4 · Ethics and access

Wednesday, September 16, 2026

This page is a stub. Materials appear here before the meeting.

What you should be able to do after this meeting. Say whether your project needs IRB review, a data-use agreement, both or neither — and defend the answer. Name the date each gate has to start, counted backwards from January, so the spring is not spent waiting.

Where to read more

Adams ch. 2 on research ethics.

Session A · 2:05–3:15

Five blocks, and the last one is the point. First, why the rules exist — briefly, and without the sermon. Every rule in research ethics was written after a specific failure. Nuremberg followed the doctors’ trial. The Belmont Report followed Tuskegee, which ran for forty years and was stopped by a reporter rather than by a scientist. Its three principles — respect for persons, beneficence, justice — are still the frame every IRB applies. But the modern failures are the ones that concern this room, and none of them involved a needle. Facebook ran a mood experiment on 689,000 users and published it. Cambridge Analytica harvested a personality quiz’s friend graph. Second, the IRB. Two questions decide whether it applies. Is this research? Are there human participants? Teams miss the second half, because identifiable private information counts even when you never meet anybody. Scraped posts count when individuals are identifiable. So do purchased consumer records. Then the three levels of review, described in weeks rather than in definitions. Exempt can clear in a fortnight if nothing is wrong with the submission. Expedited runs to a month or more. The full board meets on a schedule you do not control, so its clock is a calendar, not a queue. And the rule that catches somebody every year: you do not decide that you are exempt. The IRB issues that determination, and it issues nothing until every person named on the protocol has finished CITI human-participants training. Exempt protocols included. One teammate who skipped the modules holds up the whole team, so do them this week, before you know whether you need them. Third, the other gate. A data-use agreement is a contract, not an ethics review, and the university signs it rather than you. Expect legal review on both sides. Expect months. Expect restrictions on what you are allowed to publish, which can mean you cannot show your own result. Terms of service are the same species — a contract you accepted by clicking. Scraping is rarely a crime and frequently a breach. Prefer the download, then the API, then nothing. Fourth, whether you may hold the file at all. Direct identifiers are the easy part. Latanya Sweeney showed that ZIP code, birth date and sex together identify most Americans uniquely. So “we removed the names” is not de-identification, and a vendor’s word for it is not a determination. Then conflicts of interest, which are disclosed rather than confessed — a disclosure tells the reader how to weight your claim, nothing more. The clause to settle before anyone signs anything: a sponsor may have the right to review, never the right to veto. Then credit inside the team, agreed now, while there is still nothing to fight over. Fifth, integrity. Fabrication, falsification and plagiarism, one line each, with a case attached to each. Diederik Stapel invented his data and lost 58 papers. Reinhart and Rogoff made a spreadsheet error nobody checked and it moved fiscal policy in several countries. And the one that is live in this room: a fabricated citation is a fabrication. A New York lawyer was sanctioned $5,000 in 2023 for filing six cases an assistant had invented. “The AI generated it” was his defence, and it did not work for him either. Finally the calendar, run backwards from January. That is the argument for holding this meeting in September.

Session B · 3:30–4:30

Every session B opens with a ten-minute team check-in: what you did since last week, what is stuck, and who is doing what next. Written down, and handed in with that session’s work.

Ten minutes of team check-in, then the cards. Each team draws a project somebody actually proposed, and every one is blocked in a different place. A team scraping Glassdoor reviews with the usernames attached. A teammate’s employer offering internal HR records, with a clause letting the firm approve the write-up. Interviews with farmers in the Dominican Republic, conducted in Spanish, by a team that has not done CITI. A vendor file sold as de-identified that carries ZIP, birth year and sex. A licensed WRDS extract about to be uploaded to a chatbot for cleaning. A survey of your own classmates about salary expectations and visa status. Three specifications run and only the one that worked reported. For each card, three answers. Which gate does this trip — IRB, DUA, terms of service, conflict of interest, integrity, or none? What is the earliest date it has to start? And the half that carries the marks: what is the version of this project that is legal, is honest, and is still worth doing? Then one team is drawn at random to defend at the front while the room attacks, and we draw again as the clock allows. Nobody knows in advance whether they are up. Two cards trip nothing at all, and the team holding one has to be willing to say so. Then your own project. You fill in the ethics-and-access checklist for it, on the template, and you hand it in signed before you leave. Human participants, yes or no, with the sentence that justifies the answer. Every data source you named, who holds it, and what its licence or terms permit. Whether any field is identifiable, what you do about it, and where the file will live. Any conflict, one sentence each. Who does what, by name. And the date the slowest gate has to start. Most teams will find they need none of it. The teams that do need something find out today, which is the whole reason this meeting is in September.

Your team’s output is submitted before you leave.