CSEG3060 · Research Methodology in Computer Science
Institutional Ethics Committees · plagiarism policy · ethical dilemmas in computing
Principles become obligations only when a committee can refuse your protocol and a regulation can cancel your degree.
Unit III · Lecture 8 of 8 — concluding lecture · 60 minutes · CO3
Dr. Mohsin Furkh Dar · School of Computer Science, UPES
→ / Space next · ← back · O overview · N speaker notes · F full screen
Learning objectives · CO3
Identify the principal national and international bodies governing research ethics in India
Describe the composition, mandate and review procedure of an Ethics Committee
Apply UGC and UPES plagiarism regulations to concrete academic situations
Analyse real case studies to detect violations and recommend corrective action
Evaluate emerging dilemmas arising from AI, big data and generative systems
Formulate a defensible position using established regulatory language
Orientation
| Tier | Instruments | Enforcement mechanism |
|---|---|---|
| 1 · International codes | Nuremberg (1947), Helsinki (1964, rev. 2013), Belmont (1979) | Moral authority; no direct enforcement |
| 2 · Professional codes | ACM Code of Ethics (2018), IEEE Code of Ethics | Membership status, venue policy, reputation |
| 3 · National law and guidance | ICMR (2017), UGC (2018), DPDP Act (2023), IT Act (2000/2008), CDSCO, MeitY | Legally binding; penalties attach |
| 4 · Institutional bodies | IECs / IRBs, Research Integrity Offices, Departmental Research Committees | Operational gatekeepers — approve, refuse, monitor |
A multidisciplinary body reviewing research involving human participants or sensitive data.
The US equivalent; used interchangeably in the literature.
Percentage of matched text reported by detection software.
Fabrication, falsification or plagiarism in proposing, performing, reviewing or reporting research (ORI).
The tiers interlock: a UPES-IEC decision applies Belmont principles through ICMR procedure — so an institutional refusal ultimately rests on a 1979 document. Tier 4 is the only layer you will personally interact with.
Tier 1
Arising from the trial of Nazi physicians. Ten principles, foremost voluntary informed consent — which now undergirds modern data-protection law and CS user studies alike.
World Medical Association. Extends Nuremberg and distinguishes therapeutic from non-therapeutic research. The most widely adopted international standard; referenced by Indian institutional policy.
Three principles that now structure IEC review: respect for persons (autonomy, consent), beneficence (minimise harm), justice (fair distribution of burdens and benefits).
Belmont is the examinable one because IEC review forms are effectively operationalised Belmont: consent procedures test respect for persons, risk–benefit analysis tests beneficence, and recruitment criteria test justice.
Tier 2
Commits members to treat all persons fairly and with respect, to refrain from harassment and discrimination, to avoid injuring others, and explicitly requires responsible disclosure of factors that might endanger the public.
Note the structure of both: they impose positive duties — contribute, act against discrimination, disclose danger — and not merely prohibitions. Students read all ethics as a list of prohibitions and conclude that doing nothing is always safe. The ACM code says otherwise.
Sanctioned through membership status, publication venue policy and reputational consequence rather than by law. A code violation rarely reaches a court — but can end a publication record.
ACM's “avoid harm” and anti-discrimination duties are the instruments under which algorithmic bias and unsafe deployment are argued as ethics violations rather than merely engineering defects.
Tier 3
India's most comprehensive ethical standard and the source of IEC composition and procedure rules. ICMR has additionally issued dedicated ethical guidance on AI in biomedical research and healthcare — algorithmic transparency, dataset representativeness, bias mitigation.
The (Promotion of Academic Integrity and Prevention of Plagiarism) Regulations, 2018 define plagiarism levels and penalties for higher education institutions. Subsequent draft revisions address similarity thresholds and generative-AI content.
National Strategy for AI (2018) and the Digital Personal Data Protection Act, 2023 — the operative Indian data-protection statute, which applies to your research data handling, not only to companies.
Regulates clinical trials and software as a medical device (SaMD) — increasingly relevant where CS departments build AI/ML diagnostic tools.
The legal foundation for prosecuting unauthorised data access, digital fraud and cybercrime — the statute under which a research data-handling failure becomes a criminal rather than an academic matter.
Institutional bodies · 1 of 3
Multidisciplinary and gender-balanced, minimum five and maximum twelve members under ICMR 2017:
Where proposals involve large-scale personal-data processing, the committee should additionally include a data protection officer or information-security expert — without whom it cannot competently assess re-identification risk.
The external chair guards against institutional self-interest; the legal member reads consent documents as enforceable instruments; the layperson tests whether disclosure is actually comprehensible to a participant.
Institutional bodies · 2 of 3
| Review level | Trigger | Outcome |
|---|---|---|
| Exempt | Minimal risk; secondary use of de-identified data; survey of public officials | Notification of exemption |
| Expedited | Minimal risk but not exempt; minor modification to an approved protocol | Approval by Member Secretary and one member |
| Full board | Greater than minimal risk; vulnerable populations; novel AI/ML systems involving personal data | Decision at a convened quorum meeting |
Submission carries the proposal, consent forms, data management plan, recruitment materials and risk–benefit analysis. Notification typically follows within 4–6 weeks; “modifications required” is the most common outcome and is not a rejection.
Exemption is a determination the committee makes, not one the investigator may assume. Self-exempting a protocol is itself a procedural violation — and a protocol amended mid-study without resubmission is operating without approval.
Institutional bodies · 3 of 3
Proposals route through the online Research Management System (RMS) portal. The committee meets quarterly, with provision for emergency review of time-sensitive studies.
A usability study, a developer survey, a crowdsourced annotation task or an adversarial-testing protocol with human participants all require review. A purely computational study on a public, properly licensed, de-identified dataset generally does not.
DURC is listed deliberately. Research with legitimate civilian use that is also weaponisable — vulnerability-discovery tooling, disinformation-capable generative models, surveillance automation — is within the committee's remit even with no human participants at all.
Policy
Penalties shown for students' theses and dissertations. Faculty: withdraw the manuscript at Level 1; at Levels 2–3 also lose increments and new research students for two or three years. A repeat offence takes the next level up.
Exclusions: attributed quotes, references and bibliography, generic terms and standard equations. Thresholds are floors for penalty — an institution may be stricter, not laxer.
Note the third clause of the definition: methodologies, datasets or algorithms. A borrowed pipeline or dataset is regulated content, not just borrowed prose.
Source: UGC (Promotion of Academic Integrity and Prevention of Plagiarism in Higher Educational Institutions) Regulations, 2018.
Core
Participants may not read forms · deception is sometimes necessary (phishing susceptibility) · withdrawal after anonymisation is technically difficult.
Social media, mobile and IoT datasets remain re-identifiable; hence differential privacy, k-anonymity, federated learning.
Hiring tools disadvantaging women (Amazon, 2018) · facial recognition with elevated error rates for women and people of colour · predictive policing. ACM: non-discrimination.
Generative models capable of disinformation · vulnerability-discovery tooling · surveillance automation. IEEE: public-endangerment disclosure.
Omitted contributors, honorary authorship, competing priority claims.
Loyalty to colleagues against responsibility to the public. Institutional protection aligned to the Public Interest Disclosure and Protection of Informers Act, 2010.
Publication pressure driving selective reporting, p-hacking and, at the extreme, invented results.
Practical application
Turnitin for textual submissions · Ouriginal for cross-checking · MOSS for code at the supervising faculty's discretion.
M.Tech / PhD dissertations ≤ 10%
B.Tech project reports ≤ 20%
Conference / journal publications ≤ 15% (excluding self-citation)
First offence — written warning and mandatory resubmission
Second — grade “F” and six-month debarment
Third, or major plagiarism above 40% — expulsion, and degree revocation if discovered post-graduation
Generative AI is permitted for grammar and code suggestion, subject to explicit declaration in the Acknowledgement section. Submitting AI-generated text as one's own original writing constitutes academic misconduct.
Aditi's B.Tech report. Initial index 22%, of which 14% is a methodology section closely paraphrasing a published survey without quotation marks. Threshold is 20%, so it fails. She rewrites, cites the survey and quotes technical definitions; the revised report returns 9% and the DRC accepts it.
Had she not revised: grade “F”, and the supervisor must report to the Departmental Disciplinary Committee.
Case studies
| Case | Facts | Lesson |
|---|---|---|
| Facebook emotional contagion (2014) | Cornell and Facebook manipulated news feeds of ~689,000 users; no consent, on the basis of terms of service. HHS later clarified such work can require IRB review | Manipulating the user environment triggers obligation even when the data already exist |
| Cambridge Analytica (2018) | Data of ~87 million users harvested via a personality app for political micro-targeting; $5bn FTC penalty | Verify the chain of consent for all secondary data, especially across jurisdictions |
| Theranos (2003–2018) | Claimed finger-prick diagnostics; whistleblowers alleged non-functional technology and fabricated results; criminal prosecution | Reporting model accuracy unsupported by experiment is the same category of misconduct |
| Henrietta Lacks / HeLa | Cells taken in 1951 without consent; genome published in 2013 without consulting the family; NIH data-access working group established | Data from identifiable sources retain ethical obligations indefinitely |
| Microsoft “Tay” (2016) | A learning Twitter chatbot driven to offensive output by coordinated adversarial input within ~16 hours; withdrawn | ACM “avoid harm” applies at deployment — red-teaming and safeguards are required |
| Indian doctoral thesis (2016) | ~60% of a thesis found plagiarised via Turnitin and manual review; registration cancelled under UGC Regulations; supervisory committee scrutinised | Supervisors share responsibility; checks belong throughout the lifecycle |
Consolidation
Analyse the Facebook contagion study using the Belmont framework — which principles were violated, and how might an IEC review have altered the design?
Compare the ACM and IEEE codes. To what extent are they enforceable in practice, and what does that imply?
Examine Cambridge Analytica under the DPDP Act, 2023 — what liabilities would researchers face today at an Indian institution?
Can consent be meaningfully obtained for large pre-existing datasets? · Where should the line fall on dual-use research?
Exam preparation
Tay → ACM “avoid harm” · Cambridge Analytica → DPDP / GDPR · the thesis case → UGC 2018. Always link a dilemma to a specific instrument.
Expect a current-affairs slant on generative AI and DPDP Act enforcement, and be able to explain why IEC multidisciplinary composition matters rather than merely listing its members.
The practical test of this unit: before your next submission, can you name the committee, the threshold and the declaration that apply to it?