4 · Ethical and legal obligations

Wednesday, September 16, 2026

Open the slides

What you should be able to do after this meeting. Say whether your project involves human participants, and defend the answer with the branch of Cornell’s decision tree it sits on. Say what p-hacking is, and what the honest version of a three-specification analysis looks like. Say whether any data source you named needs a data-use agreement or carries a licence, and who signs.

NoteWhat to take away

A study is a question, the data and the methods. Two more things decide whether it can happen and whether it survives: ethical practice and legal obligation. They are different tests. The Tuskegee study ran for forty years and nobody was ever prosecuted.

Human subjects and the IRB. The rules were written after specific failures. They apply when you interact with people, or hold identifiable information about them, and your results leave the course. Many projects in this room do neither. Cornell’s decision tree says which, and when in doubt the IRB office decides, not you.

Ethical research practices. Fabrication, falsification and plagiarism are misconduct. P-hacking, selective reporting and HARKing fall short of misconduct and are far more common. Every case in the deck was caught by outsiders, from the data file, after publication. A fabricated citation is a fabrication, whoever or whatever produced it.

Data-use agreements and licences. A data-use agreement is a contract, and the university signs it, not you. A licence and a website’s terms of service are contracts too. Nothing at moderate risk or above goes into a public AI tool.

Session B decides which teams need an IRB application and which need a data-use agreement. The teams whose project involves human participants complete CITI training before meeting 6, because the IRB issues nothing until every person on a protocol has finished.

Due

In session B, your project’s IRB and DUA checklist, signed by every member: does it need an IRB application, and does any data source need a data-use agreement. If the answer to the first is yes, every member’s CITI human-participants training certificate on Canvas before meeting 6, Wednesday September 30.

Session A · 2:00 to 3:15

The hour opens with why it exists, and then has three parts.

Why this meeting exists

A study is a question, the data and the methods to answer it. That is how you have been taught to think about it, and it is what the first three meetings were about. Two more things decide whether the study can happen, and whether it survives. Ethical practice: how you treat the people in the data and the people who read the result. Legal obligation: what a contract, a licence or a regulation lets you do with the data.

They are different tests. Legal is a floor set by somebody else. Ethical is a judgement about people who cannot make it for you. The Tuskegee study ran for forty years and nobody was ever prosecuted. The Facebook experiment broke no law and drew an expression of concern from the journal. Reporting one regression out of three breaks no law and has ended careers. Scraping a public website is rarely a crime and frequently a breach of contract. The National Academies’ 2017 report on research integrity tells institutions to go beyond simple compliance.

Human subjects and the IRB

Every rule in research ethics was written after a specific failure, and the hour tells two of them without assuming you know either. Many projects in this room involve no people at all. The rules are still yours, because the same ones govern every survey and experiment you will run inside a firm.

The Nuremberg Code. From 1942, SS and Luftwaffe doctors ran experiments on concentration-camp prisoners who could not refuse: low-pressure and freezing experiments at Dachau, wound experiments at Ravensbrück, Mengele’s experiments on twins at Auschwitz. Hundreds died or were harmed, and nobody asked the prisoners or told them. The United States Holocaust Memorial Museum is the source. In December 1946 a US military tribunal at Nuremberg put 23 doctors and administrators on trial; the judgment of August 1947 convicted sixteen and sentenced seven to death. Into that judgment the judges wrote ten rules for research on people, the Nuremberg Code. The first: “The voluntary consent of the human subject is absolutely essential.” The Code was never adopted in full as law by any country (Shuster 1997). It was absorbed into the World Medical Association’s Declaration of Helsinki in 1964 and into the consent rules of US regulation, 45 CFR 46.116. The question for the room is which of these experiments would still have been wrong if nobody had been harmed, and the answer is all of them, because the subjects could not refuse.

The Tuskegee syphilis study. From 1932 to 1972 the US Public Health Service followed 600 Black men in Macon County, Alabama, 399 with syphilis and 201 without, to record the course of the untreated disease. The men were told they had “bad blood”, were given free meals, transport and burial insurance, and were never told the diagnosis. Penicillin became the standard treatment in the 1940s and was withheld. Nobody was ever prosecuted. A Public Health Service employee, Peter Buxtun, objected from 1966, was rebuked, and gave the documents to the Associated Press; Jean Heller’s story ran on July 25, 1972, and the study ended that November. The CDC’s timeline is the source. The question for the room is in which year the study became wrong, and it has two answers: 1932, when the men were deceived, and the late 1940s, when a cure was withheld.

The Belmont Report. The National Research Act of 1974 created a national commission and wrote the Institutional Review Board into law (Public Law 93-348). The commission’s Belmont Report of 1979 set out three principles, each paired with a practice: respect for persons, applied as informed consent; beneficence, applied as weighing risks against benefits; justice, applied as choosing participants fairly. The report names Tuskegee as the case where justice failed. An IRB applies the three principles before a study starts. A board has at least five members, at least one non-scientist and one person from outside the institution (45 CFR 46.107), and the federal rule reaches only research that is federally funded or federally regulated. So no law requires a company to apply the three principles to research it pays for itself; only a drug or device trial must go through a board whoever pays, under FDA rules. What reaches the firm instead is privacy and consumer-protection law, its own contracts, journals and the press, and none of them needs a board to act, as AOL learned in 2006.

The Facebook experiment of 2014. For one week in January 2012, Facebook changed the News Feeds of 689,003 users and measured whether their own posts turned more positive or negative. They did, by about a tenth of a percentage point. Consent was the Data Use Policy. Two authors were at Cornell, and Cornell’s IRB ruled that they only saw results. PNAS published it in June 2014 and issued an expression of concern in July. Facebook’s answer in October 2014 was an internal review panel. The first question for the room: what is different between the Facebook experiment and an ordinary A/B test? The answer is that it was designed to produce generalisable knowledge and it was published. The definition turns on the intent to generalise, not on whether anybody was hurt.

When the IRB applies. Two questions decide it. Is this research, meaning a systematic investigation designed to produce generalisable knowledge? Are there human participants, meaning you interact with people or you hold identifiable private information about them? Both have to be yes. A survey, an interview or an experiment you run counts. Scraped posts count when individuals are identifiable, and so do purchased consumer records. Firm financials, prices, trade flows, weather and foot-traffic data that arrives aggregated do not. Many projects in this room are on the second list.

Cornell’s IRB office publishes the decision tree its own staff use. A class project whose sole intent is to meet a course requirement is not human participant research; a capstone whose results leave the course, for a presentation, a thesis or a sponsor’s decision, is. A study whose outcomes stay specific to one organisation is quality improvement and not human participant research, which is last week’s private value. Existing data has its own page, and the question it asks is whether you can link a row to a living person, directly or through a code, not what the vendor calls the file. And removing the names is not de-identification: in 1997 a graduate student, Latanya Sweeney, joined a “de-identified” hospital file to the voter roll on ZIP code, birth date and sex and mailed the governor of Massachusetts his own records, and those three fields together identify 87 percent of Americans uniquely; Netflix’s anonymised ratings were matched to named IMDb reviewers, and New York’s taxi trips with hashed medallion numbers were reversed in hours. The second question for the room is which of five projects needs an application, and two of the five need nothing.

For the teams that answer yes, the levels of review in Cornell’s own weeks: an exemption takes three to four, expedited review four to six, the full board four to eight, and the board meets on the first Friday of the month. You do not decide that you are exempt. The IRB issues that determination, and a student protocol needs a faculty advisor who answers for it, and that is me. The IRB issues nothing until every person named on the protocol has finished CITI human-participants training, exempt protocols included. So the teams whose project involves human participants complete the training now, with every member’s certificate on Canvas before meeting 6, Wednesday September 30. The teams whose project does not complete it the week the plan changes, and the credential is worth having anyway for the research most of you will run inside a firm.

Ethical research practices

The section opens with Diederik Stapel, who invented the data behind his own papers and his students’ dissertations and was reported by three junior researchers in 2011. Then the three words of the federal definition: fabrication, falsification and plagiarism. A finding requires a significant departure from accepted practice, done intentionally, knowingly or recklessly; honest error is not misconduct; and a citation that does not exist is a fabrication, whoever or whatever produced it. Then the rule you are bound by as students: Cornell’s Code of Academic Integrity, whose new version took effect on August 24, 2026. Its principle is that “absolute integrity is expected of every Cornell student in all academic undertakings”, and among the violations it names are representing the work of others as one’s own, unauthorized assistance including by artificial intelligence, citing fabricated or non-existent sources including false citations generated by AI, and fabricating data. The instructor hears a case first, the college’s Academic Integrity Hearing Board hears appeals, and penalties run from a failing grade to a transcript notation, suspension or expulsion. The syllabus’s AI policy is a written variance under the Code: AI is permitted and disclosed, and a fabricated citation is still a fabrication. Francesca Gino is the falsification case: rows moved between conditions, found from the metadata inside an Excel file, and tenure revoked in 2025.

Then the practices that fall short of misconduct and are far more common: p-hacking, HARKing, selective reporting, undisclosed data cleaning, not keeping the data and code, and authorship abuses. They fall short because nothing is invented or altered: the data are real and the search is undisclosed, and a finding of misconduct needs a significant departure from accepted practice done intentionally, knowingly or recklessly. The line is intent, since falsification includes omitting results so that the record misrepresents the research. The National Academies’ 2017 report, chapter 4, names the family detrimental research practices in place of the older “questionable research practices”, lists misleading statistical analysis short of falsification and failure to retain or share data and code among them, and says the damage might surpass what misconduct causes. In a 2012 survey of 2,155 psychologists, 46 percent admitted selectively reporting studies that worked. None of these requires a human participant: a team on firm financials can p-hack as easily as a team on a survey. Brian Wansink is the case for this room: a null result in this school, re-analysed until four papers came out of it, and a misconduct finding.

The table below has every case with its sources. The pattern is the lesson: caught by outsiders and juniors, from the data file or the reported numbers, after publication, and the price was usually the job. Journal articles per year from OpenAlex are on the Stapel, Gino and Wansink slides, with the year each case broke marked. And the one that is live in this room: two New York lawyers were sanctioned in 2023 for filing six cases an AI assistant had invented, and the judge said the tool was not the problem. The third question for the room is whether reporting one specification out of three is misconduct. It is not, under the definition. It is selective reporting, and the honest versions are to report all three and say why they differ, or to write the specification down before running it.

Data-use agreements and licences

The section opens with Cambridge Analytica, a British political consulting firm that sold voter targeting by personality and worked for the 2016 Trump campaign. Its raw material came from a Cambridge University psychologist’s quiz app, built in 2014 and presented as academic research, which about 270,000 people installed and which, as Facebook then allowed, also took their friends’ data. The data went to Cambridge Analytica against Facebook’s platform policy; up to 87 million profiles were reached, and the certificates Facebook took in 2015 that the data had been deleted were false. In March 2018 a former employee, Christopher Wylie, took the story to the Observer and the New York Times. The price was a 500,000 pound fine in the UK, the legal maximum, a 5 billion dollar FTC penalty on Facebook in 2019, the chief executive before Congress, and the firm itself, which closed within two months of the story. Three more cases where data was used beyond what was agreed: blood given by the Havasupai for diabetes research was used for studies of schizophrenia, migration and inbreeding; a London hospital trust gave Google DeepMind 1.6 million patients’ records, and the UK regulator ruled in 2017 that it had broken data protection law; AOL posted 20 million search queries for researchers in 2006 and a user was identified by name. The common thread: the harm came from use beyond the stated purpose, and a data-use agreement fixes the purpose, the recipients and the exit.

A data-use agreement is a contract, not an ethics review, and the university signs it rather than you, through the Office of Sponsored Programs. Expect legal review on both sides. Expect months. Expect clauses on publication review, destruction and redistribution, and settle one before anybody signs: a sponsor may have the right to review, never the right to veto. Employer data brings its own clauses: an NDA that covers the result blocks the presentation in December, ownership of the output is settled before the file arrives, and a conflict of interest is disclosed rather than confessed.

A licence is a contract too, and it applies to most of the room whether or not anybody signs anything. Most of what the library pays for, WRDS and Compustat included, is licensed for academic non-commercial use, so a project a firm would pay for cannot be built on it. The terms decide what you may publish and whether you may pass the rows on; the restriction is on the rows, not on the result. Terms of service are a contract you accepted by clicking. Scraping is rarely a crime and frequently a breach: in hiQ v. LinkedIn the Ninth Circuit let a scraper keep taking public pages because there was a serious question whether that is a computer crime at all, and the district court then found the same scraper had breached the user agreement, which ended in a 500,000 dollar judgment. In 2021 Facebook shut down NYU researchers’ accounts over a browser extension that collected political ads with users’ consent. Prefer the download, then the API, then nothing.

Where the file lives is a rule rather than a preference. Cornell classifies data as low, moderate or high risk, proprietary and licensed data sit at moderate risk, and Cornell’s rule is that nothing at moderate risk or above goes into a publicly available AI tool. The approved tools are listed at the AI Innovation Hub, and next week’s session runs on that list. Collect only what you need, because a column you did not need is a risk you did not need.

The cases in full

Case What was wrong Who caught it and how The price Sources
Stapel, 2011 Invented the data for dozens of papers Three junior researchers in his own department reported him His chair, his doctorate and 58 papers Levelt, Noort and Drenth (2012); Retraction Watch
LaCour, 2015 A survey that was never run Two graduate students tried to replicate it and found the survey firm had no record The paper and a job offer Retraction Watch, May 20, 2015; the retraction
Wansink, 2017 Null results re-analysed until they were papers; misreporting; records not kept Three outside researchers found about 150 inconsistencies in four papers’ reported statistics His position and 18 papers van der Zee, Anaya and Brown (2017); Cornell Chronicle, September 20, 2018; Retraction Watch, May 31, 2022
The 2012 honesty-pledge paper, 2021 Fabricated rows in an insurance field experiment Three bloggers found two fonts in one column The paper Data Colada 98; the retraction; Ariely, April 2, 2024
Gino, 2023 Altered rows in four papers The same bloggers read the metadata inside an Excel file Harvard revoked her tenure in 2025, and her defamation claims were dismissed in 2024 Data Colada 109; The Harvard Crimson, September 12, 2024; Inside Higher Ed, May 27, 2025
Mata v. Avianca, 2023 Six invented cases in a court filing Opposing counsel could not find them A 5,000 dollar sanction and letters to every judge named The sanctions order

The charts on the case slides show journal articles per year from OpenAlex, fetched September 16, 2026, with the year each case broke marked. The count excludes preprints, dataset records and the conference-meeting abstracts that journals such as The FASEB Journal print in supplements; counting every OpenAlex work would credit Wansink with 119 “publications” in 2014, of which 37 were journal articles. Output is shown rather than citations because citation counts keep rising after a retraction, and it is the career that stops. The honesty-pledge paper carries no chart, because a chart titled with an author’s name would attribute a fabrication that has not been established. The script and data snapshot are kept with the course tooling.

The Nuremberg Code, all ten rules

From the tribunal’s judgment, as printed in Trials of War Criminals before the Nuremberg Military Tribunals, volume 2, 1949, in brief. 1. The voluntary consent of the human subject is absolutely essential. 2. The experiment should yield results for the good of society that cannot be obtained otherwise. 3. It should be designed on the basis of animal experimentation and prior knowledge. 4. It should avoid all unnecessary physical and mental suffering and injury. 5. No experiment should be conducted where there is reason to believe death or disabling injury will occur, except perhaps where the physicians also serve as subjects. 6. The risk should never exceed the humanitarian importance of the problem. 7. Proper preparations and facilities should protect the subject. 8. Only scientifically qualified persons should conduct it. 9. The subject should be free to end the experiment if continuing seems impossible to him. 10. The scientist must be prepared to end it if continuing is likely to result in injury, disability or death.

Images and their licences

  • The Doctors’ Trial dock, Nuremberg, 1946 to 1947: US Army photograph via USHMM, public domain.
  • A doctor draws blood from a Tuskegee participant: National Archives, undated, public domain.
  • PNAS’s Editorial Expression of Concern of July 22, 2014: a page of the journal, reproduced for teaching.
  • Christopher Wylie at the Parliament Square protest, March 29, 2018: John Lubbock, CC BY-SA 4.0.
  • The first page of the sanctions order in Mata v. Avianca, June 22, 2023: a public court record.
  • Cornell’s IRB decision trees are reproduced from the IRB office’s public document, for a Cornell course.

Cornell’s pages in one list

Session B · 3:30 to 4:30

Ten minutes of team check-in. Then two questions about the research idea you are proposing, answered on the IRB and DUA checklist and signed by every member.

Does your project need an IRB application? Yes, no, or ask the office, with the branch of Cornell’s decision tree that says so: no people and no identifiable rows; existing data you cannot link to a living person; results that stay with one organisation; or yes, because you interact with people or hold identifiable rows and the results leave the course. A team that answers yes also names the level it expects and the month the draft goes to me.

Does any data source need a data-use agreement? One row per source: who holds it, whether it is public, licensed through Cornell, or restricted, and whether a data-use agreement is needed before it moves. A licensed source is a source whose terms you have read. A restricted source is a source OSP has to be asked about in October, with a plan B written down.

Then every team reads its two answers to the room, the room names a gate the team missed, and I rule. Many teams will find they need neither, and a team that needs neither has to be willing to say so. The teams that need something find out today, which is the whole reason this meeting is in September.

Homework. For the teams that answered yes or ask on the IRB question, CITI human-participants training, with every member’s certificate on Canvas before meeting 6, Wednesday September 30. For the others, nothing until the plan changes.

Handouts

IRB and DUA checklist. The two questions, answered for your own project and signed this afternoon.

Team check-in sheet. One sheet per team, every week.

Permissions and ethics. The reference page for both gates, with the timeline.

Where to read more

Adams, Khan, Raeside and White, chapter 2, on research ethics.

The Belmont Report is short and it is the frame every review board applies. Read it once.

The US Holocaust Memorial Museum’s Holocaust Encyclopedia on the medical experiments and the Doctors’ Trial, and the CDC’s Tuskegee timeline, are the primary accounts behind the history slides.

Sweeney (2000) is the paper behind the 87 percent, and Narayanan and Shmatikov (2008) is the Netflix paper. Both are short.

Data Colada is where the Gino and honesty-pledge findings were published, post by post, with the files. It is the best available course in how a data file gives a paper away.