Research, the Cloud, and the IRB:
Post on 25-Feb-2016
DESCRIPTIONResearch, the Cloud, and the IRB:. New Opportunities :: new challenges. Michael Zimmer, PhD Assistant Professor, School of Information Studies Director, Center for Information Policy Research University of Wisconsin-Milwaukee firstname.lastname@example.org www.michaelzimmer.org. - PowerPoint PPT Presentation
Research, the Cloud, and the IRB:New Opportunities :: new challengesMichael Zimmer, PhDAssistant Professor, School of Information StudiesDirector, Center for Information Policy ResearchUniversity of Wisconsin-Milwaukeezimmerm@uwm.eduwww.michaelzimmer.orgAnyone who has studied the history of technology knows that technological change is always a Faustian bargainTechnology giveth and technology taketh away, and not always in equal measure. A new technology sometimes creates more than it destroys. Sometimes, it destroys more than it creates. But it is never one-sided.Neil Postman
10/12/2012Virginia IRB Consortium Conference 2AgendaWhat is Cloud Computing?Opportunities for Use in ResearchEthical DimensionsSubject confidentiality & anonymityData privacy & securityData ownership & stewardshipResearch integrity & authorshipConceptual Gaps & Policy VacuumsWhat can Researchers and IRBs do?10/12/2012Virginia IRB Consortium Conference 3What is Cloud Computing?
KEXINO (CC BY-NC-ND 2.0) http://www.flickr.com/photos/kexino/4202662815/10/12/2012Virginia IRB Consortium Conference 4What is Cloud Computing?On-demand, network-based access to computing recoursesFeaturesLocation independent; supports increased mobilityFlexible, scalable, robustOn-demand performance; big data processingLittle (if any) local support or maintenance10/12/2012Virginia IRB Consortium Conference 5What is Cloud Computing?Milestones1999 Salesforce.com delivers enterprise services via the web2002 Amazon Web Services (storage, computation, human intelligence via the cloud)2004 Gmail reboots web-based email, follows with Google Docs2006 Amazons Elastic Compute Cloud (EC2)2007 IBM shifts focus to the cloudPopularityAs early as 2008, 69 percent of Americans were using webmail services, storing data online, or otherwise using software programs located on the webBy 2011, 80% of Fortune 500 companies use IBM cloud10/12/2012Virginia IRB Consortium Conference 63 Layers of Cloud Computing
http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0) 10/12/2012Virginia IRB Consortium Conference 7Application LayerSoftware as a serviceProviding productivity applications via the Web; no local software needed
10/12/2012Virginia IRB Consortium Conference 8Platform LayerPlatform as a serviceProviding application development platforms and operating systems via the WebCan deploy applications without needing your own infrastructure or distribution channels
10/12/2012Virginia IRB Consortium Conference 9Infrastructure LayerInfrastructure as a serviceProvide computing infrastructure on demandOutsourcing servers, storage, network equipment, processing power, data centers
10/12/2012Virginia IRB Consortium Conference 10Research Opportunities for Cloud ComputingApplication layerMost common and easiest application of cloudData gathering, storage, collaborationPlatform layerHosted apps for recruitment & surveysInfrastructure layerAccess to increased processing power for large-scale research projectsSome non-traditional uses
10/12/2012Virginia IRB Consortium Conference 11Research Opportunities: ApplicationsData gathering using web-based survey applicationsSurveyMonkeyZoomerangQualtricsTypically used in the wild, sometimes institutionally-bound10/12/2012Virginia IRB Consortium Conference 12Research Opportunities: ApplicationsData storage & sharing using cloud-based applicationsDropboxBox.netiCloudCommunication & collaboration using cloud-based applicationsGmail, IM, SkypeGoogle Docs, Office LiveWikis10/12/2012Virginia IRB Consortium Conference 13Research Opportunities: PlatformsWith skilled programmers, can build custom apps to deploy via cloud-based platformsSubject recruitment and screening apps on FacebookBuilding and deploying test instruments within online gaming platformsMonitoring and activity tracking apps on mobile device platforms10/12/2012Virginia IRB Consortium Conference 14Research Opportunities: InfrastructureLeverage cloud-based computing infrastructures to handle resource-intensive processing tasksClinical trial data storage & processingSharing extremely large databasesInnovative, non-traditional use of cloud-based processing resources____@Home (distributed computing)Fold.ItAmazon Mechanical Turk
10/12/2012Virginia IRB Consortium Conference 15Fold.ItWeb-based puzzle video game to assist with protein folding researchLeverage millions of gamers to assist in data processing10/12/2012Virginia IRB Consortium Conference 16Fold.It
10/12/2012Virginia IRB Consortium Conference 17http://fold.it/Fold.ItWeb-based puzzle video game to assist with protein folding researchLeverage millions of gamers to assist in data processingPlayers produced an accurate 3D model of and AIDS-related enzyme in just 10 daysResearchers had been trying for 15 years10/12/2012Virginia IRB Consortium Conference 18Amazon Mechanical TurkFacilitates outsourcing of computational or other mundane tasksRequesters post Human Intelligence Tasks offering minimal feesWorkers select tasks to complete for micropayments10/12/2012Virginia IRB Consortium Conference 19Amazon Mechanical Turk10/12/2012Virginia IRB Consortium Conference 20
3 Layers of Cloud Computing
http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0) 10/12/2012Virginia IRB Consortium Conference 21Ethical DimensionsSubject confidentiality & anonymityData privacy & securityData ownership & stewardshipResearch integrity & authorship10/12/2012Virginia IRB Consortium Conference 22Subject Confidentiality & AnonymityWhen recruiting subjects or collecting data with cloud-based applicationsAre IP addresses logged in such a way to allow re-identification of subjectsUsing a Facebook app might provide researchers access to unnecessary personal informationAre cloud providers tracking data and usage themselves? Delivering ads? Selling user data?10/12/2012Virginia IRB Consortium Conference 23Data Privacy & SecurityCritical concern of any cloud system, takes on even more importance when dealing with subject dataAre cloud-based communication and collaboration systems using SSL encryption?Is data stored on cloud-servers encrypted? What is services policy regarding 3rd party accessAdvertisersInvestigative inquiry vs. subpoena vs. warrants?Electronic Communication Privacy Act (ECPA)10/12/2012Virginia IRB Consortium Conference 24Data Ownership & StewardshipWho owns, and who controls (meta)data in the cloud?Are you granting the cloud provider any license to use your data or activities (for advertising, data mining, etc)?Can you ensure data remains in the U.S.?Can data be destroyed on demand, including backups?Can you ensure cloud provider wont hold your data hostage, or disappear?
10/12/2012Virginia IRB Consortium Conference 25Research Integrity & AuthorshipShould researchers rely on cloud-based data processing and analysis?Can you trust (or audit?) external/collaborative processing platformsEthical to use Mechanical Turk, or otherwise outsource mundane tasks to unknown persons for nominal wages?Authorship claims?
10/12/2012Virginia IRB Consortium Conference 26Conceptual Gaps & Policy VacuumsEmergence of new technologies often lead to conceptual gaps in how we think about ethical problems, and reveal policy vacuums for how we should best address them
Computer technology transforms many of our human activities and social institutions, and will leave us with policy and conceptual vacuums about how to use computer technology Often, either no policies for conduct in these situations exist or existing policies seem inadequate. Jim Moor, What is Computer Ethics?
10/12/2012Virginia IRB Consortium Conference 27Conceptual Gaps & Policy VacuumsThe fluidity and complexity of cloud-based tools and platforms creates potential conceptual gapsAre these ethical dimensions merely the same as before, or fundamentally different due to the cloud?Does the nature of anonymity, privacy, consent, even harm change when dealing with cloud-based research?10/12/2012Virginia IRB Consortium Conference 28Conceptual Gap: PrivacyPresumption that because subjects make information available on a cloud-based service, they dont have an expectation of privacyResearchers/IRBs might assume everything is always public, and was meant to beAssumes no harm could come to subjects if data is already publicNew ethical problemsIgnores contextual nature of sharingFails to recognize the strict dichotomy of public/private doesnt apply in the 2.0 worldNeed to track if ToS/architecture have changed, or if users even understand what is available to researchersNissenbaum, H. 2011. Privacy in Context: Technology, Policy, and the Integrity of Social LifeVirginia IRB Consortium Conference 2910/12/201229Conceptual Gap: Anonymity vs. IdentifiabilityPresumption that stripping names & other obvious identifiers provides sufficient anonymity when sharing data in the cloudAssumes only PII allows re-identificationNew ethical problemsIgnores how anything can potentially identifiable information and become the missing link to re-identify an entire datasetAnonymous datasets are not achievable and provides false sense of protectionOhm, P. Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law ReviewVirginia IRB Consortium Conference 3010/12/201230Conceptual Gap: ConsentPresumption that because something is shared or available without a password, the subject is consenting to it being harvested for researchAssumes no harm can come from use of data already shared with friends or other contextually-bound circlesNew ethical problemsMust recognize that a user making something public online comes with a set of assumptions/expectations about who can access and howMust recognize how research methods might allow un-anticipated access to restricted dataVirginia IRB Consortium Conference 3110/12/201231Conceptual Gap: HarmPresumption that harm means risk of physical or tangible impact on subjectResearchers often imply data is already public, so what harm could possibly happenNew ethical problemsMust move beyond the concept of harm as requiring a tangible consequenceProtecting from harm is more than protecting from hackers, spammers, identity thieves, etcConsider dignity/autonomy theories of harmMust a wrong occur for there to be damage to the subject?Do subjects deserve control over the use of their data streams?Virginia IRB Consortium Conference 3210/12/201232Conceptual Gap: Human SubjectsResearchers (esp. CompSci) often interact only with datasets, objects, or avatars, thus feel a conceptual distance from an actual humanOften dont consider what they do as human subject researchNew ethical problemsMust bridge this (artificial) distance between researcher and the actual human subjectAlso consider other stakeholders within the complex arrangement of information intermediariesCarpenter, K & Dittrich, D. Bridging the Distance: Removing the Technology Buffer and Seeking Consistent Ethical Analysis in Computer Security ResearchVirginia IRB Consortium Conference 3310/12/201233Conceptual Gaps & Policy VacuumsThe fluidity and complexity of cloud-based tools and platforms creates potential conceptual gapsAre these ethical dimensions merely the same as before, or fundamentally different due to the cloud?Does the nature of anonymity, privacy, consent, even harm change when dealing with cloud-based research?Leaving researchers & IRBs with considerable policy vacuumsHow should researchers deal with using the cloud in their projects?How should IRBs review them?And how can we ensure good research still gets done10/12/2012Virginia IRB Consortium Conference 34What can Researchers & IRBs do? - broadlyGet educated, find recoursesEvents like today; PRIM&RUtilize disciplinary resourcesFor example: Ethical decision-making and Internet research: Recommendations from the AoIR Ethics Working CommitteeKeep up on researchUtilize expertsLook for guidanceIncreased attention hopefully will prompt guidance from HHS and related regulatory bodies10/12/2012Virginia IRB Consortium Conference 35What can Researchers & IRBs do? - practicallyRead and understand the Terms of ServiceIncorporate in risk analysisInclude mention of cloud-based services in consent formsLevel of detail?Monitor/audit cloud services over life of projectHave terms or practices changed?All this is new, complex, and difficult10/12/2012Virginia IRB Consortium Conference 36Anyone who has studied the history of technology knows that technological change is always a Faustian bargainTechnology giveth and technology taketh away, and not always in equal measure. A new technology sometimes creates more than it destroys. Sometimes, it destroys more than it creates. But it is never one-sided.Neil Postman
10/12/2012Virginia IRB Consortium Conference 37Research, the Cloud, and the IRB:New Opportunities :: new challengesMichael Zimmer, PhDAssistant Professor, School of Information StudiesDirector, Center for Information Policy ResearchUniversity of Wisconsin-Milwaukeezimmerm@uwm.eduwww.michaelzimmer.org