IRBs and Computer Science Research
Simson L. Garfinkel
Associate Professor
Naval Postgraduate School"The views expressed in thispresentation do not necessarily reflect
the position of the US Government or
the Department of Defense."
1

NPS is a research university operated
by the Department of Defense.
Located in: Monterey, CA
Campus Size: 627 acres
Students:
1500
 US Military (All 5 services) US Civilian (Scholarship for Service & SMART) Foreign Military (30 countries) All students are fully funded!

Schools: Business & Public Policy Engineering & Applied Sciences
 Operational & Information Sciences International Graduate Studies

2

Key points in this presentation:
Many Computer Science Researchers:
 Don’t realize they are working with human subject data.
 Don’t know that there are special rules for this data.

What’s wrong with this picture?
3

Key points in this presentation:
Many Computer Science Researchers:
 Don’t realize they are working with human subject data.
 Don’t know that there are special rules for this data.

Much Computer Security Research: Is minimal risk
 Requires deception for external validity.
 Debriefing can cause real harm.

Many IRBs:
 Aren’t qualified to evaluate CS applications.

4Is this “individually identifiable?”70.134.86.19

5

Is this “individually identifiable?”70.134.86.19
IP Address assigned to AT&T DSL service.

6Is this “individually identifiable?”70.134.86.19
5:29pm EST
November 13, 20087

70.134.86.19 @ 5:29pm EST November 13, 20088

70.134.86.19 @ 5:29pm EST November 13, 20089

70.134.86.19 @ 5:29pm EST November 13, 200810

70.134.86.19 @ 5:29pm EST November 13, 200810

70.134.86.19 @ 5:29pm EST November 13, 2008

If you are AT&T or Vonage,
70.134.86.19 @ 5:29pm is individually identifiable.
11How about this one?

64.7.15.234
26 Aug 2004
19:23:4312

64.7.15.234 was my static IP address from2001 till 2005.

Search 64.7.15.234 on Google or Yahoo, and you'll find me.
13

Are IP addresses PII?
"Sometimes... it depends on the context"
 Peter Fleischer, Google, addressing the European Parliament Civil Liberties
Committee, 21 January 2008.

"In most cases IP addresses have to be seen as
personal related and therefore the European Directive
on Data Protection covers also the use of IP
addresses." Peter Schaar,German Federal Data Protection Commissioner, 31 Jan. 08"Dynamic IP Addresses Are Not Personally Identifiable
Information Because They Are Anonymous, Temporary,
And Only identify internet devices." TRUSTe Amicus Curiae, Jeffrey Klimas v. Comcast, 465 F.3d 271, 273 (2006)14

Is your IP address PII?
It depends on who is looking.
OHRP says “private information must be individually
identifiable in order for obtaining the information to
constitute research involving human subjects.”
Guidance on Research Involving Coded Private Information on BiologicalSpecimens, October 16, 2008
http://www.dhhs.gov/ohrp/humansubjects/guidance/cdebiol.htm

Increasingly:
If there are individually records
Then the individuals can be identified (with effort).

15

Main message...
A significant amount of Computer Science research: Directly involves human beings or data.
 Is minimal risk.
 Cannot be reasonably performed with informed consent.

This work requires IRB approval under 45 CFR 46.
That's because: It involves human subjects.
 Experimenters are not allowed to exempt their own research!

16

AOL Search History Fiasco: August 2006
8/4/06 — AOL posted a link for CS researchers 20 million “anonymized” searches 658,000 customers, March 2006-May 2006
AnonID

Query

Querytime

Click URL

4417749 Movies for Dogs

2006-03-02 09:24:14

4417749 blue book2006-03-02 11:48:52 http://kbb.com

RANK
14417749 best dog for older owner 2006-03-02 11:48:24 http://caismajor.com 1

8/7/06 — AOL removed the link following complaints.
8/9/06 — NYT identifies AOL search user.
 Despite anonymization, some users identified by their search terms.

17Netflix “prize” fiasco:$1M for 10% improvement in recommendations.
Netflix released for researchers: Title of movie
 Year of movie release RankingResearchers Correlate with:
 Reviews posted to Internet Movie Database (IMDb)

Resulting Scientific Publication:
 “Robust De-Anonymization of Large Sparse Datasets,”
Arvind Narayanan and Vitaly Shmatikov,
IEEE Symposium on Security and Privacy 200818

Open question for IRB chairs:
If publicly available data can be reverse-engineered toreveal privacy sensitive facts,
but nobody knows that this reverse engineering ispossible,does the research require IRB approval?

19

Identity Trail: Covert Surveillance Using DNS
Guha & Francis, PET2007
Many companies provide"Dynamic DNS" updates.
Identity Trail: Covert Surveillance Using DNS

 DynDNS, No-IP, TZO and others

Saikat Guha and Paul Francis
Cornell University, Ithaca NY 14853, USA{saikat, francis}@cs.cornell.edu

Abstract. The Domain Name System (DNS) is the only globally deployed Internet service that provides user-friendly naming for Internet
hosts. It was originally designed to return the same answer to any given
query regardless of who may have issued the query, and thus all data in
the DNS is assumed to be public. Such an assumption potentially conflicts with the privacy policies of private Internet hosts, particularly theincreasing numbers of laptops and PDAs used by mobile users as theirprimary computing device. IP addresses of such devices in the DNS reveal the host’s, and typically the user’s, dynamic geographic location toanyone that is interested without the host’s knowledge or explicit consent. This paper demonstrates, and measures the severity of an attack
that allows anyone on the Internet to covertly monitor mobile devices
to construct detailed user profiles including user identity, daily commute
patterns, and travel itineraries. Users that wish to identify their private
hosts using user-friendly names are locked into the DNS model, thus becoming unwitting victims to this attack; we identify a growing number ofsuch dynamic DNS users (two million and climbing), and covertly trailover one hundred thousand of them. We report on a large scale study
that demonstrates the feasibility and severity of such an attack in today’s
Internet. We further propose short-term and long-term defenses for theattack.

Typical vanity DNS address:
 laptop.simson.net = 172.20.0.43
Typical uses:1

 Private web servers
 Gaming
 FTP
 Web cams

Introduction

The Domain Name System (DNS) is a core Internet infrastructure that maps
user-friendly mnemonics to non-user-friendly IP addresses. The DNS resolves IP
addresses for both public services 1 like Google, as well as private services 2 suchas Alice’s personal laptop. The DNS does not distinguish between the scope ofthe services it resolves.
As stated in RFC 4033 [1], the DNS was originally designed with the assumption that the DNS will return the same answer to any given query regardlessof who may have issued the query, and that all data in the DNS is thus public. The DNS does not provide any authorization mechanism or other means ofdifferentiating between inquirers. Indeed, DNS nameservers do not even know
the IP address of the querying host. Network DoS attackers exploit this shortcoming to learn the IP address of the victim and overwhelm the victim’s link12Services available to everyone e.g. www.google.com
Services available to a small group of people e.g. alice.dyndns.org

By design, DNS is a public service:no access controls.
20

"We discovered 36,011 potential victims through avariety of methods."
Users identified using public information:
 Web pages, mailing lists archives, etc.:

4,351 DNS names

 Dictionary attack of common names:

31,660 DNS names

Users monitored with DNS queries:
 "We monitored 18,720 hosts from July 20, 2006 to August 8, 2006"

Ground truth determination:
 Some "victims" were contacted to verify accuracy of surveillance.

21

"Figure 2 is a screenshot of a summer road-trip
taken by user M as tracked by our application."Fig. 2. Tracking a user’s summer road-trip through the DNS
22

"Figure 3 plots the mobility of one of the authors
from August 18, 2006 to November 2, 2006."
Italy
Philadelphia(airport)
Home(Ithaca)
Cornell U.
(CS Dept.)
Princeton
Cisco Systems(San Jose)

08/19

09/02

09/16
09/30
10/14
Date and Time (noon EDT)

10/28

Fig. 3. Tracking a user’s daily commute and travel through the DNS
23

Is IRB approval required for Self-Experimentation?
"In the case of self-experimentation... IRBs are at aconsiderable disadvantage. There are no specificguidelines to cover their actions. The OPRR does notinclude self-experimenters among its special classes ofresearch subjects. On the other hand, the OPRR considers
normal volunteers to be a vulnerable population...""Nevertheless, we believe that the IRB must exercise its
same best judgement on self-experimentation, as it
does on all other human research..." "A Case of Self-Experimentation," Editorial, Cancer Epidemiology, Biomarkers &Prevention, Vol. 6, 475-476, July 1997.
(Office for Protection from Research Risks became
Office for Human Research Protections in 2000.)24

Security research increasingly involves humansubjects.

SPAM

phishing
Wireless Usability

This research is vital for our national interests.
25

Research question:
Can data from Facebook improve phishing?

26

"Social Phishing," Jagatic, Johnson, Jakobsson,
Menczer, Indiana University, 2005
Protocol: Search Facebook for IU students.
 Email Alice with fake mail from
"Bob."
 "Hey, check this out!" https://www.whuffo.com/
 Prompt students for IU username &password.

27

Facebook helps a lot!
With Facebook
A

B
Success Rate
0%

Senior

10%

20%

30%

40%

Success Rate
50%

60%

80%

0%

5%

10%

Social

40%

50%

60%

70%

80%

90%

50%

Education

13%

68%

69%

26%

Class Sophomore

19%
71%

Major

71%

Science

Other

30%

72%

Liberal Arts

Freshman

20%
19%

Business

68%
Control

Junior

70%

0%
80%

14%
76%

Technology

50%
76%

Other

0%
36%

ControlSocial14%
67%

Figure 3: A: Success rate of phishing attack by target class. “Other” represents students who
did not provide their class or student who are classified as graduate, professional, etc. Whileaccording to t-tests the differences in success rates are significant for all classes (p ≤ 0.01),
χ2 tests reveal that the success rate of neither the control nor the social attack depends
significantly on the class. B: Success rate of phishing attack by target major. “Other”
represents students who did not provide information about their major. While according tot-tests the differences in success rates are significant for all majors (p ≤ 0.02), χ2 tests reveal 28

Social Phishing study was heavily criticized.
Key aspects of study:
 Performed with cooperation of Indiana University Security Staff.
 Students involved without their consent!
 Deception!
 IRB Approval!

Major complaint: Telling students that they had been successfully phished caused stress!

The IRB required the “debriefing.” Was this a mistake?

Phishing attacks are “minimal risk.” --- !
29

Research Question:
How do spammers make money?

What are the economics of spam?
What is the response rate?
30

"Spamalytics: An Empirical Analysis of Spam
Marketing Conversion," CCS 2008
Security Researchers:
Spamalytics: An Empirical Analysis
of Spam Marketing Conversion

 Infiltrated part of a botnet.
 Set up a fake online pharmacy.
 Redirected clicks for 469,906,992
spam messages.
 Converted 569 recipients!

∗

†

∗

∗

Chris Kanich
Christian Kreibich
Kirill Levchenko
Brandon EnrightGeoffrey M. Voelker∗ Vern Paxson† Stefan Savage∗†

International Computer Science InstituteBerkeley, USAchristian@icir.org,vern@cs.berkeley.edu

ABSTRACTThe “conversion rate” of spam — the probability that an unsolicited e-mail will ultimately elicit a “sale” — underlies the entire
spam value proposition. However, our understanding of this criticalbehavior is quite limited, and the literature lacks any quantitative
study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic
infiltration of an existing botnet’s infrastructure, we analyze two
spam campaigns: one designed to propagate a malware Trojan, theother marketing on-line pharmaceuticals. For nearly a half billion
spam e-mails we identify the number that are successfully delivered, the number that pass through popular anti-spam filters, thenumber that elicit user visits to the advertised sites, and the numberof “sales” and “infections” produced.

Categories and Subject Descriptors
K.4.1 [Public Policy Issues]: ABUSE AND CRIME INVOLVINGCOMPUTERSGeneral Terms
Measurement, Security, Economics

Keywords
Spam, Unsolicited Email, Conversion

1.

INTRODUCTION

Spam-based marketing is a curious beast. We all receive the advertisements — “Excellent hardness is easy!” — but few of us haveencountered a person who admits to following through on this offer and making a purchase. And yet, the relentlessness by whichsuch spam continually clogs Internet inboxes, despite years of energetic deployment of anti-spam technology, provides undeniable
testament that spammers find their campaigns profitable. Someone
is clearly buying. But how many, how often, and how much?

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.
CCS’08, October 27–31, 2008, Alexandria, Virginia, USA.
Copyright 2008 ACM 978-1-59593-810-7/08/10 ...$5.00.

∗

Dept. of Computer Science and Engineering
University of California, San Diego, USA{ckanich,klevchen,voelker,savage}@cs.ucsd.edu
bmenrigh@ucsd.edu
Unraveling such questions is essential for understanding the economic support for spam and hence where any structural weaknesses
may lie. Unfortunately, spammers do not file quarterly financial
reports, and the underground nature of their activities makes thirdparty data gathering a challenge at best. Absent an empirical foundation, defenders are often left to speculate as to how successful
spam campaigns are and to what degree they are profitable. For example, IBM’s Joshua Corman was widely quoted as claiming thatspam sent by the Storm worm alone was generating “millions andmillions of dollars every day” [2]. While this claim could in fact betrue, we are unaware of any public data or methodology capable ofconfirming or refuting it.
The key problem is our limited visibility into the three basic parameters of the spam value proposition: the cost to send spam, offset by the “conversion rate” (probability that an e-mail sent will
ultimately yield a “sale”), and the marginal profit per sale. The firstand last of these are self-contained and can at least be estimatedbased on the costs charged by third-party spam senders and throughthe pricing and gross margins offered by various Internet marketing “affiliate programs”.1 However, the conversion rate depends
fundamentally on group actions — on what hundreds of millionsof Internet users do when confronted with a new piece of spam —and is much harder to obtain. While a range of anecdotal numbers
exist, we are unaware of any well-documented measurement of thespam conversion rate.2
In part, this problem is methodological. There are no apparent
methods for indirectly measuring spam conversion. Thus, the only
obvious way to extract this data is to build an e-commerce site,
market it via spam, and then record the number of sales. Moreover,to capture the spammer’s experience with full fidelity, such a study
must also mimic their use of illicit botnets for distributing e-mailand proxying user responses. In effect, the best way to measurespam is to be a spammer.
In this paper, we have effectively conducted this study, thoughsidestepping the obvious legal and ethical problems associated withsending spam.3 Critically, our study makes use of an existing spam1
Our cursory investigations suggest that commissions on pharmaceutical affiliate programs tend to hover around 40-50%, while theretail cost for spam delivery has been estimated at under $80 per
million [22].
2
The best known among these anecdotal figures comes from theWall Street Journal’s 2003 investigation of Howard Carmack (a.k.athe “Buffalo Spammer”), revealing that he obtained a 0.00036 conversion rate on ten million messages marketing an herbal stimulant [4].
3
We conducted our study under the ethical criteria of ensuring neutral actions so that users should never be worse off due to our ac-

31

How can we make better spam filters?
How about "personal keywords?"
Inputs: Father name: Marvin Town: Pacific Grove

Rules:
body my_father /Marvin/score my_father -55.0
body my_town /Pacific Grove/iscore my_town -55.0

Protocol: Run this on my inbox and see how well it works.
 Post ideas to a mailing list and get other people's experiences.

What's wrong here?

32

45 CFR 46 never anticipated email.
Protocol: Run this on my inbox and see how well it works.
 Post ideas to a mailing list and get other people's experiences.

Problems:
 I am experimenting on people who send me mail.
 Most email is not a public document.
 Senders did not give consent to be involved in my research.
 Under 45 CFR 46, I need IRB approval for this experiment.

33

True Story: “Send me your file system statistics.”
A PhD student at a major university sent email to a list:
 “Please download this program and run it.” The program collected file system statistics and sends it back for analysis.

I sent mail to the student:
 “Did you get IRB approval?”

Student response: “What’s an IRB?”

34

True Story: Check for updates.
Software that checks for updates“phones home.”
Information collected:
 Version number of client.
 IP address of client When the client is run

Question for IRB Chairs: Does the release of a program which checks
for updates require IRB approval?

35

Computer Science and IRBs: on collision course.
Most Computer Scientists:
 Don't know what an IRB is.
 Don't want IRB oversight.
 Do not have the training to formulate a "protocol" in advance.
 Don’t know what they are going to find — are doing exploratory work
—Just like ethnographers Don't know if they are experimenting on humans!

Conflict in the IRB rules:
 Experimenters are not allowed to decide if research is exempt.
 But experimenters are allowed to decide if research involves humans!

36

Computer Science and IRBs: on collision course.
Most IRBs:
 Can't turn around an exempt or minimal risk protocol in 1-2 business days.
—Some can't do it in 2 months!
—This is a real problem for student research.
 Don't have much computer science knowledge.
—The details matter a lot!
 Some don't think that they even have jurisdiction.

NIH was unwilling to issue a CoC to protect highly
confidential experimental subject data.
 "This project doesn't seem to fit within the mission of any of the Public
Health Service agencies that have been delegated this authority."

37

Recommendations
IRBs need dramatically streamlined review processes.
 CS students routinely work with human subject data for class projects.
 Approve “Minimal Risk” studies with self-certification via web.

IRBs need better understanding of computer science.
 What data collection is standard/appropriate/excessive?
 Can information be "anonymized." ?
 DOES IT MATTER IF INFORMATION IS ANONYMIZED?

PIs need to do a better job crafting IRB applications.
 Broadly written applications to avoid needless reviews.

45 CFR 46 needs updating.
 Address issue of retroactive approval and "pilot studies."38