Dear List,

I think that part of the confusion emerging in this thread in relation to
the practice of "metadata scrubbing" is based on the assumption that all
metadata are "created equal" in terms of maintaining or preserving the
authenticity of a record and that, therefore, the deletion of any metadata
will inherently impact the authenticity of the record. To demonstrate why
this, in fact, is not the case requires a bit of background discussion about
authenticity of a record and the metadata that relate to that particular
characteristic of a record.

Authenticity comprises two elements: identity and integrity (one often sees
integrity discussed as distinct from authenticity, which is unfortunate). 

Identity refers to the attributes of a record that uniquely characterize it
and distinguish it from all other records. In general, these include: the
names of the persons concurring in its creation (i.e., author, addressee,
writer and, if applicable, originator and/or recipient); its date(s) of
creation and transmission; an indication of the matter or action in which it
participates; the expression of its relationships with other records; and an
indication of any attachment(s).

The integrity of a record refers to its wholeness and soundness: a record
has integrity when it is complete and uncorrupted in all its essential
respects. That is to say that a record has integrity if the message that it
is meant to communicate to achieve its purpose is unaltered. In practical
terms, this means that a digital record's physical integrity, such as the
proper number of bit strings, may be compromised, provided that the
articulation of the content and its required elements of form remain the
same. In other words, certain changes to the form and/or content of a record
(including the deletion of certain metadata) are permissible to the extent
that those changes to not compromise the requirements set by the creator
and/or by the juridical system (requirements that will, of course, vary from
one creator to another, and from one juridical system to another) for the
record to reach the consequences or produce the effects for which it was
intended.

The presumption of a record's authenticity is strengthened by knowledge of
certain basic facts about it, some of which are embodied in the record's
attributes. In many cases, these attributes are expressed as metadata. 
	
The attributes that establish the identity of a record (e.g., name of the
author) may be explicitly expressed in an element of the record (e.g., a
signature), in metadata related to the record, or they may be implicit in
its various contexts (i.e., documentary, technological,
juridical-administrative, provenancial and procedural). Metadata that speak
to the identity of a record are referred to as identity metadata. The
InterPARES 2 Project identified the following attributes as important for
conveying the identity of a record (these typically are expressed as
identity metadata attached to the record or linked to the record--e.g., in a
record profile): 

a. Names of the persons involved in the creation of the digital record
(i.e., author, writer, addressee, originator, recipient). 
b. Name of the action or matter (in other words, the title or subject).
c. Documentary form (e.g., report, letter, contract, etc.).
d. Digital presentation (e.g., file format, wrapper, encoding, etc.).
e. Date(s) of creation and transmission (i.e., chronological date, date(s)
of transmission and/or receipt, archival or filing date). 
f. Expression of documentary context (e.g., a classification code). 
g. Indication of attachments, if applicable. 
h. Indication of copyright or other intellectual rights, if applicable. 
i. Indication of the presence or removal of a digital signature, if
applicable. 
j. Indication of other forms of authentication, if applicable. 
k. Indication of the draft or version number, if applicable. 
l. Existence and location of duplicate materials outside the digital system,
if applicable (i.e., an indication of which copy of a record is the official
or authoritative copy, in cases where multiple copies exist)

Likewise, the integrity of a record may be demonstrated by evidence found on
the face of the record, in metadata related to the record, or in one or more
of its various contexts. Metadata that speak to the integrity of a record
are referred to as integrity metadata. The InterPARES 2 Project identified
the following attributes as important for conveying the integrity of a
record (again, these typically are expressed as integrity metadata attached
to the record or linked to the record): 

a. Name of handling person/office (i.e., person or office using the record
to carry out business). 
b. Name of person or office with primary responsibility for keeping the
record (may be the same as the handling person/office). 
c. Indication of annotations added to the record, if applicable. 
d. Indication of any technical change(s) to the record or to the
application(s) responsible for managing and providing access to the record
(e.g., change of encoding, wrapper or file format). 
e. Access restriction code (i.e., indication of the person, position or
office authorized to read the materials), if applicable. 
f. Access privileges code (i.e., indication of the person, position or
office authorized to annotate the materials, delete them, or remove them
from the system), if applicable.
g. Vital record code (i.e., indication of the degree of importance of the
record to continue the activity for which it was created or the business of
the person/office that created it), if applicable.
h. Planned disposition.

[For further elaboration about these two types of metadata, see
recommendations 3 and 4 in the InterPARES 2 Project's Creator Guidelines,
which are available in report form in Appendix 20 of the InterPARES 2 book
at http://www.interpares.org/ip2/book.cfm, and in a colour booklet form at
http://www.interpares.org/ip2/display_file.cfm?doc=ip2(pub)creator_guideline
s_booklet.pdf.]

In the digital environment, the use of metadata to identify or document the
necessary identity and integrity attributes of a record are far more
critical for establishing a presumption of authenticity than is the case in
the paper environment. As outlined in the InterPARES 1 Project's Benchmark
Requirements (http://www.interpares.org/book/interpares_book_k_app02.pdf),
to maintain the authenticity of a digital record, it is imperative that the
relevant identity and integrity attributes be expressed explicitly and
linked inextricably to the record during its life, and carried forward with
it over time and space. In other words, to be able to provide a strong
foundation on which to establish a record's identity and demonstrate its
integrity (i.e., to verify and declare its authenticity), it is imperative
that the record's identity and integrity metadata are persistently attached
or linked inextricably to the record.

Thus, returning to the issue of "metadata scrubbing," it is clear that the
removal of any of a record's relevant identity and integrity metadata
through "metadata scrubbing" or any other similar activity will adversely
impact one's ability to verify and declare the authenticity of the record.
Accordingly, if it is important for the records creator to be able to
maintain the authenticity of its records, then this issue should be taken
into consideration before proceeding with any such scrubbing.

Now, another aspect to this discussion that appears to be causing some
confusion turns on whether we are talking about "scrubbing" metadata from a
record (A) that will continue to be used for the purpose for which it was
originally created, or whether we are talking about scrubbing metadata from
a copy of a record (A2) that will be "repurposed" for a new use. If the
latter, then we are in fact talking about, at least potentially, the
creation of a new record (B). In which case, in relation to the issue of
authenticity, there is no concern about "scrubbing" the identity and
integrity metadata from the document (derived from record copy A2) that is
then used to create record B--at least not in relation to concerns about
adversely impacting the authenticity of record A. (This assumes, of course,
that record A remains unchanged in its original context, if it is still
needed by its creator).

The example that Dana mentioned, where the company used metadata scrubbing
to "strip away any reference to the former client from underlying metadata
before sending along [an existing document] to the new client" so as "to be
able to re-use documents from one case to another," appears to be an example
of this latter situation where a copy of an existing record is repurposed in
a different context (and hence, becomes a different record than the one from
which it was derived, and to which integrity and identity metadata specific
to that new record should be generated and attached).

If, on the other hand, we are talking about scrubbing metadata from a record
that will continue to be used for the purpose for which it was originally
created, then it is important to understand the distinction between the
different types of record metadata and ensure that those identity and
integrity metadata that are necessary to maintain the authenticity of the
record are not scrubbed.

Regards,
Randy

--
Randy Preston
Project Coordinator, InterPARES Project
The University of British Columbia
Suite 470, 1961 East Mall
Vancouver, British Columbia  V6T 1Z1  Canada
tel: +1(604)822-2694  fax: +1(604)822-6006
[log in to unmask]
www.interpares.org


List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]