1mZ2hsN

ZentralblattGuarding your Searches:Data Protection at zbMATHJens Holzkämper (FIZ Karlsruhe, Germany) and Olaf Teschke (FIZ Karlsruhe, Germany)This year, as in the quadrennial cycles before, the mathematicalcommunity eagerly awaits the announcementof the Fields Medallists during the opening ceremony ofthe ICM on 13 August. Though there are as usual manyspeculations and educated guesses, we can be pretty optimisticthat the names of the prize winners will onceagain remain secret up till then; indeed, discretion hasworked well so far and this has been a great part of thefun.Of course, perfect secrecy is hard to maintain and isprobably harder than ever nowadays due to technicaldevelopments. It is not necessary to kidnap and interrogatethe Chair of the Fields Committee; surveillanceof communication of the people involved would do (includingnot just possible committee members but, atleast at a later stage, press officers of mainstream media),since at least some of them would most likely notrefrain from using insecure channels. Alternatively, theanalysis of search queries as employed in trend miningcould evolve into a pretty clear picture of the ongoingdiscussions if restricted to a sufficiently adapteduser pool – which might be intricate for Google or Bing(where mathematics is just a tiny noise in the large datastream) but would surely be applicable for MathSciNetor zbMATH requests.Fortunately, this Orwellian scenario is unlikely, butonly since it appears that no one capable of doing sowould be interested in spoiling the party at the ICM.However, there is much more sensitive informationaround. Hiring decisions are often connected to an evaluationthrough scientific databases. On a general level,knowing in advance what mathematical research is goingon is definitely of interest both inside and outside ofmathematics. Frequently, allegations of plagiarism havebeen made, involving claims that new results might havebeen copied from a colleague and (pre-)published firstby someone else; on the other hand, knowing developmentsin many applications ahead of publication couldlead to significant advantages. Cryptography is a wellknownexample, which directly pertains to organisationsthat are capable of large-scale surveillance. However,mathematical results are part of so many applicationsthat it wouldn’t make sense to restrict to this (or extendto network algorithms, data mining, pattern recognition,etc.) as it is not certain whether more impact might comefrom theoretical foundations of number theory or fastermatrix multiplication. Mathematics is interesting as awhole, which is actually pursued on a rather transparentlevel by the NSA (which publicly spends a lot of moneyon grants, and even more on recruiting mathematicians).No doubt similar activities occur, if less prominently, inother services and regions 1 . With the information thatbecame public from the Snowden files, one would besurprised if there were no algorithms that keep track ofresearch activities and persons in areas like, for example,cryptography; and the uneasy feeling that these algorithmsmay raise alarm due to connections unknowneven to the researchers themselves, or just due to falsepositive signals, is certainly not a good environment forindependent research.While the solution of this dilemma obviously requiresefforts of the society as a whole, we can try toimprove things in our small area. More than 20 millionsearch queries every year in zbMATH are only a verytiny fraction of the world’s web traffic but possibly largeenough to derive sensitive information in our subject,especially when queries could be personalised (whichhappens, for example, when EMS member accounts areused). This confronts us with the task of taking measuresfor data protection – at least as far as can be donefrom the zbMATH supplier side. Concerning the dataconnection, an SSL certificate (on a non-Heartbleed 2 -affected server) has been set up over the last month toprotect zbMATH queries (soon to be upgraded furtherwith software that allows perfect forward secrecy 3 ), encryptingall data exchange between your browser andour servers.While this closes the most obvious vector of attack,the question of handling the information on our serversremains. The level of possible access by the secretservices to user data stored by providers has been a centraltopic in recent discussions. While connection dataare elusive, the only secure way to protect search logs atsupply servers is their permanent deletion. On the otherhand, erasure is in conflict with requests from librarians,and also possibly cripples functions of the interface.Hence there are decisions to be taken, which will be outlinedbelow.From the librarians’ side, there is an ongoing demandfor access data. At the moment, the most common standardis described by the COUNTER Code of Practice fore-Resources 4 . While the desire to evaluate the usage ofthe resources is highly understandable, the 90 pages (in-1While there has been a discussion about the impact of mathematicalfinance to the banking crisis, it seems that the ethicaldimension of mathematicians’ contribution to global surveillanceinfrastructure is yet unexplored.2The crypto-apocalypse of April 2014: http://heartbleed.com/,https://xkcd.com/1354/.3https://en.wikipedia.org/wiki/Forward_secrecy.4http://www.projectcounter.org/code_practice.html.54 EMS Newsletter June 2014