OK, great, so welcome everybody to this week's graduate lecture, we're continuing in the theme of statistics and ethics and their intersection.
Today, I'm very happy that Catherine Fletcher is going to speak.
She is in the Department of Computer Science and instigator of the Research Ethics Committee,
and her talk is the practicalities of academic research ethics, how to get things done.
Catherine, as I mentioned in computer science, she searches a project such programme manager specialising in interdisciplinary projects,
interest in bridging academia and industry and having having encountered several ethics and
compliance dilemmas in cybersecurity and other data driven research fields relevant to statistics.
She helped set up the Computer Science Department Research Ethics Committee, and so to sort of advance this cause,
she's run a series of workshops and took an annual conference of the CSC Academic Centres of Excellence Cyber Security Research one in Oxford,
one the Alan Turing Institute has said is now managing the Global Pathogen Analysis System in the field Department of Medicine,
which you can access a deep dark cloud working at the sharp end,
as she puts it, to help public health agencies to respond to the COVID 19 pandemic while also preserving our privacy and national data sovereignty.
So the talk today? Practicalities of academic research ethics has to get things done very well to talk about truth,
beauty and justice for academic research ethics, but how would you do these things at a practical level?
I think today we're going to hear from Catherine exactly where to go, who to talk to,
what, what we need to do or be aware of on various levels, including legal levels.
And so what what are the important implications? If you stumble upon something, what do you do with it?
How do you make sure that appropriate safeguards are applied without drowning in bureaucracy?
So we'll hear a brief introduction to these first legal and procedural concepts and discuss how it might apply to your work,
both within and beyond academia. I think Catherine would welcome a discussion format, so if you've got questions,
raise them up during the talk if you want to be recorded or touch them, and I will read them for you.
Okay, so over to you, Catherine. Thank you. Well, thank you very much for the introduction.
It's a pleasure to be here. So as Garrett said,
I'm a bit of a fraud because I've spent about 12 years in my of my career at the University of Oxford in the Department of Computer Science.
But I have since may come across to the Nuffield Department of Experimental Medicine,
where I'm helping run this project, where, as it turns out, they didn't hire me for my ethics background per se.
But it turns out we're doing cutting edge research with data again, where ethics and norms and legal structures are lagging behind.
So as something that I'm very sensitive to and I wanted to help people learn from the mistakes I've made and the lessons I've learnt of trying to
navigate the university systems where literally there is not necessarily one
authority to go to because what you're doing is new because it's research.
So in that sense, I would love it if you guys took part in the conversation. The easiest way to do it probably is to drop things into the chat.
I won't be able to read it myself because I've only got a laptop, and when I'm sharing my screen,
I won't be able to see the comments, but again kindly offered to watch it for me.
So please do definitely feel free to use that, to ask questions and stop me or whatever you'd like.
And particularly actually, could I ask you guys, you know, the system where if you go to the chat at the bottom of the screen and Zoom,
there's a little picture of a speech, but we'll go to the chat and on your own name, you can change your name to anything you like.
And may I just ask if you would be willing to change your name to whether or not you've had any formal training in research,
ethics or something that you would consider formal training like something involving serious thought?
I can't seem to redeem myself. Other.
So I was wrong, so it's not the chat thing, it's the list of participants is how you click on your own name and you could rename yourself.
Thank you very much for adding that it's really useful to see it as background.
So the other question I would ask for you is, do you think I realise things can change?
VIDEO But do you think as of right now,
the kind of work that you hope to do in the next couple of years in your career would probably benefit from some ethics or oversight?
Thank you very much. I really appreciate you guys putting putting this stuff in there and feel free to.
You can also use your name as a thing else you want to communicate that way, but it's entirely up to you what you wish to share,
but otherwise feel free to use the chat for any other written conversation that you want to add to the day.
Otherwise, for now, I will get going with sharing my screen. I'll show you my slides and we'll be off to the races.
And I have to also say I know that I have a terrible habit of speaking very quickly, especially when I get excited everything's yardstick.
And even more when I've had a lot of coffee, which I mistakenly did this afternoon.
So if I'm going too fast, please call me up. Or if I'm I'm difficult to understand because especially for people, a lot of people,
English isn't even your first language, and we're having a conversation about complicated things.
So tell me if I'm going too fast or if you can't understand me. So, right.
How are we going to get stuff done? I am so glad to be here and like I said,
the purpose of this talk is to share what I've learnt so that you don't have to do things the hard way, but the way I had to do it.
I think very much it's important to keep a sense of perspective about this stuff, which is that.
You know, I said the things I said, no one's coming from the future to stop you from doing it, how bad her decision can it really be?
But the thing is, now that you are, especially since you're at the University of Oxford,
the things that you do is very likely that you're you're bright and you're really good at what you're doing or you wouldn't be here,
which means that what you do is likely to be really interesting and new and cutting edge.
And when it's interesting and new and cutting edge,
it can be easy to not be supported by the existing systems because the existing systems that they're meant
to be there for safeguards and for help and even legal structures are designed for what happened before,
not for what you're making now. And especially since you're here at the University of Oxford,
often that means that things we do get is more likely to get picked up in sort of higher impact venues just because got the Oxford name on it.
So it does actually matter. But the really the reason this actually matters is not about reputation management.
It is absolutely not about you protecting the university from scandal. It's about people.
The reason we are here is because, you know, we care about people and as as humans, that's what really matters.
So the important part is that we don't do things that are, I mean, basically don't be a jerk, right?
But especially don't be inadvertently faultless because you didn't see things
from somebody else's perspective because you weren't thinking in those terms.
That's where we can come in and help you and pull it up and say, Hang on, you can look at it from this angle, from this angle, from this angle.
Now, do you still feel that what you're doing is responsible?
Or are there any safeguards that you might put in place, for example, to make sure that you're being responsible?
Now, formally speaking, there are a lot of processes in the university,
so my talk is going to talk a lot about the processes because there are so many different things.
I'm not expecting you all to remember this now. A lot of you will.
Some of you will never encounter any of these, and a lot of you will say, Yeah, yeah, that's great.
But I don't need it right now.
But maybe a year or two from now or six months from now, you might go, Oh, wasn't there something about I could have sworn there was a team?
So the purpose of this talk is actually to tell you about all the things. We'll make sure you have a copy of the slides at the end if you want them.
And then when you're ready to if you need to come back,
then you can refer back to the slides and find all the web links to all the different places around the university.
So the first thing that you need to know, though, is that we have a research integrity policy here at the University of Oxford,
and it's absolutely standard across academia worldwide. None of this should come as news to you.
None of it should be a surprise. But but also you need to have had somebody tell you this at some point.
Because it's not fair on you, if nobody ever told you we had a policy about it and then you break the policy, how can how is that fair?
You will still be in trouble, right?
So the obvious things are that I've literally pulled this off of the university's website, and the link at the top is where all the details are.
But your fundamental jobs as a researcher are, to be honest.
To comply with any ethical and legal obligations which are either through national law or university policies, you need to think about the safety,
dignity and well-being of yourself and others, and that may or may not be the same thing as complying with legal obligations.
Sometimes that can be very different where I mean, civil disobedience happens occasionally,
for example, where people think the law is not protecting people in the way it should be.
So those two are not the same thing, but also it's really important to remember that this extends not just to other people, but to yourself,
that we as a university also have an obligation towards you and that if we're not supporting you properly,
I want you to know that somebody cares and somebody needs to know and that we're supposed to do that.
So if you're finding that you're not having your dignity and safety, well, being respected, talk to people because there is a requirement around that.
You are supposed to not conduct research where there are conflicts of interest that should be fairly obvious.
But if you're not sure if you ever end up with some kind of essential corporate stake or something like that,
you do need to declare these things, especially in papers, obviously.
Likewise, around papers and publications, attribution and authorship are really important.
And especially if you're a more junior researcher, sometimes that can be a really awkward,
difficult conversation to have if you're not sure and you've never done it before.
So again, if the rule of thumb is if a paper would not have been possible without someone's input,
then that person deserves authorship or equivalent sort of credit.
And so again, if you're not sure, talk to somebody in the university.
If you're not, especially there's an awkward relationship with a collaborator.
Talk to somebody else to get some advice, because the point is that should definitely be followed.
The last thing, of course, is that you're supposed to follow the best requirements and guidance of any professional bodies in the field of research.
Now, unfortunately, I don't know what this is for stat.
You might be able to tell people, but in computer science often, for example, the ACM, the Association of Computer Machinery, I think it stands for.
But any other professional bodies that sort of regulate your field?
Specifically, then the ways you can break those rules are what's known as academic misconduct,
and here's a quick list of them, and I'm not expecting you to read through this whole thing and memorise it.
The two things I wanted to call out for your attention are failure to follow
good practise for proper preservation management and sharing of primary data.
So you guys again, you're in the stats department.
Isn't the idea of managing data is probably more familiar to you than it is of a lot of other areas,
but that this is formally grounds for an academic misconduct discussion is important news to some people.
So the point is if especially in the context where your data might be paid for by public moneys.
If you have anything from a research council, for example, or say, the Wellcome Trust or some charitable foundation,
literally that's charity money or that's public taxes that pay for your research.
And if they spent two million pounds commissioning this research, that dataset cost two million.
Typekit basically cost you a million pounds, and so it is incumbent upon you to treat it with that kind of respect.
The other thing you need to do is to make sure that you follow again accepted procedures, legal and ethical requirements.
And that, of course, comes to includes humans, but hilariously also vertebrates, so cephalopods and the environment.
So it's just again about having a holistic sense of responsibility. And I'm not here to shout at you.
I'm just here to say those are the official policies of the university, and I want to make sure somebody has told you.
Because obviously, it's yeah, I don't understand why this is so hard, right, you just say if a robot is going to turn evil, don't bite.
So the way we try and help you with that is a ton of different overlapping bodies within the university and the public.
The good news is there's lots of different places you can go for help. The bad news is especially when you're at the cutting edge.
It's not really clear where you need to go or who you need to be answerable to, especially if there's, for example, two different committees in.
One might say yes and one might say no or one might say, please do this and another one.
I might add slightly conflicting advice. And so that's where I'd love.
Later on, after I finished talking, I would love you guys to ask questions about that, especially as it as it applies.
Just as a judge, as I've I've been bumping into things myself myself over the years, and I'll try and help you navigate it.
So first of all, the obvious one is the Central University Research Ethics Committee, otherwise known as Cure.
So that's a subset of which is what I helped set up in the Department of Computer Science.
So correct. It's above the whole university. Now that basically has to do with working with people directly, so that might be interviews or surveys,
running workshops, even if the workshop is collecting data that you're actually going to analyse.
So having a workshop on a topic of your research just to talk is fine.
But if that if the output of that research becomes part of your data set at that point, even the workshop needs ethics clearance rate user studies.
This is important even if they're anonymous, even if you're only talking to one person, even if you're not asking about anything sensitive.
It's not because. We don't believe you, it's because we have no way of knowing unless you mention it, because you can say, Oh, well,
I just decided this was insensitive to tell us why it's not sensitive and then we say, Oh great, you're absolutely right.
Off you go. Right. So for statistics, you actually have your applications go through the Medical Sciences Interdepartmental Research Ethics Committee.
So Ms. Interac, is there your contact with a lady named Helen Brown before it who has a wealth of experience on these things?
Interestingly, the reason why you guys go through medicine is because they deal with a lot of data about people in the context of medical science.
So they've got a lot of expertise in this.
But you might also find that depending on your kind of question, their expertise isn't exactly suited to what you're after.
So there's also the Computer Science Research Ethics Committee,
which actually sits within a different section of the university for reasons, but they might be a better fit for you.
The point is, you always start with Helen and then, but you might based on what Helen says or before when you approach your site.
I'll go through you if you want because it's officially her responsibility, but I think computer science will be a better fit for me.
And here's why. And again, we can talk about that later. Just it's important to understand how it works.
In terms of actual processes, there's a link at the top. This is the whole point of the science, right?
Keep these for later referred to it when you're ready, but when you're ready, if you just google me, Cedric Oxford,
that also takes you straight through the application process and their website is really nicely laid out.
And this is before you start. Check the interview. I'm summarising what's on the screen before you start.
Check the where and how to apply flowchart, and there's a little handy link. This is if you do not need to apply for NHS ethics approval.
Here's here's our application decision tool to determine how to apply for ethical review or your research and.
Again, if you get stuck just right to [INAUDIBLE], and she's lovely. The last step is.
Especially in the formal structures, the idea of integrity and ethics training, so we have online and in-person training.
So if you're just one doing a little one off survey one time or you're doing like a little bit of work on data,
you don't necessarily need formal training. I'm not going to suggest that everybody in the university must have this, but I would highly recommend it.
If you think you're going to be working with data in the long term,
and especially actually because when you go out to then submit your CVS to job opportunities,
you can say I have actually had this training and that makes you a much more interesting and valuable candidate.
But also the training itself is pretty good. It's really it's very it's very focussed on what you might need to actually do.
It's less about sort of notions of truth, and justice is more about, here's how you do it here in Oxford, and it's really helpful.
But the thing is, you only apply to cure. If you're doing research and research has a definition and it's the four Scotti definition of research.
Again, there's a link at the top so you can come back to it. So first got you something that was agreed by.
Basically, everybody has to do with any kind of things to do with data, and the definition of research is that and this is the bullet points below.
It has to be all of these things at the same time, not just one novel, creative, uncertain, systematic and transferable.
So before you go to crack, actually, you have to decide if what you're doing is research or not,
because if it's not technically all of those five things at once, it's outside the remit of Keurig.
That doesn't mean they have nothing to say to you is useful, but the point is like, technically speaking, you're outside their remit.
That doesn't also mean that what you're doing, therefore has no ethical considerations,
so then the rest of this talk is about one of the other things you might be doing if it's not officially correct correctable as it works, right?
So one of the things you might need to do is a risk assessment, and that's I mean,
you think about the old school kind of physical stuff like, I don't know, are you going to be scuba diving?
This is very unlikely, the statistics, but there are things that can entail physical risk climbing ladders to collect data from something, you know.
If so, that would be done through your departmental administrator or possibly a facilities manager,
but that involves something about your own building.
And if you're travelling for research, talk to your departmental administrator because that's they have risk assessments for that.
But also you get university travel insurance, which is actually very worthwhile.
We have a very good policy, and it's important that you have that on your side,
especially in the world of COVID and post-COVID as the world begins to reopen.
Things get complicated. So travel insurance is great, but you only get that if you did the risk assessment and came in through the front door.
But the thing is, that's lovely, that's all that existed three years ago.
Since since, especially the cybersecurity people that I used to work with in computer science started bumping into this,
we instigated a new kind of research risk assessment. So that's basically for the kinds of research they don't technically fall under Kerik,
which have to do with direct interaction with people, and it has to be defined as research.
There's plenty of other stuff you can do that probably has ethical implications. It isn't those things.
And for that, we've invented research assessments, one of which is for vulnerability or network scanning type research,
the kind of thing where you're going to be poking holes and seeing what just seeing what you can learn.
And that could also even be statistical inferences at some point.
If the idea is that you're trying to see if there's a weakness in a system, that's where this one comes in.
And there's another one which is separate for a machine learning kind of pattern extraction type research,
which I think is probably very useful for people of statistics.
So the method we have in computer science is we have these documents and they are meant to be
a self-assessment checklist so you can just pull it down yourself if you want after the talk,
like, let me know I can give you a copy of it even.
But it's meant to be a self-assessment exercise that you go through for your own benefit and just said you're going to have a copy of it.
But if based on those answers, when we walk you through that decision making tool, you kind of go,
Oh, actually, I hadn't thought about that, and I don't I don't know the answer to that question.
That's your cue to go out and get help.
And it could also be that you could then submit that to, for example, the Computer Science Research Ethics Committee.
So their advice on this is nonbinding, but they do have advice they can say,
Well, we've seen best practise about how people have dealt with that before. We can help you with that.
And it's less about stopping you doing your research and more about saying right, what you want to do, this research, we want you to do it too.
But when you're doing it, please think about this, this and this and make sure that you're not being stupid, literally.
So if you want to find out more about that again, I can help but also just write directly ethics at See US Thought Okay Study UK,
which will get you to the Computer Science Ethics Committee.
There's also data protection, and I realise this is a lot of stuff to throw at you guys over a lecture,
I wish it was more interactive and in-person, but data protection is a thing that I'm sure you will all hear a lot about in statistics.
The university itself, though, has very specific thoughts about this, but I will say that their website is now magnificent.
So again, there's a link there on the thing and it's all laid out. This is a direct screenshot and a little visit.
What is what is data protection? What is the scope of GDPR? So that thing with the little rectangle in the arrow pointing downwards?
It's a really useful tool to walk you through about whether or not GDPR would apply to your research.
There's a really clear layout of who is responsible and what is required,
and there's a lot of information about how you can transfer data, what might be exempt.
You know, practical considerations is genuinely brilliant website, so if you're dealing with any kind of data with people,
basically GDPR applies if they're European citizens or if there's even, to be honest, a chance that one European citizen might be a new data set.
That's another GDPR now applies to you. Follow the rules.
The thing is, one of the one of the things you bump into then is if you know that your research is sort of subject to GDPR,
then the first thing you probably need to do is a data protection impact assessment.
And I'm sorry to say that this is not the most fun thing you could do on a Saturday, but it actually is really important.
And the reason is important, first of all, again, is it's actually part of.
In the context of academic research, it's not enough to just do it right, although that's really important, you do need to do it right.
But the point of academic research is that it's about learning and teaching and pushing boundaries.
And all of those means there's a lot of there's a lot of scope for mistakes.
There's also a lot of scope for people who are looking again to branch out in their future careers and things.
So the whole point is you're always in academia meant to do extra effort to make sure that you're being.
Theatrically isn't the right word, I don't mean that at all,
but almost theatrically careful because what you're doing is you're demonstrating that, you know, how to do all of these things.
They might not always be necessary for everything, but you need to demonstrate in the context of an academic environment that you are able to do all
of these things and think about your research in the whole and not simply in the in the detail.
So with that in mind,
a data protection impact assessment allows you to demonstrate that which makes publications happy and makes future employers happy.
It makes examiners happy. But also, the thing is, GDPR entails a real life legal risk to the university.
And so if you goof up, the universe is on the hook and they will get fined and they will not be happy with you.
But actually, the whole point is it's not about the fine. It's really not. It's actually about the responsibility part.
But I'm saying the university takes it seriously because they will get fined.
So that's why they've done such a great website to make it easy for you to do this.
So the first step is that you fill in a little for when you can see again,
there's a website that gives you links to everything you need and then based on your answers to the form,
you find out whether or not you need to have more serious thinking about your research, data protection design, basically.
But the good news is we have researched the research, data management research does our research data Oxford team.
So all of these things so far, you can you can imagine it's kind of like a net, a web of like, Well, who do I go to?
Is it a compliance issue? Is an ethics issue? Is it under the Piscotty definition?
Is it not? Is it GDPR? Is it not? And I guess we really terrifying and confusing, especially if you've never done it.
So what you do, you take a deep breath and first of all, you can talk to your supervisor,
but the supervisor says, Well, I don't know, go to research data management. These guys are legends.
So the website again is their research data Dot Dot Dot UK.
They have real life humans at the end, so they contact us button on the on the website you put you click it.
It gives you an email and a real live human will read your email and get back to you and they'll do it quickly.
And they're brilliant.
They do things that they'll explain to you things about archival so that their responsibility to look after you data they can explain about
licencing and the legal implications of either reusing something under a licence or putting a licence on your own data or your own software,
or whatever it is you're doing.
They link back to they have a really good link between them and the compliance team to make sure that so things like GDP are linked up.
If you go in through the research data management team, they will help you to make sure that you ticking all the boxes they are.
I hope this clears you. I love them. They're brilliant. So that ends the really quick summary of types of team in the university,
and I would like to later on to discuss how you know which one you might need,
but really quickly in the interests of making sure we're all speaking the same language.
The whole point is all of those exist as different methods to get basically to compliance.
So compliance means do I comply with some specific burden and it might be a regular like an actual law of the country,
or it might be a policy the university has with the university says all employees are all students.
Must that that that you must comply with that, right?
So doing correct or doing a GDPR data impact assessment form or any of those other things are about compliance.
But there's also ethics and ethics just means what does my community?
Of like minded people in the same area, so what community, what do we believe is right?
And that's different community by community, and I'm sure this will have been discussed by a lot of other people in the same lecture series.
But the obvious the obvious example of this is, for example, concepts around privacy and self-determination.
Everybody can agree. I think very, very few people in the world will say privacy is bad.
Very people would say very few people as a self-determination, basically being able to make decisions about my own self.
Everybody agrees that it's good, but how do you ensure it? Well, the hilarious sign on the on the left of the screen, click like that's a pen tester.
So if you're a penetration tester in software development world, your ideas. I ensure privacy by checking it,
and I ensure self-determination by being allowed to prod at the boundaries of software that I'm using or on behalf of other people.
Prod at it and see if it works just just like see if people are keeping their promises to me.
But if you come from a corporate environment where, say, copyright is an issue,
then allowing people into private things is not really how you want your intellectual property to be used.
There's also a concept of So I've got this copyright, but if you've heard of copyleft,
which is why there's a reverse see there in the middle, so the copy left community, they have an idea that.
It's OK to be you, it's OK to be things so long, generally speaking, so long as you give credit, for example.
So is that OK? Do you have the concept of it's OK for anybody to use stuff so long as you acknowledge it?
Or is it like, Nope, that was mine, you can't have that. That's not fair.
Those are two different opinions, and they can both be absolutely right, depending on the community you're in.
The last ideas that I heart fries. So this is more of a social science and medical science stands.
Would talks about the fact that consent is really important.
So the way we ensure privacy and self-determination, when people is asking their consent before we do things to them or with them,
and that consent needs to be says free and informed and enthusiastic, i.e. very clear and specific.
What are they consenting to?
And those are all different ways you can ensure your privacy and self-determination, but they are not the same thing at all.
So which community are you? Part of? That depends, for example, on the general way you're publishing, and so it's actually really hard to navigate.
So why might ethics directly be relevant to your research? Well, maybe you want to reuse data about people, or maybe even you want to directly?
Maybe you want to directly collect some yourself and you want to make sure that you're
doing it respectfully and safely and robustly on behalf of yourself and the participants.
So you want to be looking after your participants in a good way, but also for yourself because you don't want to have to collect the data again.
If you collect all the data and then somebody says, Oh, this wasn't properly consented,
they will throw it out your if it's a thesis examiner, you will be hauled up.
And if it's a if it's a paper where you try to publish it, they will.
They will throw that paper out and you have to go back and collect the data again.
So in that case, the way you get around that is that you go straight through here because that's a nice,
straightforward people to write fairly directly interacting with or directly using their data.
But if it's not research, then it's not correct. And that case is more about probably about licencing.
And then you talk to the Oxford data management team.
So maybe you are developing tools for decision support and you want those tools to be robust and usable.
Well, in that case, again, if it's technically what you're doing is research, then it might be a correct thing.
But it might also be more about explainability. It might be about the data itself as and where are you getting it from?
Are you allowed to re-use it for this purpose, like legally speaking or also just again from an ethical perspective?
We can talk about some examples, but there's a lot of you know this, right?
You know, statistics data can have all kinds of weird strings attached to it.
Documentation, right? If you're developing a tool that people are going to use, it needs to be documented.
And actually, well, that's not technically part of the ethics approval process.
It's absolutely part of being an ethical actor, proper software development techniques.
So again, if it's something people are relying on, you need to have built it.
Using robust things, you can't necessarily put it together with chewing gum and duct tape because people are depending on it.
It might matter how you built it. That might involve things like accessibility and screen like is the tool you're using going to be used
by people who might need to interact with it through screen readers or are using cascading style sheets?
There's all kinds of things around that.
It might be that again, because people might depend on it needs to be secure or at least be resilient or both.
And I can provide guidance, thoughts on this if you want, but basically if going through those.
First of all, if it's Piscotty definition of research and is directly involving people, correct?
If it's not both of those things, then you like, What do I do?
So explainability that would be handled quite nicely by the computer science vulnerability risk.
I mean, the risk assessment, if it's about data and where it's coming from, that's also in the computer.
I know computer science. I risk assessment. But also you might want to talk to the research data team if it's about documentation.
Hopefully you have expertise about that.
But again, if you go through the AI risk assessment, that's one of the things that prompts you about is have you done that properly?
But if you don't know where to find the expertise again, Campsie is really good on this because we've been practising,
but I'm sure there's loads of expertise and stats as well.
Again, proper software development techniques, we've got some guidance on that from computer science that is useful accessibility.
That's fact. So the university has an accessibility office, but also again, the Oxford data management team are lovely.
They can connect you if it's about security and resilience again.
You're very welcome to lean on the computer science research ethics team who can point you in the direction of whatever
expertise you haven't got because we have a software engineering master's programme and lots of experts who are good at this,
hence the guidance talk if you want to just ask us. Or.
Maybe you want to train a magnificent deep neural net and it's hungry for data and you need to feed it.
And what you want to feed it is baby tweets or social media profiles or photographs of people maybe say you scraped it from Flickr or,
you know, dating profiles, personally identifying data.
Is this OK and this kid's incredibly complicated, because this is the part where I was talking about this, what the law says,
and then there's kind of what your conscience tells you or what actually your community ethics tells you.
More importantly, but your conscience matters, too, which is.
Under the terms of Twitter's terms of use, for example, anything people tweet isn't actually their intellectual property, it belongs to Twitter.
Right? And Twitter has a terms of use that come with it, which is that academics may reuse anything that Twitter anything on Twitter.
It can be used for academic research. No problem, but it must be cited,
including the reason you see those little screenshots of Twitter like a tweet is because under the terms of your use for Twitter,
you need to include the username of the person and the fact that it came from Twitter
and some other metadata so that the way you do that easily take a screenshot.
Problem is, that includes, like I said, the terms of you say, you must say who tweeted it and that it came from Twitter.
But if you're trying to be an academic who's trying to protect the interests of
your research participants or your unwilling people who you statistically scraped,
maybe it's not very fair to be naming them by name, because maybe you're calling out specific behaviour that might be embarrassing to them or might be
making a vulnerability for them in some way of revealing some personal information about them,
maybe whether they're at home or not or whatever. There's tons of information that people could infer that you might be able to do.
Really fascinating research on, but it wouldn't be very responsible or fair to name those people by name in your dataset.
But Twitter says you can only use our data if you name them by name. How do you balance that?
There's loads of there's loads of dilemmas like that. And again, Helen in iMessage.
Rick has some expertise in that, and so does computer science. So we'd be really happy to help you navigate that minefield, right?
So imagine you got through that somehow and you decide to train your network and you wrote a paper on it and you want to submit it to,
I don't know, some journal I put in there, it's right and you want to publish your data set to make it available for the world
because that's good science and that's part of being a responsible researcher, right?
That's part of good research, ethics and responsible research and, you know, science.
But your dataset again contains pictures of people or tweets by people in which you are
technically allowed to have because maybe it was Creative Commons licence or whatever,
but. Can you? Is that is that fair?
And in what way can you do it?
So the example is, for example, you want to include in your paper examples of things that your classify got correct, can you?
So that's about your dataset or about the publication. Or another example is maybe you want to create and create a vision system.
This is more, I guess, less stats, but it definitely people in your department have the skills to do this.
So it might well be somebody on this call. You want to create a vision system that can infer something about a person.
Anything at all about a person. But especially maybe you could add,
I think that you could infer their sexual orientation or their gender or their ethnicity or their IQ or their religious affiliation,
or their social popularity or political affiliation likelihood to commit a crime.
Academic performance almost all of those. It should be obvious to you sitting on the call and thinking about it are very, very sensitive topics.
Some of those are legally protected. They're called. It's actually a legally protected category of data.
So gender, ethnicity, things like that, sexual orientation,
you you might be able to do interesting science, but you need to know what the law says you can do.
And also, again, be aware that what you've done, even if your particular use of it as a researcher for your use case is fine once you published it.
Anybody can take that tool and run with it and do anything. So what are the ethical risks?
How do you think it through?
That's why we've got our machine learning and AI vulnerable machine learning and AI risk assessment performance to help you think
that through and ask all the questions that you should have asked before you start so that you don't build something and go,
Oh, I shouldn't done that. It's not about saying no, it's about saying, how do we do this in a way that's thoughtful.
Or finally, right, this is my my wheelhouse is the cybersecurity thing.
Maybe you maybe your research allows you to discover flaws in systems which allow you or, if misused,
could allow criminals or some kind of attacker to exploit those systems in unexpected ways.
Right. I mean, it's like anything from a classic statistical inferences thing where all of a sudden,
if I combine this dataset with that dataset, suddenly I can tell something that nobody thought I could tell.
But it can. There can be lots of other things, especially with software and penetration testing, which is less your thing, but definitely happens.
So again, what can you do about that? And that's something where the Computer Science Research Ethics Committee would be really happy to help you,
and that's where we have our vulnerability risk assessment chief. The vulnerability in pen testing type type approaches.
And again, the good news is, as you will,
those of you who are there for this talk last week will remember that responsible research and innovation is something
that the University of Oxford has actually had some of the world leading academics who are developing these frameworks.
So the area framework, which stands for Act Engage, so I anticipate engage reflect an act, a R e a and I keep getting word around.
But the words on the screen is that is a framework that allows you again to kind of work through things so that.
The system that they have developed has been incorporated into those risk assessment sheets, but also there's a formal methodology for this.
So if you're developing something bigger, some big project the U.K. research ethics councils now is,
I think UK research funding councils now require that you have thought about the area framework for a lot of kinds of research.
And so if that comes up in a grant application or a practise doing that because you think it would help your career,
but also because it's responsible,
we have the experts who've actually developed that methodology and who can help you apply it to your particular question.
They believe they'd love to you. I mean, Max, for those of you who are there is lovely.
And it would be you would be delighted to help you with that.
But the thing is, actually, I've talked an awful lot and I've still got a section on legal issues before I get into them,
would anybody like to pull me up and ask any questions? All right, well, I'm more than happy to to have sort of a more specific discussion at the end,
but the reason we the legal issues is because these are things that you may never encounter and that's absolutely fine,
but most people don't even know about them until they find out the hard way.
And it matters, particularly in the context of university research,
because it's one thing like the classic thing is it's one thing to break the law, which is wrong.
It's quite another to get caught. And if you're going to publish your research, that's that's getting caught.
Right? So you have to make sure that you're being compliant with the law,
especially for anything that you want to publish because it's really important or you want to publish it.
So one of my favourites, this comes up much more for computer science, but it might matter for you is the UK Computer Misuse Act of 1990.
Now, the date should probably tell you all you need to know about whether this law is particularly well defined for today's modern world.
So I've detailed it here on the slide for anybody who wants to refer to it later.
But the important thing is that it basically creates an actual criminal act in the UK, which is unauthorised access to a computer,
and that it can be specifically talks about unauthorised access with the intent of committing further
offences and distributed denial of service attacks and things things that you obviously know are wrong.
But the fact that unauthorised access to a computer is itself a crime is a problem, right?
All that means in this context is that the attacker attacker is aware that they are not intended to use the computer in question.
That is it. Right? So I've got the paragraph below.
Breaking organisational policies for computer use is sufficient. For example, sharing credentials within a home environment is fine.
But if there's a company policy saying don't share credentials,
they're logging into your colleagues computer even with their express permission in their presence,
like you're standing over your shoulder saying, Please take this for me. I don't, I don't know, I just broke my arm.
Can you please put my password in for me? Is in breach of the university's policy in our case,
and therefore a crime crime is committed the moment you press the first key of their username if you intended to log in using their credentials.
That's a really. Difficult things sometimes, I don't know.
I'm a huge fan, but you need to know that this exists and it's true, but it's also an offence to distribute software.
That's my eight attacks on computers, which sounds pretty obvious on the face of it, but especially in the computer science world,
there are a lot of things that have to do with tools that could be used by forensic experts for
investigations or tools used by people who are trying to test their own systems for robustness,
who never intend to take that to heart and penetrate do penetration testing on other systems.
But the same tool would allow you to exploit weaknesses in another system.
You can't create them, and you can't supply software about them, which makes publishing things in computer science tricky sometimes.
Right? So another law is the UK Wireless Telegraphy Act of 2006.
Again, the fact that is calling it wireless telegraphy probably tells you what you need to know about this law.
But if you think of it as actually the reason, it was basically reasoning by analogy,
and it started off back in the days when it was still the wireless telegraph, right?
Which is the idea that we as a society in the UK do not read other people's mail effectively, because that's the thing about privacy.
The way we respect privacy is you don't read people's stuff that it was not intended for you.
You know, it wasn't. So imagine a postcard. So a postcard has like the name and the address of the person that's going to.
And it also has the message that you've written to the person is going to. And the deal is even though everybody's there, it is there in the plane,
just as common courtesy dictates you don't read other people's postcard, even if you see it right.
So they took the same idea and applied it to wireless communications.
So you must be authorised or an intended recipient of a message to use wireless telegraphy.
Basically anything wireless, Wi-Fi, whatever, right?
To obtain information about the contents, sender or address of a message, or to disclose this information.
So again, you can't do scraping of wireless communications like full stop.
In the UK, it is really illegal. The way you could do it is say I am authorised by the owner of this equipment to do it.
But if you just plain set up a site in a public square and you put up a Wi-Fi sniffer and a sniff is going by, you have committed a criminal act.
It's really bad. And so publishing that again will be very difficult, even if the research is incredibly valuable.
Now the thing is, if the research is incredible, it's potentially really valuable and there's no other way that you could test it.
There's no sort of dummy experiment that you could do that gives you equivalent proof of concept data that it could well be.
The university will take your side on this and say, We think this is where this is worth it is basically almost civil disobedience.
This is worth the fight, but you cannot choose that for the university.
You have to have gone through, the official channel said. I know this is a thing, this is a potential risk, but it's worth it.
And here's why. And then the university will go, OK, I like the cardiologist,
and all of a sudden then you're in a position where you've got the university's lawyers behind you and not in front of you.
That's what you want. So that's why I'm telling you this stuff is not of the university.
You just have to say no, but they need to know that they've said yes because you can't surprise them with this kind of thing.
The UK Investigatory Powers Act 2016 basically is the Wireless Telegraphy Act,
but more so any kind of public telecommunication systems and all that says is you need lawful authority to carry out any kind of interception.
And that's all this right was designed with police and like GCHQ HQ in mind, so you need a warrant.
But the problem is your university. You will never have a warrant.
So to do private telecoms, public telecoms or Public Postal Service or wireless communications.
You need authority to intercept that. And so the way you do it is you either get the owner of that technology onside or
you be very careful about it because you need to know that you're playing with fire.
The last thing is the UK USA Computer Fraud and Abuse Act. Again, 1986, guys.
Not. Not great. OK. It is illegal to engage in unauthorised access to a computer connected to the internet.
This is a US law and we are currently based in the UK. But this is an international world where data crosses borders, right?
And one server that was based in California or one Amazon data centre is enough, right?
To make U.S. law applicable in do OK, so it is illegal to engage in unauthorised access to a computer connected to the internet.
But worse than the UK version, the statute doesn't define authorisation or without authorisation.
So this is basically a stick to hit people with. If you are a corporation, you want to silence and research.
So again, you need to be sure that you knew what you were doing as a researcher before you get into territory
where this might apply to other things where it applies is knowingly trafficking in computer passwords.
That sounds obvious, right? But actually, if you imagine you doing kind of statistical research on data dumps and the data dumps themselves contains
in password either explicitly you were looking for that or it's just part of some other sort of data breach.
You sending that around to your buddies is knowingly trafficking,
but also you publishing that data set is knowingly trafficking in computer passwords.
So again, this is an easy one that you think sounds obvious, but when it comes down to it can be quite problematic.
Similarly, knowingly infecting a computer with a virus,
hilariously infecting computer and virus aren't really defined in our kind of slightly old school terminology.
But again, if you make some kinds of software that's exploratory, that could be a problem, right?
And as a quick side note, actually on classified information.
So information is in the public domain because it's been leaked, right?
Normally, like with a company secret, this can be if it's like this under the secret recipe for Coca-Cola, right?
You're not allowed to do it.
But if somebody leaks it onto the internet and you get the leaked version, you can have it because that's fair game has been leaked.
Coca-Cola lost it, right? You can have it. You can't steal it from Coke,
but you can get it off the web if anything is ever classified by a government
in the USA or the UK and lots of other places that I know the USA in the UK,
it is still an offence to possess or distribute classified information, even if it's been leaked.
Right. So this is what WikiLeaks did, and that's why everybody got so mad is now granted it's bad for him to prosecute.
So again, there's a real risk here. Research is not huge, but you do need to know they could actually prosecute you for that and you need to be
aware of that if you ever want to do anything dealing with classified information. OK, almost there, guys.
You've been really patient. Well, we're getting on to that of the USA Digital Millennium Copyright Act of 1998.
This one? If possibly the worst one on the list is highly politicised, it is tied up in things like the right to repair and fair use and free speech.
But basically, if you can, if a company or any organisation, but often company,
if an organisation or a person puts copyright or access controls, digital access controls you basically encryption on something,
then it is illegal for you to circumvent that access control tool,
i.e. the encryption is illegal for you to break the the the electronic lock and use something,
even if the thing you're doing once you've broken the lock, you were totally allowed to do.
If it's a piece of software that you bought and you paid for and you own or DVD that you bought and paid for and you own,
but it's still got encryption on it and you break the encryption to,
like, make your DVD play in a different computer because of the restriction about the region controls, then you are breaking the law.
And so that matters again where the concept of technologies you might be using, it had to do with circumvention.
This isn't hugely an issue for statistics, but it can be depending on the data sets you playing with.
It could be an issue. But yeah, it's also has to do with the right to repair your own devices, which is very annoying.
There's the UK Strategic Export Controls List. Realistically, most of you will never encounter this, but again, you guys are really smart.
Right? And this is the kind of thing that you are bright enough that you might encounter it.
Basically, the summary of it is if you if you've made some new technology that is so cool that the UK military would want
to have an exclusive lock on it because they don't want other countries having access to that technology.
There is an export control that we put on it right? And a person wishing to physically export good software technology on a control list or
to transfer it by electronic means will need an export licence to be able to do so.
So that, you know, it has to do even with possibly even really cool statistical inference techniques could come under this.
Mostly, you won't run into it. But if you think you've got something that is really hot stuff, talk to your supervisor,
talk to your departmental administrator because you need to know where you will be.
You'll be in trouble because even emailing a collaborator who's across the national boundary about your project could get you in trouble with that.
And that'll mess up your visa and you'll never be able to travel again is really bad. There's also the prevent duty.
This is really minor, but people who do its deal with scraped data might encounter it.
So it's basically concerned with preventing people being drawn into terrorism.
The prevent duty really applies to the university or the department, but it also can apply to you and your research collaborators.
There are two main duties. One is that researchers need to be careful about the exposure to radicalising material.
So if you're scraping the most horrible things that you know social media has to offer,
that's really hard on a person psychologically, and you need to take care of yourself.
We want you to take care of yourself at the university has a duty to take care of you as well.
We don't want you being like, scarred or traumatised by what you've done. Also, heaven forbid, seeing all of it might actually radicalise you.
So let's we need to be really careful about this stuff, right?
And so you also have a duty about reporting any material you might come across if you're
doing some research again in the bowels of the internet where you haven't come across.
That kind of material, you have a legal duty to report it, and if you're not sure how we can help you,
if you ever get to that stage as computer science or even just Google prevent duty and people can show you it's not that hard.
There is similar things about responsible disclosure, so this is the thing where if you fight and especially in software flaws,
generally speaking, but it could well be again with statistical inferences,
you can basically poke holes in a system and especially a system that's owned by either a government or a corporation who would rather maybe,
maybe they should know about it. Maybe they'd rather not know about it, and you never know which it's going to be,
whether they're going to be delighted that you've told them, and we're so happy they can fix it or whether they'll try and gag you.
The problem is, if they choose to be the person who wants to gag you,
all those laws that I've listed above can all be used as a stick to beat us and they can silence you.
It's really hard to navigate. Generally speaking, if you're going to do something that involves showing mistakes or weaknesses in a system,
you need to generally try and ask permission first and try to engage the technology owner in the process.
Because the technology owner in every jurisdiction I've looked into this for and I've looked around a lot.
They always retain the right to prosecute you. Always.
They can agree not to. But that's all you can get. They might otherwise have.
You haven't talked to them first. They might just hit you with a stick. And that's it.
And I do know instances of researchers who were hit with gag orders and couldn't publish their work.
So the final thing and this is final is a General Data Protection Regulation GDPR.
So we talked about this a few times and hopefully you all know about it already,
which is that basically personally identifiable information or personal information is actually the legal term personal information.
But in the medical field, we talk about personally identifiable information.
So PII medicine, PII GDPR, but same idea stuff that allows one individual to be directly or indirectly identified by reference to it, right?
So it's like the pseudonym ization is great because it takes their name out of it.
But actually, it might not be enough if they're the only person in the dataset, like if you're the only person with,
say, tuberculosis in Oxford, like saying one person had tuberculosis might still identify you, right?
Especially when you can combine that with data from others that there are there are two concepts of data controller and data processor,
which I'm not going to get into here.
But no matter if you're getting into GDPR data, the important part is there are legitimate and illegitimate purposes for holding data.
If you don't have a reason to hold this personal data personal information, you must not hold it.
But there are totally lawful reasons to have it, and that might be on the basis of consent.
A person directly says Yes, I consent, hence the cookies on all the websites, which is terrible, if not real consent.
But anyway, you might be under contract. But if you keep going down, you'll see public interest.
Now, researchers at the University of Oxford carries out in the public interest.
So you're generally speaking, absolutely fine,
but you do need to know this so that you can put the right things into any wording that you might have on a website or whatever
to make sure that you're covered so that nobody can come back and hit you with the GDPR and say you were in breach of it.
And that was a heck of a lot of information. And I think your brains are probably all full.
Is there anything to do? I've got a hand.
I think under no training here.