History
Helped Rimm and Sirbu spy on users
Helped Rimm and Sirbu access confidential data
Hyped the "Carnegie Mellon Study"
Refused to release names of trustees
Hosed Marty Rimm: The Investigation
Marty Rimm transferred to Carnegie Mellon University in August 1993. The next semester, he approached the provost's office and asked them to pay for a research project focusing on adult BBS pornography. Barbara Lazarus, the associate provost, was in charge of allocating grants through the Small Undergraduate Research Grant (SURG) program.
Lazarus saw Rimm's research as a flagship project that would increase the visibility of the SURG program; she likely brought her husband, Professor Marvin Sirbu, on board as Rimm's advisor. Lazarus was the first administrator to realize the value of Rimm's study for her purposes.
Rimm and Sirbu were a perfect match. Rimm was a star student in the Electrical and Computer Engineering program, doing exceptionally well in the department's most challenging courses. Then 30 years old, he was an older student who had successfully completed a stint in the U.S. Army and was excelling in graduate-level ECE courses in broadband communications. Sirbu was chair of the well-funded Information Networking Institute, and was a senior professor with joint appointments in three departments. His specialities, as listed in CMU's Research Directory, were:
"Telecommunications technology, policy, and management, regulation and industrial structure; communications networks and standards."
His advisor's fields of interest may have led Rimm to focus more on the Internet and Usenet. Or perhaps Rimm realized that the Internet craze was starting. Whatever the reason, Rimm broadened the scope of his research to include pornography on the Internet that was distributed through Usenet newsgroups.
At the time, Bill Arms was in charge of CMU's flagship Andrew computer system. As the vice president for computing services, Arms had a long and dubious history of trying to remove pornographic images from CMU's Usenet netnews servers. One failed attempt brought him before the CMU's human relations commission in the 1993-1994 school year, where he claimed the pictures were degrading to women. Arms apparently learned about Rimm's research in June 1994, when Rimm's unusual request for 300 MB of project volume storage space for pornographic images crossed his desk. Arms was the second administrator to recognize the value of Rimm's study for his own purposes. He realized that if he wanted to argue his anti-pornography case before academicians, research showing the extent and content of network pornography would be a useful exhibit.
Erwin Steinberg was the vice provost for education at CMU. Reporting to him was the associate provost, Barbara Lazarus, who authorized $2,000 for Rimm's project. It is conceivable, though unlikely, that Steinberg knew nothing about Rimm's project at the time the four grants were awarded in early 1994.
Rimm continued working on his project through the summer, downloading at least 10,000 images from adult BBSs along with roughly a million image descriptions. By the end of the summer, he had amassed formidable amounts of data and images, some of which he learned were not just pornographic, but obscene.
Pennsylvania law defines obscene material as that which:
(1) the average person applying contemporary community standards would find that the subject matter taken as a whole appeals to the prurient interest;(2) the subject matter depicts or describes in a patently offensive way, sexual conduct of a type described in this section; and
(3) the subject matter, taken as a whole, lacks serious literary, artistic, political, educational or scientific value.
In practice, text is not obscene, but images of bestiality and sadomasochistic activities are -- and distributing obscene material is illegal under state law. One California adult BBS operator from whom Rimm acquired images had been convicted of violating obscenity laws in Tennessee. Rimm says he saw the same salacious images on the the alt.binaries.pictures.erotica.* Usenet newsgroups to which CMU subscribed. He claims he concluded this meant that CMU administrators could also face jail terms.
Rimm's next move was to tell this to CMU President Robert Mehrabian. He sent the mail around 4 am.
By 8 am, the normally sluggish CMU bureaucracy had shifted into emergency damage control mode. The high-level team assembled to defuse the situation included Don Hale, vice president for university relations, Paul Christiano, provost, Bill Arms, vice president for computing services, Erwin Steinberg, vice provost, legal counsel, and Rimm's advisors, Marvin Sirbu and statistics professor David Banks.
Arms, the only administrator with any technical knowledge, was given the task of investigating Rimm's findings and recommending a course of action. Over the next few weeks, he looked through the newsgroups "with the law in one hand and a mouse in the other." Any discussion groups that offended his refined British sensibilities he put on the list to ban. The final list included approximately 80 newsgroups -- any discussion fora that had the word "sex" or "erotica" in their titles.
Around the same time, on September 22, 1994, Arms submitted his resignation to Mehrabian, effective at the end of the semester. He had been forced to resign or be terminated involuntarily at the end of the year by a high-level outside review board brought in to review the state of computing at CMU.
On September 27, 1994, Sirbu sent mail to some of the members of the damage-control team, including Steinberg and Hale. Sirbu's mail stressed that Rimm's work was "a ground-breaking study" that would make "an important scholarly contribution." Sirbu predicted great press interest -- and academic interest from everyone from Jerry Falwell to Andrea Dworkin. He also said that Rimm wanted to publicize his study before "applying to graduate schools this fall."
Next month, at the president's behest, Arms met with a group of college deans and provosts called the Academic Council. Arms informed them, in a meeting closed to the public, that the university had learned from Rimm that it was breaking the law and that removing certain newsgroups was imperative. Absent from the meeting were key administrators who might have questioned the urgency of this action, including Charles Lowry, the head of the library system.
Scared by Arms' claims of criminal liability and assertions that he could be imprisoned over the contents of Usenet, the Academic Council allowed him to yank the newsgroups.
Afterwards, with the Academic Council's apparent -- although misguided -- blessing, Arms drafted a highly restrictive policy that eliminated all newsgroups with the word "sex" or "erotica" in their titles. (Academic Council members later distanced themselves from the decision, saying in one case: "We were snookered.")
The new policy was announced on November 3, 1994. The campus outcry was quick and furious. Students, faculty, and staff met with the president to demand changes. Students organized a rally that drew national attention, from the Associated Press, The Washington Post, ABC Radio, and TIME Magazine. A petition started circulating.
The university was unprepared. Arms, who was orchestrating the policy change, was out of town at a conference, and as the new point person, Steinberg was not competent to discuss the policy's technical details, and so relied on the authority of Rimm's research as a defense. Mehrabian had believed that criticism over what he viewed as a internal policy change would be mild and largely would be confined to the campus community. Even an internal memo instructing CMU employees not to speak with the press focused on campus media outlets:
"If anyone from the press (The Tarten, WRCT, Post-Gazette, etc) contacts you, do NOT talk to them. Instead, feel free to give my name and number..." [Internal Memo issued by Computing Services Supervisor Robert Kuszewski on November 3, 1994]
Many administrators who learned the details of Rimm's study found something in it for themselves. Lazarus saw a way to promote the SURG program. Sirbu saw a way, according to Boardwatch Magazine, to help his corporate sponsors. Arms saw a way to justify to the Academic Council a ban on pornography. Steinberg saw a way to solidify the university's increasingly tenuous censorship arguments. Soon afterwards, anti-porn groups also would see something to gain though Rimm's study and would work with him to mold it into a form that would advance their agenda, too. This time, the study would make it to the U.S. Congress.
Marvin Sirbu, Rimm's advisor, was the person who suggested that Rimm spy on the Usenet readership habits of thousands of members of the Carnegie Mellon University community.
Taking his advisor up on the suggestion, Rimm obtained records of Usenet newsgroup readership and demographic information for thousands of members of the Carnegie Mellon University campus community. Although Rimm did not publish the demographic data, he acquired them without the permission of his other subjects. He also violated the APA ethics code by not supplying a copy of his study to each of his subjects. When first questioned about this practice, Sirbu and Rimm grew defensive, saying if it wasn't illegal, they could and would do it. This ethical split led one member of the "research team," statistics professor David Banks, to withdraw from the project in late 1994.
The SURG undergraduate research policy requires that all students involved in human subjects research submit details of their research to the provost's office for approval:
Whether you are funded by SURG or not, if you will be working with human subjects during the course of your research, you must meet certain guidelines. This applies to students as well as faculty in all departments and may include surveys, data collection, interviews, and product trials on human subjects.
Assuming Rimm and Sirbu followed this policy, they submitted their research proposal to the provost's office and the provost approved it. But was it ethical?
An article in the New York Times said:
"In November, the author of the report and his faculty adviser secretly captured private computer records from the personal directories of 3,000 computer users at Carnegie Mellon to determine what bulletin boards on the Usenet the users were frequenting."However, Carnegie Mellon University's own policies say:
"All files belong to somebody. They should be assumed to be private and confidential unless the owner has explicitly made them available to others... Failure to observe [this] may lead to disciplinary action."
"The user must presume that the contents of any other user's directory are his or her private property just as one would presume that the contents of someone's apartment or office are personal... Improper behavior in the use of computers is punishable under the general university policies and regulations regarding faculty, students and staff... For students in particular, the range of penalties available includes reprimands, loss of computing privileges, course failures, disciplinary probation, suspension or dismissal from the university and/or criminal prosecution."
Rimm and Sirbu's surreptitious recording of the reading habits of Andrew users -- authorized by the provost's office -- violates multiple published policies of the university. It also represents a gross abdication of their own responsibilities as researchers to obtain informed consent of their subjects before involving them in a research project.
Carnegie Mellon University apparently violated its own policies and Federal law by giving Rimm and Sirbu access to confidential employment and enrollment data. The university's policy on the security and confidentiality of administrative data states:
"Requests for access to information for multiple divisions or university-wide must be signed by the provost or appropriate vice president. Authorization is to be granted to employees who have job responsibilities requiring the information requested... Any university employee, student or non-university individual with access to administrative data who engages in unauthorized use, disclosure, alteration or destruction of data in violation of this policy will be subject to appropriate disciplinary action, including possible dismissal and/or legal action."
Rimm claims in Footnote 40 of his study that he obtained "detailed" data on CMU users including sex, nationality, age, and marital status. That information is not publicly available, so a senior administrator authorized access to the data. Unless Rimm lied, this policy implies that the provost or a vice president helped him. Since the provost's office signed off on Rimm's research methods, the provost, Paul Christiano, likely was the administrator who authorized CMU to release confidential data to Rimm and Sirbu.
Footnote 40 does not indicate whether Rimm's "detailed" data collection was restricted to students or included the entire Carnegie Mellon campus community. The Legal Deskbook for Administrators of Independent Colleges and Universities (2nd ed, last updated 1993) discusses the implications of CMU's actions in both cases. On disclosing information on faculty and staff, the deskbook states:
Prohibition of Disclosure to Third Parties
The personnel records policy should contain a general prohibition of disclosure to third parties... without the express written consent of the employee, describing specifically the records to be disclosed and the persons to whom they are to be disclosed. Records disclosed to third parties... should be accompanied by notification (usually stamped on the documents) that the disclosure is made only on the condition that the third party shall not make any redisclosure of the information without the employee's written consent.
The deskbook says the following about disclosing student information:
Statute, Purpose, Basic Provisions
The Family Educational Rights and Privacy Act of 1974 (FERPA), commonly known as the "Buckley Amendment," seeks to ensure the privacy of the educational records of students through elaborate procedural guarantees. The Act applies to all institutions that are the recipients of federal funding. Noncompliance can result in withdrawal of federal funds...Enforcement
The Family Educational Rights and Privacy Act is enforced by the Department of Education through its FERPA office in Washington, DC. Complaints are received and reviewed by this office and those that are not resolved are forwarded to a review board which can recommend sanctions to the Secretary, including a withdrawal of federal funds.Directory Information
Certain information, known as directory information, may be disclosed by an institution without violating the Buckley Amendment. "Directory information" generally includes a student's name, address, telephone number, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and other similar information. Each institution is permitted to identify which information -- from the above categories -- will be released as "directory information" and which information remains protected against release to third parties, even though it falls under the definition of "directory information."
FERPA allows for a limited category of data designated "directory information" to be revealed. CMU's policies define directory information to be:
Disclosure of Directory Information
Carnegie Mellon University has designated directory information to be:
1. Student's full name, campus or local address, local telephone number, class, department, college of enrollment, dates of attendance, date(s) of graduation, degree(s) awarded.
2. For those students participating in intercollegiate athletic events, personally identifiable information included as directory information is the sport of participation, height and weight.
Neither CMU's own policies nor federal law allow "age, sex, nationality, and marital status" to be disclosed. No staff or faculty employees authorized CMU to give Rimm and Sirbu access to their confidential employment data. No students authorized CMU to give Rimm and Sirbu access to their confidential enrollment data. By divulging this data to Rimm -- according to his footnote -- CMU violated its own policies and Federal law.
It is difficult to determine the extent of this abuse of trust on the part of the university administration. CMU administrators are reticent to comment on their own conduct, citing the fact that the study is being investigated internally.
But the virtues of any administrators participating in this unethical conduct are suspect. CMU has a responsibility to members of its community to follow its own policies and Federal law. It may exercise its right to change the law through persuasion or petition. It may even, in rare occasions, prioritize other values by deciding to engage in civil disobedience and disobeying the law -- but such decisions must be made in an open manner allowing the maximum of community involvement. There is no excuse for CMU's demonstrably unethical conduct. The culprits should not be hidden behind an already-broken shield of confidentiality.
Carnegie Mellon University hyped Marty Rimm's paper as the "Carnegie Mellon Study," even though it was written by a sole undergraduate and received no outside funding. By doing this, CMU participated in the deception perpetrated by TIME, Rimm, and Sirbu -- that Rimm was more than an undergraduate student working on a senior thesis.
CMU's vice president for university relations is Don Hale, also the school's official spokesperson. Hale called Rimm's study the "Carnegie Mellon" study repeatedly, both to journalists and academics from other universities. Other university officials, including Erwin Steinberg, vice provost, and Kyle Fisher-Morabito, assistant vice president for university relations, did as well. Carnegie Mellon's PR office issued a news release naming Rimm's work "the Carnegie Mellon study." Carnegie Mellon even announced that free copies of the reprint from the Georgetown Law Journal would be available from the University Relations office.
TIME and ABC's Nightline organized a secrecy deal with the Georgetown Law Journal and Rimm that gave the media outlets advance copies of the study -- on the condition they embargo the study until the TIME issue hit the streets. This unethical backroom deal prevented TIME from verifying the validity of the study.
CMU participated in this TIME/Nightline/law journal secrecy deal, at least to some extent. The vice provost, Erwin Steinberg, and Rimm appeared in a pre-taped segment on the Nightline episode that aired June 27, 1995. Not only did Steinberg neglect to raise any ethical questions about the study, he used his exposure to a national television audience to validate Rimm's work. Specifically, Steinberg defended what he had been justifying for eight months -- the university's decision to ban sex-related discussions and images, a move that was sparked by Rimm's research.
CMU also helped Rimm by giving him office space and access to a computer, photocopiers, telephones, and fax machines in the University Relations office. (One of Rimm's friends afterwards said the administration did it to "keep an eye on him.")
Why did CMU devote so many resources to helping an undergraduate? Like Lazarus, Sirbu, Steinberg, Arms, and the anti-porn groups, high-level administrators at CMU saw something for themselves in Rimm's study. They decided that it had brought them positive press before. In November 1994, when CMU's Usenet censorship sparked a firestorm of media protest, free-speech groups and savvy cybernauts denounced CMU's actions, but the university rode a groundswell of support in the Pittsburgh community. The Pittsburgh Post-Gazette editorialized in favor of CMU's position. Conservative members of the community voiced their support. National anti-pornography groups weighed in with their opinions -- the same groups that later worked with Rimm to refine his paper to promote their aims. Steinberg even went to academic conferences to advance the administration's point of view.
Because of the generally positive press coverage Rimm's study provided CMU in the fall of 1994, CMU believed it would be even more beneficial when published in the prestigious Georgetown Law Journal and featured on the cover of TIME. They were proven wrong.
Apparently the names of the trustees of Carnegie Mellon University aren't always public.
The Associated Press' Aaron Dickey reported on July 15, 1995, in a post to Usenet:
CMU's PR office is now refusing to release the list of who serves on. CMU Board of Trustees. This is public information, and is published in CMU's own catalogs. As such, the only possible reason they've privatized it is to slow down reporters. The PR office admitted it was publically-available, and refused to give a reason why they wouldn't provide it. When asked when this new policy was instituted, no answer was given.CMU has apparently issued a university-wide coverup order. The simplest question about any aspect of the school's research system now results in the caller being transferred from office to office, and all information is suddenly "unavailable".
When reporters asking for the list called the office of CMU's president, Robert Mehrabian, the person answering the phone said she didn't know if she had permission to release that information.
CMU's Board of Trustees membership is public information. It's published in the Annual Report, which also is public record. According to the Student Handbook, CMU is "a private university incorporated under the laws of the Commonwealth of Pennsylvania," which would mean the names of its officers and trustees are also public information.
For CMU to stonewall on releasing publicly-available information is petty. It also stands as diametrically opposed to the core values of a university, which should be to promote openness -- not to restrict the free flow of information. Furthermore, the university relations office has a responsibility to the public, including journalists, of making publicly-available information about the university accessible within a reasonable period of time.
The example of the Board of Trustees membership is illustrative, not only to highlight an apparent ethical violation, but to demonstrate the amount of pressure CMU was under in July 1995. Major media outlets, including the New York Times, were investigating ethical violations. Academics at other universities were asking questions. Even its own faculty members were trying to distance themselves from the study -- Jim Morris, the head of the CMU computer science department, had drafted a letter to the ACM underscoring the department's lack of involvement in Rimm and Sirbu's research.
After Prof. Jim Thomas wrote a blistering criticism of the ethics involved in the "Carnegie Mellon Study," CMU announced it was forming a committee of inquiry to investigate potential ethical violations. In August, the provost announced the formation of a subsequent committee that would investigate the charges formally. As of January 1996, the provost has not announced the outcome of the charges. Unsubstantiated reports say the committee will not punish Rimm, and has not contacted him since August 1995.
Of course, the provost was the same administrator whose office had to have approved Rimm's unethical human subjects research methods.
From the wording of their announcement of the investigation committees, one might think that the central administration had never even heard of Rimm's study before -- that they had suddenly learned in July 1995 about their undergraduate's suspicious research. However, that's not the case. Their latest damage-control stance is the opposite of their initial position, when they rushed to embrace Rimm and his pornography study in a manner that was almost obscene in itself.
Even though administrators may not have read the final study, everyone in Warner Hall knew the details of Rimm's research: the vice-provost, members of the Academic Council, the provost, and the president. Rimm and Sirbu spent hours in meetings with CMU administrators, describing what they had learned and how they had learned it. Email from Sirbu dated September 27, 1994 and addressed to Rimm, Hale, Steinberg, and Dean of Student Affairs Michael Murphy, shows how close many Warner Hall administrators were to the study, half a year before it was featured in TIME:
I have been meeting regularly with Martin since last Spring, and believe that he is nearing completion on a ground-breaking study that makes an important scholarly contribution. He has developed some very interesting methodological approaches, and has amassed a remarkable database of information on his chosen subject matter. As Martin and I have discussed, there is still much to do in interpreting the data. [...]I might not have chosen myself to raise these issues via a message directly to the President, but sooner or later this study will come out and I suspect there will be significant interest among the press. It is certainly appropriate that CMU be prepared. Martin and I both concur that the way the research is publicized should be handled with great care, but I know that he is anxious, after working on this for more than a year, to get something out before he starts applying to graduate schools this fall.
Only in July 1995, after rampant ethics violations were publicized, did CMU try frantically to distance themselves from Rimm. It would not be easy. In a public post in November 1994, Rimm wrote:
