It's Academic

It’s fair to think that when conducting research on a topic, a student will think to search for research articles and stop there. This is of course a perfectly adequate way to research a topic, but as an archivist, I can’t help but think students are missing out on quality sources by not considering primary sources. I’m biased, but there is a wealth of information often hidden in dusty boxes and the depths of the internet underutilized by researchers. There may be a misconception that archival materials are precious items that should be collected and locked behind a door, never to be seen again. While some of these items are fragile, these materials are begging to be read and viewed. Archivist’s want researchers to explore and learn from the materials. But how do we teach students to look for primary sources? I believe this needs to be a group effort from librarians, archivists, and professors to partner in promoting these collections. As archivists, we are the experts in what our collections contain, and often need to facilitate connections with faculty. Sharing collections via social media, presenting at faculty meetings and workshops, and building relationships with faculty all help to promote the use of archival materials.   

I’ve discovered in Widener University’s own archival collections interesting stories of marginalized voices that I know are used in some classes. A history course at Widener utilizes our George Raymond Papers, a collection of scrapbooks covering the Civil Rights Movement in Chester, Pa during the 1960s. Also, our Human Sexuality students often use materials from our Sexuality Archives in their course work. This is a great start and I am excited for future collaborations that may happen. I hope to partner with a faculty member in the future to teach using primary sources and share all of the interesting stories in our collections.   

Another misconception I’ve found is that archival materials can only be used in history courses or the broader humanities. I’ve recently spoken with colleagues about teaching with primary sources and the multidisciplinary opportunities collections offer. Maybe your collection has papers about an influential mathematician that can be added to a math course. Or maybe you have architectural drawings of buildings on your campus that engineering students would be interested in. There are endless possibilities. So, I encourage all to think outside the box, ask about the materials in your archives, spread the word, and promote the use of archival materials. They’re ready and waiting to be used.  

Academic libraries increasingly offer Research Data Management (RDM) services to their patrons and my library is no different. My interest in RDM began while in graduate school and over the past several years I have worked on turning my interests into action. The term “research data management” gets thrown around a lot and it is useful to define what I mean by it here. To me (and I would suspect a lot of you), research data management is the process of organizing, storing, preserving, and sharing your research data. In general, RDM involves the daily, everyday management of data throughout the lifetime of your research project. It is also worth noting that when I say “data” I am referring to all data types, not just numerical data. There are infinite research projects that our patrons are working on and data is always being found, collected, stored, and hopefully preserved. National and international funding agencies have been requiring Data Management Plans (DMPS) for years. In addition to being required, DMPs serve as helpful tools for researchers who are deliberate and specific when creating them. Assisting faculty researchers on my campus with creating effective DMPs is how I began offering research data management services at my local campus.

When I began offering one-on-one DMP appointments I realized how little faculty researchers knew about how to create them. And then I realized how little faculty cared about seeing them through, which was a bit depressing. I understand that researchers are quite busy and the process of jumping through all sorts of funding hoops can be stressful and daunting. It was with this in mind that I began, in earnest, to share my knowledge and expertise of DMPs and RDM with my local research community. After a few individual appointments I decided to create a more formal workshop on creating effective DMPs and I have been slowly offering it to small groups of researchers. Their feedback has been overwhelmingly positive, and I used these connections as steppingstones to create new RDM workshops.

Over the last month I have created four additional RDM presentations to complement my DMP presentation. Practicing good RDM skills can be daunting, and it is often pushed aside to meet other research commitments. It is my hope that by offering more of these workshops – at an earlier date – will allow researchers to feel more confident in practicing these skills before it is too late. Additionally, my goal with creating several workshops was to deliver this information in bite-sized pieces. Few research faculty are on campus during the summer so I have yet to offer these workshops but topics include: data management and sharing; data discovery and storage; file naming and version control conventions; writing data management plans, and more. Though I would not consider myself an expert in any of these areas, I have spent a lot of time teaching myself and learning from others. If you or your library are interested in learning more, or offering RDM services yourselves, I have compiled a brief list of resources below that have significantly helped me in my pursuit.

If you are currently offering RDM services or are hoping to in the future, please leave a comment below! What have your successes looked like? Have you experienced any failures that have frustrated you? Is your campus community receptive to the support? Feel free to ask me any questions as well; I am happy to assist if I can.

Books on research data management

• Engaging Researchers with Data Management: The Cookbook by Clare et al.
• Exploring Research Data Management by Cox and Verbaan
• Managing and Sharing Research Data: A Guide to Good Practice by Corti et al.

Online courses/resources to learn more

• ACRL RoadShow Presenter Toolkit: Research Data Management
• DataOne Data Management Training
• Data Carpentry
• DMP Tool
• Implementing Effective Data Practices Toolkit (ARL)
• Research Data Management Library Academy (RDMLA)
• Research Data Management and Sharing (Coursera)

Organizations/groups

• Digital Curation Centre
• Research Data Access and Preservation Association
• Research Data Alliance

Hello Everyone!

Just a reminder, there are still spots available!

The College & Research Division of the Pennsylvania Library Association is pleased to invite you to register for “Engaging with the ACRL Framework.”

https://www.palibraries.org/event/2021CRD_ACRLWS

As a virtual event, it will take place over three (3) half-days which will allow time in between for the required asynchronous activities.  With this workshop being offered virtually, and grant support, the registration fee for this is an incredibly low $30 for members and $45 for non-members for nine (9) hours of continuing education!

Act quickly! The workshop is limited to only 60 participants, and we know the topic is of high interest!

Thank you.

On May 20, 2021, ACRL presented the webinar “Gone Phishing: Service Continuity after a Cyber Attack,” which was sponsored by the Scholarly Networks Security Initiative (SNSI). Addressing the increasingly commonplace threat of cyber attacks on higher education institutions, this webinar discussed how many academic libraries are not prepared to handle cyber attacks, whether large-scale or small-scale, the impact such attacks have on operations, and the lasting repercussions on both people and services. Three librarians discussed an initial incident of a cyber attack at their institution, the impact it had on their library (and elsewhere), the lessons learned while recovering from such an attack, the emotional toll inflicted upon the library and its community, and the long-term changes and repercussions once recovery had been obtained.

DID YOU KNOW? The National Cyber Security Center in the United Kingdom places the education sector as the third largest target for cyber attacks – ahead of retail! This is due to the fact that most universities routinely store a tremendous amount of personal data.

The panel of librarians were Erin McCaffrey, Dean of the Library and Director of the Center for Student Success at Regis University; Kristina Vela Bisbee, Journalism and Government Information Librarian at Columbia University; and Romel Espinel, Web Services and Instruction Librarian at Stevens Institute of Technology. Melissa DeWitt, Research and Instruction Librarian with Regis University, served as the moderator. The archived webcast recording is available at: https://www.youtube.com/watch?v=krKOwhZmqYI.

First up in describing a cyber attack experience was Erin McCaffrey. In the early hours of August 22, 2019, Regis University was struck by a cyber attack. All of the technology systems were brought down as precautionary measures, which included telephones, emails, websites, all online programs, and university-owned computer hardware, of which the employees were not able to use for quite some time. There is never a “good” time for a cyber attack, but this one occurred at a particularly busy time for the university, as summer courses were coming to an end, and it also coincided with residential students moving onto campus in preparation for the fall terms. As a result of this attack, summer courses were extended by a week. Residential students started their new semester on August 26^th as planned. The university’s residential Wi-Fi network was restored a few days later, causing online and accelerated term courses to be delayed by about a week. On September 1^st, the university’s online learning management system was restored, allowing for those online and accelerated term courses to start on September 3^rd.  Regis University also quickly established an alternative website which was used to communicate information to the university community. At the time of the cyber attack, McCaffrey reports, the university had approximately 100 applications or services that were in regular use, with almost 200 services being supported in the library’s data center. All of these were brought down by the cyber attack. Five months later, it was learned that it was a ransomware attack, and the university paid the hackers. There is no evidence that the library’s data was compromised in the attack. Federal and third-party investigators were unable to determine the root cause of the attack, although it did originate from outside the United States. McCaffrey stated that their back-ups were attacked first. Regis University’s institutional continuity plans that were already in place were based on having those back-ups. Since those were compromised in the attack, it resulted in the university’s IT department making the decision to rebuild and update systems. As a result, the road to recovery for Regis University was a long one.

Romel Espinel spoke next of his cyber attack experience. Like McCaffrey’s, the cyber attack occurred in the month of August, but happened a year prior, in 2018. Seventy-five campus members received a ransom message upon logging into the Stevens Institute of Technology’s network. As a result, IT shut everything down, and classes were about to start in three weeks. No printing, scanning, or accessing the institute’s computers could be done. Employees had to work off of their smart phones and use their own data plans and Wi-Fi. Each of the institute’s computers had to be taken offline, cleared, and scanned for viruses. What was really a challenge, says Espinel, was not having computers or Wi-Fi to use on campus, so it was certainly taxing to find things to do during this time, such as making signs. He compared it to a blackout in that it took time, slowly, for operations to resume. The institute was able to get back online with its Wi-Fi in time for the start of the fall semester, but the lasting effects of the cyber attack continued to linger right up until the COVID-19 pandemic hit in March of 2020. Espinel joked that it was like jumping from one crisis to the next!

Lastly, Kristina Vela Bisbee relayed her cyber attack experience, which was really a unique experience. In May of 2019, hackers tried to access and alter military intelligence that was provided to Columbia University by the libraries. This was done by impersonating a Columbia student, and by using the library’s various channels for research support to gain access. The very channels which the library relied upon to make itself accessible to its users, such as virtual reference and email reference web forms, was what made it vulnerable to this cyber attack. The database which was compromised – which Vela Bisbee would not disclose – was prominently featured in the library guides and its publicly indexed website. She hinted that it was not your typical library vendor. It is an industry database which is very resourceful for expert faculty in international affairs and political science, but it would not prove to be very useful for your typical undergraduate student who is thinking of majoring in political science.

Someone claiming to be a Columbia University student was trying to access this particular database by contacting the vendor directly for assistance. In an email copied between Vela Bisbee, the vendor, and the “student,” Vela Bisbee learned that she was the primary contact for relations between this database in the university. In a separate email thread between just herself and the vendor, the vendor alerted Vela Bisbee that it believed that the hacker was spoofing the university’s IP address. At first, the hackers emailed Vela Bisbee directly. As she ignored their requests, the hackers began to email other librarians at Columbia University and drop her name to give leverage to the requests that they were making. Some of the requests Vela Bisbee was getting were for high resolution images of aircraft carriers or maps of military bases. In several instances, there were requests for the library to actually reach out to the vendor to change or alter information in this database, such as technical specifications for drones and surveillance devices being used in the Middle East. Despite this database not being used primarily for academics, Vela Bisbee says, “This resource was really a feather in the library’s hat. This was our way of showing that we are legitimate to our users. And it was also something that we had been using for a very long time without any issues, so this was something that kind of blindsided us.”

Over the course of two weeks, the library had about twenty different referrals from the same user through a variety of channels. The hackers were emailing individual librarians and librarians at different locations on campus and filling out online reference help forms. Most chilling to Vela Bisbee was the hackers’ usage of the library’s chat reference: “They were speaking to a librarian in real time and troubleshooting access. Because our library system is so decentralized, some of these attempts came pretty close to a security breach, especially when the hacker was speaking with students or staff who don’t normally work with patrons in this area and therefore may not have recognized the threat.” It was an abbreviated and intense amount of time in which the hackers were testing all the library’s defenses. It was also not just one student being impersonated; it was multiple, currently-affiliated students whom the hackers were impersonating. The cyber attack resulted in Columbia University canceling its subscription to that database. Vela Bisbee even contacted the FBI about this but has not heard back from them.

The emotional impacts of the cyber attacks were also widely felt throughout the libraries and their campuses. Vela Bisbee recalled feeling awe, embarrassment, and frustration at the ideal that her name was being evoked in the hackers’ correspondence and afterwards; she felt responsible. McCaffrey felt dismayed at not being able to serve the students the way the university should. Like Espinel, McCaffrey and her co-workers had to use their personal devices for a while, in which case some reached the limits on their personal data plans. Eventually, Chromebooks were purchased for the library; McCaffrey made sure that every department had access to these once wireless access had been restored on campus but before the employees all had their university computers returned. Espinel spoke of the four stages of emotional impact after a campus-wide cyber attack. The first stage is shock: shock that an attack of this nature can shut down normal, everyday, mundane operations such as calling a co-worker on their office telephone. Everything comes to a halt, and you can overlook that a cyber attack not only has huge repercussions, but smaller nuances as well. The second stage is uncertainty. When will things get back to normal? How are the powers that be resolving this issue? How can we be better protected from a cyber attack? When are we going to get our systems back and operational so we can provide services for the students to ensure their success? Frustration, and sometimes even anger, is the third stage. Why has this not been resolved? Were there emergency plans in place beforehand in case of an attack? Lastly, the fourth stage is continued uncertainty. It resonates for a very long time. Espinel said that it makes you think of how we can be ready for the next attack should it happen.

Is there a silver lining to this experience? Absolutely. Who could have predicted that just over the horizon, a pandemic was brewing that would disrupt basic day-to-day services globally and completely turn the academic world upside-down? The actions taken to effectively combat a campus-wide cyber attack, such as creating a communication chain (something as simple as having each other’s personal telephone numbers) and establishing electronic back-ups, can only have better prepared these institutions for handling the COVID-19 crisis.

The latest issue of Pennsylvania Libraries: Research & Practice is now available at palrap.org 

Articles include:

• In the PaLRaP Spotlight: Michael Lear
• Collecting Pennsylvania Political Twitter Data
• Feedback Loops: Algorithmic Authority, Emergent Biases, and Implications for Information Literacy
• Affording Access: Pathways to Reducing Textbook Costs
• Reducing Barriers to Access in Archival and Special Collections Public Services
• Negotiating Open Access Journal Agreements: An Academic Library Case Study
• Noteworthy: News Briefs from PA Libraries

Bryan McGeary & Danielle Skaggs, Co-Editors