Barricading an open access website – reflections on the attack on DOAB

As many of you might have noticed, last week the Directory of Open Access Books (DOAB) website was unavailable for several days. Sadly, the reason for this was not a technical glitch as we first suspected, but an actual attack on DOAB.

During the weekend of 21 January, someone decided to flood the Domain Name Server (DNS) of our registrar with requests for the DOAB record – a DDoS attack.

A short explanation: when you type in www.doabooks.org, your browser looks up this address in a Domain Name Server, which translates it to an IP address (that looks like, e.g., 123.123.123.123). However, when an attacker overloads the DNS with these lookups, this does not work any more. The result is that the website is working fine, but it can’t be reached.

Sadly, we were not immediately able to understand what was happening, as we did not have any previous experience with this kind of situation. Once the reason was clear, we could take measures. We moved our domain name registration to Cloudflare, a company that specialises in the protection against these kind of attacks. At the same time, we have done this for the OAPEN and the OA Books Toolkit websites as well.

Thank you for your patience with us as we navigated these new circumstances and please accept our apologies for the inconvenience caused. We hope that our explanation was clear, but of course, please contact us if you have any questions or remarks.

OAPEN & DOAB POSI self-audit

It is with great pleasure and sense of achievement that we share with you today our POSI self-audit for OAPEN & DOAB (download OAPEN & DOAB POSI self-audit PDF).

As you may know, OAPEN and DOAB are separate but interconnected infrastructures for open access books, governed by the OAPEN Foundation and DOAB Foundation respectively. In practice, our small team of nine people works with both systems on a daily basis. But since the two organisations have different governance, we’ve carried out a self-audit for each. We hope you agree that seeing the two self-audits side-by-side helps to compare and contrast the ways they operate.

Update: learn more about OAPEN’s governance structure and why we can’t be sold or acquired.

Our POSI self-audit process

Like the world of research in which our work is immersed, we started this project by reading everything we could about POSI and the self-audits already undertaken by other organisations (the POSI Posse).

We did the first draft which was then shared internally for comments and discussion with colleagues, and then we took the document to our official governing bodies (OAPEN Board of Directors and DOAB Supervisory Board) for their views and feedback.

What did we learn?

POSI obliged us to take a good look at our practices, and address areas where we had fallen short. In some cases, we had good intentions, but as these weren’t documented anywhere, we couldn’t cite them. In others, we needed to tidy up our procedures. Some of these changes could be made immediately, while others will take a while longer. We documented these aspects in the “Next steps” column of our self-audit.

Some of the matters which gave us pause included:

Governance > Non-discriminatory membership

Is OAPEN a membership organisation? This became the subject of some debate, as we speak of publishers “joining” OAPEN. However, a publisher entering into a service agreement with OAPEN does not “buy” them a special voice or role in our governance. Our terminology for libraries is clearer, as we call them “supporters”. This has sparked efforts to improve our language to make it clear that there is no relationship between payments of any sort and governance roles.

Governance > Transparent operations

This part of the self-audit made us realise that we could improve by making more prominent on our website the OAPEN Bylaws and Articles of Association, and DOAB Articles of Association and Terms of Reference for the DOAB Scientific Committee. It was nice to be able to have this as a quick win!

Governance > Cannot lobby

At the heart of the matter is the difference between lobbying and advocacy, and whether an infrastructure should engage in such matters. We believe that any mission-driven organisation is going to have reasons to promote particular issues or approaches. For example, part of the mission of both OAPEN and DOAB is to promote open access to books. Could the Oxford English Dictionary help us?

  • Lobby, v. To influence (members of a house of legislature) in the exercise of their legislative functions by frequenting the lobby. Also, to procure the passing of (a measure) through Congress by means of such influence.
  • Advocate, v. To act as an advocate for; to support, recommend, or speak in favour of (a person or thing).

We debated the reasoning behind this element of POSI, and we also asked one of the three POSI authors, Cameron Neylon, about it. He replied: 

“The point is not to advocate or seek regulatory enclosure. For instance, advocating that OAPEN membership be required for a funder to provide BPC funding would fall within the intended scope here. Generally we felt that communities should advocate, infrastructures should support implementation. Obviously missions do involve goals and speaking to them but the argument was that lobbying in the sense of seeking regulations that benefit the infrastructure would be a red flag.”

Cameron Neylon, via email

Having also discussed this with members of the POSI Posse, we learned many of them have interpreted this Principle in the political and financial sense; that infrastructure organisations should not seek to influence legislation or regulation.

It is perhaps useful to remember that we advocate in support of our mission, a mission that is shared by many in the scholarly communications community. This is therefore a goal which is of benefit to the community in general, as compared with lobbying in the narrow interest of shareholders. This ties in well with the Principle of “formal incentives to fulfil mission & wind down” – if we no longer have the support of the community, we will take steps for an orderly wind-down, rather than continuing to exist for our own sake as a company might do.

Governance > Living will

We suddenly became aware of what it really means to have a handover plan. In our publisher agreement, it is noted that if the OAPEN Library ceases to exist, the rights granted to the OAPEN Foundation under this agreement may be transferred to the KoninklijkeBibliotheek Nederland [KB, National Library of the Netherlands, where the OAPEN office is based] exclusively for purposes of depositing the Publications in the KoninklijkeBibliotheek. Although there has long been this arrangement, we’ve never actually developed a documented process that would help the KB to put this into practice. This has spurred us to investigate how to develop such a plan.

Sustainability > Goal to generate surplus

As a not-for-profit organisation, we still have a goal to generate financial surplus. However, the surplus never leaves the organisation, it is always re-invested. The surplus is used for different things, such as building our contingency fund, new technical developments, and upgrading our existing technical infrastructures; as well as employing new colleagues to support our expanding operations and increased engagement with the community. OAPEN and DOAB have been considerably under-staffed for years, and it has long been an explicit goal to create surplus to enable us to hire more people, thus ensuring a resilient and dynamic organisation.

Sustainability > Goal to create a contingency fund to support operations for 12 months

OAPEN follows this principle by setting aside surplus revenue each year to build its contingency fund. The exact size of the contingency fund should be established by the OAPEN Board on a yearly basis. The contingency fund should cover at least 12 months of operational costs for OAPEN. At the time of doing the self-audit, OAPEN is still building its contingency fund.

Insurance > Open data

But of course our websites are openly licenced! Oh, wait… we need to state this clearly. We took action and updated both the OAPEN website and DOAB website, and OAPEN Library and DOAB Directory with CC BY 4.0 licence details. Et n’oublions pas que le site de DOAB est également disponible en français, donc il faudrait aussi le mettre à jour.

How we will follow up

Our aim for the POSI self-audit is that it will be a living document that will accompany our existing strategic plans and updates for both organisations. We plan to review our self-audit every few years to ensure it stays accurate. Meanwhile, it performs the essential everyday task of providing you, the scholarly community, with our public commitment to POSI and allowing you to question, challenge, or even encourage us on any of its aspects. We look forward to hearing from you at info@oapen.org!

Niels Stern & Laura J. Wilkinson

Laura J. Wilkinson

ORCID iD: https://orcid.org/0000-0002-8922-7839

More Posts

Search OpenEdition Search

You will be redirected to OpenEdition Search