I attended the Advanced in Security Education workshop earlier this week where I gave a lightning talk about our Communications Security and Social Movements class. The last lightning talk (which, unlike all the others, was allowed to go far longer than the 5 allotted minutes), by Anthony Serapiglia of Saint Vincent College, was about his class on forensic training where, as part of the class activities, students retrieve data from old cell phones (mostly flip phones) that are in a variety of states (e.g. seemingly broken, infected with ransom-ware).
Cellphones available from Goodwill for $6.
Serapiglia described how easy and cheaply one can get these cell phones from Goodwill’s online store (“by the pound”). That’s right, he is using real people’s old phones that were discarded (in many cases it seems that they were discarded because people thought they were unusable), lost or stolen and ended up at Goodwill. He has students retrieve personally identifiable information from the phones, phones that he himself has not looked at the data on. He illustrates the retrieved data in a series of increasingly sensationalized photos: a family picnic; a child playing; a full frontal nude selfie; and 4 photos from the same phone of a man and his girlfriend, a hand holding presumably illicit drugs, a bookie sheet, and a man lying unconscious beat up (which Serapiglia describes as the owner of the phone having not paid his gambling debts).
I was feeling increasingly sick as I listened to his talk until he brought up a slide that had some mention of ethics on it, at which point I felt even worse. His take on the ethical considerations were that of protecting his students from the pictures and other data they would uncover from the phones. On the one hand, his mention of a media spot that he claimed to have done before the course started describing how easy it is to get data off old phones seemed to be his personal stand-in for informed consent. On the other hand, his saying several times that his university’s legal counsel gave the green light for the use of people’s presumed discarded data in his class, indicated that he was using the law as his moral and ethical guide. He ended the talk asking us if we would use such real data in our classrooms, and, given the outline of his talk, the only consideration seemed to be out of concern for what the students would be exposed to.
I was relieved that my hand wasn’t the only hand to snap up after the talk. The first questioner pointed out that such data use would not be legal in Europe and (paraphrasing) that European law, in this case, more closely aligns with morality. I pointed out that if one uses the law to define ones ethics that you will far short every time and that the law in the US drags behind commonly held societal beliefs. Another questioner suggested Serapiglia try an experiment to see if his presumed implicit consent closely matches what he would get from explicit consent: put out a call for volunteer cell phones to be used in the same manner; if he doesn’t get any donations, then perhaps he shouldn’t used “discarded” phones either. Except for one audience member who thought it would be okay to use such an exercise in a graduate, but not an undergraduate, class, everyone admonished the use of people’s old cell phones without their explicit permission.
We have seen more than once, the treatment of electronic data as divorced from the people who created it, claiming at least implicitly that it does not warrant the same level of human-subjects-research protections that we afford people in person. And while IRBs don’t evaluate non-research use of human data, that doesn’t mean that we shouldn’t apply the same principles to our classroom activities. Perhaps even more importantly we should be aware of the ethics we are implicitly teaching through our classroom activities, as they shape our students.
