Minnesota seeks rethink on computing ethics after Linux sting

After being stung by a flawed attempt to point out holes in a vital computer operating system, the University of Minnesota is looking to lead a global reassessment of computer science ethics.

The issue was “ripe” for new examination, said Michael Oakes, Minnesota’s incoming interim vice-president for research. “Because this line between what’s a human being in a social network, from what’s a computer network, is blurred.”

The university has been chastened by an experiment in which a professor and two postgraduate students put forth multiple programming language revisions for the Linux operating system to see if errors in it would be discovered.

The Minnesota team claimed success in that mission, saying they had identified vulnerabilities in Linux, an operating system that has been working to make itself part of mission-critical operations in fields that include healthcare and space travel.

The ambush-style tactic, however, angered Linux administrators to the point where they banned the entire university from contributing to the Linux system. Linux is a free alternative to the main commercial computer operating systems of Microsoft and Apple, with its management run through a community-governance model.

The project supervisor, Kangjie Lu, an assistant professor of computer science and engineering, has been counselled on mistakes in his approach, said Professor Oakes, a professor of epidemiology and community health.

However, Professor Oakes expressed frustration with Linux leaders and their demands for reinstating the university as a trusted contributor to the ongoing maintenance and development of Linux.

Much of the lingering disagreement has centred on the role of institutional review boards (IRBs), which adjudicate on study proposals that involve human subjects.

Computer science experiments generally are not regarded as subject to IRB reviews, and Minnesota’s IRB – approached by Dr Lu after the controversy became public – affirmed that position for his type of project.

That judgement has not gone over well with Linux leadership. “As someone who was ‘researched on’ as part of this ‘experiment’, I was not happy to have this pointed out to me after the fact,” said Greg Kroah-Hartman, a Linux Foundation fellow in Amsterdam who plays a chief role in Linux maintenance.

But Professor Oakes, who has led IRBs at Minnesota and elsewhere for 20 years, saw the suggestion of applying IRB processes to computer science experiments as misguided. Oversight instead belonged within the university department, and the case pointed out the need for Minnesota and other universities to do better in that regard, he said.

“I just think they don’t quite understand how that works,” Professor Oakes said of Linux leaders.

One outside expert on IRBs, Scott Desposato, a professor of political science at the University of California, San Diego, saw the Minnesota-Linux case as the latest in a long line of controversial experiments done by academic scientists without the approval of study subjects.

“People generally don’t like to be treated like guinea pigs, especially without their permission,” Professor Desposato said.

Researchers can argue that the benefits outweighed the intrusions, he said, but a good practice was to seek permission whenever possible. Even computer science should be bound by such practices, Professor Desposato said.

Professor Oakes agreed that his researchers should have sought the permission of Linux before trying an unauthorised test of its system.

Longer term, however, he is challenging his computer science department to start a broad discussion well beyond Minnesota about the recognition of computer science as a matter with direct and far-reaching implications for human rights.

“This is stuff that social psychology has dealt with for 50 years,” Professor Oakes said. “They’re not naive,” he said of computer scientists, “but they’re newer to it.”

paul.basken@timeshighereducation.com