research, the cloud, and the irb

Research, the Cloud, and the IRB

PRIM&R WorkshopDecember 3, 2011

Michael Zimmer, PhDAssistant Professor, School of Information Studies

Co-Director, Center for Information Policy ResearchUniversity of Wisconsin-Milwaukee

zimmerm@uwm.eduwww.michaelzimmer.org

Agenda

What is Cloud Computing

Opportunities for Use in Research

Ethical Dimensions Subject confidentiality & anonymity Data privacy & security Data ownership & stewardship Research integrity & authorship

What can Researchers and IRBs do?

What do Researchers and IRBs need?

What is Cloud Computing?

KEXINO (CC BY-NC-ND 2.0) http://www.flickr.com/photos/kexino/4202662815/

What is Cloud Computing?

On-demand, network-based access to computing recourses

Location independent, flexible, scalable, cost effective, little (if any) local support or maintenance

As of September 2008, 69 percent of Americans were using webmail services, storing data online, or otherwise using software programs, such as word processing applications, whose functionality is located on the web.

3 Layers of Cloud Computing

http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0)

Application Layer

“Software as a service”

Providing productivity applications via the Web; no local software needed

Platform Layer

“Platform as a service”

Providing application development platforms and operating systems via the Web

Can deploy applications without needing your own infrastructure

Infrastructure Layer

“Infrastructure as a service”

Provide computing infrastructure on demand

Outsourcing servers, storage, network equipment, processing power, data centers

3 Layers of Cloud Computing

http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0)

Research Opportunities for Cloud Computing

Application layer Most common and easiest application of cloud Data gathering, storage, collaboration

Platform layer Hosted apps for recruitment & surveys

Infrastructure layer Access to increased processing power for large-

scale research projects Some non-traditional uses

Research Opportunities: Applications

Data gathering using web-based survey applications SurveyMonkey Zoomerang Qualtrics

Typically used “in the wild”, sometimes institutionally-bound

Research Opportunities: Applications

Data storage & sharing using cloud-based applications Dropbox Box.net iCloud

Communication & collaboration using cloud-based applications Gmail, IM, Skype Google Docs, Office Live Wikis

Research Opportunities: Platforms

With skilled programmers, can build custom apps to deploy via cloud-based platforms Subject recruitment and screening apps on

Facebook Building and deploying test instruments within

online gaming platforms Monitoring and activity tracking apps on mobile

device platforms

Research Opportunities: Infrastructure

Leverage cloud-based computing infrastructures to handle resource-intensive processing tasks Clinical trial data storage & processing Sharing extremely large databases

Innovative, non-traditional use of cloud-based processing “resources” ____@Home (distributed computing) FoldIt Amazon Mechanical Turk

FoldIt

FoldIt

Web-based puzzle video game to assist with protein folding research

Leverage millions of gamers to assist in data processing

Players produced an accurate 3D model of and AIDS-related enzyme in just ten days Researchers had been trying for 15 years

Amazon Mechanical Turk

Facilitates outsourcing of computational or other mundane tasks

Requesters post “Human Intelligence Tasks” offering minimal fees

Workers select tasks to complete for micropayments

Ethical Dimensions

Subject confidentiality & anonymity

Data privacy & security

Data ownership & stewardship

Research integrity & authorship

Subject Confidentiality & Anonymity

When recruiting subjects or collecting data with cloud-based applications… Are IP addresses logged in such a way to allow

re-identification of subjects Using a Facebook app might provide researchers

access to unnecessary personal information Are cloud providers tracking data and usage

themselves? Delivering ads?

Data Privacy & Security

Critical concern of any cloud system, takes on even more importance when dealing with subject data Are cloud-based communication and

collaboration systems using SSL encryption? Is data stored on cloud-servers encrypted? What is service’s policy regarding 3rd party access

AdvertisersInvestigative inquiry vs. subpoena vs. warrants?Electronic Communication Privacy Act (ECPA)

Data Ownership & Stewardship

Who owns, and who controls (meta)data in the cloud? Are you granting the cloud provider any license to

use your data or activities (for advertising, data mining, etc)?

Can you ensure data remains in the U.S.? Can data be destroyed on demand, including

backups? Can you ensure cloud provider won’t hold your

data “hostage”, or disappear?

Research Integrity & Authorship

Should researchers rely on cloud-based data processing and analysis? Must trust (audit?) external/collaborative

processing platforms Ethical to use Mechanical Turk, or otherwise

outsource mundane tasks? Authorship claims?

What can Researchers & IRBs do?

Read and understand the Terms of Service Incorporate in risk analysis

Include mention of cloud-based services in consent forms Level of detail?

Monitor cloud services over life of project Have terms or practices changed?

All this is new, complex, and difficult…

What do Researchers & IRBs need?

Training in interpreting ToS

Tools to help make translation between federal regulations and ToS, and evaluate protocols

What else?