Risk Properties Definition and Extraction (CPP-023)

Definition and scope

Risk Properties Definition and Extraction is a multi-tiered process that a) identifies risks caused by the specific properties and content of a file, b) defines methods to detect these risks based on file analysis (i.e. format identification, metadata extraction and format validation), and c) holds responsibility for performing technology watch. Together with CPP-012 Risk Mitigation, which defines which actions can be undertaken to reduce the likelihood or impact of the risk, CPP-023 Risk Properties Definition and Extraction is an essential process in the scope of the broader, on-going “risk management” activity.

Risk Properties Definition and Extraction is also the process responsible for technology watch. It receives updates from Community Watch (CPP-018), such as conference papers, specialised literature and journals, vendor announcements, etc. Based on that, it evaluates the impact of the risk with regard to the skills, objectives and means of the Designated Community. In particular, the two following activities are in scope of this CPP:

• Risk Identification involves cataloging potential threats to digital materials, including technological obsolescence (e.g. hardware or software becoming unavailable), media degradation (e.g. physical deterioration of storage devices), format obsolescence ( e.g. file formats being no longer supported), organisational risks (e.g. loss of institutional knowledge or funding), and environmental hazards (e.g. human failure and disasters such as power failures or security breaches).
• Risk Assessment evaluates the likelihood and potential impact of identified risks. This typically involves analysing object- and organisation-related factors like the criticality of the digital materials; the object’s primary and secondary value; the stability of their formats; and the resources available for preservation activities.

Problems in the rendering or reuse of Files by the TDA’s end users may stem from several reasons. For example, one common reason is the use of certain file format features, that rendering tools may misinterpret. To mitigate such misinterpretation, preservation actions (e.g. CPP-014 File Migration, CPP-027 File Repair, CPP-015 Emulation and Rendering Tools, etc.) should go beyond file format or validity status and consider risk properties. Risk properties are File or Representation properties that help identify whether a File is subject to a specific risk. Some examples of risk properties are:

• Discontinued support of file format;
• Erroneous file format structures;
• Encryption;
• External dependencies (e.g. non-embedded fonts);
• Embedded Files;
• Advanced multimedia features;
• Specific creating application, when said application is known to have created faulty Files;
• etc.

It is important to note that risk properties, in some cases, may be also considered significant properties, however, this is not necessarily the case For example, a valid PDF may be encrypted with an empty password. This is a risk property (it may endanger the following preservation processes) but it may not be considered a significant property (the TDA may decide to decrypt the PDF and keep it decrypted). Risk properties are typically defined by digital preservation analysts, while significant properties should be defined by the TDA management and stakeholders.

The step-by-step description below focuses more specifically on the risk extraction part of the process. Like Risk Mitigation, Risk Properties Definition and Extraction focuses on a specific subset of risks - in this case, risks related to inherent properties of Files. Although of major impact, the definition and detection of risks caused by organisational, financial or security issues are not described.