Login
You're viewing the discuss.systems public feed.
  • Rob Ricciricci
    Jul 22, 2026, 4:12 AM

    IRBs are a vital mechanism for ensuring that research has respect for persons and avoids causing harm.

    But they are woefully unprepared for dealing with CS research.

    Folks at Stanford and Google ran an experiment where the basically A/B tested car congestion in cities by tweaking the routing weights in Google Maps. Without informing anyone, and without consent.

    Now: their results are cool! They do suggest that this can be a good way to ease automobile traffic! It can save time and emissions!

    But check out this part of the paper:

    "The study protocol and data use were reviewed by the Stanford University Institutional Review Board (IRB). Based on the analysis involving exclusively non-identifiable data, the IRB determined that this work does not meet the definition of research involving human subjects as defined in 45 CFR 46.102 or 21 CFR 50.3, and therefore did not require formal IRB review."

    What are we even doing here if changing the traffic patterns of entire cities does not have "human subjects"

    nature.com/articles/s44284-026

    💬 10🔄 141⭐ 147

Replies

  • Rob Ricciricci
    Jul 22, 2026, 4:57 AM

    Like, I had to go through more IRB approval than this when we wanted to *interview 10 people about their jobs*.

    I'm not complaining! It was good! We approached the interviews more thoughtfully than we otherwise would have, were more careful about the kinds of things we needed to avoid exposing, and had to consider what "harm" could mean in this context!

    But IRBs *know* about talking to people! They *know* about giving people experimental drugs or surgeries.

    But apparently they don't know about perturbing the daily lives of millions of people.

    💬 3🔄 12⭐ 55
  • ansuzansuz@gts.cryptography.dog
    Jul 22, 2026, 5:25 AM

    @ricci I imagine their backroom conversation went something like

    ...but if we had to get participant consent we wouldn't be able to do a study like this...

    🙄​

    💬 0🔄 0⭐ 1
  • Davidshieldsy05@aus.social
    Jul 22, 2026, 10:51 AM

    @ricci yeah it’s hard, and I think this is an interesting edge case.

    One of my perspectives is that this is within the bounds of what the corporation who runs the software is “free” to do with their own software.

    I.e. the algorithms that program the route are (theoretically) a black box, and the company is free to change those algorithms as much as they want without ethics approval. By using the app you are agreeing to let them present you with a route.

    As the driver, you are also (for the most part) free to ignore or modify the presented route.

    But at the end of the day, it might come down to the specific wording of the regulation.

    💬 2🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Geoffrey Adamsbiogeo@mefi.social
    Jul 22, 2026, 12:06 PM

    @stefan_hessbrueggen @shieldsy05 @ricci Speaking as someone who does human subjects research in an academic setting, it is good and appropriate that we are held to a high ethical standard. Dealing with the bureaucracy around IRBs is often frustrating and slows things down, but that is an appropriate price to pay for the protection of research participants and giving society greater confidence that research undertaken for the benefit of all is being done ethically.

    What really grinds my gears is knowing that in many cases, a researcher working for a for-profit company can do the exact same things with zero oversight, and sometimes things that no IRB would approve, because many of the laws and regulations protecting human subjects no longer apply when the research is done for a "business purpose". We make it cheaper and easier to exploit people for profit than to learn from them for science.

    💬 2🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 1
  • Christine Johnsonchristinkallama@hcommons.social
    Jul 22, 2026, 3:57 PM

    @shieldsy05 @ricci Yes, but in this case drivers weren’t told that the route they were being offered was under different, non-standard criteria. Using the app may constitute consent, but in this scenario not informed consent. As you said, an interesting edge case.

    💬 0🔄 0⭐ 1
  • Colin Gordoncsgordon
    Jul 22, 2026, 12:26 PM

    @ricci I think it's partly the scale that they're not equipped for, but really the systems thinking about downstream effects of that scale. When I did my last IRB training I was struck by the fact that the system assumes either individual interactions with researchers xor Internet surveys--- that any serious impact requires direct interaction or publication of private information.

    No part of the system --- requirements or training for IRB members --- is tuned to consider impacts across millions of people (though this is the kind of obvious thing I'd expect submitters to identify clearly). This, that Minnesota kernel bug incident... I mean it's entirely possibly to fuck up traffic for millions bad enough that an ambulance doesn't get there in time, or accidents are made significantly more likely.

    💬 0🔄 0⭐ 4
  • Jef Poskanzerjef@mastodon.social
    Jul 22, 2026, 5:09 AM

    @ricci 100% this. And the only reason they even asked an IRB is because of Stanford's involvement. Tech companies do blatantly unethical A/B testing all the time with no review at all.

    💬 0🔄 0⭐ 1
  • Rui Paulorpaulo@infosec.exchange
    Jul 22, 2026, 5:56 AM

    @ricci if Amazon decides to change the website and makes it more annoying where people spend an extra minute searching for their products, does that test involve human subjects? Note that the number of people in either the A/B population is significantly higher than that of an entire city.

    💬 1🔄 0⭐ 0
  • Rob Ricciricci
    Jul 22, 2026, 8:11 AM

    @rpaulo we definitely let large companies get away with running all kinds of unethical experiments on us....

    💬 0🔄 1⭐ 4
  • Riley S. Faelanriley@toot.cat
    Jul 22, 2026, 8:19 AM

    @ricci The city was built for cars, and cars are the test subjects. The humans are just along for the ride.

    💬 1🔄 0⭐ 1
  • Rob Ricciricci
    Jul 22, 2026, 8:30 AM

    @riley definitely how they are treating us

    💬 1🔄 0⭐ 2
  • 💬 0🔄 0⭐ 1
  • Zimmiebob_zim@infosec.exchange
    Jul 22, 2026, 11:44 AM

    @ricci So making changes to something without regard for the identity of who might be affected doesn’t count as involving human subjects? Does that mean the Stanford IRB think the Tylenol murders were victimless?

    💬 0🔄 0⭐ 0
  • Peter Bloem (now at mathstodon.xyz)pbloem@sigmoid.social
    Jul 22, 2026, 11:45 AM

    @ricci IRBs are completely at sea when it comes to CS work. Ethical hacking, large data scraping, robot interaction, none of it fits the guidelines.

    We're working on new guidelines in NL, but it probably means that CS departments are going to need to have their own review boards.

    💬 0🔄 0⭐ 0
  • joepie91 needs more railing 🚅💦 (🔜 eth0)joepie91@slightly.tech
    Jul 22, 2026, 11:45 AM

    @ricci I've seen the exact same thing happen with research into tech that is (primarily or most likely) useful for bigotry and subjugation, like research into CRISPR and autism (which is a gateway to eugenics).

    "Not an ethics board issue" because it doesn't involve specific named people. Rest of the ethics not even considered.

    💬 0🔄 0⭐ 0
  • Susan Vanderplassrvanderplas@datavis.social
    Jul 22, 2026, 1:34 PM

    @ricci I once had to figure out if taking pictures of the bottom of people's shoes was human data. We weren't collecting data on the people themselves, but the shoes didn't walk around on their own. I got a number of decidedly mixed opinions about this from IRB and researchers alike. Of course, doing this in an automated fashion has its own concerns, so we asked IRB to work with us on that to ensure privacy for the people wearing the shoes, but the law isn't nearly as precise as it could be.

    💬 1🔄 0⭐ 4
  • 💬 0🔄 0⭐ 0
  • Boyd Stephen Smith Jr.BoydStephenSmithJr@hachyderm.io
    Jul 22, 2026, 1:53 PM

    @ricci
    "Human subject means a living individual about whom an investigator (whether professional or student) conducting research:

    (i) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or

    (ii) Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens." -- 45 CFR 46.102

    I agree that the human affected by this study and not "human subjects" as defined above because neither their biospecimens nor PPI were collected from/on them.

    💬 0🔄 0⭐ 0
  • Boyd Stephen Smith Jr.BoydStephenSmithJr@hachyderm.io
    Jul 22, 2026, 2:01 PM

    @ricci
    "Human subject means an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient." -- 21 CFR 50.3

    While it isn't a physical test article, I think it could certainly be argued that the affected humans in the study received routes derived from the altered / control routing weights and, as such, ARE "human subject"s.

    I guess the IRB decided that the routes provided were not "test article"s? I know the routing _weights_ were the specific items under test, but it seems like the routing information given to the humans is sufficiently derived from / controlled by the weights that it should count.

    💬 1🔄 0⭐ 1
  • 💬 0🔄 0⭐ 1