1.
Research, the Cloud, and the IRB
PRIM&R Workshop
December 3, 2011
Michael Zimmer, PhD
Assistant Professor, School of Information Studies
Co-Director, Center for Information Policy Research
University of Wisconsin-Milwaukee
zimmerm@uwm.edu
www.michaelzimmer.org
2. Agenda
What is Cloud Computing
Opportunities for Use in Research
Ethical Dimensions
Subject confidentiality & anonymity
Data privacy & security
Data ownership & stewardship
Research integrity & authorship
What can Researchers and IRBs do?
What do Researchers and IRBs need?
3. What is Cloud Computing?
KEXINO (CC BY-NC-ND 2.0) http://www.flickr.com/photos/kexino/4202662815/
4. What is Cloud Computing?
On-demand, network-based access to
computing recourses
Location independent, flexible, scalable, cost
effective, little (if any) local support or
maintenance
As of September 2008, 69 percent of Americans
were using webmail services, storing data
online, or otherwise using software
programs, such as word processing
applications, whose functionality is located on
the web.
5. 3 Layers of Cloud Computing
http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0)
6. Application Layer
“Software as a service”
Providing productivity applications via the
Web; no local software needed
7. Platform Layer
“Platform as a service”
Providing application development platforms
and operating systems via the Web
Can deploy applications without needing
your own infrastructure
8. Infrastructure Layer
“Infrastructure as a service”
Provide computing infrastructure on demand
Outsourcing servers, storage, network
equipment, processing power, data centers
9. 3 Layers of Cloud Computing
http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0)
10. Research Opportunities for Cloud
Computing
Application layer
Most common and easiest application of cloud
Data gathering, storage, collaboration
Platform layer
Hosted apps for recruitment & surveys
Infrastructure layer
Access to increased processing power for large-
scale research projects
Some non-traditional uses
11. Research Opportunities: Applications
Data gathering using web-based survey
applications
SurveyMonkey
Zoomerang
Qualtrics
Typically used “in the wild”, sometimes
institutionally-bound
12. Research Opportunities: Applications
Data storage & sharing using cloud-based
applications
Dropbox
Box.net
iCloud
Communication & collaboration using cloud-
based applications
Gmail, IM, Skype
Google Docs, Office Live
Wikis
13. Research Opportunities: Platforms
With skilled programmers, can build custom
apps to deploy via cloud-based platforms
Subject recruitment and screening apps on
Facebook
Building and deploying test instruments within
online gaming platforms
Monitoring and activity tracking apps on mobile
device platforms
14. Research Opportunities: Infrastructure
Leverage cloud-based computing
infrastructures to handle resource-intensive
processing tasks
Clinical trial data storage & processing
Sharing extremely large databases
Innovative, non-traditional use of cloud-
based processing “resources”
____@Home (distributed computing)
FoldIt
Amazon Mechanical Turk
16. FoldIt
Web-based puzzle video game to assist with
protein folding research
Leverage millions of gamers to assist in data
processing
Players produced an accurate 3D model of
and AIDS-related enzyme in just ten days
Researchers had been trying for 15 years
17. Amazon Mechanical Turk
Facilitates outsourcing of computational or
other mundane tasks
Requesters post “Human Intelligence Tasks”
offering minimal fees
Workers select tasks to complete for
micropayments
19. Ethical Dimensions
Subject confidentiality & anonymity
Data privacy & security
Data ownership & stewardship
Research integrity & authorship
20. Subject Confidentiality & Anonymity
When recruiting subjects or collecting data
with cloud-based applications…
Are IP addresses logged in such a way to allow
re-identification of subjects
Using a Facebook app might provide researchers
access to unnecessary personal information
Are cloud providers tracking data and usage
themselves? Delivering ads?
21. Data Privacy & Security
Critical concern of any cloud system, takes on
even more importance when dealing with
subject data
Are cloud-based communication and
collaboration systems using SSL encryption?
Is data stored on cloud-servers encrypted?
What is service’s policy regarding 3rd party access
Advertisers
Investigative inquiry vs. subpoena vs. warrants?
Electronic Communication Privacy Act (ECPA)
22. Data Ownership & Stewardship
Who owns, and who controls (meta)data in
the cloud?
Are you granting the cloud provider any license to
use your data or activities (for advertising, data
mining, etc)?
Can you ensure data remains in the U.S.?
Can data be destroyed on demand, including
backups?
Can you ensure cloud provider won’t hold your
data “hostage”, or disappear?
23. Research Integrity & Authorship
Should researchers rely on cloud-based data
processing and analysis?
Must trust (audit?) external/collaborative
processing platforms
Ethical to use Mechanical Turk, or otherwise
outsource mundane tasks?
Authorship claims?
24. What can Researchers & IRBs do?
Read and understand the Terms of Service
Incorporate in risk analysis
Include mention of cloud-based services in
consent forms
Level of detail?
Monitor cloud services over life of project
Have terms or practices changed?
All this is new, complex, and difficult…
25. What do Researchers & IRBs need?
Training in interpreting ToS
Tools to help make translation between
federal regulations and ToS, and evaluate
protocols
What else?