I wrote in April about a Delhi University professor who lost six years of PhD research to a bag theft. Most of the replies were about backups. A few were about the harder thing: a researcher with perfect backups may still be unable to establish that the work is theirs.

Backups are a solved problem. Provenance is not, and provenance is what decides disputes.

Three questions get collapsed into one here, and they have different answers.

Who owns the intellectual property. Who holds the data. Who can prove who produced it.

A doctoral student typically loses the first, has ambiguous standing on the second, and has almost nothing on the third.

Ownership

The general shape of institutional policy, in India and in most other places, is that intellectual property created using institutional resources belongs to the institution. Resources means supervision, equipment, funding, lab space, and often just enrolment. The specifics vary a great deal, and the variation is the point: there is no default you can assume.

Some institutions distinguish between copyright in the thesis, which frequently stays with the student, and patentable inventions, which frequently do not. Some assign a revenue share on commercialisation. Some claim everything produced during the period of registration regardless of where or how it was produced. Funded projects add another layer, because the funding agency’s terms sit on top of the institution’s, and government funding often carries its own conditions on data availability and ownership.

If you are enrolled somewhere, the actionable thing is to find the document. It exists. It is usually called an IP policy or an IPR policy and it is usually a PDF on a page nobody links to. Read the definitions section, because that is where the scope is set, and read what it says about the period of applicability. You signed something that incorporated it by reference.

I am not going to tell you what your policy says or give you legal advice. I am telling you that the number of doctoral students who have read theirs is small, and that this is the cheapest thing on the list to fix.

Custody

Ownership is about rights. Custody is about who has the files.

In practice custody sits with whoever controls the storage. A shared lab drive administered by the department. A supervisor’s server. An instrument workstation that writes to local disk. A personal laptop, which is the case in the story I wrote about.

Custody has a way of becoming decisive regardless of what the ownership policy says. A student who leaves on bad terms, or leaves the country, or simply finishes and moves on, may find that access to the raw data ends with the institutional account. Conversely a supervisor may find that the only copy of the processed dataset left with the student. Neither of these is a legal question in the first instance. It is a question of who can still log in.

The failure is symmetric and both sides tend to notice it late.

Provenance, which is the one nobody solves

Here is the question that I think is actually underserved.

Suppose there is a dispute. Suppose two people claim to have produced an analysis, or a supervisor’s name appears on work a student believes is theirs, or a result surfaces in another group six months after a conference talk. What is the evidence?

For published work the answer is reasonable. There is a paper with a date, a DOI, an author list, and increasingly an ORCID identifier attached to each author. That is a public, timestamped, third-party record.

For everything before publication, which is where most of the work lives and where most disputes happen, the record is whatever you happen to have. Emails. File modification times, which are trivially altered. A lab notebook, if the field still keeps them, which many computational fields do not. A git history, if you used git, which is genuinely good evidence and which almost nobody in the wet lab or the modelling group is using.

A file modification date is not provenance. It is a claim by the filesystem, editable by anyone with the file.

This is the gap I keep coming back to. Research produces enormous quantities of unpublished intermediate state, and the discipline has no standard way of establishing when it existed and who made it. Every other field that deals with disputed authorship of digital artefacts, from software to design, solved this by keeping an append-only history. Research mostly did not, because the incentive to keep one only becomes obvious after you needed it.

What is worth doing now

None of this requires institutional change, which is the reason to do it.

Put everything in version control. Not just code. Analysis notebooks, parameter files, the LaTeX source of the draft, the notes. A git repository is a signed, ordered, tamper-evident history of who committed what and when. If you push to a remote, you get an independent copy with independent timestamps. This is the single highest return action available and it costs an afternoon to learn.

Preprint earlier than feels comfortable. arXiv, Zenodo, SSRN depending on your field. A preprint is a public, timestamped, citable claim with a DOI. It does not settle ownership, but it establishes priority in a way no private record can, and it is the reason I put my own work on Zenodo before it is anywhere near a journal decision.

Get an ORCID and use it. It is free and it takes ten minutes. Its value is that it disambiguates you from everyone with a similar name, permanently, across institutions. If you change countries or your name changes, the identifier does not.

Keep a copy you control. An encrypted drive you own, plus one cloud location, plus one physical copy somewhere else. The professor in the Delhi story had one copy and it was in a bag. The rule is that data existing in one place does not exist.

Write down the data management terms before you start a collaboration, especially an industry one. Who holds the raw data, who can publish, what the embargo is, what happens if someone leaves. A one-page understanding written in week one is easier than a negotiation in month eighteen.

Ask your supervisor what happens to the data when you finish. Most will not have thought about it. That conversation is the point.

The structural version

The individual advice above is real and I would follow all of it. It is also a workaround.

The underlying problem is that research provenance is not infrastructure. It is left to individual habit, which means it is distributed unevenly and it is weakest exactly where the power imbalance is largest, which is the early-career researcher who has produced the work and has the least standing to make claims about it. A student who does everything right still depends on a supervisor’s goodwill for anything that happened off the record.

Fixing that properly means research management systems where authorship and time are recorded as a matter of course rather than as a matter of diligence. That is a systems problem, and one of the more interesting unsolved ones I know of, because the technical part is not hard and the adoption part is very hard. Which is usually a sign that the answer is a company rather than a paper.

Someone is going to build it. Until then, use git and post preprints.

Related: