doing this with the ULMFIT approach https://www.novetta.com/2019/03/introducing_me_ulmfit/

I’d be curious to hear about any thoughts on this and whether you think it might be a possible approach.

thanks again for the wonderful paper :)

As I am worked on FFMPEG before I’ve stuck on that particular part at that time.

So, Here is a scenario
I have 100’s of small chunks of an video but they’ve different bitrate (audio), and when I am trying to merge then they merge without any error, but issue is that after the merger the 3 minutes of video becomes 9 minutes.

What do you what will be the issue here, if there is any unique or unknown command that I didn’t know, then please let me know.

Thanks,
Sanchit Sharma

There was a special issue that explored diversity and social issues in library technology some time ago, but it’s time to go beyond special issues. To acknowledge library technology’s role in creating and upholding systems of surveillance and oppression (among others), I ask the editorial committee to consider incorporating ethics and social responsibility (and etc.) in the regular review process.

Again, I appreciate the editorial committee’s time and care in discussing and replying, so I hope that we can continue this discussion.

On behalf of the editorial committee…

We appreciate the time and thoughtfulness of your response.

Several members of the editorial board discussed this article in depth before publication. Reactions ranged from “nice code, and does in-house what vendors are doing” to “very concerning in terms of privacy and perhaps should not be published” to “please educate me what is wrong with this article”. The authors were asked to consider patron privacy issues and did rework their article to include what measures they had taken.

As we decide how to move forward, we have heard some calls for the removal of the article. Rather than do so, we feel that this should be an opportunity for further discussion and education. We believe the C4LJ should be a place where we learn from each other in the field, including from imperfect projects and the community responses they elicit.

One takeaway from this process has been a renewed recognition of the limitations of expertise on the editorial board in some areas, and the need to occasionally pull in outside experts to comment on articles.

We welcome more comments and feedback, and look forward to a productive discussion.