Thursday, 19 December 2013

"They've given me a number..."

What’s wrong with the “International Standard Name Identifier” (ISNI)?

To: Olav Stokkmo
Chair of the Board, International Standard Name Identifier - International Agency (ISNI-IA)
CEO, International Federation of Reproduction Rights Organisations (IFRRO)

Dear Olav:

Thank you very much for your request last week for me to expand on my Tweet in response to yours about the International Standard Name Identifier (ISNI) scheme.

I’m sorry that, in order to be honest, these comments will have to be severely critical of the ISNI project in its current form. If these criticisms come as a surprise to you or to others involved in the ISNI project, that is symptomatic of the problems with ISNI that concern me as a writer. I do not doubt your good intentions or goodwill toward writers and other creators. But as an institution, ISNI shows, by its actions, a blinkered, publisher-centric perspective.

ISNI describes itself as the “global standard number for identifying the millions of contributors to creative work… It is part of a family of international standard identifiers that includes identifiers of works, recordings, products and right holders in all repertoires, e.g. … ISBN.”

But while an ISBN is applied for by, and issued to, the author or publisher of the book identified by that number, millions of ISNI numbers have apparently been “assigned” to writers by third parties, without our knowledge or consent or any participation by us at all.

The stated intention of ISNI is “to assign to the public name(s) of a researcher, inventor, writer, artist, performer, publisher, etc. a persistent unique identifying number in order to resolve the problem of name ambiguity in search and discovery; and diffuse each assigned ISNI across all repertoires in the global supply chain so that every published work can be unambiguously attributed to its creator wherever that work is described.”

But how can you imagine that this is possible without consulting writers and other creators?

As I wrote in my blog in 2012, in relation to what might constitute a “diligent search” for rightsholdings and rightsholders with respect to a written work:

One of the resources required to be consulted in each such search would be a unitary global “opt out” and contact information registry of authors and pseudonyms. The International Standard Name Identifier (ISNI) database being developed by IFRRO and others will not, as currently envisioned, be such a registry. It’s an identity management scheme and system of numeric identifiers, but one with no provision for authors to apply for or manage the identifiers assigned to us by third parties. Obviously, authors are those who know which pseudonyms we may have used, and which works we have written and which have been written by other people with the same name. But ISNI’s would be assigned exclusively by libraries, publishers, licensing agencies, and other intermediaries. There’s no requirement in the ISNI standard for the individual being “identified” to be consulted before an ISNI is assigned, or even notified after one is assigned. It’s a recipe for authorial identity theft and misidentification of authorship.

Most written work being published today is being published online, not on paper. Most of it is being self-published. Self-published online works should be considered the norm, not the exception, when systems for identifying and cataloging written work are developed.

For those who publish on the Web, including self-publishers, the de facto “clearinghouses” for the collection and distribution of publication revenues are online advertising and affiliate networks, services, and brokers — a pyramid with Google Adsense at its apex. This online advertising ecosystem and economy is a “parallel universe” for monetizing copyrighted works, without selling or “licensing” them, that is largely ignored by IFRRO and its members.

Most published writers have published their work only online, not on paper. Most published writers have never been published by a third-party publisher. Most published works are not listed in any catalog of “books in print”, library catalog, or bibliographic database. Most published writers do not belong to any organization of writers or any copyright-licensing organization.

I’m one of the exceptions. Most of my work, including both writing and photography, has of course been self-published online. But I have also written and done photography for single-author books published in hardcopy format by a mainstream publisher, and I have contributed to multi-author anthologies and print periodicals published by mainstream publishers and included in library collections and bibliographic databases.

But — crucially — no publisher or librarian has ever asked me what other pseudonyms I might have used, what works I might have published anonymously, which works by other people with the same name were written by me (there are several other published writers and artists named “Edward Hasbrouck”), or anything about any of the works that I have self-published.

Publishers and bibliographers have no right to know, no reason to expect to know, and in fact almost never know anything about these aspects of writers’ identities and works.

A database of purported “identities” of writers and purported “attributions” or associations between those identities and particular works or editions is inevitably [unless it is sourced from writers and other creators ourselves] a compilation of third-party guesses and speculation about us. There is no reason to expect it to be accurate, and there is no reason for anyone to rely on it or presume it to be accurate.

Unfortunately, ISNI has chosen to assign millions of identifiers on the basis of precisely this sort of unreliable third-party speculation, without verifying it with the writers who would know if it is correct. No amount of skill in compiling data from multiple unreliable sources can somehow render the result authoritative. “Garbage in, garbage out,” no matter what the sewage treatment process.

It should be no surprise, and should be the starting point for the construction of a master register of identities, that the only people who know which names or pseudonyms we have used, or which works we have created, are writers ourselves.

In this respect, the current ISNI database is in flagrant violation of European Union and probably other data protection laws. ISNI has somehow created a database of records about millions of individuals like me, without our knowledge or consent. The Web site contains no information identifying the data controller, the applicable jurisdiction, the data protection policies (if any), or procedures for obtaining an accounting of third parties to whom ISNI records have been disclosed or for requesting correction or deletion of ISNI data.

[There’s a link on the bottom of the home page for Privacy Policy, but as of now that link gives a “Page not found” error.]

The Contact page on the ISNI Web site provides points of contact for “Becoming a Registration Agency” and for “Media enquiries”. There is no contact information for the use of writers and creators to whom ISNI numbers have been assigned. There is no contact information for the data controller, for data protection policies or procedures or inquiries, or for requests for additions, corrections, or deletions of ISNI data.

When I search Do you have an ISNI?, I find that an ISNI number has been assigned to me. Not surprisingly, the data associated with it is incomplete and inaccurate, and mis-attributes the authorship of the one work of mine to which it is linked.

There’s a link on the page with the record about me, “If you have any supplemental information about the identity listed here, please click in this box to go to the contribution form.” The form does not say by whom the information submitted will be reviewed, according to what procedures, how long the review will take, or how to follow up on the submission. I completed this form and submitted additions, corrections, and deletions months ago, but my submission went into a black hole. The ISNI record assigned to me remains unchanged.

What if I were one of the majority of published writers whose work has all been self-published and doesn’t show up in any of the bibliographic databases that have been used to assign ISNI numbers? The Get an ISNI page on the Web site directs individuals to Bowker. The link on Bowker’s Web site for “Register Your ISNI Today!” is a “mailto” link to send a message to “”. There’s no indication of what information is required for an ISNI registration, what information can optionally be included in an ISNI record, how the process is supposed to work, how long it is supposed to take, or whether there is a fee. I wrote to that e-mail address months ago, asking how an individual can register or apply for assignment of an ISNI, but to date I’ve received no reply.

[There’s no mention at all of ISNI on Bowker’s Web site, which suggests how little thought has gone into the relationship between the ISNI process and self-published authors.]

Even if ISNI assignments were based on applications and claims by writers and other creators, there would be disputed identities, pseudonyms, anonymous works, and attributions. ISNI data can only be “unique” and “unambigous” if someone adjudicates these disputes. And the results of that dispute resolution process would only be entitled to reliance by third parties if the dispute resolution process is transparent, fair, conducted by independent adjudicators, and provides claimants with a clear path for appeal and eventual judicial review.

Whatever process ISNI is currently using to resolve differences between the guesses different bibliographers or publishers have made about writers’ identities, it does not appear to be open to writers ourselves, and satisfies none of the requirements of due process.

If you don’t want to build such an adjudication system, then you should simply report disputed or conflicting claims to identities or the attribution of works, rather than aspiring to “unique” or “unambiguous” results.

It’s also bizarre that there does not appear to be any means for creators to include our contact information, if we want to do so, in the ISNI records that have been assigned to us.

Here’s what needs to be done about ISNI, for starters:

  1. ISNI should immediately purge its database of any and all data that was entered without notice to, verification by, and the consent of the entities to which it purportedly pertains.

  2. ISNI should — as a foundational principle of the ISNI system, which should be explicitly incorporated in the standard itself and in ISNI’s charter, and made binding on all participants — explicitly prohibit the creation of any ISNI identifier or the entry of any data pertaining to an identifier or identity without notice and consent of the data subject.

  3. ISNI should immediately bring itself into compliance with the other requirements of applicable data protection and privacy laws, including public disclosure of the identity of the data controller and the jurisdiction applicable to the data, and a point of contact and procedures for requests for access, accounting of disclosures, correction, or deletion of personal information.

To be clear, I support the creation of a registry of creators’ identities, whatever contact information we wish to list, and any attributions of works we wish to claim.

But this needs to be done right, starting with reliance on information provided by the writers and other creators who actually know who we are, what names and pseudonyms we have used, and which works we have created.

The National Writers Union (NWU), for example, described such a (government-run) registry as follows in comments submitted earlier this year to the U.S. Copyright Office (and sent to IFRRO at that time):

[W]e recommend that any proposed “orphan works” legislation include…

A free, voluntary, registry of creator and rightsholder contact information should be established. This registry should be operated by the Copyright Office as a neutral body accountable to the due-process standards of the Administrative Procedure Act and less likely than a private registry to be captured by any particular sector of rightsholders, such as publishers and/or distributors, to the detriment of other sectors of rightsholders such as writers and other creators. Work attributed or believed to be attributable to any creator listed in this registry should not be subject to being deemed “orphaned.” Creators and other rightsholders should be able to, but should not be required to, link their listing(s) in this contact database with any or all of their copyright registrations. This registry should be fully operational for at least two years, to allow creators around the world to learn of its existence and importance and register their contact information before it is used as the basis for any determinations of “orphan” status.

The fundamental differences between this proposal and ISNI are:

  1. That the system be operated by a government body (which already operates and makes decisions under due process requirements subject to judicial review);
  2. That the system be built from the bottom up (“crowd-sourced”, if you will, and populated with data supplied and verified by individuals), rather than from the top down (by aggregating institutional “data dumps”); and
  3. Most importantly, that the source of the data be writers and creators ourselves, who know more about our identities and works than anyone else does.

Finally, I hope that you and IFRRO will learn from the mistakes that have been made with ISNI, and apply these lessons to the ARROW project in which IFRRO is also involved.

ARROW is based on a fundamentally similar implicit assumption to ISNI: that information about works and their creators can be determined from publication and bibliographic records, without the need to consult creators ourselves. But just as publishers and librarians do not know which works were actually written by the same person, so they do not know who currently holds which rights to those works. The fact of having published an edition of a work is not evidence of currently holding any rights to further reproduction of that work, much less evidence of which rights (if any) the publisher of that previous edition may now hold.

Although ARROW is, by its very name (“Accessible Registries of Rights Information and Orphan Works”), represented as being a registry of information about rights, many, perhaps most of the databases from which ARROW is compiled, such as library catalogs and other bibliographic records, contain no information at all about rights.

The only way anyone could possibly believe that these ARROW records actually pertain to “rights” is if they conflate “publisher” (or former publisher) with “rightsholder”, and erroneously assume that the erstwhile publisher of an edition of a work is the authoritative source of information as to the current holdership of rights to that work.

IFRRO should be working actively to disabuse ARROW participants of this fallacy.

I made this point to both IFRRO and ARROW staff at the workshop on ARROW at the 2011 IFRRO World Congress in Ljubljana, but I have heard nothing from them since then.

Many countries are contemplating reliance on ARROW as evidence of “due diligence” in searching for “rightsholders”. But many, perhaps most, of the publication and bibliographic sources relied on for compiling the aggregated ARROW database were not sourced from creators ourselves, and do not actually contain any information (or at least, not any reliable information) about rightsholders or rightsholdings. Reliance on ARROW searches is likely to result in systematic misidentification of putative rightsholders and rightsholdings, and systematic bias in favor of publishers over writers and other creators as claimants to rights.

These problems with ARROW, and the likely negative consequences for writers of misguided reliance on records of publication as a proxy for records of rightsholdings, were discussed in more detail in a paper I wrote for the 2012 Berkeley conference on orphan works, Facts and Fallacies of Orphan Works, and in the most recent reply comments of the NWU to the U.S. Copyright Office on Orphan Works and Mass Digitization.

I would welcome an opportunity to discuss these concerns further with you and other participants in ISNI, IFRRO, and ARROW, and to work with you to address them. Please feel free to share these comments with others inside or outside ISNI, IFRRO, and ARROW.

Again, I thank you for your interest in understanding why a writer like me opposes the current ISNI scheme that — as an inevitable and entirely forseable result of its basic design and modus operandi, and not merely as a result of minor mistakes in implementation — has compiled and is propagating misinformation about me and my work.


Edward Hasbrouck

Link | Posted by Edward on Thursday, 19 December 2013, 13:01 ( 1:01 PM)

"International Standard Name Identifier Gets the Hasbrouck Treatment":

Posted by: Michael Froomkin, 20 December 2013, 13:27 ( 1:27 PM)

"ISNI: An Authority for Authors?"

(by Michael Capobianco for Writer Beware)

...Edward Hasbrouck of the National Writers Union, who is an author advocate par excellence, has many problems with ISNI, which he has detailed in an open letter. He feels that ISNI has an obligation to involve authors proactively in the creation of their entries--but I won"t try to summarize. Read Edward"s post for yourself....

Posted by: Michael Capobianco, 10 February 2014, 22:30 (10:30 PM)

Thank you Edward Hasbrouck for bringing the issue to the attention of writers and other creators of copyrighted and published works. I found my name and my number listed on ISNI with only my 1977 Ph.D. dissertation from University of Connecticut. There is no mention of my copyrighted works done and self-published through POD providers from 1977 to 2014. I urge other writers to spread the word about Edward Hasbrouck article with the links to this post and to the Writer Beware! Newsletter.

Posted by: Olga Verro, 14 February 2014, 19:39 ( 7:39 PM)

I met personally with Mr. Stokkmo in Brussels while I was in Europe on other business in March 2014. He was generous with his time, and we discussed these issues at length. I'm waiting for ISNI's response and to see what action will be taken.

Posted by: Edward Hasbrouck, 7 April 2014, 07:32 ( 7:32 AM)

I received an e-mail message today (Wednesday, 9 April 2014) from someone on the "ISNI Quality Team" at the British Library, in response to the form I completed on the Web site on 6 August 2013, eight months ago.

There is a meeting today of the ISNI board of directtros, and I assume that the timing of this message, and the fact that I have finally received nay response, is a result of intercession at the level of ISNI's board of directors. That's obviously not a process that scales to millions of records.

Some of the additions, deletions, and corrections to the ISNI record about me have been made. Some have not been, without any explanation as to why.

Other new, incorrect information -- directly contrary to the information I provided to ISNI -- has been added to the ISNI record about me.

The link for "Privacy Policy" on still gives a "file not found" error.

I've sent a reply to request more information, including the data protection jurisdiction applicable to ISNU records about individuals, the name and contact information of the data controller, and ISNI's data protection and dispute resolution procedures.

Posted by: Edward Hasbrouck, 9 April 2014, 09:49 ( 9:49 AM)

One 10 April 2014, one day after the e-mail from ISNI described in my previous update, and one day after the latest meeting of ISNI's board of directors, a "Privacy Policy" was posted on It pertains solely to data submitted to ISNI in connection with the Web site. It does not pertain to the contents of ISNI records. It does not identify the owner of the data, the data controller, or the applicable data protection jurisdiction. It does not contain any information about access, correction, or deletion of data. It does not provide any contact information. It does not contain any of the information required by EU data protection law.

The link from the ISNI record about me, "If you have any supplemental information about the identity listed here, please click in this box to go to the contribution form," no longer works at all in any browser I have tried.

Posted by: Edward Hasbrouck, 10 April 2014, 07:20 ( 7:20 AM)

After some further experimentation,I've determined that if I click on "Do I have an ISNI?" on the home page, and search for my name, the update form is accessible from the search results page.

But if I start from the static URL for "my" ISNI (the URL I would most likely have bookmarked and be using to check for updates to the record about me) the link from the update box doesn't work:

Also, the form refers to "additionns and corrections", but says nothing about deletions of data, or deletion of a record in its entirety.

There's still no evidence of any verification. This makes it trivial to hijack the ISNI and the revenues* of an author who is unaware that an ISNI has been assigned to her, or isn;t checking it regularly.

Suppose I submit an "update" to ISNI directing people to a fake Web site I have set up that looks like it is the site of a famous but reclusive author. People wanting to license that author's work look up the ISNI, follow the link to that site, and contact me, thinking I am the author or the author's licensing agent.

I quote them a price to use e.g. a story or poem in a magazine or anthology or Web site. They send me money. I send them a purported license agreement. I disappear with the money.

The real author never knows that she's been ripped off.

ISNI clearly isn't thinking about "use cases" (or threat models) from a writer's perspective.

Posted by: Edward Hasbrouck, 10 April 2014, 10:15 (10:15 AM)

I received a further response from ISNI today, saying that my concerns were discussed at yesterday's meeting of ISNI's board of directors and promising posting of policies on and follow-up on issues including how an ISNI was assigned to me without my knowledge or consent.

Posted by: Edward Hasbrouck, 10 April 2014, 12:21 (12:21 PM)

A day later, I received another response, this time from someone with a different organization (OCLC) in a different country, (the Netherlands), saying, "I am writing to you in my role as caretaker of the ISNI database and system." She offered another apology on behalf of ISNI, and thanked me for pointing out a problem with their system. She said that, "The ISNI-IA Board is currently compiling a comprehensive response to your points."

Some of the amendments I requested last August to the ISNI record about me still haven't been made. New errors have been introduced in that record. And I still have received no acknowledgement or response to my request for the identity and contact information for ISNI's data controller (if one has been designated) or the data protection jurisdiction applicable to ISNI data.

Posted by: Edward Hasbrouck, 11 April 2014, 14:14 ( 2:14 PM)

Another e-mail message and a phone conversation today with someone at OCLC. ISNI has now made most of the changes I requested (last August) to the ISNI record about me. OCLC told me today that ISNI data is aggregated from data supplied by the US Library of Congress, the British Library, the Bibliotheque Nationale de France, and OCLC. Responsibility for ISNI data is "shared" by all of these entities. The ISNI-IA is incorporated in the UK. The ISNI database is hosted by OCLC in Leiden, the Netherlands. ISNI still hasn't figured out what data protection jurisdiction applies, or who is the data controller for ISNI records. ISNI's board of directors (whose names and contact information I do not know) is aware of this issue, and is working on responses to me and additional FAQs for the Web site.

Posted by: Edward Hasbrouck, 14 April 2014, 13:07 ( 1:07 PM)

"Do you have an International Standard Name Identifier?"

(by M.A. Demers)

...This in indicative of what critics argue is the fundamental problem with the database: it has been assembled by data mining rather than by permission of those in the database; this may only lead to entrenched inaccuracies....

There are also privacy concerns, and concerns that the database will be used to justify orphaned works. These issues and more are covered quite well by author Edward Hasbrouck on his blog, The Practical Nomad....

Posted by: M.A. Demers, 10 August 2014, 18:27 ( 6:27 PM)

I've discovered that I'm not the only writer concerned that ISNI may be violating privacy and data protection laws. The International Confederation of Societies of Authors and Composers (CISAC), made the following announcement on 28 October 2013 (although I only recently learned of it):

"CISAC has recently expressed concern over data privacy issues surrounding ISNI, the ISO identifier used for the public identity of creators created in 2010 by a coalition that includes CISAC, IFFRO, IPDA, ProQuest, OCLC, and the Conference of European National Librarians...."


Posted by: Edward Hasbrouck, 1 May 2015, 10:11 (10:11 AM)

"Finding Authors: The Importance of Establishing an Online Licensing System for Copyrighted Works"

(by Michael Capobianco for Writer Beware)

Posted by: Edward Hasbrouck, 15 May 2015, 06:58 ( 6:58 AM)
Post a comment

Save personal info as cookie?

Bio | Blog | Blogroll | Books | Contact | Disclosures | Events | FAQs & Explainers | Home | Newsletter | Privacy | Resisters.Info | Search | Sitemap | The Amazing Race | The Identity Project | Travel Privacy & Human Rights | Twitter

"Don't believe anything just because you read it on the Internet. Anyone can say anything on the Internet, and they do. The Internet is the most effective medium in history for the rapid global propagation of rumor, myth, and false information." (From The Practical Nomad Guide to the Online Travel Marketplace, 2001)
RSS 2.0 feed of this blog
RSS 2.0 feed of this blog
RSS 1.0 feed of this blog
Powered by
Movable Type Open Source
Movable Type Open Source 5.2.13

Pegasus Mail
Pegasus Mail by David Harris