ACT Government IT Potemkin village

AN IT Security Potemkin village? The damning ACT Auditor‐General's report on Data Security in the ACT public sector states that ‘ACT Government agencies have not clearly understood the risks and requirements of securing sensitive data, and are not well placed to respond to a data breach or loss of critical business systems’.

Overall the 'comprehensive ICT Security Policy, which all agencies must comply with under the ACT Protective Security Policy Framework' has been a fizzer: agencies do not need to demonstrate their compliance and compliance with ICT Security Policy requirements is often lacking. The audit found:

• 89% of critical ICT systems did not have a current system security risk management plan that demonstrated and documented data security risks and controls. 
• there are significant delays in completing security plans. On average it took Shared Services over three months to commence a critical ICT system security assessment and it would then take Shared Services and ACT Government agencies on average almost eight months to complete a critical ICT system security risk management plan. 
• agencies have not notified Shared Services of the security classification of 65% of ACT Government agency ICT systems. This makes it difficult to prioritise security protection activities. 
•  it is not known for most critical ICT systems if there is a recovery plan in place. 
• there is widespread use of high‐risk cloud services by agency users. This can expose sensitive or personal data to unauthorised external parties often with little recourse available.
• there is a low level of data security awareness among staff in most agencies examined in the audit. This increases the likelihood of a data breach and its potential impact. 

The full report should be chastening for ACT ministers. A summary states

Providing secure means of handling data, both in transit and at rest, is a necessary requirement for providing online services to the community. Government agencies are held to a high standard of accountability for securing sensitive data on behalf of the community. Within the Territory, there is a data security accountability framework set in place by legislation, policies and oversight functions to monitor compliance. ACT Government agencies need to securely manage the receipt, storage, transmission and destruction of data within this framework. This audit has sought to examine whether this accountability framework is designed to provide security to agencies when managing data. Agency efforts to comply with this framework has then been examined to determine if data security risks are being managed in a way that is consistent with mandatory requirements and better practice.

The Auditor-General Concludes

DATA SECURITY GOVERNANCE AND STRATEGY 

The ACT Protective Security Policy Framework and ICT Security Policy define the minimum standards for ACT Government agencies to comply with achieving confidentiality and availability of their data and systems. Under its CYBERSEC obligations, the Framework requires agencies to comply with the ICT Security Policy. The ICT Security Policy and its related subordinate policies give agencies mandatory requirements and guidance for most aspects of the management and operation of their ICT business systems recommended by better practice. While some of these subordinate policies need to be reviewed and additional guidance should be given for agencies to manage ICT service vendors, the ICT Security Policy provides clear guidance for agencies to manage data security. 

The mandatory status of the ICT Security Policy is not supported by effective agency monitoring arrangements. The ACT Protective Security Policy Framework has annual compliance reporting from agencies on their efforts to manage protective security to the Security and Emergency Management Senior Officials Committee. But its reportable CYBERSEC compliance requirements do not provide reasonable assurance that agencies have effectively protected the data for which they are responsible. These obligations focus on the role of Shared Services to document and implement the controls contained in the ICT Security Policy, and for agencies to consult Shared Services when implementing and maintaining their ICT business systems. These obligations do not recognise the scope of agency responsibility for the security of the systems they are responsible for. These reporting arrangements are also not used to inform a whole of government data security risk assessment to determine if agencies are exposed to unacceptable data security risks. 

While there are governance committees with responsibility for oversighting and improving ACT Government agencies’ data security, they are not effectively focussed towards a common strategy that sets the priorities, resourcing and responsibilities for securing data across government. This reduces the effectiveness of these bodies to communicate to agency executives what the expectations across government are for data security, and which risks and systems should be prioritised across government to reduce the likelihood and impact of a serious data breach. 

DATA SECURITY MANAGEMENT ACT 

Government agencies have not implemented effective governance and administrative arrangements to comply with the ICT Security Policy and the ACT Protective Security Policy Framework. By not complying with ICT Security Policy requirements, the ACT Public Service is not well placed to understand what data agencies are responsible for, the risks of this data being breached, and controls to be implemented across government to manage this risk. 

Shared Services has effective tools and processes to help agencies manage data security risks by using system risk management plans and security assessments. However, as agencies have not effectively managed the security status of their systems, and Shared Services is experiencing a significant backlog of security assessments, Shared Services and agencies are not presently well placed to address gaps in data security risk management in a timely manner. 

Agencies have not clearly understood their data security risks and requirements. While one agency reviewed in this audit had documented its system security risks for one system, most agencies have not done this effectively. Agencies have not controlled the usage of cloud‐based ICT services, or determined how business needs can be met through the use of sanctioned ICT services. A particular area of risk noted is a lack of user education on how to use data securely. A lack of awareness has been demonstrated in a lack of understanding on how to share data securely, as well as to recognise when a data breach has occurred and needs to be reported. This increases the likelihood of a data breach and its potential impact. More education is needed that is targeted at the needs of agencies, and specific groups of users such as privileged and senior executive users. 

There is no whole‐of‐government data breach response plan to manage and coordinate resources and stakeholders in the event of a major data breach. The Security and Emergency Management Senior Officials Group agreed to implement improvements to government’s capability to respond to these events, but these have not yet been completed. Furthermore, individual agencies are not well placed to respond to a data breach or loss of system availability, and need to invest more effort in documenting and testing how to restore functionality of critical business systems. 

However, there are initiatives underway to manage the risk of legacy systems which is another area of risk for agency data security. More work is needed to realise the benefits of these initiatives, including: decommissioning old systems when new ones are implemented; upgrading systems to use supported technology; and securing ones that cannot be upgraded through protective controls that shield these systems from data security attacks.

Key findings are

DATA SECURITY GOVERNANCE AND STRATEGY 

The ACT Protective Security Policy Framework (December 2019) and ACT Protective Security Policy Framework Operational Procedures Manual (July 2017) and supporting policies such as the ICT Security Policy (August 2019) provide a framework for data security for ACT Government agencies. Annual directorate and agency compliance reporting, and the resulting reporting to the Security and Emergency Management Senior Officials Group, seeks to provide the leadership of the ACT Public Service with reasonable assurance that data security risks are being effectively managed. However, the suite of policy and its associated reporting does not provide: 

• a clear picture of the status of ICT system security across government, including common data security risks, possible treatments for as many of these risks as possible within a given resource allocation, and prioritisation of where treatment efforts should be directed based on the impact of a data breach or loss; 

• expected minimum standards for the management of ACT Government agency ICT systems such as for information security documentation and monitoring, vulnerability management, access control, administrator rights, secure data transfers and system recovery ‐ particularly where directorates and agencies do not use Shared Services to manage system security; 

• a shared understanding of the risk tolerance for data security risks across government and how this will be translated into acceptable risk management approaches for individual systems; 

• causes of common data security risks, issues and breaches; and 

• current data security management capabilities, along with activities and projects underway to extend this capability. 

GOVSEC 4 of the ACT Protective Security Policy Framework (December 2019) includes 2.22 annual compliance reporting requirements for all directorates. Through this process, directorates provide assurance on aspects of their compliance with data security and other protective security requirements. The GOVSEC 4 compliance and annual reporting arrangements do not provide reasonable assurance that whole of government data security risks are being effectively managed. Agency compliance with CYBERSEC requirements and their reported efforts to address data security risks are not captured in a whole of government data security risk assessment. 

The ACT Protective Security Policy Framework (December 2019) requires directorates to follow the ICT Security Policy (August 2019), which is developed and maintained by Shared Services. The ICT Security Policy is a comprehensive policy that provides instructions for complying with most whole of government security requirements. It outlines responsibilities for data security and includes references to relevant legislation and better practice. A review of the ICT Security Policy against the requirements of the NIST Cybersecurity Framework shows that guidance is provided on most areas, but there is a gap in the guidance with respect to the management and monitoring of ICT service vendors. A small number of subordinate policy documents to the ICT Security Policy are either no longer in existence or have not been recently reviewed. 

The ACT Protective Security Policy Framework Operational Guidelines (July 2017),   which support the ACT Protective Security Policy Framework (December 2019), specifically require agencies to comply with the ICT Security Policy (August 2019). However, the annual compliance reporting obligation of directorates under GOVSEC 4 only requires them to report against the mandatory requirements of the Framework, including CYBERSEC 2 which requires that they consult with Shared Services when implementing or improving their ICT systems. There is no information or assurance in the annual directorate reporting under GOVSEC 4 as to whether and how directorates have complied with the ICT Security Policy. A requirement to consult Shared Services is not effective in providing an acceptable level of data security and the annual compliance reporting process does not provide reasonable assurance that data security risks are being effectively managed. 

There are several separate and distinct governance bodies that have a role in  influencing and determining how data security is managed by ACT Government agencies. These bodies include the Strategic Board, the Data Steering Committee, the Digital Services Governance Committee (including its Strategic IT Digital Capability Sub‐Committee) and the Security and Emergency Management Senior Officials Group. These bodies have broad and senior representation across ACT Government agencies, and are actively seeking to improve data security across government through their oversight of a series of initiatives and activities. There are a series of strategies and plans relating to data security that have been documented or are being developed across ACT Government agencies. These include Shared Services‐specific documents and whole‐of‐government documents. While the various governance bodies that have responsibility for managing and improving ACT Government data security have identified activities and improvements to implement, there is a risk that these are not connected and coordinated in an efficient manner that is driven by an overarching strategy. None of these documents presently fulfil the role of an overarching strategy or plan for ACT Government agencies to manage and improve data security. None of the strategies and plans that have been developed to date have:

• recognised the role of the various governance bodies and stakeholders who have a responsibility for managing and improving ACT Government data security; 

• identified interactions with legislative compliance obligations such as the Information Privacy Act 2014; 

• an identified single responsible executive who is responsible for leading, monitoring and reporting on the implementation of the strategy. This role could be fulfilled by the Chief Digital Officer, who is currently responsible for leading improvements to IT investment to address data security and for public relations when significant data breaches occur in ACT Government; 

• coordinated governance efforts across government to ensure a shared vision for improving data security. This may identify relevant cross‐ jurisdictional coordination needs, such as considering the future implementation of the Australian Government’s Cyber Security Strategy 2020; 

• recognised the current state of data security for ACT Government; 

• identified a desired state for data security based on a clearly stated risk appetite; and 

• recognised the resources and activities required to manage and improve data security and be approved by the Strategic Board and Cabinet. 

DATA SECURITY MANAGEMENT 

The ICT Security Policy (August 2019) requires agencies to register their ICT systems 3.11 including cloud services with Shared Services. The policy also requires Shared Services to maintain an inventory of the systems, including a range of information that is useful for identifying the systems’ risks. Over time Shared Services has attempted to maintain such an inventory but this has been unsuccessful. Accordingly, there is no complete and current inventory of ICT systems in use across ACT Government agencies. New functionality is being implemented into Shared Services’ ServiceNow system, which is expected to automatically discover ICT systems and assets across the ACT Government ICT network. Until this is successfully implemented and producing the expected results, there will not be a collective and comprehensive understanding of ICT systems across ACT Government and therefore accountabilities for data assets. The use of unauthorised cloud‐based ICT services and systems presents a risk to ACT Government agencies’ data security. Typically, these cloud‐based services are identified and downloaded by ACT Government agencies’ employees. Many of these services relate to image and document conversion software. The use of these services presents a risk of exposing sensitive data to cloud‐based service providers with unknown data security protections, as well as licencing and legislative compliance risks. To help deal with these issues, Shared Services has implemented a new specialised software package that seeks to identify and analyse the use of cloud‐ based services across ACT Government agencies. Through this initiative, reports have been prepared and presented to directorates by Shared Services in January 2020, which shows that there is use of cloud‐based software and systems by users of the ACT Government ICT network. 

System security risk management plans are a mandatory requirement of the ICT Security Policy (August 2019) and are an effective control for demonstrating and documenting the data security risks and controls for ACT Government agencies’ ICT systems. There is widespread non‐compliance across the ACT Public Service with the requirement to have system security risk management plans and poor demonstration of the effective and efficient management of data security using these plans. The ACT Audit Office’s 2012 Whole‐of‐Government Information and Communication Technology Security Management and Services report recommended a mandatory requirement that directorates and agencies develop system security plans, and threat and risk assessments for all new ICT systems and legacy ICT systems using a risk analysis. In December 2019, 89% of critical ICT systems did not have a current, approved system security risk management plan. 

The assessment of a system’s security risk management plan can be conducted by the Shared Services ICT Security team or by an external provider at the directorate’s cost. As at December 2019 there was a significant backlog of requests for reviews of system security risk management plans with the Shared Services ICT Security team. 

It takes on average over three months to allocate a security resource to undertake an assessment of a critical ICT system and four months to allocate a security resource to undertake an assessment of a non‐critical ICT system. After this point, Shared Services and system owners work together to review these plans. On average it takes almost eight months to review and approve critical ICT system security risk management plans and over five months to review and approve less complex non‐ critical ICT system security risk management plans. These delays compromise the effective and efficient management of data security risks by ACT Government agencies. As part of efforts to address the issues with the timeliness and currency of system security risk management plans, Shared Services has developed a quarterly security report to directorates to highlight the status of these plans. Automated alerts are also being investigated to remind agency system owners when plans are due for review. 

The management of system security risk management plans at a system‐by‐system  level means that the management of data security is siloed across ACT Government agencies and systems and common risks are not managed in a similar way across systems. Capturing common risks and treatments from these plans across government agencies and systems is necessary to provide ACT Public Service leadership with a clear understanding of whole‐of‐government data security risk management, and to prioritise which risks and systems should receive highest attention with limited resources. 

The use of accredited cloud service providers for software implementation and maintenance reduces some data security risks, but gives rise to other risks. The use of these services requires sound contract management arrangements that allow for assurance to be obtained from vendors on the management of these risks. For two of the agencies’ systems considered as part of the audit, there were inadequate processes in place to identify and manage the data security risks; one system owner had access to certifications and reviews undertaken by the cloud service vendor to demonstrate their ongoing management of data security for the system, but did not avail themselves of this information, and the system owner for another system had not adequately monitored the vendor’s security practices. Shared Services has well established processes and systems for managing user identities and access to ICT systems. Two directorate systems examined in this audit also had adequate processes for managing this, but one system had not demonstrated appropriate management of security for its privileged or regular users. This system had users who have moved to other parts of the agency or the ACT Public Service and no longer required access. The fourth system examined was in the process of reviewing its user role group structure, which was highly complex and difficult to monitor. The Community Services Directorate has established clear procedures relating to the  types of information that could be shared and with whom. Staff within the directorate also demonstrated a good understanding of what data was considered sensitive personal information and the legislative basis for classifying it as such. Users in other audited agencies did not demonstrate an awareness of the risks associated with sensitive personal information, and of sharing this data via email or USB drives and were also unaware of the acceptable file sharing mechanisms that are available to them to securely share data with third parties. This lack of understanding and awareness across ACT Government agency users presents a risk to the security of data. 

The ACT Protective Security Policy Framework (December 2020) and the ICT Security Policy (August 2019) requires directorates to have policies and procedures in place to inform, train and counsel employees on their data security responsibilities. In the four entities examined during the audit, data security user awareness was hampered by a lack of knowledge and training to support understanding on data security and the handling of data security breaches. None of the four entities considered as part of the audit had developed a comprehensive data security awareness training package for its staff. However, some had developed discrete training packages that targeted elements of data security, such as the Community Services Directorate and the Justice and Community Safety Directorate working together to develop e‐ learning training for cyber security awareness, and ACT Corrective Services which provides security awareness training for new corrections staff. Neither Shared Services, the Territory Records Office, Security and Emergency Management Branch nor the Office of the Chief Digital Officer provide reusable training packages to agencies with respect to data security or breach management. The delivery of data security training and awareness activities, targeted to meet the needs all users including privileged users and executives, would support agencies to meet their training obligations under the ICT Security Policy (August 2019). Such training could be tailored to address agency‐specific threats, as well as reference any agency‐specific policies and procedures. INFOSEC 2 of the ACT Protective Security Policy Framework (December 2019) requires directorates and agencies to classify, mark, transfer, handle and store information relative to its value, importance and sensitivity. As part of managing the inventory of ICT systems under the ICT Security Policy (August 2019), directorates must advise Shared Services of the information classification of their ICT systems. A review of the information classification of ACT Government systems shows that for 65% of ACT Government systems Shared Services has not been notified of the system’s information classification. This hampers the ability of Shared Services to prioritise security protection activities and insufficient protection strategies may be applied to these systems. 

The need to manage and support legacy systems has led to the ACT Government incurring significant extra cost and increased data security risks from the delayed full implementation of Windows 10. Approximately 29% of existing ACT Government agency desktops have not been upgraded to Windows 10, due to the number of legacy systems that will not work in the new operating system. Maintaining extended support for Windows 7 is expected to cost the ACT Government $450,000 per annum until this operating system is decommissioned. Until this point, the ACT Government will not fully realise the improved data security benefits of the more modern Windows 10 operating system. Some improvements are being made to the management of legacy systems in recent times, including packaging legacy applications to work with Windows 10, using a secure environment to run unsupported applications, and implementing a library of application programming interfaces which could introduce a secure intermediary to operate between less secure legacy systems and the internet. 

Applying software patches to address vulnerabilities in applications and operating systems are two of the ‘Essential Eight’ strategies to mitigate data security breaches. Shared Services has developed effective processes for implementing patches to operating systems and applications. Three of the four systems examined as part of the audit were having patches implemented either by the vendor directly or by Shared Services. The fourth system was a legacy system that was no longer supported and due to be replaced and it was not having patches applied. In order to mitigate the risks to the system it was operating in a supported desktop and server environment with reduced functionality. Being able to operate in such a controlled environment is not always the case for legacy systems and, given the large number of legacy applications in the ACT Government ICT network, this is one of the most significant areas of data security risk. 

Directorates have not implemented effective audit logging policies that consider the data security risks faced by their ICT systems. For the four systems reviewed as part of the audit, agencies had implemented audit logging to the extent possible within each system, but had not determined how these logs would be used and had not determined whether other events or triggers were needed to periodically check logs. Shared Services has implemented effective audit logging practices via a security information and event monitoring system which receives logs from across the network, as well as for cloud‐based applications. It has an established and regular process for monitoring logs and events for the network and cloud application and has also reviewed and defined the events that are high risk to necessitate alerts or triggers for further investigation. 

Following a significant data breach of the ACT Government’s online directory in November 2018 the Security and Emergency Management Senior Officials Group reviewed roles and responsibilities for cyber security across the ACT Government network. To improve ACT Government responsiveness in the event of a significant data security breach, the Security and Emergency Management Senior Officials Group agreed to a series of actions in March 2019. The Security and Emergency Management Senior Officials Group intends that these actions will be completed by July 2020. 

In the event of damage to an ICT system or the loss of data, accurate system design documentation will assist in promptly rebuilding system functionality. In December 2019 the Digital Service Governance Committee was advised 68 critical directorate ICT systems did not have system design documentation and the status and accuracy of system design documentation for the other 147 systems was unknown. Two of the four systems examined as part of the audit had outdated system design documentation. 

An effective data restoration plan (also commonly referred to as system design documentation, or schematics) when paired with an appropriate patching strategy, backup schedule and restoration from backup testing is an important safeguard in providing assurance that data recovery from the loss of system availability is possible. A review of recovery plans across ACT Government agencies shows: five per cent of systems have a tested recovery plan in place; 35% of systems have a recovery plan in place, which has not been tested; six per cent of systems do not have a recovery plan in place; and for 54% of systems it is not known whether there is a recovery plan in place. None of the four systems reviewed as part of the audit had current recovery plans that had been tested through agency business continuity or lifecycle management activities.

Consequent  recommendations are -

1 WHOLE‐OF‐GOVERNMENT DATA SECURITY RISK ASSESSMENT 

Shared Services (Chief Minister, Treasury and Economic Development Directorate) and the Security and Emergency Management Branch (Justice and Community Safety Directorate) should develop a whole‐of‐government data security risk assessment. The whole‐of‐government data security risk assessment should be reviewed and updated at scheduled intervals. 

2 ICT SECURITY POLICIES 

Shared Services (Chief Minister, Treasury and Economic Development Directorate) should: a) revise and update the ICT Security Policy (August 2019) to accurately refer to supporting documents referred to in the policy. Where supporting documents and policies are out of date, they should be reviewed; and b) develop policy guidance, in support of the ICT Security Policy, for ACT Government agencies on their responsibilities with respect to managing and monitoring ICT service vendors. 

3 CYBERSEC CONTROLS AND REPORTING 

The Security and Emergency Management Branch (Justice and Community Safety Directorate), Shared Services and the Office of the Chief Digital Officer (Chief Minister, Treasury and Economic Development Directorate), through the auspices of the Security and Emergency Management Senior Officials Group should: a) review and update the CYBERSEC requirements of the ACT Protective Security Policy Framework to reflect the most important system security measures from the ICT Security Policy (August 2019). These measures should be targeted at the areas of agency responsibility and able to be reported in dashboard form; and b) require agencies to report on the implementation of these measures in their ICT systems as part of the GOVSEC 4 reporting process of the ACT Protective Security Policy Framework, in order to provide reasonable assurance that data security risks are being effectively managed. 

4 DATA SECURITY STRATEGY 

The Office of the Chief Digital Officer and Shared Services (Chief Minister, Treasury and Economic Development Directorate) and Security and Emergency Management Branch (Justice and Community Safety Directorate), in partnership with ACT Government agencies, should document and agree a whole of government data security strategy and plan. This document should identify: a) the role and responsibilities of governance bodies and agencies responsible for managing and improving data security across ACT Government; b) any related whole‐of‐government plans for addressing specific data security issues, such as the planned Cyber Security Incident Emergency Sub‐plan to the ACT Emergency Plan; c) activities and resources to improve data security for ACT Government; and d) identifying the Chief Digital Officer as the responsible senior executive for implementing the strategy to improve data security across ACT Government. 

5 SYSTEM SECURITY RISK MANAGEMENT PLAN ASSESSMENTS 

Shared Services (Chief Minister, Treasury and Economic Development Directorate) should: a) in conjunction with Recommendation 4, ensure agencies take account of the full cost of managing security across a system’s lifecycle as part of ICT projects, including undertaking security assessments; and b) address the backlog of security risk management plan assessments so that agencies can access security assessments and advice to help them manage data security risks in a timely manner. 

6 SYSTEM SECURITY RISK MANAGEMENT PLANS 

The Security and Emergency Management Branch (Justice and Community Safety Directorate) and Shared Services (Chief Minister, Treasury and Economic Development Directorate) should: a) in conjunction with Recommendation 3, require ACT Government agencies to report on the currency of their system security risk management plans using a common authoritative list of critical systems; and b) in conjunction with Recommendation 1, develop a process to capture common risks and treatments from ACT Government agencies’ system security risk management plans to inform the whole of government data security risk assessment. 

7 DATA SECURITY TRAINING 

Shared Services (Chief Minister, Treasury and Economic Development Directorate), with input from the Security and Emergency Management Branch (Justice and Community Safety Directorate) and the Office of the Chief Digital Officer (Chief Minister, Treasury and Economic Development Directorate), should coordinate the development of data security training that: a) considers the specific training needs for all users, privileged users and executives; and b) addresses the risk of using unsanctioned methods of sharing sensitive personal data. The data security training package should be capable of being delivered and customised by ACT Government agencies as necessary. 

8 DATA BREACH RESPONSE PLANS 

The Security and Emergency Management Branch (Justice and Community Safety Directorate), the Office of the Chief Digital Officer and Shared Services (Chief Minister, Treasury and Economic Development Directorate) should complete all agreed actions from the March 2019 Security and Emergency Management Senior Officials Group meeting to improve the data breach response processes.

Experts in the dock

'The New Psychology of Expert Witness Procedure' by Jason M Chin, Mehera San Roque and Rory McFadden in (2020) 42(1) Sydney Law Review 69 asks

Can procedural reforms effectively regulate expert witnesses? Expert procedures, like codes of conduct and court-appointed experts, remain controversial among academics and courts. Much of this discussion, however, has been divorced from the science of the reforms. In this article, the authors draw from emerging work in behavioural ethics and metascience that studies procedures analogous to those that are being used in courts. This work suggests that procedures can be effective, as they have been in science, if directed at key vulnerabilities in the research and reporting process. The authors’ analysis of the metascience and behavioural ethics literature also suggests several nuances in how expert evidence procedure ought to be designed and employed. For instance, codes of conduct require specific and direct wording that experts cannot interpret as ethically permissive. Further, drawing on a recent case study, courts have an important role to play in establishing a culture that takes codes as serious ethical responsibilities, and not simply as pro forma requirements. 

 The authors argue

In response to the threat of partisan expert witnesses, legal systems have developed a variety of procedural mechanisms (for example, expert codes of conduct, concurrent evidence, and court-appointed experts) to help manage experts and maintain public trust in the courts.[1] These procedures have inspired considerable academic and professional debate, and uneven adoption by courts.  However, this discussion has been almost entirely uninformed by empirical research.  In contrast with this experience in law, several sciences are enthusiastically enacting procedural reforms, which are being robustly tested and which rely on a large body of psychological research. This new area of metascientific and psychological research provides a novel perspective on procedural reform, suggesting such reform can meaningfully contribute to the regulation of expert witnesses. It also suggests how procedures ought to be designed and implemented. In this article, we explore that connection and, in doing so, the possibilities and limits of expert witness procedure. 

In law, procedural reform aimed at expert partisanship has been controversial, garnering professional and academic support, but also sceptical and critical commentary. In particular, the critics have pointed out that the focus on individual expert partisanship promotes a narrow understanding of current problems with expert evidence, and also that expert procedures were designed without the benefit of empirical testing and may have perverse effects. Moreover, in forensic science specifically, partisanship may be a less pressing concern than the fact that many practices have not been demonstrated to actually work.

We seek to develop this discussion by highlighting an emerging corner of metascientific research (that is, the scientific study of science itself) that examines analogous procedural reform in science. These new procedures — grounded in the psychological study of ethical behavioural — have responded to a growing concern from many fields that many published studies cannot be reproduced by independent researchers. Such reforms include procedural modifications to the way scientists typically see their findings reviewed by others and published. Importantly, these reforms have received empirical testing demonstrating they often work and have been endorsed by respected scientific bodies, which may increase their ethical and psychological force. As we will discuss below, these insights from metascience help provide a roadmap for procedural reform in courts. Expert codes of conduct may especially benefit from recent research in metascience.

Our emphasis on codes of conduct — a procedural reform that spans civil and criminal trials in New South Wales (‘NSW’) — makes our analysis necessarily broad. That said, we recognise that criminal and civil litigation engage different policy considerations and practicalities (for example, the recent emphasis on efficiency in civil litigation). As to the latter, criminally accused parties frequently cannot afford their own expert witnesses and must rely on the expert proffered by the Crown. So, in the criminal context, robust expert procedure may be especially important. Indeed, we will focus on criminal cases in our legal analysis.Any application of our suggestions should mind the significant policy gap between civil and criminal cases.

In Part II, we briefly set the scene with some of the most significant procedural reforms that have been introduced to manage the presentation, form and content of expert evidence and expert reports. Part III introduces new research in metascience and behavioural ethics (that is, the psychological study of the situational factors that influence ethical behaviour) that founds a procedural reform movement in science. As we discuss, these reforms are being eagerly adopted in many scientific fields. Part IV then begins the discussion about how revelations from metascience and behavioural ethics could be leveraged to improve expert evidence procedure, putting them on firmer (meta)scientific footing. In Part V, we conclude with some limitations that can be expected of even the most scientifically grounded expert procedural reforms.

Robotics and Automated Vehicle Testing

'Robo-Apocalypse cancelled? Reframing the automation and future of work debate' by Leslie Willcocks in (2020) Journal of Information Technology argues

Robotics and the automation of knowledge work, often referred to as AI (artificial intelligence), are presented in the media as likely to have massive impacts, for better or worse, on jobs skills, organizations and society. The article deconstructs the dominant hype-and-fear narrative. Claims on net job loss emerge as exaggerated, but there will be considerable skills disruption and change in the major global economies over the next 12 years. The term AI has been hijacked, in order to suggest much more going on technologically than can be the case. The article reviews critically the research evidence so far, including the author’s own, pointing to eight major qualifiers to the dominant discourse of major net job loss from a seamless, overwhelming AI wave sweeping fast through the major economies. The article questions many assumptions: that automation creates few jobs short or long term; that whole jobs can be automated; that the technology is perfectible; that organizations can seamlessly and quickly deploy AI; that humans are machines that can be replicated; and that it is politically, socially and economically feasible to apply these technologies. A major omission in all studies is factoring in dramatic increases in the amount of work to be done. Adding in ageing populations, productivity gaps and skills shortages predicted across many G20 countries, the danger might be too little, rather than too much labour. The article concludes that, if there is going to be a Robo-Apocalypse, this will be from a collective failure to adjust to skills change over the next 12years. But the debate needs to be widened to the impact of eight other technologies that AI insufficiently represents in the popular imagination and that, in combination, could cause a techno-apocalypse.

The National Transport Commission 2020 Review of ‘Guidelines for trials of automated vehicles in Australia’: Discussion paper

 reviews the National Transport Commission (NTC) and Austroads’ Guidelines for trials of automated vehicles in Australia. The guidelines were released in 2017 to support nationally consistent conditions for automated vehicle trials in Australia. The NTC has undertaken research and targeted consultation to present potential updates to the guidelines that aim to benefit trialling organisations and road transport agencies. Updates could include: further detail about requirements; alignment with the future commercial deployment framework; clarifying the application of the guidelines to other technologies; and improving administrative processes.

 The paper states

The National Transport Commission and Austroads’ Guidelines for trials of automated vehicles in Australia were released in May 2017 to support nationally consistent conditions for automated vehicle trials in Australia. The guidelines were intended to:

• provide certainty and clarity to industry regarding expectations when trialling in Australia 

• help agencies manage trials in their own jurisdictions as well as across state borders 

• establish minimum standards of safety 

• help assure the public that roads are being used safely 

• help raise awareness and acceptance of automated vehicles in the community.

Transport and infrastructure ministers directed that the guidelines should be reviewed every two years. We began this review of the guidelines in 2019 and it is the first to take place since they were published. The purpose of this discussion paper is to assess how well the guidelines are working in practice and to seek broader stakeholder views on any required changes. 

Context 

Since the guidelines were published in May 2017 there have been a number of developments in trialling and the development of regulatory frameworks for automated vehicles:

• Trials have now taken place in every Australian state and territory, and trialling organisations and road transport agencies can share their experience of the application, approval and operation of trials. 

• There has been further development of the regulatory framework for the commercial deployment of automated vehicles, which will eventually succeed the trials framework. 

• International guidance has further evolved.

The objectives of the review are to identify:

• whether the guidelines have assisted governments and trialling organisations 

• challenges faced by governments and trialling organisations using the guidelines or in applying for, approving, operating and evaluating trials 

• additional requirements governments have placed on trialling organisations 

• whether the guidelines should be updated to ensure a nationally consistent and safe approach to automated vehicle trials in Australia.

Consultation topics 

In late 2019 the NTC undertook targeted consultation and a review of international guidance to inform this discussion paper. Through this consultation we have learned that trialling organisations and road transport agencies have found the guidelines useful, particularly as a starting point to guide trialling organisations as they prepare their trial applications. We have also learned that the guidelines could provide further detail to assist trialling organisations and to provide some consistency in applications for road transport agencies. As well, we have learned that there are a number of differences in trial requirements and application processes across states and territories, which has led to differing experiences in gaining approvals for trials. 

Consultation topics in this discussion paper fall under five broad categories:

• content and level of detail in the current guidelines (chapter 3) 

• application of the guidelines (chapter 4) 

• administrative processes and harmonisation (chapter 5) 

• other automated vehicle trial issues outside the scope of the guidelines (chapter 6).

There could be a number of updates to the guidelines that will benefit both trialling organisations and road transport agencies. These include

• ▪ further detail about safety, traffic management and data and information requirements; 

• further alignment with future safety requirements for commercial deployment; 

• clarifying the application of the guidelines to other technologies, operating domains and types of trials; and 

• improving the efficiency of administrative processes at the point of application. 

We are seeking views from stakeholders on the potential updates discussed in this paper and on any other useful changes. We want to ensure the guidelines support safe and innovative trials in Australia. This will help Australia gain the safety and productivity benefits of this technology. 

List of questions 

1 Should the guidelines be updated to improve the management of trials (section 3 of the guidelines) and, if so, why? Consider in particular:. 

2 Should the guidelines be updated to improve the safety management of trials (section 4 of the guidelines) and, if so, why? Consider in particular: 

3 What issues have been encountered when obtaining or providing insurance? 

4 Are the current insurance requirements sufficient (section 5 of the guidelines)? If not, how should they change?. 

5 Should the guidelines be updated to improve the provision of relevant data and information (section 6 of the guidelines)? 

6 Is there any additional information the guidelines should include for trialling organisations? 

7 Should the guidelines apply to any other emerging technologies (discussed in chapter 4 or other technologies) and operating domains?. 

8 Are there any additional criteria or additional matters relevant to the trials of automated heavy vehicles that should be included in the guidelines?. 

9 Are there currently any regulatory or other barriers to running larger trials? If so, how should these barriers be addressed? (Consider the guidelines, state and territory exemption and permit schemes, and Commonwealth importation processes.). 

10 Should the guidelines continue to allow commercial passenger services in automated vehicle trials? If so, should the guidelines reference additional criteria that trialling organisations should be subject to, and what should these criteria be?. 

11 What challenges have you faced with administrative processes when applying for approving trials of automated vehicles, and how could these be addressed?. 

12 Are there any other barriers to cross-border trials? Is there a need to change current arrangements for cross border trials? 

13 Should there be a more standardised government evaluation framework for automated vehicle trials? If so, what are the trial issues that should be evaluated?.

14 Should the results of evaluations be shared between states and territories? If so, how should commercially sensitive information be treated? 

15 What works well in the automated vehicle importation process, and what are the challenges?. 

16 Is there anything further that should be done to facilitate a transition from trial to commercial deployment? 

17 Are there any matters that the NTC should consider in its review of the guidelines?

Property

Own Data? Ethical Reflections on Data Ownership' by Patrik Hummel, Matthias Braun and Peter Dabrock in (2020) Philosophy and Technology comments

 In discourses on digitization and the data economy, it is often claimed that data subjects shall be owners of their data. In this paper, we provide a problem diagnosis for such calls for data ownership: a large variety of demands are discussed under this heading. It thus becomes challenging to specify what—if anything—unites them. We identify four conceptual dimensions of calls for data ownership and argue that these help to systematize and to compare different positions. In view of this pluralism of data ownership claims, we introduce, spell out and defend a constructive interpretative proposal: claims for data ownership are charitably understood as attempts to call for the redistribution of material resources and the socio-cultural recognition of data subjects. We argue that as one consequence of this reading, it misses the point to reject claims for data ownership on the grounds that property in data does not exist. Instead, data ownership brings to attention a claim to renegotiate such aspects of the status quo.

The authors argue

 Data seem to be produced on unprecedented scales. Sensors, wearables, and devices continuously translate physical movements and states of affairs into data points. When browsing the internet or using social media, analytic tools process each and every click. Shopping interests and behaviours feed into tailor-made adverts and products. Networked cars and autonomous driving rest on large-scale gathering and processing of vehicle and traffic data. Precision medicine aims to search for patterns and correlations in huge sets of patient data, and promises to personalize prevention, diagnostics, and treatments to the specific characteristics and circumstances of individual patients. Industry 4.0 datafies and automates steps in manufacturing and production. The Internet of Things extends digitization, datafication, and networked objects even further. The recurring observation is that data processing will become increasingly pervasive and powerful. Already now, we witness transformations in how we perceive, frame, think, value, communicate, negotiate, work, coordinate, consume, keep information confidential, and make it transparent. 

One—if not the—pressing question in the context of digitization is whether foundational rights of individual subjects are respected, and what it takes to safeguard them against interferences. One frequently discussed suggestion is that these questions arise against the backdrop of contested relations of ownership, i.e. the relation between an owner and her property. There is a set of expectations associated with data ownership. “It gives hope to those wishing to unlock the potential of the data economy and to those trying to re-empower individuals that have lost control over their data” (Thouvenin et al. 2017, 113). In this spirit, calls for data ownership demand that data can be property. Yet, commentators caution that “[s]implified versions of ownership […] may create compelling soundbites but provide little direction in practice” (The British Academy and The Royal Society 2017, 32). While data have tangible aspects, such as their relation to technical-material infrastructures, they also seem to differ from ordinary resources and tangible property (Prainsack 2019b, 5). In a digitized and datafied lifeworld, claims to data are indispensable towards claiming fundamental rights and freedoms. These preliminary observations prompt us to clarify what data ownership exactly means, how it is justified, what it tries to achieve, and whether it succeeds in promoting its aims. 

The present paper explores the content of claims for data ownership. It has two goals: first, it provides an in-depth analysis of different notions of data ownership and uncovers inherent conceptual tensions and puzzles. As we will argue, a variety of considerations are put forward under the heading of data ownership. The notion is ambiguous and even paradoxical: it used to articulate and taken to support claims that stand in tension and are mutually incompatible. 

Second, we argue that all of these dimensions of data ownership matter for informational self-determination, understood as the ability of data subjects to shape how datafication and data-driven analytics affect their lives, to safeguard a personal sphere from others, and to weave informational ties with their environment. Specifically, and drawing on a debate between Axel Honneth and Nancy Fraser, we demonstrate how the meanings of data ownership raise both issues of material ownership (pertaining to the sphere of distribution) and issues of socio-cultural ownership (pertaining to the sphere of recognition). Our proposal is that important entanglements between both spheres get overlooked if we merely focus on one of them. For informational self-determination, both are relevant. Thus, we need to take seriously the full range of dimensions of data ownership in order to understand how data subjects exercise informational self-determination, and how such exercises can be facilitated and promoted. We discuss these challenges under the heading of data sovereignty (German Ethics Council 2017, 2018; Hummel et al. 2018; Hummel et al. 2019, 26–27). 

In order to pursue these goals, we begin by briefly considering data ownership from a legal perspective (2.). As we will show, there is a debate about the compatibility between data ownership and current legal frameworks. Moreover, a number of rationales that typically discourage the institutionalization of data ownership are beginning to disintegrate in contemporary big data environments, which we take to suggest that the case for data ownership is worth debating. We then go on to provide interpretative contributions on what it would mean to establish or to maintain data ownership (3.). As it turns out, the substantive demands and goals vary significantly across discussants. We distinguish four dimensions of data ownership. Each of them is debated by reference to a pair of conceptual poles: the institutionalization of property versus cognate notions of quasi-property (3.1), the marketability versus the inalienability of data (3.2), the protection of data subjects versus their participation and inclusion into societal endeavours (3.3), and individual versus collective claims and interests in data and their processing (3.4). We propose that this characterization explains why different proposals on data ownership articulate diverging or even mutually incompatible demands, and helps us to get a grip on what is at stake when the notion is invoked. Drawing on Honneth and Fraser (4.), we go on to argue that all of these dimensions are vital for informational self-determination. Statements on data ownership touch upon and go back and forth between two different spheres: the redistribution of material resources and the socio-cultural recognition of data subjects. In view of our findings, the notion of data ownership can be understood as an expressive resource for articulating and negotiating claims concerning both spheres. 

In the following, we use the terms ‘ownership’ and ‘property rights’ as follows: “Property rights […] are the rights of ownership. In every case, to have a property right in a thing is to have a bundle of rights that defines a form of ownership” (Becker 1980, 189–190). ‘Property’ refers to the thing(s) to which property rights apply.

Personhood

'Leviathan Inc.: Hobbes on the nature and person of the state' by Johan Olsthoorn in (2020) History of European Ideas comments

This article aspires to make two original contributions to the vast literature on Hobbes’s account of the nature and person of the commonwealth: (1) I provide the first systematic analysis of his changing conception of ‘person’; and (2) use it to show that those who claim that the Hobbesian commonwealth is created by personation by fiction misconstrue his theory of the state. Whereas Elements/De Cive advance a metaphysics-based distinction between individuals (‘natural persons’) and corporations (‘civil persons’), from Leviathan onwards Hobbes contrasts individuals acting in their own name (‘natural persons’) with representatives (‘artificial persons’). These changes notwithstanding, Hobbes retains the same corporate conception of the state throughout. On the prevailing ‘fictionalist’ interpretation, the sovereign brings the commonwealth into existence by representing it. I argue, rather, that as an incorporation of natural persons, the commonwealth becomes one person through the authorized (i.e. non-fictitious) representation of each constituent member singly by one common representative (‘the sovereign’). 

 Olsthoorn states

The question of what kind of person the Hobbesian state is has long troubled commentators. The majority position now seems to be that the commonwealth is a ‘person by fiction’ or a ‘purely fictional Person’. According to Hobbes, some subject S is personated by fiction by a representative R whenever S has not authorized R to speak or act in S’s name. Absent such authorization, R’s words and actions are attributed to S not truly, but ‘by Fiction’ (L 16.1). Inanimate things, such as hospitals and bridges, ‘cannot be Authors, nor therefore give Authority to their Actors’ (L 16.9). For this reason, inanimate things can only be personated by fiction. On the prevailing ‘fictionalist’ interpretation, the commonwealth (i.e. the people understood as a single collective body) is likewise personated by the sovereign by fiction. The commonwealth itself cannot possibly have authorized the sovereign to represent it because, Hobbes insists, the people incorporated cannot speak or act except via their representative. Representation by the sovereign is a precondition of the commonwealth’s capacity to act; authorization being an action, this precludes authorized (i.e. non-fictitious) representation. 

This article will not challenge these claims: properly understood, they are tenable. Rather, I will counter a further claim defended by proponents of the fictionalist interpretation: that the commonwealth comes into existence by being represented by the sovereign. It is commonly maintained that the commonwealth is a person by fiction since it exists as a person only insofar as it is personated by the sovereign – notwithstanding Hobbes’s claim that representation by fiction is impossible outside the state. Some have inferred from this that the commonwealth itself has a fictional character.  My contention is that the fictionalist interpretation misconstrues Hobbes’s theory of the state. It fails to appreciate that personation occurs at two levels: the sovereign represents each individual citizen, thus turning the multitude into one person (‘a commonwealth’), and he bears the person of the commonwealth thus formed. These two instances of personation, I argue, are different in kind, and only the second relation of representation can be said to be fictional. The corporate unity formed by individual authorization of a common representative is one person in virtue of its capacity to speak and act as one – as all its constituent members have bound themselves to accept as theirs whatever their common representative shall do. The fictionalist interpretation wrongly treats the commonwealth as existing apart from the multitude of individuals who compose it. Unlike personations of non-corporate entities like bridges, hospitals, children, and false idols, the person of the commonwealth is not brought into being by representation by fiction. 

I bolster my novel interpretation through a second original contribution to the literature. This article provides the first systematic analysis of the dramatic changes in Hobbes’s account and typology of ‘person’, and hence of state personality, between the early works and Leviathan.  Hobbes never wavers from regarding ‘persons’ foremost as agents – entities that can be said to speak and act.  But his views on what kinds of persons exist, and in what sense they are agents, alter fundamentally between De Cive (1642/1647) and Leviathan (1651). From Leviathan onwards, Hobbes advances what we may call a Ciceronian conception of agent-persons, linked to his new theory of personation by representation. ‘A Person’, Hobbes declares in allusion to Cicero, ‘is the same that an Actor is’ wearing a persona or mask (L 16.3). A person is thus someone who ‘acteth any thing in his own or another’s name, or by his own or another’s authority’ (EW 4: 310). Whoever acts in his own name is called a ‘natural’ person; whoever acts in the name of someone or something else is an ‘artificial’ or ‘representative’ person. The Ciceronian conception thus differentiates persons by whether they bear their own persona or someone else’s, not by their metaphysical status. 

An irreducibly different account of personhood is found in Elements (1640) and De Cive. Those texts portray a person as anyone or anything with independent legal standing – any entity to whom words and actions can be ascribed in law. Call this the Juristic conception of agent-persons. Hobbes distinguishes between two kinds of juristic persons: natural and civil ones. On the Juristic conception, ‘natural persons’ are rational agents capable of unmediated action. ‘Civil persons’ are incorporations of natural persons. Thus, Elements explores ‘how a multitude of persons natural are united by covenants into one person civil, or body politic’ (EL 20.1). As social constructs, civil persons are not capable of unmediated action. Some established and binding rule is necessary to determine which actions performed by which natural persons should be regarded as those of the civil person. The Juristic conception thus differentiates persons by their metaphysical status: whether their capacity for agency depends on some artifice or not. Observe that ‘natural person’ means something else on the Juristic conception than on the Ciceronian one. A Juristic natural person is any rational agent ‘naturally’ capable of acting; a Ciceronian natural person is anyone acting in their own name. The two can come apart. I shall therefore henceforth add subscripts: J (Juristic) and C (Ciceronian). 

My pioneering analysis of Hobbes’s changing conception of person sheds new light on the controverted question of what gives the commonwealth personality. In the early texts, a plurality of natural- J persons become one civil person by each submitting their will to another natural- J or civil person (‘the sovereign’). Incorporation requires formation of a single will, achieved by each constituent member promising simple obedience to the sovereign. In Leviathan, a multitude becomes one person through individual authorization of a common representative (‘the sovereign’) to carry their persons jointly. Authorized representation replaces promises of simple obedience as the means to ‘reduce all their Wills … unto one Will’ (L 17.13). Leviathan’s novel doctrine of personation by representation is in many ways an improvement: it offers a parsimonious and capacious explanation of how a multitude becomes one person and clarifies the relation between the sovereign and the commonwealth. Yet it also obscures the corporate nature of the Hobbesian commonwealth and conceals that personation occurs at two levels. It does not help that the English Leviathan incoherently states that the sovereign bears only one person – that of the commonwealth; a glitch corrected in the 1668 Latin Leviathan. To grasp Hobbes’s theory of the state, I conclude, we best turn to texts other than the English Leviathan.

Fandom, SNS and Privacy

'Ethical and privacy considerations for research using online fandom data' by  Brianna Dym and Casey Fiesler in (2020) 33 Transformative Works and Cultures  comments

As online fandom continues to grow, so do the public data created by fan creations and interactions. With researchers and journalists regularly engaging with those data (and not always asking permission), many fans are concerned that their content might end up in front of the wrong audience, which could lead to privacy violations or even harassment from within or outside of fandom. To better understand fan perspectives on the collection and analysis of public data as a methodology, we conducted both an interview study and a survey to solicit responses that would help provide a broader understanding of fandom's privacy norms as they relate to the ethical use of data. We use these findings to revisit and recommend best practices for working with public data within fandom. 

The authors argue

Transformative fandom has long occupied the grey spaces online. Because fandom is both entirely open to the public and living in the cracks of obscurity, accessing its communities sometimes feels like knowing the secret knock to get into the speakeasy tucked away in the back alley. People come inside. They order their favorite special at the bar ("I'll have a 'And They Were Roommates,' please"). They make idle conversation with other patrons as they wait for the next performer or their favorite bartender to come along. At the end of the night, these visitors return home, friends and family often none the wiser to where they were or the specific transactions of their nightlife, though any of them could have easily come to the speakeasy if they had only known where to look. 

The metaphor neatly encapsulates online fandom life—though in the digital world those interactions also leave data traces, and knowing who has seen them is not as easy as looking around the room to see who else is there. The transactions of their nightlife have been broadcasted the entire time, leaving a trail of public data that is accessible, identifiable, and valuable. 

Even outside the context of fandom, many people are unsure at best as to whether or not their data are publicly viewable and how they might be accessed by third parties (Proferes 2017). Journalists, for example, might include a public tweet in an article to represent public opinion on a news-relevant issue. Meanwhile, internet researchers are increasingly collecting public data that may seem ephemeral to social media users but in fact lingers, and many of those users are entirely unaware that their data can legally be collected for research purposes (Fiesler and Proferes 2018). 

The disconnect between people, their data, and how others use them is complicated by the fact that researchers disagree over norms for studying public data as well as a definition for what public even means (Vitak, Shilton, and Ashktorab 2016). For example, while some researchers might argue that public data are freely accessible and therefore usable (Zimmer 2010), fan studies scholars often argue that scholars ought to inform or ask people about using their data, regardless of whether or not they are accessible (Nielsen 2016). While not all disciplines are in agreement, scholarship on the ethics of studying fandom has emphasized the need to preserve fan privacy (Busse and Hellekson 2012), prioritize transparency in research (Bennett 2018), and gain permission from fans before referencing their work in academic research (Busse and Hellekson 2012). These principles often sit in contrast to how many disciplines approach the ethics of using public data in their own work. 

Fan studies cover a wide variety of domains and methods. For example, fan scholars have provided literary analysis of fan works (Coppa 2017), analysis of human behavior (Guerrero-Pico, Establés, and Ventura 2018), and an understanding of different learning that occurs within fan communities (Black 2005; Evans et al. 2017). Bethan Jones (2016) has identified two primary traditions of approaching fan studies research: (1) literary analysis, when the content creator is assumed inaccessible and a fan work is the subject of study, and (2) human subjects research, in which the creator is the subject of study—whether with consent (e.g., interviews or surveys) or without consent (e.g., collecting public trace data). 

Traditional human subjects research, where consent must be established for data collection, often falls under the purview of ethical review bodies such as institutional review boards (IRBs) at US universities. However, many IRBs consider the collection of public data to not constitute human subjects research because it typically does not involve direct interaction with humans or collection of personally identifiable information (Vitak et al. 2017). Perhaps in part because of this line drawn by IRBs, a common perception among researchers is that the most important question for using data is whether they are public, regardless of other relevant factors such as users' expectations of privacy (Zimmer 2010). Our goal with the work here is to bridge discussions in fan studies with broader conversations about use of public data in research across all disciplines. 

Fan studies are an interesting context for examining the intersection of research ethics and privacy, in part because of the long-standing social norms that dictate sharing and privacy behavior (Dym and Fiesler 2018a). We also think that it is important that fans have a voice in determining best practices for researchers. To that end, we conducted an interview study and a large-scale survey in which we asked about privacy and ethical concerns in relation to fandom and public data. By fandom, we mean transformative fandom, or an online fan community that both creates and shares fan works that are transformative of source material through writing fan fiction, creating fan art, or other creative practices. 

Our findings further illustrate the concerns that fandom communities have about privacy, safety, and the integrity of their content. This includes (1) special concern for fans from marginalized backgrounds (especially LGBTQ fans) who may face serious consequences from privacy violations; (2) fear of harassment within fandom; and (3) the importance of positionality within and understanding of fandom for researchers. Our findings contribute to specific recommendations for working with public data generated within fandom, including special care to avoid amplifying fan content and ways that researchers can care for the trust they receive. These findings stand to inform broader discussions on what constitutes the ethical use of public data within other types of research as well, particularly for vulnerable populations.

'“Participant” Perceptions of Twitter Research Ethics' by  Casey Fiesler and Nicholas Proferes in (2018) Social Media + Society comments

Social computing systems such as Twitter present new research sites that have provided billions of data points to researchers. However, the availability of public social media data has also presented ethical challenges. As the research community works to create ethical norms, we should be considering users’ concerns as well. With this in mind, we report on an exploratory survey of Twitter users’ perceptions of the use of tweets in research. Within our survey sample, few users were previously aware that their public tweets could be used by researchers, and the majority felt that researchers should not be able to use tweets without consent. However, we find that these attitudes are highly contextual, depending on factors such as how the research is conducted or disseminated, who is conducting it, and what the study is about. The findings of this study point to potential best practices for researchers conducting observation and analysis of public data. 

The authors state

 In recent years, research ethics has become a topic of greater public scrutiny. This is particularly the case for research taking place on or using data from social computing systems (McNeal, 2014; Wood, 2014; Zimmer, 2010a). However, as Vitak, Shilton, and Ashktorab (2016) point out in a study of ethical practices and beliefs among online data researchers, there are not agreed upon norms or best practices in this space. Organizations such as the Association of Internet Researchers (AOIR) have offered guides for researchers (Ess and AOIR Ethics Working Committee, 2002), although these guidelines have had to be revised as new platforms present novel research contexts and as data collection practices evolve alongside them (Markham, Buchanan and AOIR Ethics Working Committee, 2012). It is also rare that the people whose data are being studied are involved in the development of such guidelines. However, public reaction to research ethics controversies (McNeal, 2014; Wood, 2014; Zimmer, 2016) suggests that these individuals have opinions about how researchers should study and use online systems and data. Brown, Weilenmann, Mcmillan, and Lampinen (2016) suggest that research ethics should be grounded in “the sensitivities of those being studied” and “everyday practice” as opposed to bureaucratic or legal concerns. We therefore suggest users can help inform ethical research practices.

Traditional interventional human subjects research involves informed consent and direct interaction with participants who are aware they are being studied. Under certain regulatory conditions, research that falls outside of this scope may not be strongly regulated. For example, in the United States, the use of publicly available data (e.g., tweets) may not meet the criteria of research involving human subjects as per the Code of Federal Regulations (45 CFR 46.101). However, there is a lack of consensus among individual university institutional review boards (IRBs) on this point (Vitak, Proferes, Shilton and Ashktorab, 2017). Data obtained from sources such as Twitter most often do not constitute research that requires their oversight or informed consent practices. Most researchers who use data sets of tweets do not gain consent from each Twitter user whose tweet is collected, nor are those users typically given notice by the researcher. Although Twitter’s Privacy Policy now mentions that academics may use tweets as part of research, this update was not included until revisions were made to the policy in the Fall of 2014.1 Moreover, Internet users rarely read or could fully understand website terms and conditions (Fiesler, Lampe and Bruckman, 2016; Luger, Moran and Rodden, 2013; Reidenberg, Breaux, Cranor and French, 2015).

Although there are a great many open questions around research ethics, including around experimental manipulation on online platforms (Schechter and Bravo-Lillo, 2014), for this study, we focus specifically on the issue of researchers’ use of public social media content. Because of the prominent use of Twitter data in research (Zimmer and Proferes, 2014), in this study, we ask: how do Twitter users feel about the use of their tweets in research?

Our goal with this work is not to suggest whether or not use of Twitter data is ethical or not based entirely on user attitudes. Instead, we aim to inform ethical decision-making by researchers and regulatory bodies by reporting on how user expectations align with the actual uses of their data by researchers. Therefore, we designed our survey instrument to probe contextual factors that impact whether Twitter users find studying their content acceptable. This study is exploratory, providing initial insights into a complicated space.

In brief, the majority of Twitter users in our study do not realize that researchers make use of tweets, and a majority also believe researchers should not be able to do so without permission. However, these attitudes are highly contextual, differing based on factors such as how the research is conducted or disseminated, who the researchers are, and what the study is about. After describing the study and findings, we conclude with a discussion of what these findings might suggest for best practices for Twitter research and offer potential design interventions that could help mitigate some user concerns.

Suppression

'Debunking the myth: why Victoria is not the suppression order 'capital' of Australia' by Jason Bosland in (2020) 24 Media and Arts Law Review incisively unpacks received wisdom regarding suppression orders, building on Bosland's Sydney Law Review article noted elsewhere in this blog (and in NSW Law Journal noted here).

The new piece argues that Victoria’s reputation as the nation's 'suppression order capital' is attributable ironically, as an unfortunate consequence of the Victorian courts being more transparent regarding levels of suppression than courts in other jurisdictions'. Bosland notes concerns regarding reliance on very incomplete data compiled by News Corp, with figures derived from the number of orders notified to media organisations (whether via email or directly to journalists present in court) rather than the number of orders actually made.

 The article notes that the NSW Supreme Court issued over 50% more suppression orders than the Victorian Supreme Court and that scrutiny of NSW lower courts is difficult because order notifications are rare and registries do not keep track of the numbers.

Importantly the article argues that the 'Suppression Capital' meme does not account for the variety in the types of orders that can be made, noting that a significant number of Victorian orders are made under statutory powers designed to deal with specific contexts, such as details of post-custodial sex offenders, or the names of people found not guilty by reason of mental illness. Courts elsewhere lack the specific statutory powers. Bosland accordingly notes that data should account for the fact that not all orders represent courts' 'general' approach to suppression; some instead respond to specific interventions by Parliament.

In a cogent examination of jurimetrics Bosland notes that jurisdictional 'rankings' do not account for significant differences in caseloads (consistent with differences in population). He argues that if judicial officers serve as a proxy for caseload, Victorian judges made an average of 1.5 general power suppression orders per judge, compared to 2.2 in Western Australia and 2.3 in South Australia. In a more restricted comparison between the NSW and Victorian Supreme Courts, the NSW supremes made 1.84 orders per judge and the Victorians made 1.36 orders per judge.

Jules O’Donnell, whose tweets drew my attention to the Bosland piece, astutely comments

 it seems to me that if you took the most hawkish approach to Bosland's analysis, your conclusion would still be: 'we can't be sure which State or Territory is the suppression capital of Australia, but we know Victorian courts and tribunals are the most transparent'.