13

There are many situations in academia where an entity is entrusted with confidential data belonging to a researcher. A very obvious one is the publication process: the journals are required to keep submitted papers confidential until they are published. But there are also other situations. For example, biologists can submit newly discovered nucleotide sequences to the EMBL database, and they have the option to request the new sequences to be kept confidential until publication. I guess that other disciplines can have similar arrangements.

In these cases, the entity has the responsibility of keeping the data confidential, and a leak can have highly negative consequences for the scientist who entrusted them with their not-yet-published results.

My question is: are there known cases of such leaks? I don't mean just a reviewer mentioning to his colleagues "I have a very interesting paper by X, if the results are confirmed, we may be looking at a cure for [type of cancer]" without further details. I mean high-profile cases where an institution or its employee is more or less "officially" accused of either willful wrongdoing, or of insufficient protection of the information so that e.g. a database was hacked and the information read out.

If there are such cases, what happened? How were they discovered, and what were the consequences for the scientist whose data was made public, and for the institution which should have kept it secret?

  • Another possibility: a researcher may be using confidential data that is leaked. (For instance, forecasters often work with companies' sales data, who would be very unhappy if these data were to appear on public servers.) – Stephan Kolassa Dec 10 '14 at 12:58
  • I'm not sure how factual it is, but I've always been told, even from high school biology classes, that Wilkins "leaked" Rosalind Franklin's data to Watson and Crick. – Tyler Dec 12 '14 at 11:56
3

Academic publications are sometimes subject to an embargo, in which information about the publication is shared with the media, but they are restricted from publishing a news article using this information before a certain date.

In this context, leaks are not uncommon. Sometimes the author of the paper is responsible for the leak; on other occasions, the publisher or a news agency may be responsible.

Here are two examples in which the Associated Press broke an embargo:

In both of these cases, there were no serious consequences for anybody involved.

In a case that did involve consequences, a researcher published a paper using data that was made available through the NIH, but was subject to a data embargo. The paper was retracted (see the story on RetractionWatch), and the researcher's access to the shared data was suspended:

Upon learning of the violation, the investigator’s access to dbGaP [database of Genotypes and Phenotypes] was immediately suspended pending an investigation by the NIH Data Access Committee with responsibility for the dataset involved and a review by the GWAS Senior Oversight Committee (SOC). Information pertaining to the incident was requested from the investigator’s home institution through the Institutional Signing Official that approved the investigator’s original request to the NIH. After a thorough review of the circumstances pertaining to the violation, the SOC revoked access to all dbGaP data for a period of six months.

All work with data downloaded before the date of the access suspension was expected to cease during the ban. This ban included the Primary Investigator as well as those individuals working with the individual-level GWAS data under his Data Access Request, because they also agreed to abide by the terms and conditions for data use within the Data Use Certification agreement. The period of the ban passed on March 4, 2010, and Dr. Zhang may now submit new requests for access to dbGaP data.

Another data leak scenario was mentioned by Stephan Kolassa in a comment: when a researcher uses private data that is leaked. Here is an example of a case where

the world's largest futures exchange has accused the top U.S. derivatives regulator of illegally sharing sensitive market data with outside researchers who then used the information to publish academic papers about high-frequency trading

Possibly the most high-profile case of data leakage in the very recent past is Climategate, but that turned out to be more of a "hack" than a leak by someone who had legitimate access to the data. In 2009, a server at the University of East Anglia (UEA) was compromised, and material was leaked including more than 1,000 emails, 2,000 documents, and source code, pertaining to climate change research. Many of the emails concerned technical aspects of climate research, such as data analysis. In this case, climate change skeptics argued that the leaked materials showed that scientists engaged in a conspiracy to manipulate climate data. However, various investigative committees reported no evidence of fraud or scientific misconduct on the part of the scientists.

The individuals responsible for the breach were not identified. Police said said, however, that despite rumors to the contrary, the attack had been carried out "remotely via the internet" and that there was "no evidence to suggest that anyone working at or associated with the University of East Anglia was involved in the crime."

  • For a thorough catalogue of such embargo breaks, with regular updates, see Embargo Watch. – E.P. Aug 7 '15 at 15:01
2

This is a little bit different than your question, but I think fits the spirit: there have been a number of high-profile cases of scientists being held in a position of trust and being accused of leaking confidential information. Two notorious such cases in the United States:

  • Phil Zimmerman was accused of leaking his PGP encryption algorithm, which at that time (1991) was considered illegal to export from the United States. He has claimed that the initial dissemination was accidental, which might or might not be credible, given the early stage of development of the internet. Once he was formally accused and facing potential jail time, he published the source code in a book, turning it into a question of free speech.

  • Ted Postol has claimed that various US anti-missile systems do not perform as claimed, leading, among other things to several misconduct investigations against a number of other researchers and also Postol himself. Notably, Postol ended up being accused of violating confidentiality rules with regard to other researchers. He has never formally been sanctioned, but remains a center of controversy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.