Internet Research Ethics

Internet Research Ethics
Issues and Challenges Presentation for Department of Energy Human Subjects Working Group Workshop December 1, 2011 Michael Zimmer, PhD Assistant Professor, School of Information Studies Co-Director, Center for Information Policy Research University of Wisconsin-Milwaukee zimmerm@uwm.edu www.michaelzimmer.org

Agenda What is Internet Research? What are the Ethical Issues related to Internet Research? Selected cases Conceptual gaps Closing the gaps for researchers & IRBs

What does Internet Research look like? Using Internet tools to engage in (traditional) research Online survey & data-collection tools Subject recruitment via email, social media Storing, processing, sharing data in the cloud Using Internet as the site for your research Interviewing/observing subjects in chat rooms, virtual worlds, online games Collecting/merging data from online profiles, feeds, newsgroups, blogs, archives, activity logs

Internet Tools to Engage in Research Online survey & data-collection tools SurveyMonkey Zoomerang Qualtrics Facebook apps Typically used “in the wild”, sometimes institutionally-bound

Internet Tools to Engage in Research Subject recruitment via email, social media Simple as soliciting survey respondents via email lists Or as complex as building Facebook apps to recruit participants Or engaging with people in online environments, and then asking them to take a survey

Internet Tools to Engage in Research Storing, processing, sharing data in the cloud Storing and sharing data via third party storage services like DropBox, or Box.net Collaborating (writing, data analysis) via Google Docs, wikis, etc Outsourcing (mundane) processing functions to crowdsourcing platforms like Mechanical Turk

Internet as the Site for Research Subject interaction/observation online Interviews in chat rooms, Skype, Second Life, WoW Lurking in online forums, mailing lists, etc Online ethnography and observation in virtual environments (social, gaming)

Internet as the Site for Research Using data available online for analysis of web-based activities Scraping text/images from websites, blogs, forums Harvesting “public” Facebook profiles, Twitter feeds, etc Mapping links and social connections Mining server & activity logs

Ethical Concerns The growing use of internet tools, platforms & environments in research creates conceptual gaps in our current understanding of / approaches to key ethical issues: Privacy Anonymity vs. Identifiability Consent Harm & Human subjects Honesty & Research integrity

Illuminating Cases Sensitive blogs & confidentiality Research on Tor network Harvesting & archiving of “public” Twitter streams Pete Warden’s harvesting (and proposed release) of public Facebook profiles Tastes, Ties, and Time (T3) Facebook data release

Sensitive Blogs & Confidentiality Research on personal health blogs Content analysis of 40-50 blogs Online interview with 10 bloggers Subjects will choose their own pseudonym, but researcher plans to use real name of blogs and URL Must subjects consent to use of real blog name, even if publicly visible? Could pseudonyms be linked back to blogs?

Research on Tor Network Computer science researchers increasingly interested in network traffic on the Tor anonymity network What kind of traffic is on this network? What kind of users? Or, just capture Tor data as convenience sample But users of Tor are intentionally seeking additional privacy and anonymity Often not even vetted by IRBs Soghoain, C. (2011) “Enforced Community Standards For Research on Users of the Tor Anonymity Network”

Harvesting Public Twitter Streams Is it ethical for researchers to follow and systematically capture public Twitter streams without first obtaining specific, informed consent by the subjects? Are tweets publications (texts), or utterances? What are users’ expectations to how their tweets are being found & used? What if a user later changes her privacy settings, or deletes tweets, etc http://michaelzimmer.org/2010/02/12/is-it-ethical-to-harvest-public-twitter-accounts-without-consent/

LOC Archiving of Public Tweets Library of Congress will archive all public tweets 6 month delay, restricted access to researchers only Open questions: Can users opt-out from being in permanent archive? Can users delete tweets from archive? Will geolocational and other profile data be included? What about a public tweet that is re-tweeting a private one? Did users ever expect their tweets to become permanent part of LOC’s archives? http://michaelzimmer.org/2010/04/14/open-questions-about-library-of-congress-archiving-twitter-streams/

Pete Warden Facebook Dataset Exploited flaw in Facebook’s architecture to access and harvest publicly-viewable profile information of 215 million users http://petewarden.typepad.com/searchbrowser/2010/02/how-to-split-up-the-us.html

Pete Warden Facebook Dataset Planned to release entire dataset – with all personal information intact – to academic community Would it be acceptable to use this dataset? Users knew (?) data was public, but did they expect it to be harvested by bots, aggregated, and made available as raw data? Under threat of lawsuit from Facebook, Warden destroyed the data http://michaelzimmer.org/2010/02/12/why-pete-warden-should-not-release-profile-data-on-215-million-facebook-users/

T3 Facebook Project Harvard-based Tastes, Ties, and Time (T3) research project sought to understand social network dynamics of large groups of students Worked with Facebook & an “anonymous” university to harvest the Facebook profiles of an entire cohort of college freshmen Repeated each year for their 4-year tenure Co-mingled with other University data (housing, major, etc) Coded for race, gender, political views, cultural tastes, etc Zimmer, M. 2010. “But the data is already public”: On the ethics of research in Facebook. Ethics & Information Technology.

T3 Data Release As an NSF-funded project, the dataset was made publicly available First phase released September 25, 2008 One year of data (n=1,640) Prospective users must submit application to gain access to dataset Detailed codebook available for anyone to access Zimmer, M. 2010. “But the data is already public”: On the ethics of research in Facebook. Ethics & Information Technology.

“Anonymity” of the T3 Dataset “All the data is cleaned so you can’t connect anyone to an identity” But dataset had unique cases (based on codebook) If we could identify the source university, individuals could potentially be identified Took me minimal effort to discern the source was Harvard The anonymity (and privacy) of subjects in the study might be in jeopardy…. Zimmer, M. 2010. “But the data is already public”: On the ethics of research in Facebook. Ethics & Information Technology.

Good-Faith Efforts to Protect Subject Privacy Only those data that were accessible by default by each RA were collected Removing/encoding of “identifying” information Tastes & interests (“cultural footprints”) will only be released after “substantial delay” To download, must agree to “Terms and Conditions of Use” statement Reviewed & approved by Harvard’s IRB Zimmer, M. 2010. “But the data is already public”: On the ethics of research in Facebook. Ethics & Information Technology.

1. Only those data that were accessible by default by each RA were collected False assumption that because the RA could access the profile, it was “publicly available” RAs were Harvard graduate students, and thus part of the the “Harvard network” on Facebook “We have not accessed any information not otherwise available on Facebook”

5. Reviewed & Approved by IRB “Our IRB helped quite a bit as well. It is their job to insure that subjects’ rights are respected, and we think we have accomplished this” “The university in question allowed us to do this and Harvard was on board because we don’t actually talk to students, we just accessed their Facebook information”

5. Reviewed & Approved by IRB For the IRB, downloading Facebook profile information seemed less invasive than actually talking with subjects… Did IRB know unique, personal, and potentially identifiable information was present in the dataset? …and consent was not needed since the profiles were “freely available” But RA access to restricted profiles complicates this; did IRB contemplate this? Is putting information on a social network “consenting” to its use by researchers?

T3 Facebook Project Chronicle of Higher Education July 10, 2011

Illuminating Cases Sensitive blogs & confidentiality Research on Tor network Harvesting & archiving of “public” Twitter streams Pete Warden’s harvesting (and proposed release) of public Facebook profiles Tastes, Ties, and Time (T3) Facebook data release What conceptual gaps about research ethics emerge?

Conceptual Gap: Privacy Presumption that because subjects make information available on a blog, Facebook, or Twitter, they don’t have an expectation of privacy Researchers/IRBs might assume everything is always public, and was meant to be Assumes no harm could come to subjects if data is already “public” New ethical problems… Ignores contextual nature of sharing Fails to recognize the strict dichotomy of public/private doesn’t apply in the 2.0 world Need to track if ToS/architecture have changed, or if users even understand what is available to researchers Nissenbaum, H. 2011. “Privacy in Context: Technology, Policy, and the Integrity of Social Life”

Conceptual Gap: Anonymity vs. Identifiability Presumption that stripping names & other obvious identifiers provides sufficient anonymity Assumes only PII allows re-identification New ethical problems… Ignores how anything can potentially identifiable information and become the “missing link” to re-identify an entire dataset “Anonymous” datasets are not achievable and provides false sense of protection But how can we share data safely? Ohm, P. “Broken promises of privacy: Responding to the surprising failure of anonymization.” UCLA Law Review

Conceptual Gap: Consent Presumption that because something is shared or available without a password, the subject is consenting to it being harvested for research Assumes no harm can come from use of data already shared with friends or other contextually-bound circles New ethical problems… Must recognize that a user making something public online comes with a set of assumptions/expectations about who can access and how Does anything outside this need specific consent? Must recognize how research methods might allow un-anticipated access to “restricted” data

Conceptual Gap: Harm Presumption that “harm” means risk of physical or tangible impact on subject Researchers often imply “data is already public, so what harm could possibly happen” New ethical problems Must move beyond the concept of harm as requiring a tangible consequence Protecting from harm is more than protecting from hackers, spammers, identity thieves, etc Consider dignity/autonomy theories of harm Must a “wrong” occur for there to be damage to the subject? Do subjects deserve control over the use of their data streams?

Conceptual Gap: Human Subjects Researchers (esp. CompSci) often interact only with datasets, objects, or avatars, thus feel a conceptual distance from an actual human Often don’t consider what they do as “human subject” research New ethical problems Must bridge this (artificial) distance between researcher and the actual human subject Also consider other stakeholders within the complex arrangement of information intermediaries Carpenter, K & Dittrich, D. “Bridging the Distance: Removing the Technology Buffer and Seeking Consistent Ethical Analysis in Computer Security Research”

Conceptual Gap: Honesty & Integrity Presumption that we must never falsify research data Tends to privilege positivist, quantitative research Presumes any sensitive data can easily be scrubbed without impacting results New ethical problems… Scrubbing data completely can destroy valuable research results, yet concerns of privacy and identifiability persist Need to consider the ethics of fabrication Composite profiles, constructed quotes, fuzzy data Markham, A. “Fabrication as Ethical Practice: Qualitative Inquiry in Ambiguous Internet Contexts”

Conceptual Gaps  Policy Vacuums Researchers & IRBs are trying to do the right thing when faced with research projects relying on Internet tools and spaces But the fluidity and complexity of Internet tools and environments creates significant conceptual gaps Leaving researchers & IRBs with considerable policy vacuums How should researchers deal with using Internet tools in their projects? How should IRBs review them? And how can we still ensure research still gets done…

Removing the gaps, filling the vacuums Scholarship Buchanan & Ess studying how IRBs deal with Internet research Exploring new dimensions of Internet research ethics by Markham; Soghoian; Carpenter & Dittrich; and others (cited within) Resources “Internet Research Ethics Digital Library, Resource Center and Commons” http://www.InternetResearchEthics.org “Ethical decision-making and Internet research: Recommendations from the AoIR Ethics Working Committee”

Removing the gaps, filling the vacuums Education & outreach Growing focus at PRIM&R and related events Engage disciplinary conferences (ACM, ICA, etc) Policy guidance Advising SACHRP on “The Internet in Human Subjects Research” Require Internet Research Ethics training for all IRBs?

Internet Research Ethics
Issues and Challenges Presentation for Department of Energy Human Subjects Working Group Workshop December 1, 2011 Michael Zimmer, PhD Assistant Professor, School of Information Studies Co-Director, Center for Information Policy Research University of Wisconsin-Milwaukee zimmerm@uwm.edu www.michaelzimmer.org

Internet Research Ethics