Ethics Board#

Universities and research institutes worldwide often maintain ethics boards (in the US known as institutional review boards) that review research projects to ensure they meet ethical standards. Researchers may need to obtain approval from such a board before starting their work, particularly when human participants are involved. The following sections outline how these boards operate and highlight country-specific differences.

The process for these boards often starts with a checklist to fill about the current project plus a project proposal. Then a board member reviews the proposal. They then give feedback, request further information or changes to the project.

General problems exist with these boards such as they are often only responsible for human factors research. As they are traditionally designed for human factors research, they also often miss the technical expertise to assess security and privacy projects. This leads to the result that projects might be approved that later by a more technical aware REC are questioned. This is why you should not only trust on the ethics board approval but consider about the ethics of your work beyond the institutional compliance.

General Process#

While procedures differ across institutions, the review process usually follows a similar pattern. Researchers begin by submitting a proposal that describes the project’s goals, funding sources, methodology, and potential risks. This submission is often combined with a checklist addressing ethical concerns.

After submission, one or more board members review the proposal. Based on this evaluation, they may approve the project directly, request revisions, or ask for additional clarification. In some cases, approval is conditional on specific changes being implemented. For longer or updated projects, follow-up requests may also be required.

Limitations#

Ethics boards are an important safeguard, but they are not a complete solution. Many of these boards were originally designed for biomedical or psychological research (following World War II) and therefore focus primarily on risks to human participants. As a result, they may be less well equipped to assess projects in technical fields such as computer security and privacy.

A common issue is the lack of specialized technical expertise needed to evaluate modern research practices, such as large-scale data collection, analysis of live systems, or vulnerability analysis. This can lead to situations where a project is formally approved but later questioned by more technically informed reviewers or research ethics communities.

Another limitation lies in the underlying goals of different types of review boards. In the United States, Institutional Review Boards (IRBs) often operate with a strong emphasis on regulatory and legal compliance, as well as protecting the institution from liability, an aspect already reflected in the term institutional. In contrast, Ethics Review Boards (ERBs), as commonly referred to in other countries, tend to frame their role more explicitly around ethical reflection and the broader societal implications of research. While this distinction is not absolute, it can influence how reviews are conducted and what aspects receive the most attention.

Additionally, standards and expectations can vary significantly between institutions, leading to inconsistencies in how similar projects are evaluated. For these reasons, ethics approval should not be seen as a definitive judgment. Instead, it should be understood as one component of a broader, ongoing responsibility to reflect on the ethical implications of one’s work.

United States#

In the United States, research involving human subjects is regulated under the Common Rule. Approval by an Institutional Review Board (IRB) is mandatory for federally funded research and is typically required by universities and research institutions more broadly.

IRBs are responsible for evaluating potential risks to participants, ensuring that informed consent procedures are appropriate, and safeguarding privacy and confidentiality. Even in computer science, IRB approval may be necessary when research involves user data, experiments with participants, or interactions with online communities.

A list of officially registered IRBs can be found here: https://ohrp.cit.nih.gov/search/irbsearch.aspx

Germany#

In Germany, ethics review structures are less standardized. Ethics boards are often referred to as Ethics Review Boards (ERBs) or Ethics Committees, but their structure and availability differ between institutions.

Many established ethics committees are associated with medical faculties and are primarily designed for clinical or human-subject research. As a consequence, researchers in computer science and related technical fields may find that no dedicated review process exists for their work, or that existing boards are not well suited to evaluating it.

This decentralized system can create uncertainty about whether approval is required and how to obtain it. In practice, researchers often need to clarify expectations within their institution or seek alternative forms of guidance when formal review is unavailable.

Practical Advice#

It is advisable to clarify early on whether ethics approval is required for a given project and to account for the time such a process may take. When working on projects that involve technical or non-traditional risks, it can be helpful to communicate these clearly and proactively to the reviewing board.

Even when formal approval is not required, documenting ethical considerations and decisions remains important. Seeking feedback from peers or external experts can also provide valuable perspectives, especially in areas where institutional review may lack the necessary expertise.

Ultimately, ethics boards should be seen as a baseline mechanism. Responsible research requires continuous and independent ethical reflection beyond formal approval processes.