An unfortunate change in ENISA policy regarding authorship of reports.

Last year I was a member of an ENISA (the European Network and Information Security Agency) expert group. We studied the issue of how to address and support privacy and data protection in mobile application development. A few days ago (on data protection day) ENISA published the final report. It was a real pleasure to work on this project, both with the academics involved, as well as the ENISA staff supporting us. Unfortunately, ENISA has adopted a new policy whereby it no longer acknowledges the contribution of the researchers that actually wrote the report: our names are not listed as authors. Sadly this means that for academics like myself participation in ENISA research projects and contribution to ENISA reports is no longer useful or even possible.

This change in policy does not allow me to refer to the research I have done in the context of this project. As you may be well aware, academics are continually evaluated during their career regarding their research output and dissemination activities. Clear attribution of my results is crucial for me to claim scientific relevance. Being an official author of a report allows me to do so. The new ENISA policy deprives me of this possibility, and makes it no longer useful for me to contribute to future ENISA research.

Moreover, as an academic I am bound to the Netherlands Code of Conduct for Academic Practice. It requires me to be honest about and responsible for all my scientific activities. Contribution to a research report that does *not* clearly indicate my contribution would make me appear both dishonest and trying to escape my responsibility. It violates my scientific integrity. It is therefore impossible for me to contribute to future ENISA reports. (To be fair, and I am very grateful to them for that, ENISA staff went through considerable effort to actually include a proper attribution within the report itself to us, the authors. But this is an exception.)

As a result, under these new ENISA authorship rules I will not be able to participate in a future ENISA expert group or be part of a ENISA funded project. Given that academics all over the world are bound by similar codes of conduct, and similarly depend on proper attribution of scientific achievements for the advancement of their careers, I have every reason to believe that similar concerns will prevent other academics to cooperate with ENISA in the future.

I think this would be a terrible loss. The participation in applied research projects, like those instigated by ENISA, is crucial to disseminate the current state of art to policy makers and industry leaders. I sincerely hope ENISA will reconsider these new authorship rules.