Discussion: Cambridge Analytica and Research Ethics

From Joe Pater. Comments enabled

The Cambridge Analytica scandal has hit very close to home. Robert Mercer is a computational linguist, and Aleksandr Kogan is a cognitive psychologist. What should we academics be doing to respond and to prevent future violations of our ethical codes – and what exactly were the violations? I’ll share my current current thoughts in this post, and I would very much welcome others’ contributions on what I think is an important, and complicated, question.

The news yesterday (April 24, 2018) has shed a lot of light on Kogan’s work in collaboration with SCL, CA’s parent company, and how it likely violated the ethical standards of research in cognitive psychology. First, the Guardian released correspondence from the Cambridge University Ethics panel that it obtained with a FOI request. The letter rejects Kogan’s application to conduct research using the data he had acquired from Facebook because he had not obtained informed consent. The two pages of correspondence are well worth reading in whole.

Also yesterday in a news conference, CA’s spokesperson Clarence Mitchell admitted conducting research using those data (in explaining that the data were not useful for targeted advertising, and were therefore not used in the Trump campaign). This distinction between ethical standards for academic and industry research is troubling, though Kogan seems not to be troubled by it, as shown in this quote from his testimony yesterday to a British parliamentary hearing, published in another Guardian article.

Kogan also argued that his firm did not need ethics approval from Cambridge University, still his primary employer, since “there’s no real mechanism for a company to seek ethics approval for a commercial deal.

“I’ve never heard of anybody who runs a company trying to get ethics approval for a dataset whose primary function was really a commercial enterprise. Our primary deliverable here, first and foremost was the obligation in regards to SCL. Secondary purposes come later when you try and bring the work in for the university.”

Kogan admitted that, in transferring the data he had harvested from Facebook, he had acted against the specific words of its developer agreement. But, in a bizarre exchange with Labour’s Paul Farrelly, he argued that he had not broken the policy, because Facebook’s document did not amount to a policy.

“For you to break a policy it has to exist and really be their policy,” Kogan said. “But the reality is that Facebook’s policy is unlikely to be their policy.”

Part of the subtext here is a battle between Facebook and Kogan over who is to blame. My view is both have grievously violated generally held standards of ethical research.

The problematic distinction between academic and industry standards for non-medical human subjects research is also alluded to in the Cambridge University ethic board’s letter, in a discussion of  Kramer et al.’s 2014 PNAS article “Experimental evidence of massive-scale emotional contagion through social networks”. As the subsequent PNAS Editorial Expression of Concern explains, the study had not been reviewed by the authors’ Institutional Review Board at Cornell because it was done under the auspices of Facebook. The “expression of concern” is with the unacceptably weak definition of participant consent used by Facebook. PNAS does not seem to have stated, however, that the publication of the article was in violation of its policy. I have written to the current PNAS Editor-in-Chief for clarification of the policy, and will post any response I get in the comments. (Update April 26: see also the Fiske and Hauser editorial “Protecting human research participants in the age of big data”, which explicitly discusses differences between industry and academic research).

All of this points, I believe, to one thing that we academics can do to respond. We can demand that our journals apply a uniform standard of informed consent for academic and industry-based studies. In medical research, academic and industry standards seem to be basically identical (according to my father, who was the Director of the Clinical Trials Group of the Canadian National Cancer Institute; his e-mail to me on this is at the end of this post). It seems unlikely that we can achieve this standardization in non-medical research through the same mechanism – governmental regulation – but we certainly can at least press our professions’ journals and societies to maintain a uniform standard.

Robert Mercer’s role in Cambridge Analytica is comparatively old news – it came out in yet another Guardian piece, from February 2017. Mercer is the recipient of a lifetime achievement award from the Association for Computational Linguistics, and there have been some calls for this award to be revoked. Particularly relevant to the question I posed at the outset of this post is the way that Adam Goodkind, a Northwestern PhD student, frames his argument for this action in his change.org petition, in terms of violations of his discipline’s ethical codes:

  • Robert Mercer’s firm illegally, or at least unethically, acquired personal information, and used this data expressly to influence a foreign election.
  • Robert Mercer’s firm deliberately misled the population from which it collected data, exploiting their willingness to share personal information for purely financial and political gain.



E-mail of April 23, 2018, from Joseph L. Pater:

In the US, industry clinical trials (which is the main form of industry research on humans) are governed by an FDA regulation (CFR Title 21, Section 312). All clinical research funded by HHS, i.e., NIH, is governed by a federal regulation (45 CFR 46) that is enforced by an office within HHS called OHRP (the Office for Human Research Protections). For HHS funded clinical trials that require regulatory approval (i.e., involving investigational drugs) both regulations apply.

In Canada, there is a similar division. All research funded by the federal granting councils is governed by the Tri-Council Policy Statement (TCPS 2) whereas industry research is governed by something called ICH-GCP (International Council on Harmonization – Good Clinical Practice). Again, academic research that requires regulatory approval is subject to ICH-GCP as well as TCPS.

Most ethics committees that deal with clinical trials set themselves up to be compliant with everything at once.

I haven’t read the rules carefully in a long time, but it’s probably the case that you would be hard pressed to find anything substantially different, in principle at least, among these various requirements, so, in fact, industry and academia are supposed to follow more or less the same rules. My guess is that industry is better at following the letter of the law. For what it’s worth, historical examples of really egregious ethical violations like Tuskegee have come from academia.

7 thoughts on “Discussion: Cambridge Analytica and Research Ethics

  1. Paul-Olivier Dehaye

    1) Kogan is wrong. There are private sector mechanisms for ethical approval, see https://www.propublica.org/article/children-of-agent-orange-editors-note

    2) Clutching at IRBs for this type of situation might be a bad reflex. See the whole discussion here:

    3) There is no good reason that I see at the moment for the default to be that positive ethical reviews are secret, except university CYA. I can imagine this release could be part of the additional materials in a published paper. If this was done, then we could harmonize practices quicker, better train new scientists, and point to better practices for industry to follow.

    1. Joe Pater Post author

      Thank you for the quick and helpful comment! The linked Jacob Metcalf article is very interesting. I should be clear though, that my main concern here is with cases where standards of informed consent do apply – Metcalf is talking about ways in which machine learning ethical concerns go beyond the IRB’s mandate.

  2. Joe Pater Post author

    E-mail April 25, 2018, in response to my query of the same day, which is pasted beneath.
    Dear Dr. Pater,
    Thank you for contacting PNAS about this matter. Our policy is that authors must ensure their work has been properly vetted by an institutional review board or provide a statement indicating why this was not necessary. Regardless of where the research was carried out the expectation is that authors abide by the Declaration of Helsinki and the Common Rule. Deviations to these policies are considered on a case by case basis by the Editorial Board.

    Daniel Salsbury
    Deputy Executive Editor, PNAS

    Dear Natasha V. Raikhel,
    I’m writing for a clarification of your human subjects policy, with respect to research conducted outside of the University context. The reason for my inquiry is the editorial expression of concern published July 3, 2014:


    This seems to be stating that research conducted by a company without an institutional review board does not have to meet the same standards of informed consent as research conducted by a University. Does this represent the current PNAS policy?

    Thank you,
    Joe Pater

  3. Brendan O'Connor

    One small issue on all this — Mercer’s ACL award is for work from 30 years ago which is clearly separated from the last 5 or 10 years of CA or other recent activities, and as far as I know has very few ethical concerns. I think it’s useful to separate these issues.

    1. Joe Pater Post author

      It’s not entirely clear to me that an award shouldn’t be revoked if someone later grievously violates the ethical standards of their discipline. I’m sure we could construct medical versions of this sort of scenario that would seem convincing.

      What’s also not yet clear to me, though, is that Mercer’s work with Cambridge Analytica was unethical *computational linguistics*. Adam Goodkind’s petition begins to make the case, but I’d like to see it spelled out in more detail. Did computational linguistics societies and journals have existing policies in place that his work violated? It is looking increasingly like this is the case for Kogan, but for Mercer, I’m much less sure. Of course, this may mean that the policies need work…


Leave a Reply

Your email address will not be published. Required fields are marked *