Mortifyingly Stupid CITI Training Kills Oral History Course

Writing on H-Oral, Carl Kramer, the retired director of the Institute for Local and Oral History, Indiana University Southeast, reports that Indiana University's requirement of the mortifyingly stupid CITI Program dissuaded him from requiring oral history students to conduct actual interviews:

The issue is whether the training is relevant to oral history. Last year, I planned to have the students in my Oral History course at Indiana University Southeast interview baby boomers who grew up in a nearby former company town. The local library had conducted a similar project of the previous generation about 25 years earlier, and I thought it would be a great follow up. But meanwhile, Indiana University had adopted a national training program for human subjects research that was oriented toward biomedical and psychological standards, including units on dealing with pregnant women and fetuses, HIPPA, medically-oriented conflict of interest issues. It took me approximately seven hours to review the tutorial and take the exam. As an instructor who has conducted hundreds of interviews for many years, I concluded that if it took me that long to take an exam whose content was largely irrelevant to oral history, then I could not reasonably require my students to take it. So I ended up giving them the option of doing an interview or taking a final exam. The split was about 50-50, with the majority opting for the final exam. This was for an expedited review project through the IRB. I retired from the institute under which I taught the course, and I would never again teach a course that required such an irrelevant exam.

His comment comes in reply to a posting by a Kent State graduate student who may lose grant funding because she relied on OHRP's 2003 letter stating that "oral history interviewing activities, in general, are not designed to contribute to generalizable knowledge and, therefore, do not involve research as defined by Department of Health and Human Services (HHS) regulations at 45 CFR 46.102(d) and do not need to be reviewed by an institutional review board (IRB)."

Is Facebook Data Mining Human Subjects Research?

Recent law-school graduate Lauren Solberg finds that "data mining on Facebook likely does not constitute research with human subjects, and therefore does not require IRB review, because a researcher who collects data from Facebook pages does not 'interact' with the individual users, and the information on Facebook that researchers mine from individual users' pages is not 'private information.'"

[Lauren Solberg, "Data Mining on Facebook: A Free Space for Researchers or an IRB Nightmare?" article under review, University of Illinois Journal of Law, Technology & Policy 2010 (2). The article has been accepted for publication, but the journal is still soliciting comments.]

Solberg challenges policies now in place at Indiana University and the University of Massachusetts Boston, where researchers must get Facebook's written permission or the written permission of every individual who is studied. These policies, she argues, impose unnecessary burdens on researchers and IRBs alike. (The two policies are identical, but it's not clear which university borrowed from the other.)

She argues that most data mining projects do not meet the regulatory definition of human subjects research. Reading existing profiles is not interaction with an individual. Nor is a Facebook profile that is open to strangers private information, i.e., "information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record)." If a college admissions officer or a potential employer can read your profile, you've lost little by having an anthropologist read it as well.

This analysis seems sound, but it's not clear to me that anyone disagrees. In particular, the third university Solberg mentions, Washington University in St. Louis, applies its policy only to "
Any activity meeting the definition of 'human subject research' which is designed to recruit participants or collect data via the Internet." It then lists several examples, most of which involve interaction with living individuals. Thus, I doubt Solberg's claim that "researchers at Washington University need only inform Facebook users that they are recording information that is posted on their pages." Rather, if the project does not meet the definition of human subject research, then Wash U. researchers need not do even that much.

Solberg's article skirts some interesting questions. One concerns the boundaries of a reasonable expectation of privacy. Thus, Michael Zimmer gives the example of a study by Harvard graduate students of the Facebook profiles of Harvard undergraduates. If an undergraduate had made some information visible only to other Harvard students (a choice Facebook's software allows), and a Harvard student-researcher sees it, does that change Solberg's analysis?

A second question concerns the authority of university research offices and IRBs to insist that researchers abide by website terms of service. Notably, the Indiana and UMASS policies do not cite federal human subjects regulations as their authority. Rather, they claim that Facebook and Myspace "explicitly state that their sites are not intended for research but for social networking only."

Solberg writes that evaluating such claims is "outside the scope of this article," but they are interesting in three ways. First, they may be factually false; I could find no such explicit statements in the Facebook or Myspace terms of service. Second, they are divorced from federal regulation. For example, the Facebook terms of service do not distinguish between living and dead Facebook members, whereas federal human subjects protections apply only to the living. Finally, they are internally inconsistent. If Facebook and Myspace did prohibit the use of their sites for research, would not researchers still be violating the terms of service even if they got signed consent from individual members, as allowed by the policies? Just who are these two universities trying to protect?

Solberg concludes that "Unfortunately, and somewhat surprisingly, the OHRP has issued no guidance pertaining to Internet research in general, let alone guidance specifically relating to the issue of data mining on the Internet." To give the feds some credit, in summer 2010 (after Solberg wrote her article), SACHRP did sponsor a panel on the Internet in Human Subjects Research. It can take a long time from a SACHRP presentation to OHRP guidance, but the wheels may be moving on this one.

---

Note, 19 November 2010: The original version of this post identified Ms. Solberg as a law student. She has in fact graduated. I have also changed the link about Michael Zimmer's work from his SACHRP presentation to his article, "'But the data is already public': on the ethics of research in Facebook," Ethics and Information Technology 12 (2010): 313-325.

OHRP Continues Indiana-Bloomington Investigation

In September I reported on the OHRP investigation of Indiana University-Bloomington, ably covered by the Bloomington Herald-Times. Along with several stories, an editorial, and at least two op-eds, the newspaper posted heavily redacted copies of the OHRP letter and the IU reply.

On October 3, I submitted a Freedom of Information Act request for the unredacted OHRP complaint. This week, I received a reply, dated November 17, stating that "the subject matter of your request is the subject of an open and ongoing investigation. Release of any additional information at this time could reasonably be expected to interfere with ongoing proceedings." Hence, I received no information. We still don't know what Indiana-Bloomington did to bring down the federal hammer, or if the hammer will strike again.

Meanwhile, the crackdown has disrupted research, especially for social scientists. As the Herald-Times reported on October 8 (Nicole Brooks, "IU Research Oversight Office Has More Staff, But Projects Still Delayed"),

The need to “attend to the compliance issue speedily” led to Bloomington researchers using the same proposal forms as IUPUI faculty, according to [Research Affairs Committee chairman Stephen] Burns. These forms are designed for medical research, and are “more complex than needed,” especially for social science researchers.

This has caused some faculty — and students — to not bother with some research projects, Burns said. And some students are changing their thesis topics so they don’t include human subjects research, he said.

Before the compliance issue came into play, when Bloomington campus faculty used their own form and not IUPUI’s, this was a problem, Burns said. Research topics are becoming more and more diverse, and the divide between what information is necessary for different kinds of research is widening, he said.

The upshot is that faculty and students at a major research university are abandoning their research because of secret allegations against their university's administration. It's all very well for OHRP to claim (as Ivor Pritchard did at the October SACHRP meeting) that OHRP enforcement actions are rare. But even the rare crackdown, if as severe as this one, is enough to have IRBs nationwide quaking in fear, and putting regulatory compliance above all other considerations.

Crackdown at Indiana University

The Bloomington Herald-Times reports (August 10-12) on problems with human subject reviews at Indiana University in Bloomington (IUB). Though the paper does not give details of what went wrong, it does state that in the summer of 2008, two whistleblowers in the human subjects office successfully the appealed negative evaluations they had received after airing complaints. Their immediate supervisor, Carey Conover, has been reassigned, But Conover's boss, Eric Swank, has been promoted to executive director for research compliance for Bloomington and other Indiana campuses, with a salary bump from $79,000 to $119,600.

Moreover, the university has moved to protect itself by layering on more administration. According to an August 17 Herald-Times column by the university provost, Bloomington's new president "has expanded the budget for research compliance by $4.3 million - the single largest addition to his budget - in order to create a university-wide organization of well over 100 people, professionals whose sole mission is to preserve and protect the university's research mission." And starting July 1, all IUB studies have been sent to the Indiana University-Purdue University Indianapolis (IUPUI) IRB, where, the university promises, they will be met with an "AAHRPP-accredted HRPP" and legions of "CIP-certified staff members." Meanwhile, Bloomington IRB members and staff were sent for reeducation by Jeffrey Cohen, who, no doubt, told them to review oral history.

None of this is reassuring to social scientists back at Bloomington. Writing in the Herald-Times on September 14, Noretta Koertge, a specialist in research ethics, urged "the university to take this opportunity to resist bureaucratic mission creep." Lower on the chain, informatics PhD student Kevin Makice frets that the dust-up will delay his research to the point that he will have to rely on theory and public data to meet a conference deadline. He writes, "The human-computer interaction crowd often goes to [the Computer/Human Interaction conference] talking about the woes of the research approval process only to hear how much simpler it is on other U.S. campuses and seemingly non-existent off the continent. Now, with IUPUI overburdened by serving multiple campuses--which apparently is in the long-term restructuring plans anyway--we miss the days of it just being too complicated."

Back in 2005, the Illinois White Paper on IRBs complained that the "death penalty" of shutting down all research at a university in response to a single IRB violation. This penalty, the paper warned, was largely responsible for IRBs' terrified emphasis on regulatory compliance. It looks like Indiana researchers will suffer for the sins of the research administrators.