Developing a Trusted Stata ADO Repository for Trusted Research Environments

Researchers in the economical, social, and health sciences regularly analyse datasets collected by others. Many of these data are controlled-level, including variables considered to be personal and/or sensitive under data protection and privacy laws (e.g., the European Union’s GDPR). Trusted research environments (TREs), such as the UK Data Service’s SecureLab, provide secure access to these datasets for research. However, TREs must also provide researchers with data analysis tools and other software within a secure computing environment without direct internet access. While TRE software installation is a simple task, ensuring access to the auxiliary packages is an often-overlooked challenge. Importing these packages is a manual, inefficient, and tedious process to ensure that they are clean, safe, and do not put the TRE at risk.

STATA is a widely used statistical software mainly utilised in economics, sociology, and other large survey data analysis-based research. STATA ADO files are a form of generalized (not dataset- or project-specific) STATA programming code that researchers use in conjunction with self-created syntax files to conduct specific analysis. However, the restricted nature of a TRE presents several challenges for supporting STATA. First, STATA is unsupported by repository managers such as Sonatype NEXUS, requiring TRE staff to manually import and/or update ADOs researchers require. Second, there is no central STATA ADO repository similar to CRAN (R) or PyPI (Python); while official sources such as REPEC exist, many researchers request ADOs available only at other sources (e.g., project specific Github pages, personal websites of researchers, etc.) which present additional security challenges for secure environments. Third, TREs must be mindful of potential malware embedded in user-made ADOs. Potential ransomware attacks pose significant risks to work carried out in TREs. Finding the balance in importing as many ADOs as possible while ensuring TRE security is a key challenge. In sum, STATA ADO files are not organized into a central repository, resulting in outdated ADOs on official sites preventing TREs from importing the most updated versions. As repository managers do not support STATA, TREs must develop safe and secure methods for importing ADOs into the TRE.

In this poster, we propose a local and locally controlled STATA ADO repository to support the broader TRE community. This repository would support malware threat mitigation of both official and unofficial ADO files and automate updating or bringing new ADO packages into the TRE. By collecting and updating ADOs from all sources, opening and running them in an automated, anti-malware monitored manner, we can start the development of a TRE-specific ADO repository. In this poster, we will discuss the main challenges encountered in this project, how user experience and inter-TRE communication inform the repository, and how we ensure the security of the TREs.

In the future, this STATA ADO repository would support the establishment of an interactive and centralized repository of clean, safe STATA ADO files for TREs. This will enable more efficient and safe support for researchers across multiple disciplines and provide a significant improvement for the research carried out in TREs using controlled data.