 I mean, they're watching. Just my presence fixed. Yeah, why not? So, let me present Bernhard, who is not only an organizer of this room. Please, come loud for them. Great work. Also, Bernhard took some time and prepared a very interesting talk for us about ethics. So, please welcome. Okay, thank you very much for staying very late in the evening. I'll try and get through this as quickly as possible. If I had more time, this would be even better. So, let's see how it goes. Okay, so this talk is called dotting the ethics eye and crossing the T's. It's not as interesting as, you know, designing things and having lots of wireframes and stuff. It's all of the sort of the invisible work that can often be overlooked because either it's hard or people forget about it or don't sort of unaware that it's important. So, solid ethics for free open source software user research. So, this person here is Belen. She's invisible. She was supposed to be here. She's at the design booth. So, just imagine she's standing here. This is me. I'm Bernhard. I'm a user researcher and interaction designer. I try to spend a lot of time working on open source projects. But I also have to do to spend time on open source software. What am I going to talk to you about? I'm going to talk to you about ethics and user research. So, quick show of hands. Who here knows what user research is? If you don't, that's totally fine. Don't worry. So, okay. So, that's half and halfish. Essentially, what user research is, is understanding what the user of your software needs to do. Even before that, understanding who they are in order to understand is your software even needed. That's the most simple straightforward definition. Because user research involves users who are normally human, there's a lot of things that have to be considered. Come on in. When you're doing user research, because they're humans, you've got to treat them ethically. Okay? What are ethics? This is the definition I found. This isn't my words. So, moral principle that governs a person's behavior or the conducting of an activity. So, in this case, the activity is user research. And I'm going to explain, talk about a few things that you should really think about and try to put in place when you're doing user research. So, the rule zero of user research, like the rule zero of, you know, hack spaces is don't be on fire. The rule zero of user research is do no harm to the user. Okay? These people are giving you their time, speaking to you, opening up potentially their lives, their houses, their work to you. For the sole purpose of you using that information to design better software that more than likely will affect them. Okay? So, you could look at it if you were just being really, really ruthless as a transaction. Okay? You give me your time and your information and I try and give you good software. It can often be seen as a sort of an imbalance. I'm the researcher. You're the participant. I'm in control. You know, you're my experiment subject. I prod you with the stick. You jump. That's maybe a very medical way of looking at things and that can sometimes make sense in that situation, but not here. So, you should ensure that your participants suffer no adverse consequences. Physiological, psychological, social, political of taking part. This book will be familiar with some people. I see them nodding in and going, he just copied it from there. Yes, I did because it's a really good book. This explains do no harm. Okay? You can say, well, how can somebody suffer psychological or social or political consequences? I'll give you a really short example. It's the example that I speak about a lot because it was a really important example. I was doing research, user research in an Arabic country which was, well, the religion was Muslim. This person came into our research session and we had a very focused thing. We wanted to test something with this person. We wanted to understand how they do things. And before we, why they traveled to the UK so often it's to visit their partner, which this person was male and his partner was also male. This was no way of any interest or any way applicable to our research. If this is in a different country you might say, okay, well, that's kind of interesting but it's not really applicable. We were recording the session with the person's consent. We were recording his face, his audio, his voice, everything. First thing I tried to do very politely and very without sort of freaking him out was to stop our recording because I was worried that if I was stopped in an airport or something or the police or somebody saw what was on the recording and this person saying, my partner, he lives in London, he would have been potentially in, you know, certainly social, certainly political, certainly psychological adverse consequences. This is the most important thing to remember when you're doing research. Rule zero, do no harm. As a result of, you're doing research with humans. Humans have human rights, surprise, surprise. In real life, on the street, in their daily lives, they also have rights as participants of your research. I'm going to go through these reasonably quickly and we can discuss them later on. So first of all, right not to participate. Nobody has to take part in your research. It's a pain in the ass for you as a researcher or as a designer if they don't because I've got to find someone to take part in my research. That's your problem, not theirs. The right, spelled incorrectly, to withdraw from research. The right to give informed consent. The right to anonymity and the right to confidentiality. So as I said, right not to participate. If someone doesn't want to take part in their research, they don't have to. You should, must accept that decision. You may recruit somebody and they may be interested in saying it, but then change their mind and say, I'm not interested. You cannot make them do to take part in your research if they don't want to. That's your problem. You're the professional who is researching, designing, developing the software, not them. Here's, actually this fits later on. I'll come back to this in a second. The right to withdraw. Even if somebody initially agrees to take part in your research, they can change their mind at any time. Any time means literally from the point that it starts until the point it ends. I had somebody again come in for research, they sat down. I went through all of the things I have to do, explain what the research is, why we're doing it, and so on. And they were, yeah, okay, this is all fine, this is all fine. Three or four minutes after the first question I asked them, they said, no. And I said, sorry, excuse me? No, no, I said, no what? I said, no, I'm not doing this. And I said, okay, can I ask why? No, just kept on saying no. So I said, okay, well, thank you for coming in. Here's your incentive that we provide, that we said we would give you. There's the door. Thank you very much. And you can leave. I don't understand why the person didn't want to. I've got my kind of suspicions, but I can't ask them why they didn't want to change, why they didn't want to take part. Informed consent, this is really big, often really misunderstood as being really complicated. It depends on the research that you're doing. Either it can be really complicated or it can be actually quite simple. So essentially informed consent means that before you can take as given that the person consents to take part in your research, they can only consent when they actually understand what it is that they're taking part in. So if you say, hey, come along and test this app, you know, we want to see how it works for you. Okay, that's part of it. If you come along and say when the person is in the research session, okay, so I want to see everything that's on your phone. I want to look at your passwords and so on. And I'm going to be recording this on my video. That person may have consented to take part in your research, but only when you've explained to them what it is you're actually researching, can you really understand if they've given consent or not? Sometimes it can be difficult to ask to get informed consent, for example, in a situation of testing sort of security and usability. If you want to test the content of an email and your objective is to see that the person fall for a phishing attack, you don't want to say, okay, so what I'm doing here is I want to test if you're going to fall for this phishing attack because that's going to, well, bias the results and you can't really use that. However, you can still test that by giving the person a brief explanation of what you want to do and then afterwards ask them for their informed consent. So you go through your test, they perform however they perform it, and at the end you can say, okay, we invited you in to test our email application, but actually what we were doing was we were sending you a phishing email to see what your reaction would be. Going back to this, the person could potentially suffer psychological adverse consequences because they're now going to say, well, every email I receive is a potential phishing attack. So what you need to explain is what it was you were specifically looking at and then provide them with potentially, you know, somebody to speak to about, okay, this is why we were doing it. To give an example, not an open source project example, but I was doing research with compulsive online gamblers where I was specifically looking at something that was going to help them doing 30, 40 minute interviews about their gambling behavior. And I was trying to be very specific on what I was looking at, but our discussions went into attempted suicides, drug overdoses, alcohol dependency, and a whole bunch of other stuff. I had people crying on the telephone to me. I knew this was going to happen. I explained what I was going to do and they gave me their informed consent. At the end I said, okay, here's an organization that can help you with your addiction. Here's a phone number. You should call them if you think you need help. There's not much more I could have done bar giving them an avenue to support. So informed consent, again, it depends on what it is that you're doing. If you're doing an academic research study, you've got to explain everything. This is a consent form that Belen was using for her PhD, which goes into every single thing that the participant is giving consent to take part in. So I agree to take part in this interview. I understand this interview will be audio recorded and transcribed with any identifying information removed to protect my privacy. It goes on and on. It's a lot of information because the level of ethical behavior that academic research needs to attain is incredibly high. Here's a consent form that I've put together for, well, it's open source, for projects, for organizations, companies, and it asks very simple questions. Do you agree to the following information being collected? Notes, written notes, audio recording, video recording, photos? Yes, no. If the person says yes, great. If the person says no, no. Second part then is, so this is the information you're gathering and this is the usage of it. So do you agree to any recordings or photos? Who can view these? Just the researcher, the team, other people in the organization or general public all over the world. And the person says yes, no. At the end they sign and that's it. Keep it simple, not stupid, keep it very clear. Very clear. Here's what I'm asking you to do. No, no, no. Yeah, yeah, yeah, yeah. Sometimes you're doing research remotely and you can't visit the person and get them to give you their sign consent. So again, depending if it's acceptable or not, verbal informed consent. So here's again telephone consent form. If you're doing research over the phone, hello, my name is Bla. I'm a researcher from Bla. I'd like to talk to you and get some feedback on this thing. Will you speak to me today? Yes, no. I'd like to record the call. Okay, yes. The recording starts. You give the person a little bit more information. Okay, what we're going to talk about is blah, blah, blah. I'd like you to do blah, blah, blah. Or I'd like you to tell me blah, blah, blah. Again, could I ask you again, are you okay with me recording the interview? Yes, no. If it's yes, great, move on. If they say no, stop the recording. Very simple. The thing that people don't like about getting informed consent is it can be a lot of work for the researcher. That's tough. That's your job. That's your contribution. You want to do this contribution. This is how you do it. So do you give me permission to record this conversation, which will remain confidential and anonymous? Anonymity. So participants have the right to be anonymous. You don't have to give all their name, address, shoe size, you know, preferences in whatever. That can often be unimportant in the research. What you should do is give your participants a pseudonym. This can be something really boring, like participant three or Bobby or whatever. The important thing is that you know who this participant is. The pseudonym makes sense to you. When you're sharing the research, all you share is the pseudonym. Often people say, oh, well, you know, I'd like to follow up with that person myself. No, I will ask the person if they will follow up. If you have any questions, you ask me. It can look like you're being a sort of a gatekeeper. Well, sometimes you need to be. It depends on what it is you're researching. If it's a very sensitive, you know, if it's privacy software in a country where there's censorship, you know, the less people that know the details about the person, the better. Obscure the information that could identify your participant. You don't need to say Mary is a infosec security engineer working in whatever project. She's 25 years old and she lives in New York. That's more than likely irrelevant. Destroy your data in line with your research guidelines. I've got an example of some research guidelines later on that myself and Belend put together for SecureDrop. You're welcome to use them if they apply. So the person has the right to their identity and their location to be protected. So here's an example of some information from an interview that I did with a particular person working in a particular news organization who was working with SecureDrop. So participant three joined news organization three as information security engineer less than five years ago. I know exactly the time that they joined, but nobody needs to know that it was 25 months ago. Before that they worked in an e-commerce company. They worked for over 50 years.