IRB Exemptions

The Common Rule contains exemptions for some research involving human beings. For security research the relevant exemptions are:

-1ex

• Research to be conducted on educational practices or with educational tests(§46.101(b)(1&2)).
• Research involving ``existing data, documents, [and] records...'' provided that the data set is either ``publicly available'' or that the subjects ``cannot be identified, directly or through identifiers linked to the subjects''(§46.101(b)(4)).
• Research involving ``survey procedures, interview procedures or observation of public behavior,'' unless information is obtained that could identify the human subjects, and ``any disclosure of the response outside the research could place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation''(§46.101(b)(2)(i&ii)).

Few Organizations allow investigators to decide if their own research is exempt under the guidelines--that would create a conflict-of-interest. For example, Harvard requires that ``all research using human subjects'' to be ``reviewed or designed as exempt from review by a Harvard Institutional Review Board''[#!harvard-irb-2!#]. In practice, all requests at Harvard to involve human subjects in research goes to a staff member at one of the Harvard IRBs; the staff then decides if the research is actually exempt or in need of review.