place. The regulation that governs these boards is the Common Rule— “Common” because the same rule was passed in 1991 by each of the 17 federal agencies that fund most scientific research in the U.S.

Computer scientists working in the field of Human-Computer Interaction (HCI) have long been familiar with the Common Rule: any research that involves recruiting volunteers, bringing them into a lab and running them through an experiment obviously involves human subjects. NSF grant applications specifically ask if human subjects will be involved in the research and require that applicants indicate the date IRB approval was obtained.

But a growing amount of research in other areas of computer science also involves human subjects. This research doesn’t involve live human beings in the lab, but instead involves network traffic monitoring, email, online surveys, digital information created by humans, photographs of humans that have been posted on the Internet, and human behavior observed via social networking sites.

The Common Rule creates a four-part test that determines whether or not proposed activity must be reviewed by an IRB:

1. The activity must constitute scientific “research,” a term that the Rule broadly defines as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”c

2. The research must be federally funded.d

3. The research must involve human subjects, defined as “a living individual about whom an investigator (whether professional or student) conducting research obtains ( 1) data through intervention or interaction with the individual, or ( 2) identifiable private information.”e

4. The research must not be “ex-
empt” under the regulations.f
The exemptions are a kind of safety
valve to prevent IRB regulations from
becoming utterly unworkable. For
c § 46. 102 (d)
d § 46. 103 (a)
e § 46. 102 (f)
f § 46. 101 (b)

much computer
science research
performed with
the internet today
involves human
subject data and,
as such, must
be reviewed by
institutional
Review Boards.

computer scientists the relevant exemptions are “research to be conducted on educational practices or with educational tests” (§ 46. 101(b)( 1& 2)); and research involving “existing data, documents, [and] records…” provided that the data set is either “publicly available” or that the subjects “cannot be identified, directly or through identifiers linked to the subjects”(§ 46. 101(b) ( 4)). Surveys, interviews, and observations of people in public are generally exempt, provided that identifiable information is not collected, and provided that the information collected, if disclosed, could not “place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, or reputation”(§ 46. 101(b)( 2)(i&ii)).

IRBs exist to review proposed research and protect the interests of the human subjects. People can participate in dangerous research, but it’s important that people are informed, if possible, of the potential risks and benefits—both to themselves and to society at large.

What this means to computer sci-
entists is that any federally funded
research involving data generated by
people that is “identifiable” and not
public probably requires approval in
advance by your organization’s IRB.
This includes obvious data sources
like network traffic, but it also in-
cludes not so obvious sources like
software that collects usage statistics
and “phones home.”
Complicating matters is the fact that
the Common Rule allows organiza-
tions to add additional requirements.
Indeed, many U.S. universities require
IRB approval for any research involving
human subjects, regardless of funding
source. Most universities also prohibit
researchers from determining if their
own research is exempt. Instead, U.S.
universities typically require that all
research involving human beings be
submitted to the school’s IRB.

 

how to stop Worrying and Love the iRB Many IRBs are not well equipped to handle the fast-paced and highly technical nature of computer-related research. Basic questions arise, such as,