Repository audit and risk profiles: trust through transparency Raivo Ruusalepp 16.06.2010 Repository audit and risk profiles: trust through transparency Raivo Ruusalepp Institute for Information Studies Tallinn University DCI Conference, Toronto 16/6/2010

Topics How to tell whether a repository is “rotten”? Audit as a method for demonstrating trustworthiness Trust in digital preservation Risk as a measure of success Risk profiles of different repositories 16.06.2010

Asymmetric information Raivo Ruusalepp 16.06.2010 Asymmetric information The problem of quality uncertainty: Information asymmetry occurs when the seller knows more about a product or service than the buyer (G. Akerlof, 1970) How to tell whether a digital preservation repository is a “cherry” or a “lemon”?

The Call for Repository Certification Raivo Ruusalepp 16.06.2010 The Call for Repository Certification “A critical component of the digital archiving infrastructure is the existence of a sufficient number of trusted organizations capable of storing, migrating, and providing access to digital collections… A process for certification of digital archives is needed to create an overall climate of trust about the prospects of preserving digital information.” Task Force on Archiving of Digital Information: Preserving Digital Information, 1996 16.06.2010 Raivo Ruusalepp, Tallinn University

Chronology of repository audit work Raivo Ruusalepp 16.06.2010 Chronology of repository audit work 2002: Trusted Repositories Attributes & Responsibilities 2005: RLG/NARA Draft Audit Check-list for Repository Certification 2006-2007: CRL and DCC Pilot Repository Audits Dec 2006: Catalogue of Criteria for Trusted Digital Repositories published (in English) by nestor Feb 2007: Digital Repository Audit Method Based on Risk Assessment (DRAMBORA) published by DPE/DCC Mar 2007: Trustworthy Repositories Audit & Certification (TRAC) Criteria and Check-list published by CRL and OCLC 2007: Birds of a Feather group of audit checklist standardisation Mar 2008: DRAMBORA Interactive released May 2008: Data Seal of Approval by DANS Nov 2008: Version 2 of the nestor repository criteria Oct 2009: CCSDS draft standard on Repository Certification Jan 2010: CRL issues first certificate of a trusted repository (to Portico) 16.06.2010 Raivo Ruusalepp, Tallinn University 5

Trust through audit Independent measuring of repositories is seen as an essential aim Taken as axiomatic that audit is a mechanism for establishing the trustworthiness of a repository Internal audit Self assessment Internal Audit Service External audit Financial auditing Operational auditing IT systems and services audit Information security audit 16.06.2010

Stakeholders’ trust in a repository Users may trust a repository because: it is deemed as safe place of deposit through law, regulations, community consensus its content is verified (authorship, authenticity, accuracy) Depositors may trust a repository because: it is deemed as a safe place of deposit it uses software that has been adopted by many other repositories it has been certified as a trusted repository (since January 2010) 16.06.2010

The nature of trust in a repository Raivo Ruusalepp 16.06.2010 The nature of trust in a repository Trust as a layered concept: Attitude, belief Decision (linked with achieving a goal and often based on assessment of associated risks) Act, behaviour (i.e. establishing a relation) TRUST(X Y C τ gx) Occurrent trust vs dispositional trust Can the risks associated with future digital preservation actions be measured? 16.06.2010

Two concepts of trust through audit Raivo Ruusalepp 16.06.2010 Two concepts of trust through audit The TRAC “family” of audit methods: A fixed set of (minimum) requirements Rely on the OAIS Reference Model as the repository standard Rely on policies to create dispositional trust The DRAMBORA method: The repository needs to demonstrate its capability to identify and prioritise the risks that impede its activities manage the risks to mitigate the likelihood of their occurrence establishing effective contingencies to alleviate the effects of the risks that occur Awareness of risks and ability to treat them creates trust 16.06.2010 Raivo Ruusalepp, Tallinn University

Digital Repository Audit Method Based on Risk Assessment Raivo Ruusalepp 16.06.2010 Digital Repository Audit Method Based on Risk Assessment Jointly developed by the Digital Curation Centre (DCC) and DigitalPreservationEurope (DPE) First released in March 2007 Over 200 users (registered repositories) DRAMBORA provides: A methodology for conducting repository self-assessments An on-line tool to facilitate the assessment and document its results – DRAMBORA Interactive 16.06.2010

Raivo Ruusalepp 16.06.2010 Objectives The purpose of the DRAMBORA toolkit is to facilitate the auditor in: defining the mandate and objectives of the repository defining the scope and constraints of functions of the repository identifying the activities and assets of the repository identifying the risks and vulnerabilities associated with the mandate, activities and assets assessing and calculating the risks defining risk management measures reporting on the self-audit 16.06.2010 Raivo Ruusalepp, Tallinn University

Repository Service Classification Raivo Ruusalepp 16.06.2010 Repository Service Classification DRAMBORA includes some rudimentary tools for identifying and describing classes of repositories in terms of their common services and characteristics Audits are only meaningful within the context of comparable repositories (‘repository-sphere’) Performance is understood in terms of services and translated into baseline risk registers OCLC Research, Research Libraries, Risk and Systemic Change (2010) 16.06.2010 Raivo Ruusalepp, Tallinn University

Raivo Ruusalepp 16.06.2010 Trust in Repositories Strong link between the organisational context of the repository and its users’ expectations For example, different treatment of authenticity in archives of records and research data centres Linking trust to services that a repository is offering is more meaningful than to a whole institution or unit within an organisation Services are much more meaningful in the context of federated repository consortia and in the Web 2.0 environment 16.06.2010 Raivo Ruusalepp, Tallinn University

Raivo Ruusalepp 16.06.2010 Concluding questions Who will drive the automation of audits – the community or the technology developers? How much disclosure is good for a repository? With very little transparency from audits we may become over-confident (the excess of trust) which will lead to additional risks With too much transparency may lead to insufficient confidence (excess of diffidence) and we may miss good opportunities/services 16.06.2010

Raivo Ruusalepp 16.06.2010 URLs Trustworthy Repositories Audit & Certification (TRAC) Criteria and Checklist http://www.crl.edu/PDF/trac.pdf nestor Catalogue of Criteria for Trusted Digital Repositories http://nbn-resolving.de/urn:nbn:de:0008-2008021802 DCC/DPE Digital Repository Audit Method Based on Risk Assessment (DRAMBORA)‏ http://www.repositoryaudit.eu/download MOIMS-Repository Audit and Certification BoF group http://wiki.digitalrepositoryauditandcertification.org/ Data Seal of Approval http://www.datasealofapproval.org/ Ten basic characteristics of digital preservation repositories http://www.crl.edu/content.asp?l1=13&l2=58&l3=162&l4=92 16.06.2010 Raivo Ruusalepp, Tallinn University

Contacts raivo@eba.ee 16.06.2010