6

This is fresh off the press:*

How to hijack a journal. J. Bohannon. Science 350 no. 6263, p. 903. 20 November 2015.

I just saw it and I find it intensely worrying. In short, it appears that scam attacks on legitimate journals are now going beyond fake websites of the form 'sciencernag.com', to actually taking control of the internet domain name of journals.

The symptoms of such an attack might look something like this: you want to submit a publication to this hot new open access Journal of Scientific Results your collaborator just told you about. You look for the journal name on Google and you click on the top result. It looks essentially fine: correct website feel, new papers on the front page, etc. Out of curiosity, you might wander over to Thomson Reuters to see what they say about JSR, and maybe even notice that the website listed is the one you just went to. So you go over and you submit your paper, and when they ask you for article processing charges you might go ahead and pay them.

However, the journal website is in fact in control of a group of scammers, through a combination of means apparently to do mostly with the jittery ways in which the administration of web domains takes place. (The true JSR might be at a new website, trying to draw traffic there but powerless to stop the new owners of the domain.)

This sort of attack seems pretty much impossible to avoid as a reader or author caught unawares. (This is unlike, say, falling in the hands of a predatory journal, where much can be done by consulting Jeffrey Beall's list of potential predatory journals and publishers.) Bohannon's piece suggests that to verify the authenticity of a journal website against such an attack, a cautious visitor might try the following.

Dadkhah suggested two ways to spot a hijacking. First, check the domain registration data online by performing a WHOIS query. (It's not an acronym, but rather a computer protocol to look up “who is” behind a particular domain.) If the registration date is recent but the journal has been around for years, that's the first clue. Also suspicious is if the domain's country of registration is different from the journal's publisher, or if the publisher's name and contact information are kept anonymous by private domain registrars.

This seems incredibly onerous to me. It might be justified if one is about to fork over manuscripts or money to a smaller journal, but it's definitely much more sleuthing than I'd find reasonable for just casual browsing. However, it's not clear to me that there are any surefire alternatives to this (and even then, WHOIS queries can only run up suspicions, but they might miss e.g. what happened to Acta Physico-Chimica Sinica). Bohannon has provided a list of hijacked journal websites as supplemental data to the piece, but this is not necessarily complete and it would need someone curating it with a dedication to match Beall's to keep it updated.

I'm asking this mostly to raise awareness, but I do have a genuine question. Are there methods and institutions within academia that could be used to prevent or hinder these sorts of attacks? This sort of thing is probably not new in business, where it is very often sink or swim for companies (so there is more awareness that you need to protect your brand against things like this) but there is also more scope for companies to reinvent themselves (whereas it is very hard for an academic journal to change its name or website and expect their entire community to be aware of the change, unless it makes a big splash like the recent shift in Lingua did).

So academia has its own particular weaknesses to this sort of thing, but we also have a bigger set of structures and institutions that can work to prevent things like attacks on reputation from working. (In fact, it is the fact that one of these mechanisms - the Thomson Reuters listings - has failed that makes this such a serious thing, even if the actual scope is probably still relatively small.) What broader tools could we as a community implement to try and hinder this sort of stuff, and how would those mechanisms look?

* So hot off the press, in fact, that it was published in the future as of this posting.

closed as off-topic by EnergyNumbers, Wrzlprmft, Enthusiastic Engineer, scaaahu, gman Nov 20 '15 at 12:28

  • This question does not appear to be about academia within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    It seems to me that this is a problem for any business/institution/organization with a website - if so, I'd wager the same techniques they use (good organization security, preventative measures, etc.) apply. – tonysdg Nov 19 '15 at 21:24
  • 2
    Have you seen the Target/Home Depot/OPM breach? It's a problem that affects organizations of all sizes - from your mom-and-pop DIY-website to major corporate entities to governments. I don't much like it either, but it's a heckuva lot harder to secure something than it is to break it - ask any 3-year-old who breaks a toy and then wants to put it back together :) I agree though - it's a scary world. – tonysdg Nov 19 '15 at 21:32
  • 3
    I might add - if your question is "how can the broader academic community protect the integrity of specific journals", that may be slightly more feasible/pointed. But protecting all journals, new and old, big and small? It's going to be thorny at best. Grouping them together under a larger org like the IEEE or ACM helps, but it's not a panacea. – tonysdg Nov 19 '15 at 21:35
  • 6
    I'm voting to close this question as off-topic because this is a boat-programming question about domain-name security and phishing. – EnergyNumbers Nov 20 '15 at 7:54
  • 1
    There is nothing special about a publisher's domain being hijacked compared to, say, any other online retailer. Indeed, it's probably far less lucrative to do, because only a very small proportion of visitors to the site are there to spend money, as opposed to reading articles (which is unlikely to work on a scam site, thus exposing it rapidly). I don't see that there's anything unique to academia about this, so it may be off-topic. – Flyto Nov 20 '15 at 8:02
0

What broader tools could we as a community implement to try and hinder this sort of stuff, and how would those mechanisms look?

In the long term, if we reduced and eventually eliminated our dependence on commercial publishers, and worked towards a future where all scientific research was free to everyone everywhere, then we would eliminate any possible financial incentive for scammers to hijack the process.

  • 5
    I'm not sure I agree. The incentive is there as long as any money changes hands (including advertising and APCs), and it doesn't go away even if the articles are free to read or even to reuse. I was looking for slightly more realistic, mid-term solutions, though. – E.P. Nov 19 '15 at 22:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.