1. 
Research, the Cloud, and the IRB
PRIM&R Workshop
December 3, 2011
Michael Zimmer, PhD
Assistant Professor, School of Information Studies
Co-Director, Center for Information Policy Research
University of Wisconsin-Milwaukee
zimmerm@uwm.edu
www.michaelzimmer.org

2. Agenda
 What is Cloud Computing
 Opportunities for Use in Research
 Ethical Dimensions
 Subject confidentiality & anonymity
 Data privacy & security
 Data ownership & stewardship
 Research integrity & authorship
 What can Researchers and IRBs do?
 What do Researchers and IRBs need?

3. What is Cloud Computing?
KEXINO (CC BY-NC-ND 2.0) http://www.flickr.com/photos/kexino/4202662815/

4. What is Cloud Computing?
 On-demand, network-based access to
computing recourses
 Location independent, flexible, scalable, cost
effective, little (if any) local support or
maintenance
 As of September 2008, 69 percent of Americans
were using webmail services, storing data
online, or otherwise using software
programs, such as word processing
applications, whose functionality is located on
the web.

5. 3 Layers of Cloud Computing
http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0)

6. Application Layer
 “Software as a service”
 Providing productivity applications via the
Web; no local software needed

7. Platform Layer
 “Platform as a service”
 Providing application development platforms
and operating systems via the Web
 Can deploy applications without needing
your own infrastructure

8. Infrastructure Layer
 “Infrastructure as a service”
 Provide computing infrastructure on demand
 Outsourcing servers, storage, network
equipment, processing power, data centers

9. 3 Layers of Cloud Computing
http://en.wikipedia.org/wiki/File:Cloud_computing.svg (CC BY-SA 3.0)

10. Research Opportunities for Cloud
Computing
 Application layer
 Most common and easiest application of cloud
 Data gathering, storage, collaboration
 Platform layer
 Hosted apps for recruitment & surveys
 Infrastructure layer
 Access to increased processing power for large-
scale research projects
 Some non-traditional uses

11. Research Opportunities: Applications
 Data gathering using web-based survey
applications
 SurveyMonkey
 Zoomerang
 Qualtrics
 Typically used “in the wild”, sometimes
institutionally-bound

12. Research Opportunities: Applications
 Data storage & sharing using cloud-based
applications
 Dropbox
 Box.net
 iCloud
 Communication & collaboration using cloud-
based applications
 Gmail, IM, Skype
 Google Docs, Office Live
 Wikis

13. Research Opportunities: Platforms
 With skilled programmers, can build custom
apps to deploy via cloud-based platforms
 Subject recruitment and screening apps on
Facebook
 Building and deploying test instruments within
online gaming platforms
 Monitoring and activity tracking apps on mobile
device platforms

14. Research Opportunities: Infrastructure
 Leverage cloud-based computing
infrastructures to handle resource-intensive
processing tasks
 Clinical trial data storage & processing
 Sharing extremely large databases
 Innovative, non-traditional use of cloud-
based processing “resources”
 ____@Home (distributed computing)
 FoldIt
 Amazon Mechanical Turk

15. FoldIt

16. FoldIt
 Web-based puzzle video game to assist with
protein folding research
 Leverage millions of gamers to assist in data
processing
 Players produced an accurate 3D model of
and AIDS-related enzyme in just ten days
 Researchers had been trying for 15 years

17. Amazon Mechanical Turk
 Facilitates outsourcing of computational or
other mundane tasks
 Requesters post “Human Intelligence Tasks”
offering minimal fees
 Workers select tasks to complete for
micropayments

19. Ethical Dimensions
 Subject confidentiality & anonymity
 Data privacy & security
 Data ownership & stewardship
 Research integrity & authorship

20. Subject Confidentiality & Anonymity
 When recruiting subjects or collecting data
with cloud-based applications…
 Are IP addresses logged in such a way to allow
re-identification of subjects
 Using a Facebook app might provide researchers
access to unnecessary personal information
 Are cloud providers tracking data and usage
themselves? Delivering ads?

21. Data Privacy & Security
 Critical concern of any cloud system, takes on
even more importance when dealing with
subject data
 Are cloud-based communication and
collaboration systems using SSL encryption?
 Is data stored on cloud-servers encrypted?
 What is service’s policy regarding 3rd party access
 Advertisers
 Investigative inquiry vs. subpoena vs. warrants?
 Electronic Communication Privacy Act (ECPA)

22. Data Ownership & Stewardship
 Who owns, and who controls (meta)data in
the cloud?
 Are you granting the cloud provider any license to
use your data or activities (for advertising, data
mining, etc)?
 Can you ensure data remains in the U.S.?
 Can data be destroyed on demand, including
backups?
 Can you ensure cloud provider won’t hold your
data “hostage”, or disappear?

23. Research Integrity & Authorship
 Should researchers rely on cloud-based data
processing and analysis?
 Must trust (audit?) external/collaborative
processing platforms
 Ethical to use Mechanical Turk, or otherwise
outsource mundane tasks?
 Authorship claims?

24. What can Researchers & IRBs do?
 Read and understand the Terms of Service
 Incorporate in risk analysis
 Include mention of cloud-based services in
consent forms
 Level of detail?
 Monitor cloud services over life of project
 Have terms or practices changed?
 All this is new, complex, and difficult…

25. What do Researchers & IRBs need?
 Training in interpreting ToS
 Tools to help make translation between
federal regulations and ToS, and evaluate
protocols
 What else?