AVH User Registration

This document outlines HISCOM's recommendations for developing the AVH user registration policy and procedures.

Introduction
Access to the AVH3.0 applications and databases will be provided via a freely accessible public interface, plus a restricted access for registered users. Registered users will be known to the system and have access to increased functionality, and increased scope and precision of data.

Registered users must agree to terms and conditions of use at the time of registration. Public access users will need to agree to the terms and conditions prior to downloading any data. The terms and conditions of public access use will be the same as those for registered users, excluding any terms and conditions relating to registration (e.g. dissemination of username and password).

Purpose of registration
This purpose of user registration is to:


 * Inform CHAH and the system about key users of the AVH
 * To restrict access to sensitive data (endangered species locations, works in progress, etc.) to authenticated and bona fide users
 * Maintain awareness and document overall use of the AVH data and applications
 * Gather usage data to guide future developments
 * Gather usage data to prove the usefulness and relevance of the AVH

Issues
Issues to be addressed in user registation include:


 * The application/registration process
 * The documentation process/application
 * The approval process
 * Access levels
 * User roles
 * User rights
 * Data coverage
 * Data precision
 * Restricting access to sensitive data

Initial recommendations
AGREED - Brett AGREED - Brett AGREED - Brett
 * Restricted access to AVH is available to all Federal, State and Territory government employees. Registration would be based upon IP address and/or domain name.
 * Restricted access to AVH is available to all university researchers. As above, registration would be based on IP address and/or domain name.
 * Use of the AVH extended query will be logged. The log will record the following data:
 * username
 * user category (or parent institution)
 * IP address
 * date and time of query
 * query performed
 * number of records downloaded
 * Usernames and passwords are selected by the registering user, not by the administrator

Registration procedure
The admin account includes privileges to add another provider, set download limits and give other users the ability to verify access for new users. There is currently only one admin account, but more than one person can use that account. After a user has applied, the registration request is sent to the Chair of CHAH for approval. Once a user has been approved (or otherwise), an email is automatically sent to the user to advise them.

Terms and conditions of use
The terms and conditions of use should include (not an exhaustive list):
 * restrictions on the dissemination of AVH data to third parties AGREED - Brett
 * restriction that the data is only used for non-commercial, research purposes AGREED - Brett
 * a requirement that appropriate recognition of CHAH and AVH be provided in any outputs (e.g. publications, websites etc.) that are generated from the use of AVH data - Brett
 * instructions for how AVH data should be cited AGREED - Brett
 * a requirement for users to provide feedback on errors and discrepancies in the data AGREED - Brett
 * statement that there is no guarantee of the fitness of AVH data for any particular purpose AGREED - Brett
 * statement that the use of the data should be consistent with efforts to preserve biological diversity (or similar) AGREED - Brett
 * usernames and passwords must not be passed on to any other individual AGREED - Brett
 * CHAH has the right to revoke registration if terms and conditions of use are not complied with AGREED - Brett

Example registration forms
Examples of registration forms for similar sites, which illustrate the types of fields that have been found to be useful:


 * FloraBase - the Western Australian Flora - access to specimen records
 * NatureMap - Mapping Western Australia's biodiversity - advanced mapping of specimens

Registration form fields
Suggested registration forms fields:
 * First name
 * Last name
 * Organisation
 * Position
 * Employment or status category (see FloraBase site for examples)
 * Address
 * Country
 * State/Territory (if within Australia)
 * Contact phone no.
 * Email address
 * Confirm email address
 * Project/research details
 * Project supervisor (if applicable)
 * Reason extended query access is required
 * Data requested
 * Username
 * Password
 * Confirm password
 * Tick box for user to record their acceptance of the tems and conditions of use

Technical issues

 * Synchronisation of registration between different access sites needs to be resolved

Discussion
Logging site use

The log will generate a huge amount of data. While this data will be invaluable for quantifying the use of the AVH extended query, thought needs to be given to how this data will be used, and who will be responsible for managing that data. It would also be valuable for CHAH and HISCOM to be able to track the purposes for which AVH data are being used. One method of doing this would be to request that users declare the purpose of their data usage (possibly from a list) each time they log in. This could apply to public access users as well as registered users.

A simple drop down list might be good, otherwise it may be too difficult to handle - Brett

Expiration of registration

The proposed model of allowing access to all government employees and all university researchers brings with it the risk that people will continue to access the AVH extended query once they are no longer associated with those institutions (although the model of access based on IP address or domain name may avoid this problem). One remedy to this would be for user registration or passwords to expire after a designated period of time. Although this could add security to the AVH extended query access, it would require a lot of work and would be very tedious to manage.

Could this be done in some automated way - it would be useful to have but unless it can be done automatically the maintenance would be difficult - Brett

Corporate registration

Should all government employees be given access, or just those with a mandate in areas of environment and sustainability? Should all university researchers be given access, or just academic staff?

Should one account be provided to an institution as a whole, or should staff or researchers within that institution be provided with individual accounts? Staff or researchers within a single organisation will use the AVH for different purposes. Blanket corporate registration will only allow us to identify the users at the broadest level, so we will lose the finer detail that could reveal valuable information about how AVH data is being used. It would be preferable for individuals within government departments or universities to register individually, so we can capture information about data usage.

Suggest individual accounts may be better and provides better stats for CHAH and AVH etc - Brett

Access to sensitive data

There has been some discussion about how and when to restrict access to sensitive data, in particular, records of rare or threatened taxa. Past HISCOM discussion has concluded that, due to the differing conservation status of (and, in some cases, the application of different names to) rare and threatened taxa between states, this issue cannot be satisfactorily resolved until the completion of the APC. Theoretically, it should be reasonably easy for state and territory herbaria to flag their own records of rare or threatened taxa, but it becomes problematic when, for example, BRI wishes PERTH to flag PERTH records of threatened Queensland taxa as sensitive.

Other examples of potentially sensitive data include personal names and addresses, where these appear in locality data, and collectors' names, especially if associated with unauthorised collecting activity.

No easy answer to this one - Brett