17

The other day I was reading a paper on IEEE. To access the paper I needed to sign in through my institution. On the bottom of the paper, it read:

Accessed through [my institution name] at Oct 24, 9:30 PM

Will my institution be able to see all the papers I'm reading?

6
  • 4
    Your institution can see all the papers you are reading. They can also see all the papers you are not reading, as long as they are open access or in journals they subscribe to. I think your question is a different one... :)
    – gerrit
    Commented Oct 26, 2022 at 8:13
  • 15
    I'm not quite sure just why you are concerned that somebody is looking at the technical papers you read. Are some NSFW somehow? In general, librarians are very concerned about privacy of their patrons, and would fight tooth and nail should they ever find out their institution is tracking individuals reading habits. They do need high level summary statistics for business purposes.
    – Jon Custer
    Commented Oct 26, 2022 at 13:39
  • 2
    haha no its nothing different. i just was reading a paper about crimes and i don't want my college to think I'm trying to become a criminal Commented Oct 26, 2022 at 19:25
  • 4
    @JonCuster I disagree with the thrust of your comment, which seems to be "privacy is very important, but why do you want privacy anyway?"
    – usul
    Commented Oct 26, 2022 at 19:59
  • 2
    @usul - I disagree that was the thrust of my comment. The major point is that the librarians are very protective of privacy. As for the other bit, I've never worried about my various institutions eavesdropping on my technical reading...
    – Jon Custer
    Commented Oct 26, 2022 at 20:01

4 Answers 4

34

Your library will get aggregate data from the publishers along the lines of "in this month, 473 user sessions read 621 papers on the service". (The standard for this is COUNTER, and I assume IEEE use it). They won't be told "at 5.11 am on Sunday 20th, Steve downloaded..."

However, that data does exist, somewhere. If you are going through your university network there are situations in which it could in theory be identified from their logs, in much the same way that they could tell you then read a news story and finished for the day. The same is true for your home internet connection, but the widespread use of secure HTTPS connections make this level of detailed visibility less common than it used to be.

If you are signing in through Shibboleth authentication or similar, the university will know that you were authenticated for that provider at a particular time, but may not exactly know what items you read. (I would have to dig into the mechanism to be confident either way here). The publisher will also have a log of what you read, and that you were an authenticated user from X, but probably not precisely who you are.

It is vanishingly unlikely (and probably, in many jurisdictions, illegal) for this information to be used other than for things like troubleshooting and tracing abuse, however. So no-one is going to get sent a file of 'here's everything the department read this week, we highlighted Steve'.

But if there are problems, someone might well get an email that says 'user STEVE logged in from a weird looking Moldovan IP and downloaded 5000 papers in ten minutes last night, so the system then shut the account out, you should probably look into this before we reenable it'.

8
  • 4
    If you are going through your university network it could in theory be identified from the logs -- actually no, because almost every website uses SSL today. So the IEEE's server knows which article I downloaded, and they can tell anyone they want, but everyone else that just observes your internet connection can only tell that you downloaded something from the IEEE's server. Commented Oct 26, 2022 at 12:26
  • 9
    Just to be clear, the bottom line is that if I want to read a paper about how to dissolve human bones into acid, I should not do it through my institution, correct? Asking for a friend.
    – Stef
    Commented Oct 26, 2022 at 13:21
  • 2
    @Stef No, because your institution would not know which paper you read. And the publisher does not know that you are not a forensic to check out which chemicals would help dissolving human bones.
    – usr1234567
    Commented Oct 26, 2022 at 15:14
  • 3
    @FedericoPoloni If the network requires you to install their certificate (as Eduroam does here for example) they have more options, though a well-set-up server should still cause the client to give an error if the network tries to MITM your connection
    – Chris H
    Commented Oct 26, 2022 at 15:56
  • 2
    @ChrisH Are you sure your Eduroam installs a SSL MITM certificate and not just one to authenticate the Radius auth server? This seems much more common to me. Do you insert the certificate in your browser or in the Wifi configuration window? Commented Oct 26, 2022 at 16:32
6

Since you are using your institution's network, yes, they could see all of your internet activity, including your accesses to the digital library of IEEE. But it is rather unlikely they would bother.

If your university wanted, they can use a man-in-the-middle attacks when establishing an SSL connection by using their own certificates. Some corporations with high security needs do this. They would need to get you to install a root certificate for this. Otherwise, they can tell the sites to which you go.

If you access the library via a token provided by the university via the log in through your institution, they can keep track of the token and its destination.

However, at least in the US, librarians will fight tooth and nails to dissuade the institution from getting this information while accessing library functions.

6
  • not my institutions network. im doing it from my home. but I'm using my institution login (ex: [email protected]) to read IEEE papers since it often asks you to "sign in through institution" Commented Oct 26, 2022 at 5:20
  • 6
    In this age I would assume the website uses SSL, so the network provider can see OP is accessing IEEE's library, but not which page or article they are downloading. Commented Oct 26, 2022 at 7:50
  • 3
    @DavidESpeyer With SSL the full destination URL is not leaked, only the server name. Commented Oct 26, 2022 at 16:30
  • 1
    Downvoting as this is probably not accurate Commented Oct 27, 2022 at 12:28
  • 3
    "But it is rather unlikely they would bother" that could vary a lot depending on country.
    – uhoh
    Commented Oct 27, 2022 at 23:17
4

The counting statistics not only applies to publications (as in primary literature), but equally to databases your school then may highlight e.g., as top in a given specialty (example University of Vienna), most useful (example University of Geneva), or recommended (example Polytechnique Montréal). And if the electronic catalogue does not display these on the library's web site, beside the subscription fee, the number of accesses per license period and database still are arguments to (dis)continue the provision of access to all on campus' network, or only to the few interested groups of a department (perhaps especially if groups/schools do not team up).

2
  • Good to see a Matter Modeler here!
    – Nik
    Commented Oct 28, 2022 at 14:56
  • 1
    @user1271772 Oh ... Since the first time I recall one of your faculty delivered an inspiring lecture at our school with food for thought well beyond the talk he was invited to deliver (either Donald Knuth, or Robert Grubbs), the classy, iconic torch on their back pack is among my first associations with «Caltech» leading to a friendly tip to hat to appreciate your work, and curiosity about «what are your news». You can't «unsee it» once your eye spots them e.g., in the airport.
    – Buttonwood
    Commented Oct 31, 2022 at 14:34
-3

Yes they can.

Your institutional library uses data on what papers you're reading to decide which journals to subscribe to.

2
  • 6
    This answer would benefit from some more explanation. Who gives the library these data? IEEE? With how much detail? Are they given in anonymized/aggregated form, or can OP be identified? Commented Oct 26, 2022 at 7:51
  • 1
    I recommend that you delete this and make it a comment. It's been flagged for "length and quality" and in this case probably more for "length".
    – Nik
    Commented Oct 28, 2022 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .