Computer science security research and human subjects: Emerging considerations for research ethics boards

Journal of Empirical Research on Human Research Ethics

Volumn 6, Issue 2, 2011, Pages 71-83

  Buchanan, Elizabeth ^a   Aycock, John ^b   Dexter, Scott ^c   Dittrich, David ^d   Hvizdak, Erin ^e  

^a UNIVERSITY OF WISCONSIN STOUT   (United States)

^b UNIVERSITY OF CALGARY   (Canada)

^c CITY UNIVERSITY OF NEW YORK   (United States)

^d UNIVERSITY OF WASHINGTON   (United States)

^e LOYOLA UNIVERSITY CHICAGO   (United States)

Author keywords

Computer ethics; Computer science research; Computer security; Data security; Human subjects review; Internet research; IRB; Research ethics; Research ethics boards; Research regulation

Indexed keywords

ARTICLE; COMPUTER SECURITY; ETHICS; HUMAN; HUMAN EXPERIMENT; PROFESSIONAL STANDARD; RESEARCH ETHICS; RESEARCH SUBJECT;

COMPUTER SECURITY; ETHICS COMMITTEES, RESEARCH; ETHICS, RESEARCH; HUMAN EXPERIMENTATION; HUMANS; RESEARCH SUBJECTS;

EID: 79959417340     PISSN: 15562646     EISSN: 15562654     Source Type: Journal    
DOI: 10.1525/jer.2011.6.2.71     Document Type: Article

References (52)

1. Albrecht, V. (2009). Avatars and other cyber-folk: Are they human subjects? CUNY Institutional Research Board Annual Conference, New York.
2. Aldrige, J., Medina, J., & Ralphs, R. (2009). The problem of proliferation: Guidelines for improving the security of qualitative data in a digital age. Research Ethics Review, 6(1), 3-9.
3. Anti-Phishing Working Group. (2010). Phishing activity trends report. Retrieved from http://www.antiphishing.org/reports/ apwg-report-q2-2010.pdf.
4. Association for Computing Machinery. (1998). The 1998 ACM Computing Classification System. Retrieved rom http://www. acm.org/about/class/1998.
5. Aycock, J., Buchanan, E., Dexter, S., & Dittrich, D. (2011). Human subjects, agents, or bots: Current issues in ethics and computer security research. In Proceedings from 2nd workshop on ethics in computer security research, St. Lucia, February 28- March 4, 2011. Lecture Notes in Computer Science. New York: Springer.
6. Aycock, J. & Maurushat, A. (2007). Future threats. In Proceedings from 17th Virus Bulletin International Conference (pp. 275-281). Retrieved from http://pages.cpsc.ucalgary.ca/ ~aycock/papers/vb2007future.pdf.
7. Aycock, J. & Sullins, J. (2010). Ethical proactive threat research. In Proceedings from Workshop on Ethics in Computer Security Research (LNCS 6054) (pp. 231-239). New York: Springer.
8. Bell, D., & LaPadula, L. (1973). Secure computer systems: Mathematical foundations (MITRE Technical Report 2547). Retrieved from http://www.albany.edu/acc/courses/ia/ classics/belllapadula1.pdf.
9. Brothers, K. & Clayton, E. W. (2010). "Human non-subjects research ": Privacy and compliance. The American Journal of Bioethics, 10(9), 15-17.
10. Buchanan, E. (2010). Internet research ethics: Past, present, future. In C. Ess and M. Consalvo (Eds.), The Handbook of Internet Studies (pp. 82-108). Oxford: Blackwell.
11. Buchanan, E. (forthcoming). E-research and e-planning: Emerging considerations for transformative research. International Journal of E-Planning Research 1(1).
12. Buchanan, E. & Ess, C. (2009). Internet research ethics and the institutional review board: Current practices and issues. ACM SIGCAS Computers and Society, 39(3), 43-49.
13. Buchanan, E., Gallant, D., Odwazny, L. & Miller, M. (2011). Internet research ethics. PRIM&R Annual Conference Presentation. San Diego, CA.
14. Buchanan, E. & Hvizdak, E. (2009). Online survey tools: Ethical and methodological concerns of human research ethics committees. Journal of Empirical Research on Human Research Ethics, 4(2), 37-48.
15. Canadian Institutes of Health Research (CIHR), Natural Sciences and Engineering Research Council of Canada, Social Sciences and Humanities Research Council of Canada. (1998). Tri-Council policy statement: Ethical conduct for research involving humans. Retrieved from http://pre.ethics. gc.ca/eng/archives/tcps-eptc/Default.
16. Canadian Institutes of Health Research (CIHR), Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada. (2010). Tri-Council policy statement: Ethical conduct for research involving humans. Retrieved from http://pre.ethics.0020 gc.ca/eng/policy-politique/initiatives/tcps2-eptc2/Default/.
17. Chow, R., Golle, P., Jakobsson, M., Shi, E., Staddon, J., Masuoka, R., & Molina, J. (2009). Controlling data in the cloud: Outsourcing computation without outsourcing control. In Proceedings of the 2009 ACM Workshop on Cloud Computing Security (pp. 85-90). New York: Association for Computing Machinery.
18. Denning, P., Corner, D., Gries, D., Mulder, M., Tucker, A., Turner, A., & Young, P. (1989). Computing as a discipline. Communications of the Association for Computing Machinery, 32(1), 9-23.
19. Dias, K. (2003). The ana sanctuary: Women's pro-anorexia narratives in cyberspace. Journal of International Women's Studies, 4(2), 31-45. (Pubitemid 40652603)
20. Dittrich, D., Bailey, M., & Dietrich, S. (2009). Have we crossed the line? The growing ethical debate in modern computer security research (Stevens CS Technical Report 2009-1). Hoboken, NJ: Stevens Institute of Technology. Retrieved from http://staff.washington.edu/dittrich/papers/dbd2009tr1/.
21. Dittrich, D., Bailey, M., & Dietrich, S. (2011). Building an active computer security ethics community. IEEE Security and Privacy, 9(3), 1-9.
22. École Polytechnique Montréal. (2009). Procédure de certification des travaux de recherche comportant ou pouvant comporter des risques informatiques. Retrieved from http://www.polymtl.ca/ recherche/doc/Procedure-RisquesInformatiques.pdf.
23. European Commission, Directorate of General Justice. (2010). European Union Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Retrieved from http://ec.europa.eu/justice-home/fsj/privacy/ law/index-en.htm.
24. European Commission, Directorate of General Justice. (2010). European Union Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC. Retrieved from http://ec.europa. eu/justice-home/fsj/privacy/law/index-en.htm.
25. Finn, P. & Jakobsson, M. (2007). Designing ethical phishing experiments. IEEE Technology and Society Magazine, 26(1), 46-58. (Pubitemid 46563123)
26. Floridi, L. (2004). On the morality of artificial agents. Minds and Machines, 14(3), 349-379.
27. Floridi, L. (2010). Information: A very short introduction. New York: Oxford University Press.
28. Food and Drug Administration. (2011). Exception from informed consent requirements for emergency research. Retrieved from www.fda.gov/downloads/ RegulatoryInformation/.../ UCM249673.pdf.
29. Garfinkel, S. (2008). IRBs and security research: Myths, facts and mission creep. In UPSEC'08 Proceedings of the 1st Conference on Usability, Psychology, and Security. Berkeley, CA: USENIX Association.
30. Gotterbarn, D., Miller, K., & Rogerson, S. (1999). Software engineering code of ethics is approved. Communications of the Association for Computing Machinery, 42(10), 102-107.
31. Hall, T. & Flynn, V. (2001). Ethical issues in software engineering research: A survey of current practice. Empirical Software Engineering: An International Journal, 6(4), 305-317. (Pubitemid 33067820)
32. Harvard University. (2010). Harvard research data security policy. Retrieved from http://security.harvard.edu/research-data security- policy.
33. Jaeger, P. T., Lin, J., & Grimes, J. M. (2008). Cloud computing and information policy: Computing in a policy cloud? Journal of Information Technology & Politics, 5(3), 269-283.
34. Jakobsson, M., Finn, P., & Johnson, N. (2008). Why and how to perform fraud experiments. IEEE Security & Privacy, 6(2), 66-68. (Pubitemid 351506258)
35. Johnson, D. (2009). Computer ethics. Englewood Cliffs, NJ: Prentice Hall.
36. Kenneally, E., Bailey, M., & Maughan, D. (2010). A framework for understanding and applying ethical principles in network and security research. In R. Sion, R. Curtmola, S. Dietrich, A. Kiayias, J. M. Miret, K. Sako, & F. Sebé (Eds.), Financial Cryptography and Data Security (pp. 240-246). New York: Springer.
37. Krieger, N., Chen, J., Waterman, P., Rehkopf, D., & Subramanian, S. V. (2005). Painting a truer picture of U.S. socioeconomic and racial/ethnic health inequalities: The Public Health Disparities Geocoding Project. American Journal of Public Health, 95(2), 312-323. (Pubitemid 40179832)
38. Lethbridge, T. C. (2001). Mixing software engineering research and development: What needs ethical review and does not? Empirical Software Engineering: An International Journal, 6(4), 319-321. (Pubitemid 33067821)
39. Lung, J., Aranda, J., Easterbrook, S., & Wilson, G. (2008). On the difficulty of replicating human subjects studies in software engineering. In Proceedings of the 30th International Conference on Software Engineering (ICSE'08), Leipzig, Germany, May 10-18, 2008. New York: Association for Computing Machinery. Retrieved from http://www.cs.toronto.edu/~sme/papers/2008/ Lung- ICSE2008.pdf.
40. Maes, P. (1995). Artificial life meets entertainment: Life like autonomous agents. Communications of the Association for Computing Machinery, 38(11), 108-114.
41. Markham, A. ,Buchanan, E. (forthcoming). The distance principle and Internet research ethics "subjects. " International Journal of Internet Research Ethics.
42. Mol Økken- Østvold, K. (2005). Ethical concerns when increasing realism in controlled experiments with industrial participants. In Proceedings of the 38th Annual Hawaii International Conference on System Sciences, 2005 (pp. 1-10).
43. New Brunswick, NJ: IEEE Publications. Myers, A. (2010). Fieldwork in the age of digital reproduction: A review of the potentials and limitations of Google Earth for archaeologists. SAA Archaeological Record, 10(4), 7-11.
44. National Institute of Standards and Technology. (2010). NIST cloud computing program. Retrieved from http://www.nist. gov/itl/cloud/.
45. Pearson, S. (2009). Taking account of privacy when designing cloud computing services. Cloud '09: Proceedings of the 2009 ICSE Workshop on Software Engineering Challenges of Cloud Computing (pp. 44-52). New Brunswick, NJ: IEEE Publications.
46. Ross, L, Loup, A., Nelson, R., Botkin, J., Kost, R., Smith, G., & Gehlert, S . (2010). Human subjects protections in communityengaged research: A research ethics framework. Journal of Empirical Research on Human Research Ethics, 5(1), 5-17.
47. Shore, N., Drew, E., Brazauskas, R., & Seifer, S. D. (2011). Relationships between community-based processes for research ethics review and institution-based IRBs: A national study. Journal of Empirical Research on Human Research Ethics, 6(2), 13-21.
48. Singer, J. & Vinson, N. (2001). Why and how research ethics matters to you. Yes, you! Empirical Software Engineering: An International Journal, 6(4), 287-290. (Pubitemid 33067815)
49. Smith, R. M. (2003). Web counter in the new Swen/Gibe.F worm. Message posted to BugTraq mailing list, September 18.
50. Sweeney, L. (2003). Navigating computer science research through waves of privacy concerns: Discussions among computer scientists at Carnegie Mellon University. In Tech Report, CMU CS 03-165, CMU-ISRI-03-102. Pittsburgh: Carnegie Mellon University.
51. Tavani, H. (2011). Ethics and technology: Controversies, questions, and strategies in ethical computing. Boston: John Wiley.
52. Wright, D. R. (2006). Research ethics and computer science: An unconsummated marriage. SIGDOC '06: Proceedings of the 24th Annual ACM International Conference on Design of Communication. New York: Association for Computing Machinery. Retrieved from www4.ncsu.edu/~drwrigh3/docs/ pubs/sigdoc06a.pdf