Achieving real data security via community self-enforcement
Richard Welpton, Katharina E. Kinder-Kurlanda · Zenodo (CERN European Organization for Nuclear Research) · 2013
Providers of sensitive/confidential data typically rely on IT-based measures to control the security of their data. Examples include swipe-card access to "controlled" rooms, with CCTV monitoring, sign-in procedures etc. When providing access to research data such a focus on security reinforces the message that researchers are a security problem. We argue that these measures not only are costly and increase barriers to sensible research, but also create the wrong incentives for researchers, who are seen as a threat to rather than collaborators in creating and maintaining secure. We argue that fostering a community of trusted researchers is the most effective way of achieving security. With the right incentives in place, researchers, when considering themselves as part of a community, will reinforce standards upon each other, lest their entire community is denied access to data. In addition, cumbersome or hard to comprehend measures are more likely to result in security breaches as researchers make mistakes or deliberately flout rules for the sake of convenience. We will explain how to build trusted communities of researchers around the secure data services of both the UKDS and GESIS – Leibniz Institute for the Social Sciences and how these fit with providers' and researchers' interests in secure and accessible data.