Research, the Cloud, and the IRB: NEW OPPORTUNITIES :: NEW CHALLENGES Michael Zimmer, PhD Assistant Professor, School of Information Studies Director,

Download Research, the Cloud, and the IRB: NEW OPPORTUNITIES :: NEW CHALLENGES Michael Zimmer, PhD Assistant Professor, School of Information Studies Director,

Post on 25-Dec-2015

214 views

Category:

Documents

0 download

TRANSCRIPT

  • Slide 1
  • Research, the Cloud, and the IRB: NEW OPPORTUNITIES :: NEW CHALLENGES Michael Zimmer, PhD Assistant Professor, School of Information Studies Director, Center for Information Policy Research University of Wisconsin-Milwaukee zimmerm@uwm.edu www.michaelzimmer.org
  • Slide 2
  • Anyone who has studied the history of technology knows that technological change is always a Faustian bargain Technology giveth and technology taketh away, and not always in equal measure. A new technology sometimes creates more than it destroys. Sometimes, it destroys more than it creates. But it is never one-sided. Neil Postman 10/12/2012Virginia IRB Consortium Conference2
  • Slide 3
  • Agenda What is Cloud Computing? Opportunities for Use in Research Ethical Dimensions Subject confidentiality & anonymity Data privacy & security Data ownership & stewardship Research integrity & authorship Conceptual Gaps & Policy Vacuums What can Researchers and IRBs do? 10/12/2012Virginia IRB Consortium Conference3
  • Slide 4
  • What is Cloud Computing? KEXINO (CC BY-NC-ND 2.0) http://www.flickr.com/photos/kexino/4202662815/ 10/12/2012Virginia IRB Consortium Conference4
  • Slide 5
  • What is Cloud Computing? On-demand, network-based access to computing recourses Features Location independent; supports increased mobility Flexible, scalable, robust On-demand performance; big data processing Little (if any) local support or maintenance 10/12/2012Virginia IRB Consortium Conference5
  • Slide 6
  • What is Cloud Computing? Milestones 1999 Salesforce.com delivers enterprise services via the web 2002 Amazon Web Services (storage, computation, human intelligence via the cloud) 2004 Gmail reboots web-based email, follows with Google Docs 2006 Amazons Elastic Compute Cloud (EC2) 2007 IBM shifts focus to the cloud Popularity As early as 2008, 69 percent of Americans were using webmail services, storing data online, or otherwise using software programs located on the web By 2011, 80% of Fortune 500 companies use IBM cloud 10/12/2012Virginia IRB Consortium Conference6
  • Slide 7
  • 3 Layers of Cloud Computing http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0) 10/12/2012Virginia IRB Consortium Conference7
  • Slide 8
  • Application Layer Software as a service Providing productivity applications via the Web; no local software needed 10/12/2012Virginia IRB Consortium Conference8
  • Slide 9
  • Platform Layer Platform as a service Providing application development platforms and operating systems via the Web Can deploy applications without needing your own infrastructure or distribution channels 10/12/2012Virginia IRB Consortium Conference9
  • Slide 10
  • Infrastructure Layer Infrastructure as a service Provide computing infrastructure on demand Outsourcing servers, storage, network equipment, processing power, data centers 10/12/2012Virginia IRB Consortium Conference10
  • Slide 11
  • Research Opportunities for Cloud Computing Application layer Most common and easiest application of cloud Data gathering, storage, collaboration Platform layer Hosted apps for recruitment & surveys Infrastructure layer Access to increased processing power for large-scale research projects Some non-traditional uses 10/12/2012Virginia IRB Consortium Conference11
  • Slide 12
  • Research Opportunities: Applications Data gathering using web-based survey applications SurveyMonkey Zoomerang Qualtrics Typically used in the wild, sometimes institutionally-bound 10/12/2012Virginia IRB Consortium Conference12
  • Slide 13
  • Research Opportunities: Applications Data storage & sharing using cloud-based applications Dropbox Box.net iCloud Communication & collaboration using cloud- based applications Gmail, IM, Skype Google Docs, Office Live Wikis 10/12/2012Virginia IRB Consortium Conference13
  • Slide 14
  • Research Opportunities: Platforms With skilled programmers, can build custom apps to deploy via cloud-based platforms Subject recruitment and screening apps on Facebook Building and deploying test instruments within online gaming platforms Monitoring and activity tracking apps on mobile device platforms 10/12/2012Virginia IRB Consortium Conference14
  • Slide 15
  • Research Opportunities: Infrastructure Leverage cloud-based computing infrastructures to handle resource-intensive processing tasks Clinical trial data storage & processing Sharing extremely large databases Innovative, non-traditional use of cloud-based processing resources ____@Home (distributed computing) Fold.It Amazon Mechanical Turk 10/12/2012Virginia IRB Consortium Conference15
  • Slide 16
  • Fold.It Web-based puzzle video game to assist with protein folding research Leverage millions of gamers to assist in data processing 10/12/2012Virginia IRB Consortium Conference16
  • Slide 17
  • Fold.It 10/12/2012Virginia IRB Consortium Conference17 http://fold.it/
  • Slide 18
  • Fold.It Web-based puzzle video game to assist with protein folding research Leverage millions of gamers to assist in data processing Players produced an accurate 3D model of and AIDS-related enzyme in just 10 days Researchers had been trying for 15 years 10/12/2012Virginia IRB Consortium Conference18
  • Slide 19
  • Amazon Mechanical Turk Facilitates outsourcing of computational or other mundane tasks Requesters post Human Intelligence Tasks offering minimal fees Workers select tasks to complete for micropayments 10/12/2012Virginia IRB Consortium Conference19
  • Slide 20
  • Amazon Mechanical Turk 10/12/2012Virginia IRB Consortium Conference20
  • Slide 21
  • 3 Layers of Cloud Computing http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0) 10/12/2012Virginia IRB Consortium Conference21
  • Slide 22
  • Ethical Dimensions Subject confidentiality & anonymity Data privacy & security Data ownership & stewardship Research integrity & authorship 10/12/2012Virginia IRB Consortium Conference22
  • Slide 23
  • Subject Confidentiality & Anonymity When recruiting subjects or collecting data with cloud-based applications Are IP addresses logged in such a way to allow re- identification of subjects Using a Facebook app might provide researchers access to unnecessary personal information Are cloud providers tracking data and usage themselves? Delivering ads? Selling user data? 10/12/2012Virginia IRB Consortium Conference23
  • Slide 24
  • Data Privacy & Security Critical concern of any cloud system, takes on even more importance when dealing with subject data Are cloud-based communication and collaboration systems using SSL encryption? Is data stored on cloud-servers encrypted? What is services policy regarding 3 rd party access Advertisers Investigative inquiry vs. subpoena vs. warrants? Electronic Communication Privacy Act (ECPA) 10/12/2012Virginia IRB Consortium Conference24
  • Slide 25
  • Data Ownership & Stewardship Who owns, and who controls (meta)data in the cloud? Are you granting the cloud provider any license to use your data or activities (for advertising, data mining, etc)? Can you ensure data remains in the U.S.? Can data be destroyed on demand, including backups? Can you ensure cloud provider wont hold your data hostage, or disappear? 10/12/2012Virginia IRB Consortium Conference25
  • Slide 26
  • Research Integrity & Authorship Should researchers rely on cloud-based data processing and analysis? Can you trust (or audit?) external/collaborative processing platforms Ethical to use Mechanical Turk, or otherwise outsource mundane tasks to unknown persons for nominal wages? Authorship claims? 10/12/2012Virginia IRB Consortium Conference26
  • Slide 27
  • Conceptual Gaps & Policy Vacuums Emergence of new technologies often lead to conceptual gaps in how we think about ethical problems, and reveal policy vacuums for how we should best address them Computer technology transforms many of our human activities and social institutions, and will leave us with policy and conceptual vacuums about how to use computer technology Often, either no policies for conduct in these situations exist or existing policies seem inadequate. Jim Moor, What is Computer Ethics? 10/12/2012Virginia IRB Consortium Conference27
  • Slide 28
  • Conceptual Gaps & Policy Vacuums The fluidity and complexity of cloud-based tools and platforms creates potential conceptual gaps Are these ethical dimensions merely the same as before, or fundamentally different due to the cloud? Does the nature of anonymity, privacy, consent, even harm change when dealing with cloud-based research? 10/12/2012Virginia IRB Consortium Conference28
  • Slide 29
  • Conceptual Gap: Privacy Presumption that because subjects make information available on a cloud-based service, they dont have an expectation of privacy Researchers/IRBs might assume everything is always public, and was meant to be Assumes no harm could come to subjects if data is already public New ethical problems Ignores contextual nature of sharing Fails to recognize the strict dichotomy of public/private doesnt apply in the 2.0 world Need to track if ToS/architecture have changed, or if users even understand what is available to researchers Nissenbaum, H. 2011. Privacy in Context: Technology, Policy, and the Integrity of Social Life Virginia IRB Consortium Conference2910/12/2012
  • Slide 30
  • Conceptual Gap: Anonymity vs. Identifiability Presumption that stripping names & other obvious identifiers provides sufficient anonymity when sharing data in the cloud Assumes only PII allows re-identification New ethical problems Ignores how anything can potentially identifiable information and become the missing link to re-identify an entire dataset Anonymous datasets are not achievable and provides false sense of protection Ohm, P. Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law Review Virginia IRB Consortium Conference3010/12/2012
  • Slide 31
  • Conceptual Gap: Consent Presumption that because something is shared or available without a password, the subject is consenting to it being harvested for research Assumes no harm can come from use of data already shared with friends or other contextually-bound circles New ethical problems Must recognize that a user making something public online comes with a set of assumptions/expectations about who can access and how Must recognize how research methods might allow un- anticipated access to restricted data Virginia IRB Consortium Conference3110/12/2012
  • Slide 32
  • Conceptual Gap: Harm Presumption that harm means risk of physical or tangible impact on subject Researchers often imply data is already public, so what harm could possibly happen New ethical problems Must move beyond the concept of harm as requiring a tangible consequence Protecting from harm is more than protecting from hackers, spammers, identity thieves, etc Consider dignity/autonomy theories of harm Must a wrong occur for there to be damage to the subject? Do subjects deserve control over the use of their data streams? Virginia IRB Consortium Conference3210/12/2012
  • Slide 33
  • Conceptual Gap: Human Subjects Researchers (esp. CompSci) often interact only with datasets, objects, or avatars, thus feel a conceptual distance from an actual human Often dont consider what they do as human subject research New ethical problems Must bridge this (artificial) distance between researcher and the actual human subject Also consider other stakeholders within the complex arrangement of information intermediaries Carpenter, K & Dittrich, D. Bridging the Distance: Removing the Technology Buffer and Seeking Consistent Ethical Analysis in Computer Security Research Virginia IRB Consortium Conference3310/12/2012
  • Slide 34
  • Conceptual Gaps & Policy Vacuums The fluidity and complexity of cloud-based tools and platforms creates potential conceptual gaps Are these ethical dimensions merely the same as before, or fundamentally different due to the cloud? Does the nature of anonymity, privacy, consent, even harm change when dealing with cloud-based research? Leaving researchers & IRBs with considerable policy vacuums How should researchers deal with using the cloud in their projects? How should IRBs review them? And how can we ensure good research still gets done 10/12/2012Virginia IRB Consortium Conference34
  • Slide 35
  • What can Researchers & IRBs do? - broadly Get educated, find recourses Events like today; PRIM&R Utilize disciplinary resources For example: Ethical decision-making and Internet research: Recommendations from the AoIR Ethics Working Committee Keep up on research Utilize experts Look for guidance Increased attention hopefully will prompt guidance from HHS and related regulatory bodies 10/12/2012Virginia IRB Consortium Conference35
  • Slide 36
  • What can Researchers & IRBs do? - practically Read and understand the Terms of Service Incorporate in risk analysis Include mention of cloud-based services in consent forms Level of detail? Monitor/audit cloud services over life of project Have terms or practices changed? All this is new, complex, and difficult 10/12/2012Virginia IRB Consortium Conference36
  • Slide 37
  • Anyone who has studied the history of technology knows that technological change is always a Faustian bargain Technology giveth and technology taketh away, and not always in equal measure. A new technology sometimes creates more than it destroys. Sometimes, it destroys more than it creates. But it is never one-sided. Neil Postman 10/12/2012Virginia IRB Consortium Conference37
  • Slide 38
  • Research, the Cloud, and the IRB: NEW OPPORTUNITIES :: NEW CHALLENGES Michael Zimmer, PhD Assistant Professor, School of Information Studies Director, Center for Information Policy Research University of Wisconsin-Milwaukee zimmerm@uwm.edu www.michaelzimmer.org

Recommended

View more >