Law Professor Sees Broad Role for IRBs in Virtual Worlds

Professor Joshua A. T. Fairfield of the Washington & Lee University School of Law explores the law of research in virtual worlds.

[Joshua Fairfield, "Avatar Experimentation: Human Subjects Research in Virtual Worlds." (November 29, 2010). U.C. Irvine Law Review, Symposium Issue, 2011; Washington & Lee Legal Studies Paper No. 2010-14. Available at SSRN: http://ssrn.com/abstract=1717057.]

Fairfield makes some important points about how researchers interested in these environments might apply ethical guidelines developed for older forms of research. But the article pays insufficient attention to the limits of ethical guidance developed to govern medical experimentation, misstates some of the provisions of current regulations, and downplays the troubles Internet researchers have faced with IRBs.

Ethical Issues

Fairfield raises important points about the ethical challenges of research into virtual worlds. He notes, for example, that elements of a virtual world can be valued as much as more tangible assets:

An avatar, for example, does not merely represent a collection of pixels—it represents the identity of the user. The user is known by the avatar’s name and is represented in the virtual world by the avatar. The avatar is the connection of the user to her online social community. Likewise, virtual reputations and trust are costly to generate, but easy to lose. If an avatar is identified as having harmed the community through interactions with a researcher, the human being behind the avatar will certainly suffer harm to her identity, reputation, and community.

In the same vein, the accumulation of property in virtual worlds often reflects very real economic interests of the human subject. Many virtual worlds have in-world economies. These virtual economies have grown rapidly, and began interacting with the real-world economy. People now routinely use real dollars to purchase virtual land, goods, and services.

As an example of the perils of research into such worlds, Fairfield offers the case of Elizabeth Reid, who found that her research disrupted an online community.

These strike me as fair points that should be kept in mind by researchers wishing to avoid harm to research participants.

Fairfield is less persuasive when he suggests that the Belmont Report offers helpful guidance to such researchers. He offers a somewhat odd account of the the report, describing it in a section entitled "Law," though the report has no legal force. And he has subsections entitled "autonomy," "beneficence," and "justice," though the Belmont Report's three principles are respect for persons, beneficence and justice.

"Researchers should account for the communal nature of virtual worlds," he writes, under the beneficence heading. "They should take precautions to safeguard the community as a whole, in addition to those individuals directly participating in the research." Maybe so. But as commentators have pointed out, the Belmont Report does not address questions of community.

And Fairfield himself notes that the Belmont Report's concern for "fair procedures and outcomes in the selection of research subjects" is not clearly relevant to research on virtual worlds. "It is important not to overstate the issue," he writes. "Human subjects research is conducted on narrow population segments all the time."

Legal and Regulatory Issues: Private Information

"The law governing human subjects research in virtual worlds is wide-ranging and complex," Fairfield proclaims. True enough. Unfortunately, he oversimplifies that law, potentially misleading his readers.

The first set of claims concerns data saved by the companies that run virtual worlds ("game gods") and shared with researchers. Fairfield claims that "Commercial databases are increasingly relevant to virtual worlds research. Game gods license enormous collections of data to researchers for secondary analysis." Moreover, he claims, "Secondary data sets can include the extremely private conversations of millions of virtual world users over a period of years." Finally, he states that "in general it is not possible to obtain blanket consent from everyone in a virtual world," suggesting that there is no ethical or legal way to conduct analysis of large datasets from server logs.

There are several problems with this analysis. First, the facts about the collections may be wrong. Fairfield attributes his factual claims to a 2009 article, describing Sony's sharing of four years of data of EverQuest 2. But the article he cites does not support the claims. For one thing, Sony shared data for "over 400,000 players," not "millions." Second, the article mentions only one such collection of data--for Everquest 2--and notes that and most companies "haven't been interested in sharing their logs or the logs themselves don't contain the sort of data that would make for fruitful research." Thus, Fairfield's plurals ("databases" and "data sets") may be inaccurate.

Moreover, Fairfield ignores a follow-up post stating that the logs were “scrubbed of all PII (Personally Identifiable Information) prior to being provided to the researchers.” Presumably this would include "extremely private conversations."

Second, the article offers a brief analysis of whether research using such logs would constitute human subjects research under the Common Rule. Unfortunately, this analysis seems uninformed by current OHRP guidance. For one thing, Fairfiled claims that because the Common Rule provides for expedited review of research involving data that has been collected for nonresearch purposes, such work must be research under the Common Rule definition. "Expedited review under the Common Rule is only available for human subjects research," he writes, "so any listed categories represent the narrowest subset of data analysis that can be considered research under the regulations."

OHRP has rejected such reasoning. "The fact that an activity, such as oral history, appears on the list of activities that may be reviewed by an IRB through an expedited review procedure does not mean that such an activity always involves research," wrote Michael Carome in 2005. "For example, collection of blood samples; weighing or testing sensory acuity; magnetic resonance imaging; electrocardiography, electroencephalography, thermography, detection of naturally occurring radioactivity, electroretinography, ultrasound, diagnostic infrared imaging, doppler blood flow, and echocardiography; moderate exercise, muscular strength testing, body composition assessment, and flexibility testing are also on the expedited review category list; however, the use of these procedures most commonly occurs outside the research context."

Third, Fairfield dances around the question of whether the server logs contain the "identifiable private information" necessary to trigger IRB jurisdiction under the Common Rule. Even if the logs did include messages from one player to another, 45 CFR 46.102 defines "private information" as "information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record)." And, as Fairfield notes, virtual worlds typically require users to agree to licenses "inform users that their personal and private information may be given to third parties."

Fairfield suggests that though these license agreements may be legally binding, no one reads them and "these users have not meaningfully consented to the use of their private communications as research fodder, nor would ethical researchers make use of such data since it contravenes the users’ expectations of privacy."

Perhaps. But the Common Rule does not require IRB review merely because an individual expects privacy; the individual must reasonably expect privacy, and I wonder if such expectations are reasonable in this case. Of course, a researcher can choose to respect even unreasonable expectations of privacy. But conflating what is ethical and what is legal, Fairfield risks confusing his readers.

Finally, it is odd to see Fairfield disparage the legalistic license agreements that no one reads only to champion IRB-approved consent forms, which are also ignored or misunderstood by their intended readers.

Fairfield would be on stronger ground had he explored how medical researchers, IRBs, and regulators have made use of datasets containing sensitive medical information. His use of "general judicial decisions" to understand what "obtains" means in the context of human subjects research, rather than OHRP's Guidance on Research Involving Coded Private Information or Biological Specimens, suggests that there is much more work to be done to figure out what "realspace research" can tell us about the study of virtual worlds.

Legal and Regulatory Issues: When is Informed Consent Necessary?

The article misrepresents the regulations when it claims that "The Common Rule requires full and documented informed consent to all human subjects research." The accompanying foonote (137) reads: "("[N]o investigator may involve a human being as a subject in research covered by this policy unless the investigator has obtained the legally effective informed consent of the subject of the subject's legally authorized representative.")."

Why is that capital "N" in brackets? Because the actual regulation reads, "Except as provided elsewhere in this policy, no investigator may involve a human being as a subject in research covered by this policy unless the investigator has obtained the legally effective informed consent of the subject or the subject's legally authorized representative." And those exceptions include all the exemptions of 45 CFR 46.101. Thus, the regulations do not require researchers to obtain informed consent for an enormous range of human subjects research in virtual worlds.

I could not find a reference to 45 CFR 46.101 anywhere in the article. This is a serious oversight.

Strategic Issues

If ethics committees had a good record of offering sound advice to Internet researchers, those researchers would not need to insist on their rights under the Common Rule. But ethics committees have compiled a poor record. As Elizabeth A. Buchanan and Charles M. Ess noted in 2009, "IRBs generally do not know what . . . protections apply strictly to online research, and such boards often ignore the complexities of such research and thereby risk harming subjects while also violating federal regulations, or, they apply such restrictive models that inhibit researchers from pursuing important online endeavors." (British researchers have similar complaints.)

Fairfield briefly alludes to researcher complaints about IRBs, though not specifically to their treatment of Internet research. But he offers little in the way of solutions, except to promise that "A well-informed IRB will better understand the ethical issues in virtual worlds research and will be able to issue strong recommendations to improve an inadequate proposal." While he is imagining such an IRB, Fairfield may as well assume a can opener.

What Experimentation?

Finally, I must note the oddity of the title; though the article is entitled, "Avatar Experimentation," it does not describe any experimentation taking place in these vitual worlds. The first paragraph claims "a significant increase in the number of virtual world human subjects experiments," but it cites an article that does not mention experimentation, only interview and observational research. By conflating all interaction with experimentation, Fairfield risks perpetuating a system of ethics that takes medical experimentation as a norm and other forms of research with people as deviations. This has had poor results in realspace, and it is likely to work just as badly in other worlds.

All told, Fairfield has raised some important questions of how human subjects regulations and research ethics might constrain research on virtual worlds. But the article is not well grounded in either the facts or the law.