[ooni-dev] On the ethics of soliciting measurements and informed consent

[Arturo Filastò]

Hello Oonitarians,

During yesterdays we had a very interesting conversation about the
ethics of measurements, informed consent and methodologies for achieving it.
These are very important discussions to have and we agreed that we
should continue it in this thread.

For those that were not on IRC at that time I will explain briefly what
it was that sparked the debate. If you are interested in reading the
full transcript of the meeting private message me and I will send it to you.

A problem that we have with OONI and I think is common to most network
measurements projects is that of acquiring reliable vantage points in
non western countries.
By reliable I mean vantage points where the tool in question is not just
run once and forgotten, but is periodically run, say once every day.
One way of acquiring vantage points is to rent VPS' and setting up the
tool on such VPS'. The problem with this approach, though, is that what
you are measuring is not the network that a real user in that country
would be using.

To overcome this issue I have come up with a scheme where by I get in
contact with people from countries that interest us and give them some
money to buy a raspberry pi and setup ooniprobe on it.
As an incentive to keep the probe running and gathering data with a
daily resolution I then pay them a small monthly fee to cover bandwidth
and power costs.
It turns out that not only is this cheaper than renting a VPS in that
country, but it also gives us more accurate results, since the
measurements are done from the users DSL home connection.

The problem with this approach is that we need to make it absolutely
clear that there is some risk involved in running the software and the
amount of risk varies greatly from country to country.
So far I have limited this to a very small set of people (3 in total, 2
paid and 1 not paid) that I have personally vetted and made sure that
they have read and understood what is written here:
https://github.com/thetorproject/ooni-probe#read-this-before-running-ooniprobe.

Some people are of the opinion that still this is not enough and that by
paying them the risk is increased.
It is not yet fully clear to me why that would be the case, nor what can
be done to make the situation better.

Some have suggested we consult some lawyers that have background in
international law to tell us how we can make this situation better.
I believe this is probably a good idea.

It was also mentioned that Stony Brook university may also have valuable
feedback in this area and we should also reach out to them.

I invite all the people present during yesterdays meeting to integrate
their feedback into this thread and forward this email to people that
can further advise.

~ Arturo