明大LINUX事件的反思（7）校方回应

The University of Minnesota has a robust and highly regarded Human Research Protections Program (HRPP). It has repeatedly achieved the highest level of accreditation by the As-sociation of Human Research Protections Programs (AHRPP). As discussed below, the IRB acted properly in this case. 

We strongly agree with the spirit of both your third and fourth requests, and we aim to institute appropriate processes and mechanisms, but there are several technicalities and complexities that need to be clarified.

First, an Institutional Review Board (IRB) is not the sole arbiter of research ethics. An IRB evaluates “Human Subjects Research”, which has a precise technical definition according to US federal regulations (see 45 CFR 46.102), and this technical definition may not accord with intuitive understanding of concepts like “experiments” or even “experiments on people”. Crucially, an essential requirement for research to be considered as “human subjects research” (and thus within the purview of the IRB) is that it involves collecting information about human subjects themselves, such as age, blood pressure, or related. No such information was sought or collected here. The study was focused on understanding a system by identifying mechanisms through which security issues could be introduced in Linux software. Therefore, purely as a technical matter, this study did not qualify as “Human Subjects Research” and received no further scrutiny or oversight from the IRB. Importantly, even if one believed the study did involve human research subjects (perhaps due to the interactions and the incidental collection of email addresses), the study would clearly be exempt from IRB oversight pursuant to 45 CFR 46.104(D). In other words, the UMN IRB acted properly in this case.

Second, we reiterate that an IRB is not and should not be the sole arbiter of research ethics.  Some specialties within Computing have developed an understanding of this; for example, social computing researchers who study online communities have developed best practices

that require consultation with a community of interest and consideration of ethical issues regardless of whether the research methods actually constitute “Human Subjects Re-search”. (For an example of acceptable practices that have developed in the Wikipedia community, see https://en.wikipedia.org/w/index.php?title=Wikipedia:NOTLAB and Wikipedia:Ethically researching Wikipedia.) There is, however, no standard body chartered to review ethical considerations of this sort, that is, considerations that fall outside of the legally defined scope of an IRB.

Third, however, this experience has shown that our department has work to do in educating our faculty and students about the broad range of ethical considerations and ensuring that they comply with them. Even before this incident, we have taken some steps focused on our students: (i) Integrating ethical considerations into our core undergraduate curriculum; and (ii) integrating ethics into the year-long introductory seminar for new PhD students. 

We are now exploring suitable education and oversight processes for our faculty. At a min-imum, we will develop a program for our weekly faculty meetings in the 2021-2022 aca-demic year to ethics training, with a focus on this incident and similar incidents, and con-siderations that go beyond issues within the scope of the IRB. As we complete a review of this incident, we expect to define additional education activities and controls, but this will require more time and consultation. Nevertheless, we emphasize that we acknowledge our responsibility to do this to prevent situations like this incident in the future. We aim to first thoroughly understand what transpired in this project and use that as a guide for improve-ments.