Toward a Taxonomy of Risks to Human Subjects involved in Internet-based Research

The practical application of research ethics must continually evolve to remain relevant as more research involves computer-mediated communication (CMC) and Internet-based research. There is a broad scope of harms to which subjects of research may be at risk. Physical harm, psychological abuse, loss of privacy, and unwanted public exposure are common research concerns that take on an added edge in research involving CMC. The permeability of the Net; the persistence of electronic data; and the electronic identification inherent in CMC all pose unique and far-reaching risks to subjects. The authors present a taxonomy of risks to human subjects organized by research intervention. In June 1999 the AAAS (American Association for the Advancement of Science) and the OPRR (Office for Protection From Research Risks) sponsored an exploratory workshop on "Ethical and Legal Aspects of Human Subjects Research in Cyberspace" in Washington DC. The intent of this gathering was to reflect on ethical concerns emerging as research using the Internet and studies of the Internet and cybercommunities become common. As part of that workshop the authors presented a talk on the risks and benefits of research on the Internet. Building on this work the authors present a taxonomy of risks of Internet research organized by the type of research intervention. There is a broad scope of harms to which subjects of research may be at risk. The extreme of that harm would be physical injury and death. More common concerns include psychological abuse, loss of privacy, and unwanted public exposure. Additional concerns include damage to interpersonal relationships, legal jeopardy, and threats to one's livelihood or career. Computer-mediated communications intensifies the historically identified risks of research articulated in both biomedical and social science literature. All of the above risks, including death, may come about as a consequence of public exposure or an undesired sharing of the information provided to researchers by, and about, subjects. The severity of this breach is, of course, dependent on a number of variables, such as the sensitivity of the information gathered, the vulnerability of the subjects, and to whom the information becomes available. Each of the above potential harms is made more likely, however, for subjects involved in research using the Internet because three features of computer-mediated communications (CMC) can contribute to just such a public exposure. First, we discuss the risks inherent in the permeability of Net communications and suggest precautions that can be taken to minimize that risk. Second, we discuss the risks that accompany the persistence of electronic data, including storage mediums, and issues involving collecting such data into databases. Third, we review the potential risks of electronic identification inherent in computer-mediated communications. We discuss cases in which these risks have manifested in the harm of subjects. There are many non-obvious implications of computer-mediated communication and several ways researchers can and should protect the subjects of their research. These questions are of interest to researchers, policy makers, commercial providers and the whole range of Internet users because given the permeability of the web, all users may be unwitting subjects of research and other forms of invasive data collection.