Stevan Harnad wrote: sh> There are indeed powerful new ways of authenticating texts and dates in sh> a digital archive. I hope my colleague, Adrian Pickering, will reply, sh> describing his system, which CogPrints and Eprints may be sh> implementing. sh> sh> But let me point out that at this time, priority and plagiarism are not sh> the real problems, and I doubt they are what is delaying the inevitable sh> era of self-archiving. (In context: getting people to read and cite our sh> work is already such a problem that it is hard to imagine that there is sh> much of a market for stealing it!)
Self archiving is, of course, something that engineers/scientists are very familar with when it comes to keeping records for IPR purposes. This model will continue as we progress towards entirely electronic record keeping in this arena. Hence methods need to be adopted which are amenable to this end. There is only one emergent method, but with many variations. It is all based upon hashing the digital document and then certifying (or notarising) the hash. (The hash must be cryptographically secure.) Digital time-stamp services are fast developing to cater for this. However, all of these services have an 'Achilles Heel' - if the service doing the time-stamping disappears or has its service compromised then you lose the validity of your time-stamp (your priority date). Assuming, however, that you can use varing and distributed methods to fix your hash (and, thereby your document) in time, the authentication then involves replaying the hash/time-stamp process and then showing (in court perhaps) that this is identical to the one submitted at the time. (As far as I am aware, no priority case has used this as a defense yet, but it cannot be far off - particularly in the US, where electronic transactions now have legal force.) Accordingly, the original documents must be self-archived just s paper ones always have been in the engineering/scientific arena (the traditional log book). I already use hashing to link my own digital documents to my log book. The only extra step of proof required is to show that no document other than the one in question can have existed at the time the log book entry was made. Log book entries already have credance, so it is only the collision and cryptographic properties of the hashing algorithm which are in question (and still to be tested, legally). Those who know (RSA, NSA/FIPS etc) are pretty confident in their algorithms despite serious attacks by the best decryptographers in the world. Where can Open Archives such as Eprints.org help? One of the properties of any time-stamping service is that they are entirely indifferent to the subject and the material. Indeed, the emerging IETF time-stamp protocol - by definition - does not permit the agency to know the identity of the requesters. Moreover, since it consists of time-stamping hashes, it cannot know anything about the material either. It is truly disinterested. However, it suffers from being compromisable - that Achilles Heel. Electronic archives - particularly those favoured by collaborating communities, are not disinterested insofar as their own contents are concerned. But they can do distributed cross-validation by (a) first doing their own hashing and registering and (b) then securing that information remotely by using one or more FURTHER, truly disinterested service with which they have a dispassionate link. The more distribution that goes on, the more resilient the scheme becomes. As authors, we can accordingly feel more confident that priority dates can be proved. There are many e-time-stamp services about. However, there is quite an interesting registry system operated by Surety and its affiliates (from work originating at Bellcore). Visit http://www.surety.com/. One still cannot be 100% confident that they are 'Achilles Heel' proof. But as part of a distributed network, they are just another service that could be used for robustness. At Southampton, we are developing a truly distributed and scaleable approach, elements of which we may well incorporate in Open Archives like Eprints.org and its friends. It is based on another principle - that of the 'widely witnessed event' i.e. all the registrations are publically viewable and thereby subject to scrutiny, which also helps the case and increases resilience. As soon as we are ready to say more about, it the 'white papers' will appear on http://www.probity.org/ Adrian Pickering Lecturer Electronics and Computer Science University of Southampton Southampton UK +44 23 8059 2898
