Social Media, Internet-based Research, and Ethics: Challenges and Strategies Stanley Estime, MSCI, CIP Tel: 617-432-2164 E-mail: qip@hsph.harvard.edu URL: www.hsph.harvard.edu/ohra/qip

Outline What is internet research? How is social media used by researchers? What are the related challenges, ethical issues and regulatory considerations?

What is Internet Research? When internet is used as a tool for conducting research Examples: online survey, subject recruitment – Amazon Mechanical Turk (mTurk), email or discussions/interviews, data mining Internet as a location or site for conducting research Examples: Collecting data about or observing online environments such as chatrooms, gaming sites, virtual worlds, social media video conferencing (Skype, Facetime), and use of “the Cloud” Amazon – Mturk for recruitment; research about internet itself/users; Some may overlap tool and location for research (especially now with mobile devices)

What is Social Media? Social media – Internet-based applications that allow creation and exchange of user generated content Provide mechanisms for users to interact: --chat, instant messaging, email, video, file sharing, blogging, discussion groups

Why are we here? We are seeing an increasing use of the internet and social media for research purposes There are no specific regulations outside of SACHRP recommendations governing internet research

Benefits to Internet Research Capture data in real time Paperless data collection Easy communication and management of data (especially in multi-site environment) Potential for increase subject recruitment

Risks to Internet Research No direct contact with participants Validate individuals: inclusion/exclusion criteria Validate integrity of the data (e.g. - falsifications/multiple submissions) Inability to assist individual(s) if they become distressed (e.g. - UAP or AE) Data security Definition of interaction/intervention is blurred – can be texual/graphical, social media, via mobile devices (which anyone can share with someone else)

IRB Questions Describe study procedures? Does the study involve human subjects research? Does the research present no more than minimal risk such that it may be reviewed via expedited review or does it need full board review? How to handle informed consent? – can it waived, is a brief consent script sufficient? What measures are in place to ensure privacy and confidentiality Consent – no direct researcher to facilitate process, not clear who participants are, waive documentation or entire process; How to handle consent when researcher and participants aren’t sharing same physical space?

Examples of Internet Research Category B1 – Online internet research, evaluation of a web-based classroom Category B2 – Online surveys/interviews or observation of public behavior Category B4 – Existing publically available, large datasets purchased/obtained from websites *Note these examples can be expedited if recording/use of identifiable info is involved. They may also require full board review if greater than minimal risk Exemption determination may be difficult because publically available or public behavior is not always clear (e.g. property tax, birth and death records, realestate transactions); Social Media: Postings on FB, Youtube, Tweeter, etc. Publically available = no charge, for a fee, or based on terms of use

Regulatory Challenges What is “private?” What is “identifiable” – current & future? Avatars and Bots – “human subjects?” Can risk be minimized when using sensitive online data? How should other study related communications be handled (e.g. Tweets, posts, etc.)? Are they identifiable? In the next few slides I am going to be discussing some of the regulatory challenges associated with internet base research: Private – should be considered public unless explicitly stated in TOS – IM, tweet, email, Facebook profile, chatroom discussion, Avatars/Bots – computer generated characters or programs to act like individual listserve posting – what is reasonable expectation of privacy in each? –Or is everything on the Internet that I can see public?

Investigator Considerations: Data Privacy Is it “reasonable” to ensure privacy? Investigators can’t promise expectation of privacy when social networks are involved (FB, Tweeter, Chat rooms) – Privacy settings (Terms of Service) always changing Technical: Spyware, keystroke monitoring, video camera - Password protection doesn’t automatically ensure privacy Can participant’s identity be readily ascertained through limited datasets? Username, alias, e-mails, IP address, partial identifiers (e.g. gender, DOB, race) Address these points when writing research protocol or think about them when designing your study Participants own expectations vs. reasonable expectation of privacy; just because there is a password

Investigator Considerations: Data Confidentiality Is it feasible to ensure confidentiality? Lock and key paper process doesn’t apply Info stored “In the cloud” – de-identified or coded Investigator should be mindful of participant retention/re-contact Transmitted information may not be secure (encryption/firewalls between host and users) Data sharing restrictions may be mandated by funding agency, data provider, or regulatory bodies (NIH, FDA, IRB) De-identified data (even in aggregate) may potentially be re-identified now or in the future (e.g. for retention and/or follow-up) Participant retention – Can/Should PI’s use social networks to re-contact individuals loss to follow-up?

Investigator Considerations: Eligibility and Recruitment If research population should not involve minors how do you verify (Adult Check, NetNanny)? Children Online Privacy and Protection Act (COPPA) mandates children <13 provide parental permission Can internet recruitment strategies increase risk? Search engines can leave local pop-ups/cookies Recruitment mailings/website contain stigmatizing information “Private” social media discussions “going viral” or researchers manipulating conversations Apps or browser cookies allowing automatic posting about the research on social websites Cross reference previous log-ins; address destruction of recordings after data analysis; consider giving participants heads up instructions on how to secure their computers (settings to delete cookies) – must consider technology risks in addition to research risk.

Investigator and IRB Collaboration: Informed Consent Both the investigators and the IRB must work together to ensure participants’ rights and welfare are protected: Online Consent Script w/ checkbox (I agree/understand statement) or eSignature Waiver or alterations (consents emailed separately, comprehension quiz, separate Skype or Live Chat process)

Investigator and IRB Collaboration: Research Protocol Consider including screenshots/data flow so IRB can understand recruitment process Ensure PI/Staff involvement is clearly described (Lurking/Deception)  Debriefing Elaborate on minimal risk associated with internet risk “confidentiality can’t be guaranteed” “limited by technology being used” “data retention - may exist on back-up servers”

Investigator and IRB Collaboration: Research Protocol Ensure participants are aware of research consent vs. any consent information on internet/social media sites Ensure participants are aware of any 3rd party data sharing arrangements Ensure the IRB and participants have a thorough understanding of any encryption processes or coding /linking arrangements

More and more countries coming on-line!