Locking the virtual filing cabinet: A researcher's guide to Internet data security

Abstract

As the Internet has grown in popularity, the opportunity it provides for conducting research has also become too large for researchers to ignore. Thus many have flocked to put surveys, experiments, and other data collection measures online in an attempt to gather empirical evidence in a variety of fields. While some choose a commercial provider to host surveys or experiments, others require the additional flexibility that comes with creating and maintaining a custom server. Herein lies a crucial problem: Most researchers lack the skills necessary to design, implement, and manage a server end-to-end. To overcome this limitation, they often hire programmers and administrators, who while usually competent, are not ultimately accountable to granting agencies funding research or Institutional Review Boards overseeing the research. This puts the researcher in a position of accountability in data security, confidentiality, and privacy concerns. The goal of the present paper is to outline a typical server setup, and highlight issues pertaining to data security in language accessible to researcher. This paper also presents data collected and analyzed from an anonymous distributed survey asking researchers questions assessing their management of research data. Our findings from the responses confirmed the legitimacy of our concerns by demonstrating the evident need for stricter security measures in research settings. By reading this paper, we hope that researchers will be cognizant of the optimal security practices which can be equipped to avoid the extreme consequences of data security breaches and gain a deeper understanding of the software they use to collect research data.

Introduction

The role of research within science has always been to provide empirical observations that drive both theory creation and subsequent investigation. Today, there are methods available to collect these observations that would have been just a dream ten years ago. For example, complex surveys and cognitive tasks can now be bundled together (informally called a ‘wave’) and administered electronically. Participants receive invitations through electronic mail or other mediums such as instant message or social networking websites. They complete the wave and are compensated electronically within 2–3 weeks. To participants, this is often viewed as simply a quick way to make a bit of extra money. To researchers, however, this data is considerably more valuable—what once took months to collect in person can now take hours or even minutes to collect and what once may have taken a week of fulltime work to code and enter into a spreadsheet (before analyses even began) can now be done concurrently with data collection. Truly, this use of Internet and computer technology to conduct research is revolutionizing social science, opening up access to more diverse samples than typically used in the past.

However, with this new method of data collection and storage comes new concerns regarding the security of that data. In the past, a principle investigator (PI) had very clear guidelines on the storage of data. Data, especially if they contained personally-identifiable information, were kept literally under lock and key—data collection closets with locked filing cabinets were a common sight. Today, however, the need for physical security is dwarfed by the need for computer data security. Unfortunately, many researchers seem unclear on how exactly to achieve that security.

In this paper, we hope to achieve the following goals: (1) demonstrating the need for higher data security measures deduced from recent events covered in media and our analyses from the anonymous online survey we conducted amongst a group of researchers (2) providing a detailed step-by-step overview of online behavioral research design and execution from the initial planning stages of the study to the collection of data to the preservation of the finished analyses and (3) elucidating on how security can be ensured at every stage of the scientific endeavor. After reading our paper, researchers should feel more equipped to conduct Internet-based research, placing their labs and themselves on the exciting new frontier of social science.