Publishers naturally hate it – and have unsuccessfully tried to shut it down through the courts.

But Sci-Hub has a lot of moral support from academics who resent that highly profitable publishers still lock a large amount of research behind costly paywalls, despite scholars themselves having done the hard work of peer review for free.

Eyebrows were raised in December 2019 when a Washington Post article reported that the US Justice Department was investigating Alexandra Elbakyan, the Kazakhstan-born founder of Sci-Hub, “on suspicion that she may also be working with Russian intelligence to steal US military secrets from defence contractors”, citing anonymous sources.

The article cautioned that it was “unclear whether Elbakyan is using Sci-Hub’s operations in service of Russian intelligence”, and there has been no update since.

Open access campaigners, although not ruling out a risk entirely, see this as a red herring. Publishers were getting “increasingly desperate”, said Leonhard Dobusch, a professor at Innsbruck University who studies openness and transparency. “The only way they see is to attack Sci-Hub with all they have got.”

The existence of Sci-Hub has hugely weakened publishers’ leverage over libraries, Professor Dobusch recently argued, and helps explains why Germany, for example, has been able to go without a contract with Elsevier for more than two years with seemingly few consequences.

Sci-Hub illicitly harvests journal papers from publishers by using academics’ and students’ own login credentials. These may be given willingly by supporters, but Ms Elbakyan has admitted that Sci-Hub also gains account details without permission.

The question is whether Sci-Hub is using these details to steal more than just journal articles from university networks, which contain far more valuable research secrets and personal data.

Andrew Pitts, managing director at PSI, a company that offers libraries anti-hacking tools and has issued a number of warnings about Sci-Hub, told Times Higher Education that libraries privately complained that Sci-Hub is taking more than article PDFs – but admitted that none will go public with their concerns.

Aside from not wanting to spook their commercial partners, Mr Pitts said, “libraries are terrified of the Russian government”.

THE asked SNSI for evidence that Sci-Hub was stealing more than just journal articles, but received no response.

Still, security experts believe it is plausible that credentials gathered by Sci-Hub could be used to gain access to more sensitive university networks.

“It depends,” said Mark Ford, a former higher education cyber-security expert at the audit firm Deloitte. “There are many ways to set up accounts that restrict access to only the information the site wants you to have access to. Your ability to access restricted networks and data beyond this is highly relative to how the site is designed.”

The broader fear for open access campaigners is that the cyber-security threat is being over-hyped to justify data gathering on academics.

One SNSI webinar, held at the end of October, drew particular attention. “Cyber-security landscape – protecting the scholarly infrastructure” heard suggestions that academics accessing journal articles could have their keystrokes and mouse movements monitored to make sure they were not bots harvesting papers (although this idea came not from a publisher, but a university employee).

“The concept is outrageous,” said Björn Brembs, a neurogeneticist at the University of Regensburg and long-time critic of publishers, who argued this showed publishers were hoping to move into a business model where they tracked researchers’ online behaviour and sold this data on. Sci-Hub “is just used as a justification”, he said.

“Librarians are always concerned about user privacy and how user data is collected, managed and shared,” said Lisa Hinchliffe, coordinator for information literacy services and instruction at the University of Illinois library, and one of those who attended the SNSI conference. “Security is a prerequisite for protecting privacy.”

Sci-Hub did not respond to a request for comment.

[email protected]