JSTOR Open Proxy Session ALA Midwinter January 26, 2003

Implications for the Scholarly Community Heidi McGregor Director of Publisher Relations

JSTOR Open Proxy Session Community Reactions Publisher and library reactions similar and positive. Characterized by a shared sense of responsibility. Looking for practical solutions.

JSTOR Open Proxy Session Risks of Unauthorized Access Undermines legal obligations and trust. Challenges ability to sustain electronic resources. Raises questions of authenticity.

Technological Implications David Yakimischak, CTO, JSTOR Dan Oberst, OIT, Princeton

JSTOR Open Proxy Session JSTOR Perspective Tools for Automated Monitoring Human Actions

JSTOR Open Proxy Session Tools for Automated Monitoring 24x7 Hourly Web Log Analysis Look at Activity per IP Address Look for Sequential Journal Coverage Suspicion => Scan for Open Proxies If open, suspend further printing and notify Look for other patterns and signatures

JSTOR Open Proxy Session Human Intervention Review logs and look for patterns Oversight of robots Liaison with User Services, Legal, and others

JSTOR Open Proxy Session Campus Network Perspective Policies Monitoring Current Ideas Future Ideas

JSTOR Open Proxy Session Policies Each institution needs to determine how it will address this issue Review existing policies and precedents Determine new policies, enact, and notify Typical policies cover: monitoring, notification, action, and responses Common policy is to respond to incidents What to do about proactive steps?

JSTOR Open Proxy Session Monitoring Scan campus networks for open proxies Test access to [external] restricted resources Frequency and composition of scans Part of overall campus intrusion detection Proactive monitoring for vulnerabilities

JSTOR Open Proxy Session Possibilities for Discussion Consider a central proxy as the only means to access licensed resources Consider if JSTOR should scan machines for open proxies before providing access Smaller institutions are implementing firewalls and tightly monitoring for abuse

JSTOR Open Proxy Session Future Ideas Shibboleth ( International efforts such as Athens ( Digital Certificates (

The Role of the Librarian Sherry Aschenbrenner Director of User Services

JSTOR Open Proxy Session Librarian Response Response has been overwhelmingly positive, and interest is high. This is new territory for many librarians, including those of us at JSTOR. We can be all be informed by looking at the questions JSTOR has received.

JSTOR Open Proxy Session Library Proxy Servers Is it possible that my library’s proxy server is unrestricted? –It is very unlikely that your main library proxy server is unrestricted. –It is much more likely that an individual has set up a web server without realizing that they may have also implemented an unrestricted proxy server.

JSTOR Open Proxy Session Detecting Open Proxies Should we scan our network for open proxies? –Contact network staff to determine if there are existing procedures on your campus for identifying open proxies. Some campuses, for example, already perform periodic scans. –Scanning should only be done in conjunction with or by your technology staff. We recommend that you don’t scan for open proxies yourself. You could trigger campus alarms.

JSTOR Open Proxy Session Unauthorized Downloading How do I know if our campus network was involved in the unauthorized downloading of JSTOR articles last fall? –We have notified our contacts at the affected participating institutions. –Who is your contact?

JSTOR Open Proxy Session If JSTOR Calls… What steps are taken if JSTOR discovers an open proxy on your campus? –We will let you know we have detected an open proxy, its IP number, port number, and the date and time of access. –Printing from this IP address will have been automatically denied. –The owner of the proxy will need to change the configuration of the proxy -- “close it.” –As soon as we can verify that the proxy is no longer unrestricted, we will re-establish the ability to print at this IP number.

JSTOR Open Proxy Session Testing for an Open Proxy

JSTOR Open Proxy Session What More Can Librarians Do? Become familiar with proxy servers. Be assured that: –JSTOR’s access policies have not changed –JSTOR does allow the use of legitimate proxies Educate patrons and staff about the risks and issues associated with open proxies. If necessary, talk to campus IT staff to make sure they are aware of these issues. Learn more about new initiatives that may present alternatives to IP authentication.