Ethics and governance for internet‐based conservation science research

Internet‐based research is increasingly important for conservation science and has wide‐ranging applications and contexts, including culturomics, illegal wildlife trade, and citizen science. However, online research methods pose a range of ethical and legal challenges. Online data may be protected by copyright, database rights, or contract law. Privacy rights may also restrict the use and access of data, as well as ethical requirements from institutions. Online data have real‐world meaning, and the ethical treatment of individuals and communities must not be marginalized when conducting internet‐based research. As ethics frameworks originally developed for biomedical applications are inadequate for these methods, we propose that research activities involving the analysis of preexisting online data be treated analogous to offline social science methods, in particular, nondeceptive covert observation. By treating internet users and their data with respect and due consideration, conservationists can uphold the public trust needed to effectively address real‐world issues.

Ética y Gestión para la Investigación Científica de la Conservación Basada en Internet Resumen: La investigación basada en internet es cada vez más importante para las ciencias de la conservación, además de tener contextos y aplicaciones de gran alcance como el análisis de textos, el mercado ilegal de fauna y la ciencia ciudadana. Sin embargo, los métodos de investigación en línea representan una gama de retos éticos y legales pues los datos virtuales pueden estar protegidos por derechos de autor, derechos de base de datos o leyes contractuales. Además, los derechos de privacidad pueden restringir el uso y el acceso a los datos, así como también los requerimientos éticos impuestos por las instituciones. Los datos virtuales tienen valor en el mundo real y el tratamiento ético de los individuos y de las comunidades no se debe marginalizar cuando se realiza una investigación por internet. Ya que los marcos éticos desarrollados originalmente para aplicarse en temas biomédicos son inadecuados para estos métodos, proponemos que las actividades de investigación que involucran el análisis de los datos virtuales preexistentes sean tratadas como análogas a los métodos no virtuales de las ciencias sociales, especialmente la observación encubierta no engañosa. Si se trata a los usuarios del internet y a sus datos con respeto y la consideración debida, los conservacionistas pueden mantener la confianza pública necesaria para tratar efectivamente los asuntos del mundo real.

FIGURE 1
Example of an auction website in which automated collection methods can result in unexpected personal data collection, and published anonymized or nonpersonal data can be matched with online records for reidentification

INTRODUCTION
Internet-based research is increasingly being utilized in conservation science across many methodological contexts, including analyzing trends in public interest through site traffic and search engine usage (Soriano-Redondo et al. 2017;Fernández-Bellon & Kane 2019), studying online trade in wildlife products through manual searches or automated retrieval Sung & Fong 2018), studying behavior change (Doughty et al. 2020), conducting outreach and citizen science projects (Tulloch et al. 2013), and sharing databases and analytical tools online. Conservation culturomics, which analyzes trends in word usage over the Web (such as search engine queries of endangered species), is also emerging as a major field, requiring vast quantities of online data (Sutherland et al. 2018). Online research activities centered on collecting and sharing data relating to or created by individuals requires consideration of research ethics, intellectual property (including copyright and database rights), privacy rights, and data protection ( Figure 1) (Franzke et al. 2020). Ethical internet-based research is a particular challenge for conservationists operating in a normative, crisis discipline reliant on support from stakeholders and the wider public, as well as navigating potential social imbalances or mixed roles of the researcher in relation to study subjects (Bennett et al. 2017;Brittain et al. 2020).
Having a clear and explicit rationale behind online research activities from the start upholds public accountability and confidence when disseminating results (Zook et al. 2017;Monkman et al. 2018). The COVID-19 pandemic and resulting social distancing measures have also led to otherwise offline research activities, including interviews or surveys, being conducted online (Wardropper et al. 2021). This change in operations requires researchers to adapt their practices, ensuring their use of technology does not conflict with participants' ethical expectations.
We focused on the ethics and legal implications of online information access and collection and the appropriate dissemination and sharing of data and analytical results. We first examined the foundation of free and prior informed consent in biomedical ethics and considered its feasibility for internet research depending on how the data of interest is created. We argue that justifying research through definitions of privacy or the application of social norms is not appropriate in the absence of consent and instead argue that the collection of preexisting data should be facilitated through nondeceptive covert observation where possible (Spicker 2011) and remain relevant to the contexts in which the data are created (Nissenbaum 2010). Organizational codes of conduct and publication requirements should be updated to reflect ethical challenges specific to internet-based research for conservation science. Finally, we discuss legal challenges and risks to researchers in terms of intellectual property, contract law, privacy, and data protection. In addition to the topics we considered, researchers will need to assess the ethical implications of analytical methods used, such as the interpretation of machine learning tools and its role in predictions or decision-making (Wearn et al. 2019).
Long-term storage and data sharing are also becoming important elements in funding and publication requirements, and they have implications for how research is planned to account for the relevant consent or permissions needed and how data sets are constructed with privacy built in (Hart et al. 2016). For a multidisciplinary perspective, conservationists should refer to guidelines by the Association of Internet Researchers (AoIR) (Ess et al. 2002;Markham & Buchanan 2012;Franzke et al. 2020). This article does not constitute legal advice.

ETHICS AND CONTEXTUAL INTEGRITY IN INTERNET-BASED RESEARCH
Social science methods have become increasingly prominent in conservation with the understanding that anthropogenic biodiversity and habitat loss cannot be countered with a purely natural sciences focus (Bennett et al. 2017;Brittain et al. 2020). The ethical underpinnings of social research to meet conservation goals based on methods that preceded the internet, such as surveys and interviews, are largely guided by codes of conduct established in other disciplines; in turn, many of these are rooted in biomedical ethics (Ibbett & Brittain 2019). The Belmont Report summarizes these ethical standards as ideals of respect (preserving autonomy and protecting those with less autonomy), beneficence (minimizing harm, benefiting individuals and society), and justice (fairness) (National Commission for the Protection of Human Subjects of Biomedical and Behavioural Research 1979). These ideals are typically upheld through free and prior informed consent (FPIC) of research participants, the option for participants to withdraw during the study, the assurance of confidentiality or anonymity, and the validation of ethical review. Ethical approval is typically conducted once prior to the start of a study, and forms a more rigid, top-down regulatory approach that is necessary in medical or psychological experimentation. Methods suited to this ethical process have predetermined, specific variables and study subjects, unlike commonly used big data methods in internet research, such as pattern discovery over a broad range of attributes.
Internet-based research can be broadly categorized into 2 areas based on whether the original data of interest are created for the purpose of the research (e.g., respondents completing an online survey or answering interview questions created by the researcher) or whether the data are created by internet users for their own purposes (e.g., posting to an online traditional medicine forum, listing an exotic pet for sale, or sending a query on reintroduced species to a search engine). For the former, the use of internet-mediated communication with participants is analogous to offline methods that require FPIC. There have been increasing calls within conservation for a processoriented, reflective ethics approach to social science methods used in fieldwork requiring awareness of value conflicts, power dynamics, and cultural sensitivity (St John et al. 2016;Ibbett & Brittain 2019;Brittain et al. 2020). In addition to these recommendations, researchers must ensure their use of technology does not undermine ethical principles (e.g., assessing and disclosing the privacy and security risks of conducting surveys through third-party websites to participants and encrypting sensitive emails to maintain confidentiality [Franzke et al. 2020]).
For research involving the collection and analysis of preexisting online data, within legal constraints, the situation becomes more contentious. Even if researchers view this information as fair game by considering all accessible online data as authored works or activities consciously under public scrutiny, internet users' expectations of privacy often extend to publicly accessible data or information that is contractually accessible by third parties (Boyd & Crawford 2012). Furthermore, given the rapid growth of the online world and its encroachment into all aspects of many people's lives, nonparticipation in online activities can result in social exclusion, economic suppression, and limiting of health, governmental, and other administrative services (Nissenbaum 2011). As such, it is no longer appropriate to assume informed, noncoercive consent. However, FPIC is most often impractical for online research requiring large or complete data sets of preexisting information for meaningful analysis (particularly when studying illegal activity), and explicit opt-in or opt-out consent requests can be viewed as intrusive behavior (Ess et al. 2002, Spicker 2011. Given that public trust and cooperation are necessary for positive conservation intervention outcomes, being able to provide transparent, ethical reasoning for internet research methods is still important, even if the information used is freely available. The ideals on which FPIC is based--respect, beneficence, and justice--in research utilizing preexisting data are closely tied with peoples' notions of privacy and violations thereof. Privacy is beneficial to individuals and societies because it preserves autonomy and freedoms while shielding people from unjust treatment (Nissenbaum 2010). Despite its importance, however, assigning a strict universal definition to privacy in order to build an ethical framework is not straightforward. In short, it can hold a multitude of potentially contradictory meanings and is contextually dependent (Nissenbaum 2010). In attempting to circumvent the aforementioned issues in obtaining FPIC, the collection and analysis of preexisting data have been justified by definitions of public spaces as a negation of privacy rights or by downgrading peoples' online representations as digital subjects resulting in dehumanization through abstraction (Buchanan 2017). Regulatory approaches to privacy typically build on binary classifications of private and public spaces or sensitive and nonsensitive personal details, with corresponding restrictive or permissive approaches to the accessibility or use of information (Nissenbaum 2010). However, as illustrated above, these regulatory definitions do not necessarily align with users' expectations or principles.
Another viewpoint of conducting research that demonstrates respect, beneficence, and justice is the need to recognize and work within the contexts and boundaries of subjects' values and social norms. For other social science techniques employed in conservation, such as interviews, this is straightforward. The research is conducted within specific contexts with a limited number of participants, and the principles and study methods are explicitly agreed to through FPIC. The FPIC, in this sense, provides a mutually understood ethical contract between the researcher and research subject. However, for online research methods in which collected data may relate to anyone, anywhere, relying instead on universal norms as perceived and formulated by the researcher or discipline as a form of assumed consent becomes problematic. Even if the researchers believe their actions are justified, this could translate differently to others in a global context as paternalistic or have unforeseen consequences. In addition, the use of normative constructs (words or phrases that carry some implicit judgment or value) in decisionmaking processes for conservation has been criticized for lacking scientific or logical rigor (Yanco et al. 2019). This highlights the need to clearly define conservationists' underlying value assumptions when formulating a research plan as well as interventions. These complications become amplified as the proposed benefits can be focused on nonhuman species and may come at a cost to human groups, often separate from the researchers themselves (Ibbett & Brittain 2019; c.f. Newing & Perram 2019). Both of these instances (justifications based on definitions of privacy or universal application of perceived social norms) can lead to public disapproval and a setback in conservation efforts. Public trust is not guaranteed simply by following the minimum legal requirements or formulating abstract moral justifications from the researchers' perspective.
In response to public unease with technology replacing or altering the means by which social interaction, transactions, or the provision of services takes place, Nissenbaum's theory of contextual integrity (Nissenbaum 2010) argues that instead of attempting to define privacy and violations thereof, the flow of information should be described in terms of the contexts and subcontexts in which it operates (e.g., commerce and education), persons or entities involved (e.g., sellers and platforms), the nature of the information, and the principles by which it is transmitted (e.g., compulsory and confidential). If the new flow of information departs from entrenched norms specific to those contexts and has harmful implications to individuals, social structures or the functional purposes and goals of the context, then this is in violation of contextual integrity and should be avoided (Nissenbaum 2010). Although this theory is a useful means of conceptualizing research data in context, collecting and analyzing this for conservation is (unless, e.g., under the mandate of legal monitoring) not functionally relevant to the information flow taking place for the sender or intended recipients. How, then, can conservationists appropriately act within this ecosystem of data?

COVERT RESEARCH ETHICS
One approach to maintaining ethical integrity when research involves preexisting data could be to consider these activities as observations analogous to offline covert research methods in the social sciences. Spicker (2011) defines covert research as consisting of no or limited disclosure to research subjects, as opposed to being intrinsically linked with deceptive practices or avoidance of detection (e.g., Roulet et al. 2017). For example, studying publicly available information on exotic pets for sale online would be covert observation; the sellers are not explicitly informed that the data they upload are also being used for research (e.g., Sung & Fong 2018). However, if this information is in a closed social media group, use of which would require approval under a provided identity, posing as a potential buyer to gain access would be an act of deceptive covert research. Unless such exceptional practices are rigorously justified by carefully balancing competing principles (Spicker 2011), the researcher should make their purposes explicit to gatekeepers and participants (e.g., Hinsley et al. 2016).
Research in a public space could still be viewed as deceptive if the researcher knowingly exploits subjects' assumptions of their identity and purposes (Spicker 2011). We define public space in an online context as an abstract space consisting of data that can be physically accessed by anyone with the appropriate legal technological means and according to the sites' terms of service, rather than as the antithesis of a private space. Because justifications based on researchers' intentions may be questionable or unclear, Nissenbaum's (2010) theory of contextual integrity can help determine the appropriate flow and use of information within the resulting multiplicity of contexts, such as the platform, community, or activity, in which users engage. In this case, the appropriate flow of information ensures that data collection and processing remain applicable to the contexts in which the data have been created. In the above scenarios, a typical ecommerce website would be subject to legal conditions and the companies' terms of service for the appropriate sale of items. This limits the extent to which information can be reasonably collected and processed. For example, if studying online marketplaces that may host illegal wildlife trade, aggregating these data with sellers' social media profiles on a separate site would be ethically dubious, especially if one considers such a profile is a composite of personal information and that of uninvolved family and friends. However, comparing sale items with official import records (Sung & Fong 2018) would be contextually relevant and not obviously objectionable.
Complying with prevailing contextual norms is not equivalent to assuming consent. It can be argued that contextual integrity leads to a "tyranny of the normal," that is, a conservative framework with adherence to norms that reflect a majority of users at the potential expense of minority groups or individuals (Nissenbaum 2010, p. 160). Researchers should recognize and minimize potential harms to individuals and groups who may find the methods disagreeable without the researchers' knowledge. This includes deidentifying, anonymizing, summarizing, and minimizing collected data sets as soon as possible; evaluating the possible broader consequences of sharing research results and data other than intended conservation outcomes (Di Minin et al. 2021); and reevaluating the contexts in which researchers operate in light of their observations, including the exclusion of groups found to oppose the collection of data where reasonably possible.
A key difference between conservation science and many other research activities is that it is operating as a crisis discipline, and whether or not conservationists are acting in a proactive or reactive capacity, the observations they make online are not for passive understanding but for monitoring and intervention, which has implications for individuals' and communities' autonomy. Defining these research methods as covert observation recognizes that prior informed consent does not take place, and this burden of responsibility must be acknowledged even if the activity involved seems trivial to the researcher.
There is no single perspective or unifying framework in which to conduct online research without some consequence or risk. Online conservation research will frequently result in situations for which there is no single correct answer or ethical shortcut. Researchers may be tempted to cherry-pick abstract moral theories that suit their preferred methods, instead of critically reflecting on the real-world circumstances of their work (Macfarlane 2009). The AoIR recommends that through practical experience, familiarity with a range of ethical frameworks, and discussion with peers and stakeholders, researchers can develop sound judgment that reflects the flexibility required to adapt to novel research contexts (Franzke et al. 2020).

CONSERVATION RESEARCH IN COMMERCIAL CONTEXTS
Since the commercialization of the internet in the 1990s (Langford 2000) and the subsequent domination of commercial platforms on the World Wide Web, the data that researchers obtain from and about users are usually mediated by corporate entities with separate business interests that may conflict with those of users and conservationists (Toivonen et al. 2019). As such, the resulting information may be fragmented to protect commercial interests (Ladle et al. 2016); distorted by user expectations akin to an "informational panopticon," leading to self-censorship or editing (Nissenbaum 2010:75); or data may be molded for commercial use, limiting its meaning. Even if users would opt for services with greater privacy controls, the terms of service or other legal agreements they are subject to under the "duty to read" are often classified as unreadable to the average U.S. citizen (Benoliel & Becher 2019), reducing market competition and contributing to user disempowerment, particularly among vulnerable groups. Researchers should be aware of these contexts to better assess the exploitation of subjects involved.

PUBLICATION REQUIREMENTS FOR ETHICAL RESEARCH
Because social science methods preceding internet-based research have been utilized for conservation research, such as interviews, many journals and publishers in the field have enacted ethical requirements that are associated with biomedical research, such as the Helsinki declaration (WMA General Assembly 2001), or require approval from ethics committees (or their equivalent) that retain similar policies (Ibbett & Brittain 2019). Ibbett and Brittain (2019) report that, in the context of wildlife hunting, although there is an upward trend in reporting human subject ethical considerations in conservation publications, there is a disparity between journal requirements and their implementation. St. John et al. (2016) recommend that the American Anthropological Association (AAA) Code of Ethics (2012) is more suitable for individualized human subject inter-action, although how applicable this is to research based on subjects' preexisting online data is uncertain. In its 2012 revision, the AAA's Principles of Professional Responsibility state that research without prior or retroactive informed consent should be avoided (see also the Society for Conservation Biology [2004]), suggesting an opposition to a significant portion of online research methods for large-scale, publicly accessible data. Although analysis of anonymized data would not require individuals' consent according to these guidelines, seemingly innocuous online data can frequently be aggregated with other resources for the reidentification of individuals on a scale and level of detail that surpasses offline research (Tavani & Grodzinsky 2019). Instead of interpreting guidelines from other disciplines, updated ethical requirements from publishers specific to the challenges of conservation research and online research methods could contribute to more cohesive ethical practices and reporting. This would be especially valuable to conservationists who do not have access to external validation mechanisms, such as ethical review boards (Ibbett & Brittain 2019).

COMPLIANCE AND LEGAL RISKS IN ONLINE RESEARCH
Unlike most offline research activities, data collected via the Web are typically owned by companies or individuals, with corresponding legal protections, and transmitted by commercial entities. In addition to maintaining ethical integrity, conservationists' online research activities must also navigate these areas of compliance and assess the risks where legal uncertainty arises. Compliance with the law is a first indicator to the public as to whether researchers are acting ethically and is especially relevant if conservationists seek to influence legislation through their results.
Legal compliance in internet-based research is generally centered on copyright, privacy, and data protection. Copyright protection is broadly recognized internationally, but implementation and exceptions vary among countries (World Intellectual Property Organization 1979;World Trade Organization 1994). Privacy rights and data protection are more varied and largely dictated by preexisting social norms (Spinello 2017).

INTELLECTUAL PROPERTY AND COPYRIGHT
Digital media, whether created by individuals or companies, is automatically protected under international copyright laws, which confer economic (financial reward) and moral (personal credit and reputation) rights to the work's owner (World Intellectual Property Organization 1979). These protections are still relevant to media published online, including images, text, audio, code, and compilations of data (World Trade Organization 1994;Ricketson 2003). Some countries and territories, such as within the EU, also confer database (sui generis) rights, which may include social media and auction sites' data structures (European Commission 2015).
Exceptions to copyright enable the copying and sharing of works without authorization, within a defined scope, and for public benefit, including nonprofit research activities. Such exceptions are especially important in large-scale studies, where the ability to credit and gain permissions from content creators becomes impractical. Although international agreements, such as the Berne Convention (World Intellectual Property Organization 1979) and the TRIPS agreement (World Trade Organization 1994 section 1 article 10), set out broad definitions of works protected by copyright and exclusive rights for authors and producers, the interpretation and implementation of copyright and its exceptions are defined by individual nation states.
Text and data mining (TDM) exceptions, with varying requirements, have been gaining traction in the Global North for noncommercial research. For example, the United Kingdom has had a TDM exception since 2014 (UK Public General Acts 1988) that requires a "sufficient acknowledgment" of the author or copyright owner, whereas the EU Digital Single Market Directive, to be implemented by member states within 2 years of approval, specifies that mandatory TDM exceptions will apply to research organizations whose activity is structurally noncommercial and in the public interest (i.e., the output is not subject to "preferential access" and does not "conflict with the normal exploitation of the works"); there are some provisions for public-private partnerships and commercial use (European Parliament & Council of the European Union 2019). In the United States, TDM exceptions are not explicitly defined and may fall under "fair use" on a case-by-case basis (Copyright Law of the United States [Title 17] 1976). Exceptions to TDM have been further extended to commercial activities in several instances, potentially enabling joint conservation research with the private sector. For example, Japan has had broad TDM exceptions to copyright since 2009 (Oyama et al. (Translation) 1970), and Singapore is expanding TDM exceptions with analytical requirements (Singapore Ministry of Law & Intellectual Property Office of Singapore 2019). In all cases, the researcher must have the legal means to access the works in question, and international or public-private collaborations should have the appropriate regional rights to copy, distribute, or analyze data. Although TDM exceptions are gaining traction internationally, intellectual property law is often more restrictive in developing countries (Okediji 2019), and the current variations with which they are implemented or interpreted in a global context make such exceptions difficult to solely rely on when conducting research.
Even if intellectual property rights challenges can be overcome, data access may be restricted by contract law or technical measures. For example, if a researcher intends to scrape data from an online auction site, their lawful access will be subject to the service's terms and conditions, regardless of whether registration is required. The terms of service are a binding legal contract between the user and service, but are rarely written to accommodate academic researchers, normally assuming that a consumer or rival commercial organization is accessing the platform. The permissions and prohibitions set out in these terms, therefore, require interpretation, potentially introducing uncertainty over and above intellectual property concerns.
Access to data may also be restricted through technical measures, such as digital rights management software. Legislation, including the Digital Millennium Copyright Act (DMCA) in the United States, and article 6 of the 2001 Information Society Directive in the EU (European Parliament & Council of the European Union 2001) prevent circumvention of technical measures such that even if a research exception to copyright applies, bypassing these measures is legally ambiguous or practically difficult (Liu 2003;Spinello 2017). Given the legal uncertainties and regional variations presented by intellectual property and contract law, researchers should seek expert advice where possible.

PRIVACY AND DATA PROTECTION
In contrast to somewhat harmonized approaches to copyright, there is much greater regional variation in approaches to privacy and data protection, which are driven by preexisting social norms. As a starting point, the U.S. Department for Health and Human Services maintains an international compilation of laws governing human research (Office for Human Research Protections 2020). The United States and European Union provide an example of how stark these contrasts in legislation can be. Privacy in U.S. legislature is highly fragmented and focuses on privacy from the state, with the assumption that market selfregulation will ensure that users migrate to services that treat their data appropriately (Benoliel & Becher 2019). Dealing with data in this context requires knowledge of specific legislation related to the researchers' methods, data, and region of interest due to additional variability in data-processing requirements between states. In the EU, privacy is regarded as a distinct human right; the General Data Protection Regulation (GDPR) imposes stringent requirements for organizations storing, processing, or sharing citizens' data, with interpretation at the state level and extraterritorial applicability (European Parliament & Council of the European Union 2016; Spinello 2017). These requirements apply to both preexisting online data collection and citizen science projects. Ensuring ethical practices may require going beyond basic legal requirements to ensure fairness, for example, by implementing the same privacy protections for participants in a research study regardless of nationality.
In our brief outline of intellectual property, privacy, and data protection laws, it becomes clear that the aims, methods, analyses, and sharing of data, along with their respective legal implications, must be considered throughout the research process. This may include input from organizational copyright and IP specialists, data protection officers, and independent legal advice when necessary.

CONCLUSIONS
Conservation scientists are using internet-based research methods for a wide range of purposes, from culturomics to studying the online wildlife trade (Sutherland et al. 2018). Such methods are becoming increasingly relevant to conservation as new applications continue to emerge. To benefit from these methods, ethical and legal considerations (e.g., privacy; appropriate ethical treatment of internet users; intellectual property and data protection requirements; and challenges particular to conservation research) of using online data must be evaluated.
Free and prior informed consent is often impractical when collecting users' preexisting online data for research. Despite this, it is important to recognize the ethical implications of these activities as research involving human subjects. By treating these online methods as analogous to offline covert research methods, in particular nondeceptive covert observation wherever possible (Spicker 2011), these activities can be assessed honestly, on a case-by-case basis, as a balance of competing principles within the contexts they operate. Consent cannot be assumed on the part of individuals regardless of social norms that represent the views of a majority in such contexts (Nissenbaum 2010: 160;Markham & Buchanan 2012). Potential resulting harms should be minimized regardless of data anonymization, bearing in mind that innocuous combinations of users' nonpersonal information (e.g., details of online wildlife sales associated with a user) can still lead to reidentification when publishing results or sharing datasets. Researchers should avoid treating ethics as an administrative checklist because being unfamiliar with the underlying reasoning or decision-making processes for ethical research practice can leave them unprepared for novel situations (Geller et al. 2010).
Without awareness of the scope of copyright and contract law in their region, researchers could breach these laws from the use of online images, text, or audio. Separate database rights can also be extended to online structured data including e-commerce sites and social media. Conservationists should be aware that noncompliance with copyright and contract law can lead to personal and organizational legal risk, as well as potentially damaging public relations if they act illegally.
By carefully considering the ethical treatment of internet users, in addition to complying with regulations, conservation scientists can uphold the public trust needed for successful intervention outcomes to pressing issues.