Alarmist Views on Harvard Facebook Study

The Chronicle of Higher Ed reports a debate over a study of Facebook profiles, started in 2006 by Jason Kaufman of Harvard's Berkman Center for Internet & Society. The debate suggests that researchers may not be aware of how easy it can be to identify allegedly anonymous institutions and individuals, but that neither IRBs nor outside critics may understand all the implications of a study either.

[Marc Parry, "Harvard's Privacy Meltdown," Chronicle of Higher Education, 10 July 2011.]

As I mentioned briefly last year, the Harvard researchers studied the Facebook profiles of undergraduates at "an anonymous, northeastern American university." In his June 2010 article, "'But the Data Is Already Public': On the Ethics of Research in Facebook, Michael Zimmer of the University of Wisconsin at Milwaukee critqued the study design on two grounds. (If there is a more recent news hook to the Chronicle story, I missed it.)

First, Zimmer showed that Kaufman had failed to keep secret the identity of the university he was studying by including information about majors (er, concentrations) and housing choices that are unique to Harvard.

Second, Zimmer suggested that Kaufman had erred in letting Harvard researchers study Harvard students:

A Facebook user might decide to share her profile information only with other Harvard students, but wants to remain private to the rest of the world. The RAs employed for the project, being from the same network as the subject, would be able to view and download a subject’s profile data that was otherwise restricted from outside view. Thus, her profile data—originally meant for only those within the Harvard network—is now included in a dataset released to the public. As a result, it is likely that profile information that a subject explicitly restricted to only ''in network'' participants in Facebook has been accessed from within that network, but then extracted and shared outside those explicit boundaries.

Kaufman apparently did not consider this possibility when designing the study, nor did he realize how easily information he did release about the university he was studying could be used to identify it as Harvard. By identifying individual students, the Chronicle showed that Zimmer was correct that the Kaufman team was wrong to claim that "all the data is cleaned so you can not connect anyone to an identity."

On the other hand, I believe Zimmer is simply wrong to suggest that it is possible to restrict one's profile only to other students at one's institution. So far as I know, Facebook makes no distinction among people using a given university's domain in their e-mail addresses. In other words, if a George Mason University undergraduate makes a profile visible only to members of the Mason network, I--as Mason faculty member--still get to see it. (Ick.) I don't know how long this has been the case, but I know it has been true since I joined Facebook some years ago. And I was able to join Harvard's network using my alumnus e-mail address.

I therefore question Zimmer's suggestion that students were "likely" to have posted significant information that they were unwilling to share with the general Facebook public but were willing to share with the tens of thousands of fellow Harvard students, staff, faculty, and alumni who presumably comprise the Harvard network on Facebook.

Zimmer may be right that "the IRB did not fully comprehend the complex privacy implications of this particular research project." But he goes too far in claiming that

By failing to recognize that users might maintain strong expectations that information shared on Facebook is meant to stay on Facebook, or that only members of the Harvard network would ever have access to the data, the T3 researchers have failed in their duty to engage in ethically-based research.

I suppose the students might maintain such expections, but the Common Rule defines "private information" as "information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public." (Emphasis added.) Facebook users can harbor no such expectations for their profiles.

As one comment on the Chronicle article puts it, "Something has gone horribly wrong in academe when non-profit researchers seeking to expand human knowledge are disallowed from doing what for-profit marketing companies who have nothing but their own gain as motive are legally allowed to do."

So what do we learn?

1. Researchers should not expect that the institutions and places they study will remain anonymous.

2. Researchers using cutting-edge methods, like the study of Facebook, may not appreciate all the privacy consequences of those methods.

3. Zimmer, the alleged expert in Internet privacy, is willing to speculate that Harvard students were "likely" to rely on a Facebook privacy setting that would afford them no real privacy. He apparently wants IRBs to forbid academic researchers from doing something that any advertiser could do (providing it hired a Harvard affiliate as an intern).

4. IRBs aren't much help. The article paraphrases Zimmer's judgment that IRBs "lack experience with Web-based research." Elizabeth A. Buchanan and Charles M. Ess would agree.

5. The federal government isn't much help. The article states that Zimmer thinks the federal government should "do more to educate IRB's about Web research." And it quotes Harvard spokesman Jeff A. Neal saying that "Federal regulators, professional associations, and IRB's are all working to understand these risks and to develop guidelines."

Are they really? Professional associations, perhaps. But regulators? SACHRP invited Zimmer and other experts to talk about Internet research, but that was a year ago. Where is the guidance? And where is the guidance about the hopelessness of anonymizing institutions, which has been known for decades?

All of this comes down to basic flaws in the current system of human research protections: it neither learns nor teaches. Harvard is a pretty good school, yet its IRB was unlikely to have an expert on Internet research or, better still, two Internet experts able to discuss the project in terms more measured than Zimmer's.

As Alice Dreger and Laura Stark have argued, serious expertise would require some kind of national coordination of knowledge. Canada's Panel on Research Ethics performs that role to a degree. But in the United States, the Ethics Advisory Board died an early death, and local IRBs have been wandering in the fog ever since.

The good news is that at least one person involved in the Harvard study did possess expertise about privacy and Facebook. "Anything that's put on Facebook somehow will make it out into the general public, no matter what you attempt to do," says Sarah M. Ashburn, one of the students whose profile was studied and who was identified by the Chronicle. "So I never have anything on my Facebook profile that I wouldn't want employers, my grandmother, like anyone in the world to be able to see."