Internet research raises unique ethical concerns for IRBs

Consider the public nature of web, as well as information security

Over the past decade, the Internet has become an invaluable tool for researchers, linking colleagues across nations or even continents and enabling huge amounts of data to be transmitted quickly and securely. It even makes applying to IRBs faster and (well, relatively) painless.

But many researchers are looking to the vastness of the world wide web and seeing more — a conduit for recruiting and interviewing subjects who might not otherwise be easily contacted. And in the virtual communities that have sprung up on the web, many social-behavioral researchers see an untapped venue for studying human behavior and interpersonal relationships.

This new emphasis on Internet research has left some IRBs looking for ways to catch up to the technology and to learn how to approach the special challenges involved.

Washington University in St. Louis, MO, recently won the Health Improvement Institute's Award for Excellence in Human Research Protection in the area of innovation, for its development of a guideline for Internet research.

Sarah Fowler-Dixon, PhD, an education specialist in the university's Human Research Protection Office, says the guideline was developed because her office had noted an increase in studies that used Internet surveys and other on-line resources.

"We figured we were going to just keep seeing more of it," she says. "As protocols were coming through, reviewers were having questions about how to handle it. But we also thought it would be useful for [principal investigators], because Internet research is new for these people as well."

Similarly, after early experiences gaining IRB approval for studies that involved social networking sites such as MySpace, Megan Moreno, MD, MSEd, an adolescent medicine fellow at the University of Washington in Seattle, began to explore the ethical issues involved in doing research on the sites.

"I was thinking, if we were experiencing this, I'm sure there are other people who are experiencing it as well," says Moreno, whose article on the subject was published earlier this year in the journal Pediatrics.1 "I feel that everybody who is doing this kind of work is just getting started, and the idea of talking about the ethics before the research gets way ahead of itself is really exciting."

Mostly social-behavioral

At Washington University, Fowler-Dixon says the bulk of Internet studies currently being conducted are social-behavioral studies, in which subjects are directed to a survey site such as SurveyMonkey to fill out an on-line form.

"I think nationally that's what people are seeing when they talk about Internet research," she says. "I'm sure it will develop from there."

Such research raises issues of the confidentiality of the sites involved and how well subjects are informed about the security of their data.

But Fowler-Dixon notes that researchers have begun attempting other types of Internet research, including observational studies in chat rooms and longitudinal studies that involve sensitive information.

She says use of the Internet for research is likely to change over time, and that the guideline needs to be a "living document" that can meet those changing needs.

"I don't write any of the guidelines to be black and white," she says. "They can't be — they have to be gray so they can be applied to various research studies."

At the University of Washington, Moreno's interest in Internet research grew out of her adolescent medicine fellowship, which has enabled her to interview teenage patients in a variety of settings.

"I would see patients in chronic pain clinics, who tend to be pretty high-achieving stressed out kids, and then I would see patients in juvenile detention or [while volunteering in] homeless clinics," she says. "And I was noticing that all the patients were talking to me about MySpace and saying it was the main thing they did, their favorite hobby. Even these homeless kids were saying we go to coffee shops and check on where all our other friends are all over the country."

Moreno became interested in examining the information adolescents post on MySpace to learn more about high-risk behaviors such as violence, substance abuse, and risky sex.

Moreno says most of her work so far has involved collecting data from viewing teens' MySpace pages or inviting MySpace participants to a survey site. Her early studies met with very different reactions from two different IRBs.

"A couple of people gave me the advice to go to the IRB and just start talking to them before I really even got started," she says. "I ended up working pretty closely with someone at one of our university IRBs who really helped me figure out the issues that she would expect the IRB would be concerned about."

Moreno says those issues tended to revolve around consent, how to deal with underage participants or those who might lie about their age, and the public nature of MySpace.

"Was this site really public? We spent a lot of time figuring out could the average person go on there and find these things. And we quickly became comfortable saying yes," Moreno says.

When she subsequently needed approval from a different IRB, she was surprised to find that it had a completely different set of concerns.

"I got the feeling that there was a real uncertainty about what these sites are," she says. "I'd get comments such as, 'It's really unethical to read people's e-mails without telling them.' And I thought, well gosh yes, but that's not what I'm doing."

Moreno eventually got approval in both cases, but in the second instance, it required educating the IRB about how the sites work.

Public vs. private space

The use of the Internet in research — whether it involves gathering data from public sites or inviting people to fill out on-line surveys — does raise special issues that IRBs need to grapple with:

Intrusiveness (public vs. private space): To what degree is the research intruding into an Internet community such as a chat room or mailing list? Is the researcher informing the group being studied or covertly "lurking" to gather information?

Washington University's guideline states that the university's Human Research Protection Office generally will require investigators to inform participants that they're being studied, by contacting a site's web master, for example.

In the case of large social-networking site, Moreno says it's clear that they are public, since anyone can access them and read the same information a researcher could.

When she talks to kids about what they post on MySpace (details of drunken binges, sexual behavior, etc.), she says she hears two responses.

"One would be total disbelief that any adult could have cracked the code," she says. "I think there is a sense among many of them that this is a place that's theirs and adults are very intimidated by it and so they can kind of do whatever they want with any discretion they want.

"The second thing I've heard is: 'I know [adults can access their pages], and I don't care.'"

Vulnerability of subjects: Does the group being studied have particular vulnerabilities that need to be considered? An example might be a mailing list for victims of sexual abuse.

Potential harm: Does the research or the publication of results have the potential to cause harm to an individual or to the Internet community being studied?

Moreno says that in much of her research, IRBs have determined that the risks to teens of being studied, or even being asked to participate in a survey, weren't any greater than the risks of being on MySpace in general.

"When you look at the data on predators, the number of kids who report that they have been bullied or who have been approached with unwanted sexual solicitation, it is a risky place to some degree," she notes.

She says one IRB actually saw participation in the study as a potential benefit, since the teens involved were discussing risky behaviors on their pages. The IRB reasoned that alerting the kids to how public their postings were might prompt them to clean up their pages.

Ages of participants: Because it's difficult to verify the age of a participant on the web, researchers must consider how to weed out minors from taking part in a study that isn't intended for them. Some suggested methods include a posted disclaimer stating that underage individuals should not continue or asking potential participants to provide a date of birth, with a calculator determining age and either allowing or refusing to let the survey go forward.

When dealing with underage participants, parental consent is usually required. But in her article, Moreno argues that it's not always necessarily the best approach to take with adolescents. She uses as an example a 16-year-old disclosing identifiable information on a web site about drug use. A researcher may want to contact the teen to take part in an intervention to reduce that use. That recruitment, which potentially could benefit the teen, may be more successful if his or her parents aren't informed.

Security of information: Fowler-Dixon says it's important to help subjects understand just how secure (or unsecure) their information might be if they participate in Internet research.

"We need to point out some things that might not be readily obvious or things that people might not think about," she says. "An example might be if they're on any public access computer, including their work computer, then anybody can access [their data]."

She says popular survey sites are anonymous, "to a point. It can be completely anonymous, but it doesn't have to be, depending on how you use it."

The Washington University guideline calls for explaining the coding for secure sites — that only URLs beginning with "https" or displaying a padlock icon are considered secure. Participants should be reminded to completely log off the computer and to delete temporary files and "cookies" after a session to help maintain their privacy.

Researchers should be asked if information is being sent using encryption via secure sites.

Use of quotes in published articles: Moreno notes that because of the searchable nature of sites such as MySpace, researchers need to be extremely careful about any verbatim quotes they use from sites, since they could lead directly back to research subjects.

"If they put a particularly revealing quote or a series of information, it is easy to search by [those keywords]," she says. "We have to realize that kids' written language is now becoming an identifier, if it's unique.

"If you type in, 'I got wasted last weekend,' you're going to get 10,000 hits. But I think the quotes that people like to use, especially for qualitative research, are the unusual ones."


  1. Moreno MA, Fost NC, Christakis DA. Research ethics in the MySpace era. Pediatrics 2008;121;157-161.