Demonstrate an understanding of ethical practices, scholarly conduct and responsible research behaviour.
Lecture 6 supplied the four governing principles. This lecture covers the five domains in which those principles become concrete obligations with named procedures and regulators.
This is the most regulation-dense lecture of the unit, and naming the right instrument is worth marks. Build flashcards for the distinction pairs in Section 8: confidentiality versus anonymity and fabrication versus falsification are the two most reliably examined and the two most reliably confused.
Each of the five domains corresponds to a distinct point at which trust fails — participants, data subjects, readers, collaborators and the public respectively. That is why five separate regimes exist rather than one general duty of good behaviour.
1. Learning Objectives
- Define and apply the principle of informed consent in human-subjects research.
- Explain the mechanisms used to preserve confidentiality and protect data.
- Distinguish between data fabrication, falsification and legitimate data transformation.
- Identify the criteria for legitimate authorship and the consequences of honorary or ghost authorship.
- Recognise, disclose and manage conflicts of interest in research.
- Connect each ethical principle to concrete computer science research scenarios.
2. The Five Pillars
Research is built upon trust. In computer science, where research increasingly involves human participants (HCI, user studies, AI fairness assessments), large-scale datasets and multi-author collaborations, ethical awareness is a core competency rather than an optional extra.
| Ethical domain | Core principle | Primary risk if violated | Who is protected |
|---|---|---|---|
| Informed consent | Voluntary, informed, capacitated agreement | Coercion, exploitation | Participants |
| Confidentiality | Privacy protection and controlled disclosure | Privacy breach, identity exposure | Data subjects |
| Fabrication / falsification | Honest data collection and reporting | Loss of scientific validity | Readers and the scientific record |
| Authorship norms | Credit for substantial intellectual contribution | Misattribution of credit | Collaborators |
| Conflict of interest | Transparent disclosure of competing interests | Compromised objectivity | The public and peer review |
3. Informed Consent
3.1 Definition
Informed consent is a process by which a participant voluntarily agrees to take part in a research study after being fully informed about its purpose, procedures, risks, benefits, alternatives and the handling of their data. It is rooted in the Belmont Report's principle of respect for persons and reaffirmed in Article 6 of the Declaration of Helsinki.
Note the word process. Students treat the signature as the deliverable and therefore optimise for obtaining it rather than for the participant's understanding.
3.2 Five Components of Valid Consent
- Disclosure. The researcher must disclose the study's purpose, duration, procedures, foreseeable risks, expected benefits and any compensation.
- Understanding. Information must be presented in language the participant can comprehend, free from jargon or undue influence. A form written at postgraduate reading level fails this criterion however complete its disclosure.
- Voluntariness. Participation must be free from coercion, undue pressure, or penalty for non-participation — a live concern when the researcher is also the participants' instructor or senior.
- Capacity. The participant must have the legal and cognitive capacity to consent. For minors or incapacitated individuals, surrogate or parental consent is required.
- Comprehension and documentation. Usually recorded through a signed consent form, although click-through or recorded verbal consent is acceptable in some digital contexts.
3.3 Hard Cases in Computing
- Online experiments and crowdsourcing (Amazon Mechanical Turk, Prolific). Consent must be obtained prior to task exposure, and IP addresses and metadata may themselves constitute identifiable information even when no name is collected.
- AI fairness and dataset research. Consent issues arise when researchers use pre-existing datasets containing personal information. Secondary use beyond the original consent's scope may violate the agreement under which the data were collected — however public the dataset now appears.
- A/B testing in industry. Many large technology firms conduct experiments on users without explicit consent. This raises unresolved concerns about autonomy and transparency; the fact that a practice is routine does not settle whether it is ethical.
A researcher studying the usability of a new authentication mechanism recruits 100 participants. Each participant must be told:
- that they may withdraw at any time;
- that their keystroke dynamics data will be collected;
- how the data will be stored and destroyed;
- whom to contact for grievances.
Failure to disclose the keystroke logging constitutes an ethical violation even if the protocol was institutionally approved. Committee approval establishes the protocol's acceptability; it says nothing about what was actually told to participants.
4. Confidentiality
4.1 Definition and the Key Distinction
Confidentiality is the obligation of researchers to protect the private information of participants and prevent unauthorised access, use or disclosure.
Anonymised data cannot be linked back to an individual at all. Confidential data are linkable but are protected by safeguards. Pseudonymised data replace identifiers with keys held separately and therefore remain re-identifiable — which is why pseudonymisation is not anonymisation under GDPR.
Claiming anonymisation is a technical assertion requiring justification: quasi-identifiers such as postcode, birth date and sex have repeatedly been shown sufficient to re-identify individuals in supposedly anonymised datasets.
4.2 Four Operational Practices
- Minimisation. Collect only the data necessary to answer the research question.
- Anonymisation and pseudonymisation. Remove or replace direct identifiers.
- Secure storage. Use encryption, access controls and audit logs.
- Controlled access. Restrict data access to authorised personnel under binding agreements.
Minimisation is the strongest safeguard available, and the one engineers reach for naturally: data never collected cannot be breached, subpoenaed, re-identified or leaked. Every other control merely reduces the risk attaching to data you chose to hold.
4.3 Regulatory Frameworks
- India — the Digital Personal Data Protection Act (DPDPA), 2023, governs the processing of digital personal data.
- European Union — the General Data Protection Regulation (GDPR) sets strict consent and data-handling standards, with extraterritorial reach.
- United States — the Health Insurance Portability and Accountability Act (HIPAA) governs medical data confidentiality.
4.4 Technical Mechanisms and Their Costs
| Mechanism | What it protects against | Its cost |
|---|---|---|
| Encryption — AES-256 at rest, TLS 1.3 in transit | Interception | Negligible; this is the baseline expectation |
| Differential privacy | Re-identification, bounded mathematically | Accuracy, traded against the privacy budget |
| Federated learning | Data centralisation | Efficiency; new leakage channels through model updates |
| Secure multi-party computation | Disclosure of individual inputs | Computationally expensive |
These mechanisms matter most in health informatics, social-network analysis and behavioural analytics — the CS subfields in which confidentiality obligations are strictest and research questions most demanding. Differential privacy's distinctive claim is that it offers a provable guarantee under a stated budget, unlike ad-hoc de-identification, which offers only a hope.
None of these mechanisms is a complete solution. Presenting them as solved problems invites the belief that a privacy-preserving pipeline discharges the consent obligation from Section 3 — which it does not.
5. Data Fabrication and Falsification
5.1 Definitions
The U.S. Office of Research Integrity and most institutional policies classify research misconduct into three categories, known as FFP:
- Fabrication — making up data, results or records and reporting them as if they were real.
- Falsification — manipulating research materials, equipment or processes, or changing, omitting, or selectively reporting data, such that the research is not accurately represented.
- Plagiarism — appropriation of another person's ideas, processes, results or words without giving appropriate credit (Lectures 4 and 5).
The official definition includes omitting. This is why leaving unfavourable runs out of a paper falls inside the definition rather than beside it — the most effective correction to the belief that only invented data counts as misconduct.
5.2 The Boundary Between Method and Misconduct
| Practice | Ethical status |
|---|---|
| Removing outliers with documented statistical justification | Generally acceptable |
| Applying anonymisation or aggregation | Acceptable and often required |
| Cherry-picking results that support a hypothesis while omitting null results | Unethical — selective reporting |
| Generating synthetic data to fill missing records without disclosure | Unethical — fabrication |
| Re-running an experiment until the result becomes significant | Unethical — manipulation |
| Image manipulation in figures that alters content | Unethical — falsification |
Disclosure and documentation. Synthetic data disclosed as synthetic is a legitimate method; the same data presented as observed is fabrication. An outlier removal you can justify in writing is method; the same removal undocumented is indistinguishable from data repair.
5.3 Computer Science Specific Issues
- Benchmark falsification. Cherry-picking benchmarks, omitting unfavourable datasets, and tuning hyperparameters on the test set are all falsification — notwithstanding that each step looks like ordinary engineering iteration.
- Test-set contamination. Once the test set has informed a design decision, the reported number is a training-set estimate presented as a generalisation estimate — a misrepresentation of what the experiment measured. This is the offence this cohort is most likely to commit and least likely to recognise as more than sloppiness.
- Image manipulation. Figures in computational biology and imaging papers can be altered in general-purpose image editors, which is why journals now require raw image data alongside submitted figures.
- Reproducibility crisis. Many published ML results cannot be replicated, in substantial part because of undisclosed data preprocessing and selective reporting rather than outright invention.
Jan Hendrik Schön (2002) — a physicist at Bell Labs fabricated data across multiple semiconductor studies. He was prolific and celebrated before he was caught, which is why community verification rather than individual reputation is the operative safeguard.
Hwang Woo-suk (2004–2005) — fabricated data in stem-cell research, leading to retraction of high-profile papers and a criminal conviction.
Contemporary retractions, including benchmark manipulation and undisclosed tuning, are catalogued publicly by Retraction Watch. Browsing ordinary, non-famous cases is more instructive than any single scandal.
6. Authorship Norms
6.1 Why Authorship Matters
Authorship is the primary mechanism through which researchers receive credit for intellectual contributions. Misattribution distorts merit, undermines accountability, and affects career progression, funding decisions and public trust.
6.2 The ICMJE Criteria
The ICMJE (International Committee of Medical Journal Editors) and COPE (Committee on Publication Ethics) have established the widely accepted criteria. Under ICMJE, authorship requires:
- Substantial contributions to conception, design, data acquisition, analysis or interpretation.
- Drafting the work or revising it critically for important intellectual content.
- Final approval of the version to be published.
- Accountability for all aspects of the work.
The criteria are conjunctive. “I wrote the code, so I am an author” and “I supervised, so I am an author” are both incomplete claims. Contributors who do not meet all four may be acknowledged but not listed.
Criterion 4 is the one students overlook: accepting authorship means accepting answerability for the whole paper, including parts you did not produce — which is why a gift author is exposed as well as unearned.
6.3 Five Named Abuses
| Misconduct | Description |
|---|---|
| Gift authorship | Listing senior colleagues without their meaningful contribution |
| Guest authorship | Adding a well-known researcher to enhance credibility |
| Ghost authorship | Omitting a contributor — a medical writer, a junior researcher — who made substantive contributions |
| Coercive authorship | Senior authors pressuring juniors to include unrelated contributors |
| Mutual-benefit authorship | Researchers agreeing to add each other across papers without genuine contribution |
6.4 Authorship in Computer Science
Traditional authorship criteria were designed around individually authored manuscripts, while CS research produces collaboratively built software, datasets and infrastructure whose contributors do not map cleanly onto drafting and revision. This is why the CRediT taxonomy matters more here than in the disciplines that wrote the original rules.
CRediT defines fourteen roles: conceptualisation, methodology, software, validation, formal analysis, investigation, data curation, writing – original draft preparation, writing – review and editing, visualisation, supervision, project administration, funding acquisition, resources.
- Mega-author papers. Submissions at venues such as NeurIPS may carry thirty or more authors, at which point a byline conveys almost no information and per-role contribution statements become the only meaningful transparency.
- Advisor–student dynamics. A student who is the primary contributor should be listed as first author. This is a recurring source of conflict, and the power asymmetry means the student rarely raises it. The remedy is a documented authorship agreement before work begins, not a negotiation after submission.
Software, data curation and validation are the roles this cohort most often fills uncredited. Naming them explicitly is how the contribution becomes visible.
7. Conflict of Interest
7.1 Definition and Types
A conflict of interest exists when a researcher's personal, financial, professional or institutional interests could compromise — or appear to compromise — the objectivity, integrity or independence of the research. Appearance is sufficient; actual bias need not be demonstrated.
- Financial. Stock holdings, consulting fees, royalties or honoraria from entities that could benefit from the research outcome.
- Personal. Close relationships with individuals or organisations that could bias the research.
- Institutional. Institutional pressures, such as funding from a company whose product is being evaluated.
- Intellectual. Strongly held theoretical commitments that may bias interpretation of data.
- Political or ideological. Particularly relevant in AI ethics, algorithmic fairness and policy research.
7.2 Disclosure Requirements
IEEE, ACM, NeurIPS and ICML all require authors to declare funding sources, employment relationships, equity interests, advisory board memberships and any other relevant relationships within roughly the past three years.
Failure to disclose is a separate, independently sanctionable offence regardless of whether the research was actually biased — which is why declaring is always cheaper than judging your own impartiality.
7.3 Managing a Conflict
- Disclosure — full transparency to journals, funders and ethics committees. This is the floor.
- Blinding — double-blind review where feasible.
- Independent oversight — an independent statistician or auditor verifies results.
- Recomposition of research teams — including members without the conflict to balance perspectives.
- Recusal — removing oneself from review or decision-making processes.
- Evaluating the safety of a self-driving system funded by its manufacturer — a clear financial conflict.
- Benchmarking against a competing library that you maintain — an intellectual and personal conflict, with no money involved at all.
- Auditing a hiring algorithm from a company you previously consulted for — a prior relationship requiring disclosure.
8. Cross-Cutting Themes
8.1 Interdependence
A single study may require informed consent from participants, confidentiality protection for the data collected, honest reporting without fabrication or falsification, accurate authorship attribution, and transparent disclosure of conflicts. Failure in one domain often cascades into others: falsification of data typically involves misleading co-authors, converting a data offence into an authorship and trust offence.
8.2 Institutional Mechanisms
- Institutional Review Boards (IRBs) or Ethics Committees for human-subjects research.
- Institutional Ethics Committees (IECs) under Indian Council of Medical Research guidelines.
- Research Integrity Offices handling allegations of misconduct.
- Funding agency policies — DST, SERB, UGC in India — requiring ethics training and certification.
In India, ICMR's National Ethical Guidelines for Biomedical and Health Research Involving Human Participants (2017) is a widely cited reference, applicable even to CS research when it involves human data.
8.3 Consequences
Confirmed violations may lead to retraction of publications, blacklisting by funding agencies, termination of employment, loss of academic degrees, and civil or criminal liability — especially where data-protection law has been breached. Platforms such as Retraction Watch document these cases publicly, serving as both deterrent and educational resource.
9. Case Studies
The following are illustrative composites for teaching. For documented incidents, see the Schön and Hwang cases in Section 5.3 and the Retraction Watch database.
| Scenario | Domain implicated | Lesson |
|---|---|---|
| A fairness paper reports a 2% demographic parity gap computed on a favourable subset of the dataset; the paper is retracted and an institutional investigation opened | Fabrication / falsification | Selective reporting and benchmark manipulation constitute falsification |
| A platform runs a large-scale A/B test manipulating the emotional valence of users' feeds, published without explicit consent | Informed consent; non-maleficence | Scale does not suspend the consent obligation |
| A company's medical writer drafts a manuscript; only academic authors are listed, and the writer cannot later be located to verify the analysis | Authorship (ghost) | Ghost authorship destroys accountability and breaches ICMJE criteria |
| A researcher publishes a paper praising an AI hiring tool; stock options in the vendor emerge later | Conflict of interest | Non-disclosure undermines the credibility of the finding |
10. Summary
| Domain | Core takeaway |
|---|---|
| Informed consent | Voluntary, informed, capacitated and documented agreement is mandatory — and committee approval does not replace participant disclosure |
| Confidentiality | Protect data through technical and procedural safeguards; distinguish anonymity from pseudonymity |
| Fabrication / falsification | Honest reporting is non-negotiable; omission is inside the definition |
| Authorship norms | Credit must reflect substantial intellectual contribution; use CRediT |
| Conflict of interest | Disclose all relevant interests; manage or recuse when necessary |
11. Exam Preparation
- Memorise definitions: fabrication, falsification, informed consent and its components, the ICMJE authorship criteria, conflict of interest.
- Apply, do not just define. Expect a hypothetical scenario and a request to identify the violation.
- Know the bodies: IRB, ICMJE, COPE, ICMR, ORI, Retraction Watch.
- Connect to CS. Always bring examples back to computing — HCI, AI, datasets, benchmarking. Answers written entirely in biomedical terms lose the discipline-specific marks.
- Use structured responses: definition → principle → CS example → consequence.
- Distinguish similar concepts: confidentiality versus anonymity; fabrication versus falsification; gift versus ghost authorship.
- Link to regulations: referencing GDPR, DPDPA, ICMR or HIPAA strengthens an answer materially.
- Discuss consequences. Examiners reward awareness of institutional and legal ramifications.
11.1 Short-Answer Questions
- Define informed consent. List its essential components. 3 marks
- Differentiate between fabrication and falsification, with one CS-relevant example of each. 3 marks
- What are the ICMJE criteria for authorship? Why is each important? 4 marks
- Explain the difference between anonymisation and pseudonymisation. Why does the distinction matter for CS research? 3 marks
- What is a conflict of interest? List three types with examples. 3 marks
11.2 Long-Answer Questions
- Discuss the ethical issues surrounding the use of publicly available social-media data for research. Address informed consent, confidentiality and applicable regulations. 10 marks
- Critically evaluate the criteria for authorship in large multi-institutional machine learning collaborations. How does the CRediT taxonomy help resolve ambiguities? 10 marks
- A CS researcher at your institute is suspected of manipulating benchmark results. Outline the institutional process for investigating the allegation and the potential consequences. 10 marks
- Compare the ICMR (India) and GDPR (EU) frameworks in their treatment of informed consent and data protection. Which is more restrictive, and why? 10 marks
- Discuss the role of differential privacy in protecting participant confidentiality. What are its limitations? 10 marks
11.3 Scenario-Based Questions
- A PhD student wants to scrape user reviews from a public website for a sentiment-analysis study. Identify the ethical concerns and propose safeguards.
- Three students collaborate on a project. Only the first writes the paper, but all three are listed as authors; the other two performed coding and analysis. Evaluate this authorship claim against ICMJE standards.
- You are reviewing a paper for an AI conference and notice that the lead author is a co-founder of the startup whose product is being evaluated. What should you do?
- A dataset used in your research contains personal information, but its terms of use explicitly prohibit re-identification. Discuss the ethical and legal implications.
11.4 Higher-Order Questions
- To what extent should research ethics differ between academic and industry research?
- Can informed consent be meaningfully obtained for large-scale, pre-existing datasets? Justify your position.
- How should authorship be attributed in projects involving generative AI tools such as large language models? Argue from the accountability criterion: a tool cannot be accountable and therefore cannot be an author.
- Should conflict-of-interest disclosures be made public for all funded research? Argue both sides.
12. Further Reading
- Belmont Report (1979).
- Declaration of Helsinki (1964, last revised 2013).
- ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants (2017).
- Digital Personal Data Protection Act, India (2023).
- General Data Protection Regulation, EU.
- ICMJE Recommendations for the Conduct, Reporting, Editing, and Publication of Scholarly Work in Medical Journals.
- COPE (Committee on Publication Ethics) Guidelines.
- Office of Research Integrity — Introduction to RCR.
- Martín-Martín, A., et al. (2018). Ordinary authors and invisible contributors: The need to improve credit attribution in research.
- Retraction Watch database.