Research, the Cloud, and the IRB:
NEW OPPORTUNITIES :: NEW CHALLENGES
Michael Zimmer, PhD
Assistant Professor, School of Information Studies
Director, Center for Information Policy Research
University of Wisconsin
-
Milwaukee
zimmerm@uwm.edu
www.michaelzimmer.org
•
A
nyone
who has studied the history of
technology knows that technological change is
always a Faustian
bargain
•
Technology
giveth
and technology
taketh
away,
and not always in equal measure
.
•
A new technology sometimes creates more than
it destroys. Sometimes, it destroys more than it
creates. But it is never one
-
sided
.
•
Neil
Postman
10/12/2012
Virginia IRB Consortium Conference
2
Agenda
•
What is Cloud Computing?
•
Opportunities for Use in Research
•
Ethical Dimensions
•
Subject confidentiality & anonymity
•
Data privacy & security
•
Data ownership & stewardship
•
Research integrity
& authorship
•
Conceptual Gaps & Policy Vacuums
•
What can Researchers and IRBs do?
10/12/2012
Virginia IRB Consortium Conference
3
What is Cloud Computing?
KEXINO (CC BY
-
NC
-
ND 2.0) http
://
www.flickr.com
/photos/
kexino
/4202662815/
10/12/2012
Virginia IRB Consortium Conference
4
What is Cloud Computing?
•
On
-
demand, network
-
based access to computing
recourses
•
Features
•
Location independent; supports increased mobility
•
Flexible, scalable, robust
•
On
-
demand performance; big data processing
•
Little (if any) local support or maintenance
10/12/2012
Virginia IRB Consortium Conference
5
What is Cloud Computing?
•
Milestones
•
1999
–
Salesforce.com
delivers enterprise services via the
web
•
2002
–
Amazon Web Services (storage, computation, human
intelligence via the cloud)
•
2004
–
Gmail reboots web
-
based email, follows with Google
Docs
•
2006
–
Amazon’s Elastic Compute Cloud (EC2)
•
2007
–
IBM shifts focus to the cloud
•
Popularity
•
As early as 2008
, 69 percent of Americans were using
webmail services, storing data online, or otherwise using
software
programs
located
on the
web
•
By 2011, 80% of Fortune 500 companies use IBM cloud
10/12/2012
Virginia IRB Consortium Conference
6
3 Layers of Cloud Computing
http://
en.wikipedia.org
/wiki/
File:Cloud_computing.svg
(
CC BY
-
SA 3.0
)
10/12/2012
Virginia IRB Consortium Conference
7
Application Layer
•
“Software as a service”
•
Providing productivity applications via the Web;
no local software needed
10/12/2012
Virginia IRB Consortium Conference
8
Platform Layer
•
“Platform as a service”
•
Providing application development platforms and
operating systems via the Web
•
Can deploy applications without needing your
own infrastructure or distribution channels
10/12/2012
Virginia IRB Consortium Conference
9
Infrastructure Layer
•
“Infrastructure as a service”
•
Provide computing infrastructure on demand
•
Outsourcing servers,
storage, network
equipment, processing power, data centers
10/12/2012
Virginia IRB Consortium Conference
10
Research Opportunities for Cloud
Computing
•
Application layer
•
Most common and easiest application of cloud
•
Data gathering, storage, collaboration
•
Platform layer
•
Hosted apps for recruitment & surveys
•
Infrastructure layer
•
Access to increased processing power for large
-
scale
research projects
•
Some non
-
traditional uses
10/12/2012
Virginia IRB Consortium Conference
11
Research Opportunities:
Applications
•
Data gathering
using web
-
based survey
applications
•
SurveyMonkey
•
Zoomerang
•
Qualtrics
•
Typically used
“in the wild”, sometimes
institutionally
-
bound
10/12/2012
Virginia IRB Consortium Conference
12
Research Opportunities:
Applications
•
Data storage & sharing
using cloud
-
based
applications
•
Dropbox
•
Box.net
•
iCloud
•
Communication & collaboration
using cloud
-
based applications
•
Gmail, IM, Skype
•
Google Docs, Office Live
•
Wikis
10/12/2012
Virginia IRB Consortium Conference
13
Research Opportunities:
Platforms
•
With skilled programmers, can build
custom apps
to deploy
via cloud
-
based platforms
•
Subject recruitment and screening apps on Facebook
•
Building and deploying test instruments within online
gaming platforms
•
Monitoring
and activity tracking apps on mobile
device
platforms
10/12/2012
Virginia IRB Consortium Conference
14
Research Opportunities:
Infrastructure
•
Leverage cloud
-
based computing infrastructures to
handle resource
-
intensive processing tasks
•
Clinical trial data storage & processing
•
Sharing extremely large databases
•
Innovative, non
-
traditional use of cloud
-
based
processing “resources”
•
____@Home (distributed computing)
•
Fold.It
•
Amazon Mechanical Turk
10/12/2012
Virginia IRB Consortium Conference
15
Fold.It
•
Web
-
based puzzle
video game
to assist with
protein folding research
•
Leverage millions of gamers to assist in data
processing
10/12/2012
Virginia IRB Consortium Conference
16
Fold.It
10/12/2012
Virginia IRB Consortium Conference
17
http://
fold.it
/
Fold.It
•
Web
-
based puzzle
video game
to assist with
protein folding research
•
Leverage millions of gamers to assist in data
processing
•
P
layers
produced an accurate 3D model
of and
AIDS
-
related enzyme
in just
10 days
•
Researchers had been trying for
15 years
10/12/2012
Virginia IRB Consortium Conference
18
Amazon Mechanical Turk
•
Facilitates outsourcing of computational or other
mundane tasks
•
Requesters post “Human Intelligence Tasks”
offering minimal fees
•
Workers select tasks to complete for
micropayments
10/12/2012
Virginia IRB Consortium Conference
19
Amazon Mechanical Turk
10/12/2012
Virginia IRB Consortium Conference
20
3 Layers of Cloud Computing
http://
en.wikipedia.org
/wiki/
File:Cloud_computing.svg
(
CC BY
-
SA 3.0
)
10/12/2012
Virginia IRB Consortium Conference
21
Ethical Dimensions
•
Subject confidentiality & anonymity
•
Data privacy & security
•
Data ownership & stewardship
•
Research integrity
& authorship
10/12/2012
Virginia IRB Consortium Conference
22
Subject Confidentiality & Anonymity
•
When recruiting subjects or collecting data with
cloud
-
based applications…
•
Are IP addresses logged in such a way to allow re
-
identification of subjects
•
Using a Facebook app might provide researchers access
to unnecessary personal information
•
Are cloud providers tracking data and usage
themselves? Delivering ads? Selling user data?
10/12/2012
Virginia IRB Consortium Conference
23
Data Privacy & Security
•
Critical concern of any cloud system, takes on even
more importance when dealing with subject data
•
Are cloud
-
based communication and collaboration systems
using SSL encryption?
•
Is data stored on cloud
-
servers encrypted?
•
What is service’s policy regarding 3
rd
party access
•
Advertisers
•
Investigative inquiry vs. subpoena vs. warrants?
•
Electronic Communication Privacy Act (ECPA)
10/12/2012
Virginia IRB Consortium Conference
24
Data Ownership & Stewardship
•
Who owns, and who controls (meta)data in the
cloud?
•
Are you granting the cloud provider any license to use your
data or activities (for advertising, data mining,
etc
)?
•
Can you ensure data remains in the U.S.?
•
Can data be
destroyed on demand,
including backups?
•
Can you ensure cloud provider won’t hold your data
“hostage”, or disappear?
10/12/2012
Virginia IRB Consortium Conference
25
Research Integrity & Authorship
•
Should researchers rely on cloud
-
based data
processing and analysis?
•
Can you trust (or audit?) external/collaborative processing
platforms
•
Ethical to use Mechanical Turk, or otherwise outsource
mundane tasks to unknown persons for nominal wages?
•
Authorship claims?
10/12/2012
Virginia IRB Consortium Conference
26
Conceptual Gaps & Policy Vacuums
•
Emergence of new technologies often lead to
conceptual gaps in how we think about ethical
problems, and reveal policy vacuums for how we
should best address them
•
Computer technology transforms “many of our human
activities and social institutions,” and will
“leave us with
policy and conceptual vacuums about how to use
computer technology”
•
“Often, either no policies for conduct in these
situations exist or
existing policies seem inadequate
.
•
Jim
Moor, “What is Computer Ethics?”
10/12/2012
Virginia IRB Consortium Conference
27
Conceptual Gaps & Policy Vacuums
•
The fluidity
and complexity of
cloud
-
based tools
and platforms creates potential
conceptual gaps
•
Are these ethical dimensions merely the same as before,
or fundamentally different due to the cloud?
•
Does the nature of anonymity, privacy, consent, even
harm change when dealing with cloud
-
based research?
10/12/2012
Virginia IRB Consortium Conference
28
Conceptual Gap: Privacy
•
Presumption that because subjects make information
available on a cloud
-
based service, they don’t have an
expectation of privacy
•
Researchers/IRBs might assume everything is always public, and
was meant to be
•
Assumes no harm could come to subjects if data is already
“public”
•
New ethical problems…
•
Ignores
contextual
nature of sharing
•
Fails to recognize the strict dichotomy of public/private doesn’t
apply in the 2.0 world
•
Need to track if
ToS
/architecture have changed, or if users even
understand what is available to researchers
Nissenbaum
,
H
. 2011. “Privacy
in Context: Technology,
Policy, and the Integrity of Social
Life”
Virginia IRB Consortium Conference
29
10/12/2012
Conceptual Gap: Anonymity vs.
Identifiability
•
Presumption
that stripping names & other obvious
identifiers provides sufficient
anonymity when
sharing data in the cloud
•
Assumes only PII allows re
-
identification
•
New ethical problems…
•
Ignores how
anything
can potentially identifiable
information and become the “missing link” to re
-
identify
an entire dataset
•
“Anonymous” datasets are not achievable and provides
false sense of protection
Ohm, P. “Broken promises of privacy: Responding to the
surprising failure of
anonymization
.” UCLA Law Review
Virginia IRB Consortium Conference
30
10/12/2012
Conceptual Gap: Consent
•
Presumption that because something is shared or
available without a password, the subject is
consenting to it being harvested for research
•
Assumes no harm can come from use of data already
shared with friends or other contextually
-
bound circles
•
New ethical problems…
•
Must recognize that a user making something public
online comes with a set of assumptions/expectations
about who can access and how
•
Must recognize how
research
methods
might allow un
-
anticipated access to “restricted”
data
Virginia IRB Consortium Conference
31
10/12/2012
Conceptual Gap: Harm
•
Presumption that “harm” means risk of physical or
tangible impact on subject
•
Researchers often imply “data is already public, so what
harm could possibly happen”
•
New ethical problems
•
Must move beyond the concept of harm as requiring a
tangible consequence
•
Protecting from harm is more than protecting from hackers,
spammers, identity thieves, etc
•
Consider dignity/autonomy theories of harm
•
Must a “wrong” occur for there to be damage to the subject?
•
Do subjects deserve control over the use of their data streams?
Virginia IRB Consortium Conference
32
10/12/2012
Conceptual Gap: Human Subjects
•
Researchers (esp.
CompSci
) often interact only
with datasets, objects, or avatars, thus feel a
conceptual distance from an actual human
•
Often don’t consider what they do as “human subject”
research
•
New ethical problems
•
Must bridge this (artificial) distance between
researcher and the actual human subject
•
Also consider other stakeholders within the complex
arrangement of information intermediaries
Carpenter, K &
Dittrich
, D
. “Bridging the Distance: Removing the Technology Buffer and
Seeking Consistent Ethical Analysis in Computer Security
Research”
Virginia IRB Consortium Conference
33
10/12/2012
Conceptual Gaps & Policy Vacuums
•
The fluidity
and complexity of
cloud
-
based tools and
platforms creates potential
conceptual gaps
•
Are these ethical dimensions merely the same as before, or
fundamentally different due to the cloud?
•
Does the nature of anonymity, privacy, consent, even harm
change when dealing with cloud
-
based research?
•
Leaving researchers & IRBs with considerable policy
vacuums
•
How should researchers deal with
using the cloud in
their
projects?
•
How should IRBs review them?
•
And how can we
ensure good research still gets
done…
10/12/2012
Virginia IRB Consortium Conference
34
What can Researchers & IRBs do?
-
broadly
•
Get educated, find recourses
•
Events like today; PRIM&R
•
Utilize disciplinary resources
•
For example: “
Ethical decision
-
making and Internet research:
Recommendations from the
AoIR
Ethics Working Committee”
•
Keep up on research
•
Utilize experts
•
Look for guidance
•
Increased attention hopefully will prompt guidance
from HHS and related regulatory bodies
10/12/2012
Virginia IRB Consortium Conference
35
What can Researchers & IRBs do?
-
practically
•
Read and understand the Terms of Service
•
Incorporate in risk analysis
•
Include mention of cloud
-
based services in
consent forms
•
Level of detail?
•
Monitor/audit cloud services over life of project
•
Have terms or practices changed?
•
All this is new, complex, and difficult…
10/12/2012
Virginia IRB Consortium Conference
36
•
A
nyone
who has studied the history of
technology knows that technological change is
always a Faustian
bargain
•
Technology
giveth
and technology
taketh
away,
and not always in equal measure
.
•
A new technology sometimes creates more than
it destroys. Sometimes, it destroys more than it
creates. But it is never one
-
sided
.
•
Neil
Postman
10/12/2012
Virginia IRB Consortium Conference
37
Research, the Cloud, and the IRB:
NEW OPPORTUNITIES :: NEW CHALLENGES
Michael Zimmer, PhD
Assistant Professor, School of Information Studies
Director, Center for Information Policy Research
University of Wisconsin
-
Milwaukee
zimmerm@uwm.edu
www.michaelzimmer.org
Enter the password to open this PDF file:
File name:
-
File size:
-
Title:
-
Author:
-
Subject:
-
Keywords:
-
Creation Date:
-
Modification Date:
-
Creator:
-
PDF Producer:
-
PDF Version:
-
Page Count:
-
Preparing document for printing…
0%
Σχόλια 0
Συνδεθείτε για να κοινοποιήσετε σχόλιο