What has become known as “STM Week” represents a series of meetings in London which expanded this year to include London Information International as a competing/complementary event in another part of the city (known to some as “western Norway,” depending on how that train ride to the eXcel Center felt to you).

STM Innovations has become one of the industry’s better meetings. This year’s event was focused on the relatively worrisome and grim subject of cybersecurity, focusing on the publisher’s role in it. The theme jibed with discussions earlier in the week at the STM FutureLab meeting, a collective discussion I’ve been attending for about a decade now, and one that never disappoints. Other meetings throughout the week sought to move these deliberations along the road toward a solution set.

Out of these meetings, networking discussions, and chats while walking, here are a few stray thoughts to give you a flavor of some take-aways I gleaned from all the meetings and interactions above. Because it’s such an active week, another attendee’s results may vary.

Security is a publisher’s business — Despite Sci-Hub being fresh in everyone’s mind, there were times when the incessant talk of blockchain, WAYF, and SAML provoked skeptical minds to ask, “Do publishers really need to be carrying water in the security game? After all, it’s only content licenses at risk for us?” Well, yes and no. This is where “publishers are an extension of academia” comes into play, and Sci-Hub is a perfect example of this. While IP authentication/authorization itself was not compromised by Sci-Hub, the lax approach to usernames and passwords we share with our customers is largely to blame for the incursions by Sci-Hub. In one talk, a cybersecurity expert talked about “hacktivists” and “criminals” as distinct, failing to note that the latter can leverage the former. This is the concern with the Sci-Hub attacks — that a hacktivist going after free content was a pawn for cybercriminals, who may use the credentials gleaned from publisher logins to exploit SSO implementations at universities. We guard a door into academia, and we need to protect it better. Cybercriminals, hackers, and nation-state players are busy probing the web for vulnerabilities. Security is no longer optional. Incursions are not limited to content licenses, but include submission systems, e-commerce systems, and internal systems. We have to get real about this. Our approach is 20 years old, and it’s showing its age. Armor up!

Are we content or data companies? — One of the most interesting conversations I had during the week was with someone whose company is working with some of the larger subscription and e-commerce businesses in the world, many of whom are creating original content now in order to drive customer engagement. They are doing this not because they are content companies, but because they are data companies. It’s like the old saw about newspapers, which were, in their heyday, advertising sheets with news in the spaces between the ads. Now, it’s data companies with content in between the data capture. Think Netflix or Amazon or Hulu, who create content to get data they can then use to leverage their businesses in new and exciting ways. How important is data to these companies? About a year ago, Google, Facebook, Apple, and Amazon made their algorithms open source, in order to let the community improve them more rapidly. It’s the open source version of the Netflix Prize. But if algorithms are the differentiators, why level the playing field in this way? Because the algorithms are useless without data, and these player have vast amounts of data.

The book Joe Esposito reviewed last week starts with the story of how Netflix was able to use data to confidently purchase two seasons of House of Cards for $100 million, without requiring even a pilot episode to be made. How? Because they had data showing their subscribers had viewed the British predecessor, liked movies featuring Kevin Spacey, liked movies directed by David Fincher, and liked political dramas. The stars were aligned for success, but only Netflix had the right datascope to see it. The networks were comparatively blind.

The challenge for us may be to rethink ourselves in the data paradigm — are we truly the “content is king” people, or should we shift to “data is destiny” and begin to think differently about our businesses, our content, our promotional approaches, and our editorial processes? The thrall of content is strong. We have editors, not data scientists, at the nominal head of our content businesses. Even OA publishers, who seem poised perfectly to become strong data businesses with content as a lure, only seem to think of themselves as content providers. Perhaps the concerns over governmental (or non-governmental) snooping into the reading habits of individuals keeps us from thinking this way, but there are ways to thrive in a data business while safeguarding privacy. This may be a good topic when you sit down for your next strategic planning session.

Does OA need to be disrupted? — This thought arose after multiple discussions, listening to a few talks, and watching the world at large. It’s been 18 years since E-Biomed was brought forth as a cure-all for the woes of information inequality. Over that span of time, information inequality seems to have grown. Rather than more scientific literacy, we seem to have less. Rather than a more enlightened populace, we seem less able to agree on how the world works. At the same time, the flaw in the business model of Gold OA — an over-reliance on producers who are unwilling to bear the full costs — has become clearer. So, the major premises — more enlightened populace, better scientific literacy, a superior business model — all seem to be failing. Perhaps this is just the darkness before the dawn, but if so, the question remains: After nearly 20 years now, does OA itself need to be disrupted?

This is not a long think piece, and I’m going to stop there. Just some items to chew on today for you and your colleagues. Enjoy!