The other side of "academic freedom"

My various blog posts about moving from academia to industry have prompted a number of conversations with PhD students who are considering academic careers. The most oft-cited reason for wanting a faculty job is "academic freedom," which is typically described as "being able to work on anything you want." This is a nice theory, but I think it's important to understand the realities, especially for pre-tenure, junior faculty.

I don't believe that most professors (even tenured ones) can genuinely work on "anything they want." In practice, as a professor you are constrained by at least four things:

• What you can get funding to do;
• What you can publish (good) papers about;
• What you can get students to help you with;
• What you can do better than anyone else in the field.

These are important limitations to consider, and I want to take them one by one.

Funding doesn't come easy. When I was a PhD student at Berkeley, I was fortunate to be a student of David Culler's, who had what seemed like an endless supply of funding from big DARPA and NSF grants, among others. When I went to start my faculty career, he (and many others) told me I would have "no problem" getting plenty of funding. This turned out not to be true. Shortly after I started my faculty job, DARPA all but shut down their programs in computer science, and NSF grants became heavily constrained (and much more competitive). Being a freshly-minted faculty member meant I was essentially a nobody, but that didn't mean that NSF review panels took pity on me -- apart from special programs like the CAREER award, you're competing with the most senior, established people in your field for every grant. To make matters worse, I didn't have a lot of senior colleagues in my area at Harvard to write proposals with, so I mostly had to go it alone.

Now, I will readily admit that I suck at writing grants, although according to my colleagues my hit rate for funding was about on par with other profs in my area. However, there were several projects that I simply could not do because I couldn't get funding for them. I tried for four years to get an NSF grant for our work on monitoring volcanoes with sensor networks -- which was arguably the thing I was most famous for as a professor. I failed. As a result we never did the large-scale, 100-node, multi-month study that we had hoped to do. It was a huge disappointment and taught me a valuable lesson that you can't work on something that you can't get funding for.

Who decides which problems are sexy (and therefore publishable)? I'll tell you: it's the 30-some-odd people who serve on the program committees of the top conferences in your area year after year. It is very rare for a faculty member to buck the trend of which topics are "hot" in their area, since they would run a significant risk of not being able to publish in the top venues. This can be absolutely disastrous for junior faculty who need a strong publication record to get tenure. I know of several faculty who were denied tenure specifically because they chose to work on problems outside of the mainstream, and were not able to publish enough top papers as a result. So, sure, they could work on "anything they wanted," but that ended up getting them fired.

Now, there are some folks (David Culler being one of them) who are able to essentially start new fields and get the community to go along with them. I argue that most professors are not able to do this, even tenured ones. Most people have to go where the funding and the publication venues are.

What can you get students to work on? I don't mean this in a kind of grad-students-won't-write-unit-tests kind of way (although that is also true). What I mean is how likely is it that you will find grad students in your field who have the requisite skills to undertake a particular research agenda? In my case, I would have killed for some students who really knew how to design circuit boards. Or students who had some deep understanding of compiler optimization -- but still wanted to work on (and publish) in the area of operating systems. A bunch of times I felt that the problems I could tackle were circumscribed by my students' (and my own) technical skills. This has nothing to do with the "quality" of the students; it's just the fact that PhD students (by definition) have to be hyper-specialized. This means that grad students in a given area tend to have a fairly narrow set of skills, which can be a limitation at times.

Can you differentiate your research? The final (and arguably most important) aspect of being successful as a faculty member is being able to solve new problems better than anyone else in your area. It is not usually enough to simply do a better job solving the same problem as someone else -- you need to have a new idea, a new spin, a new approach -- or work on a different problem. Hot areas tend to get overcrowded, making it difficult for individual faculty to differentiate themselves. For a while it felt like everyone was working on peer-to-peer networking. A bunch of "me too" research projects started up, most of which were forgettable. Being one of those "me too" researchers in a crowded area would be a very bad idea for a pre-tenure faculty member.

Do things get better after tenure? I didn't stick around long enough to find out, so I don't know. I definitely know some tenured faculty who are coasting and care a lot less about where and how much they publish, or who tend to dabble rather than take a more focused research agenda post-tenure. Certainly you cannot get fired if you are not publishing or bringing in the research dollars anymore, but to me this sounds like an unsatisfying career. Others -- like David Culler -- are able to embark on ambitious, paradigm-shifting projects (like NOW and TinyOS) without much regard to which way the winds are blowing. I think most tenured faculty would agree that they are subject to the same sets of pressures to work on fundable, publishable research as pre-tenure faculty, if they care about having impact.

Okay, but how much freedom do you have in industry? This is worth a separate post on its own, which I will write sometime soon. The short version is that it depends a lot on the kind of job you have and what kind of company you work for. My team at Google has a pretty broad mandate which gives us a fair bit of freedom. But unlike academia, we aren't limited by funding (apart from headcount, which is substantial); technical skills (we can hire people with the skills we need); or the somewhat unpredictable whims of a research community or NSF panel. So, yes, there are limitations, but I think they are no more severe, and a lot more rational, than what you often experience as an academic.

Running a software team at Google

I'm often asked what my job is like at Google since I left academia. I guess going from tenured professor to software engineer sounds like a big step down. Job titles aside, I'm much happier and more productive in my new role than I was in the 8 years at Harvard, though there are actually a lot of similarities between being a professor and running a software team.

LIKE A BOSS.

I lead a team at Google's Seattle office which is responsible for a range of projects in the mobile web performance area (for more background on my team's work see my earlier blog post on the topic). One of our projects is the recently-announced data compression proxy support in Chrome Mobile. We also work on the PageSpeed suite of technologies, specifically focusing on mobile web optimization, as well as a bunch of other cool stuff that I can't talk about just yet.

My official job title is just "software engineer," which is the most common (and coveted) role at Google. (I say "coveted" because engineers make most of the important decisions.) Unofficially, I'm what we call a "Tech Lead Manager," which means I am responsible both for the technical direction of the team as well as doing the people management stuff. (Some people use the alternate term "Über Tech Lead" but this has one too many umlauts for me.) A TLM is not a very common role at Google: most teams have separate people doing the TL and M jobs. I do both in part because, being based out of Seattle, it doesn't make sense to have my team report to a "regular" manager who would likely be in Mountain View. Besides I'm really happy to do both jobs and enjoy the variety.

There are four main aspects to my job: (1) Defining the technical agenda for the team and making sure we're successful; (2) Writing code of my own; (3) Acting as the main liaison between our team and other groups at Google, and (4) Doing the "people management" for the team in terms of hiring, performance reviews, promotion, and so forth.

Academics will immediately recognize the parallels with being a professor. In an academic research group, the professor defines the technical scope of the group as well as mentors and guides the graduate students. The big difference here is that I don't consider the folks on my team to be my "apprentices" as a professor would with graduate students. Indeed, most people on my team are much better software engineers than I am, and I lean on them heavily to do the really hard work of building solid, reliable software. My job is to shield the engineers on my team from distractions, and support them so they can be successful.

There are of course many differences with academic life. Unlike a professor, I don't have to constantly beg for funding to keep the projects going. I have very few distractions in terms of committees, travel, writing recommendation letters, pointless meetings. Of course, I also don't have to teach. (I loved teaching, but the amount of work it requires to do well is gargantuan.) Most importantly, my team's success is no longer defined through an arbitrary and often broken peer review process, which applies to pretty much everything that matters in the academic world. This is the best part. If we can execute well and deliver products that have impact, we win. It no longer comes down to making three grumpy program committee members happy with the font spacing in your paper submissions. But I digress.

I do spend about 50% of my time writing code. I really need to have a few solid hours each day hacking in order to stay sane. Since I don't have as many coding cycles (and service more interrupts) than other people on my team, I tend to take on the more mundane tasks such as writing MapReduce code to analyze service logs and generate reports on performance. I actually like this kind of work as it means dealing with a huge amount of data and slicing and dicing it in various interesting ways. I also don't need to show off my heroic coding skills in order to get promoted at this point, so I let the folks who are better hackers implement the sexy new features.

I do exert a lot of influence over the direction that our team's software takes, in terms of overall design and architecture. Largely this is because I have more experience thinking about systems design than some of the folks on my team, although it does mean that I need to defer to the people writing the actual code when there are hairy details with which I am unfamiliar. A big part of my job is setting priorities and making the call when we are forced to choose between several unappealing options to solve a particular problem. (It also means I am the one who takes the heat if I make the wrong decision.)

I reckon that the people management aspects of my job are pretty standard in industry: I do the periodic performance reviews for my direct reports, participate in compensation planning, work on hiring new people to the team (both internally and externally), and advocate for my team members when they go up for promotion. Of course I meet with each of my direct reports on a regular basis and help them with setting priorities, clearing obstacles, and career development.

The most varied part of my job is acting as the representative for our team and working with other teams at Google to make amazing things happen. My team is part of the larger Chrome project, but we have connections with many other teams from all over the world doing work across Google's technology stack. I am also frequently called into meetings to figure out how to coordinate my team's work with other things going on around the company. So it never gets boring. Fortunately we are pretty efficient at meetings (half an hour suffices for almost everything) and even with all of this, my meeting load is about half of what it was as an academic. (Besides, these meetings are almost always productive; compared to academic meetings where only about 10% of them have any tangible outcome.)

Despite the heavy load and lots of pokers in the fire, my work at Google is largely a 9-to-5 job. I rarely work on the evenings and weekends, unless there's something I'm really itching to do, and the volume of email I get drops to near-zero when it's outside of working hours. (Although I am on our team's pager rotation and recently spent a few hours in the middle of the night fixing a production bug.) This is a huge relief from the constant pressure to work, work, work that is endemic of professors. I also feel that I get much more done now, in less time, due to fewer distractions and being able to maintain a clear focus. The way I see it is this: If I'm being asked to do more than I can get done in a sane work week, we need to hire more people. Fortunately that is rarely a problem.

Disclaimer: Everything in this post is my personal opinion and does not represent the view of my employer.

Looking back on 1 million pageviews

This blog just hit one million pageviews:

Seems like a pretty cool milestone to me. I never imagined I'd get so much traffic.

Just for fun, here are the top five most popular posts on this blog so far:

Why I'm Leaving Harvard (99263 pageviews), in which I announce my departure from Harvard to Google. I guess this post became a kind of touchstone for a bunch of people considering an academic career, or those who also made the decision to leave academia. I'm often asked whether I still think I made the right decision after nearly 3 years at Google. The answer is a resounding yes: I'm extremely happy and my team is doing amazing things - some of which you can read about here.

So, you want to go to grad school? (43314 pageviews), in which I try to give an honest assessment of why someone should (or should not) do a PhD in Computer Science. The main thing I try to dispel is this myth that you should "take a year off" and work in industry before going to grad school. Way too many students tell me that they plan to do this, and I think it is a really bad idea if you are serious about doing a PhD.

Day in the life of a Googler (33885 pageviews), which was intended as a tongue-in-cheek look at the difference between a day at Google and a day as a professor. Somehow this got taken seriously by people, and someone sent me a link to a Chinese translation that was getting a lot of hits and comments (in Chinese). My guess is that the intended humor was lost in translation.

How I almost killed Facebook (28367 pageviews), an early post about the time I tried to talk Mark Zuckerberg out of dropping out of Harvard to do a startup. Thankfully he did not listen to me.

Programming != Computer Science (25794 pageviews), a little rant against grad students who seem to mix up writing software with doing research.

Of course, not all of my posts have been widely read. Going back over them, it looks like the ones with the smallest number of hits focus on specific research topics, like my trip report for SenSys 2009 (115 pageviews!) and an announcement for postdoc openings in my group (a whopping 68 pageviews). I guess I should stick to blogging about Mark Zuckerberg instead.

Moving my life to the cloud

http://www.flickr.com/photos/clspeace/2250488434/

I'm in the process of moving my (computing) life entirely to the cloud -- no more laptop: just a phone, tablet (which I use rarely) and a Chromebook Pixel. My three-year-old MacBook Pro is about to croak, and it seems like now is the time to migrate everything to the cloud, so I can free myself from having to maintain a bunch of files, music, photos, applications, and backups locally. I'd really like to be in a place where I could throw my laptop out a moving vehicle and not care a bit about what happens to my data. Still, there are some challenges ahead.

The Chromebook Pixel itself is a sweet piece of kit. The keyboard and trackpad are nearly as good as my Mac, and the screen resolution is simply unreal: you CANNOT see the pixels (ironic choice of product name; as if the next version of a Mac would be the "MacBook Virus"). It boots in 10 seconds. Hell, the other day I did a complete OS upgrade (switching from the beta to the dev channel), which took no more than 10 seconds -- including the reboot. The Pixel comes with 1 TB (!) of Google Drive storage, so at this point there's no excuse for not storing all my stuff in the cloud -- this is more space than any laptop I've ever owned.

But you only get to use Chrome!?!? Working at Google, I spend about 70% of my time in Chrome already, so the environment is pretty much exactly what I need. The other 30% of my time is spent ssh'ing into a Linux machine to do software development. The Secure Shell Chrome extension provides a full-on terminal emulator within the browser. I pretty much only use the shell and vim when doing development, so this setup is fine for me.

Since I left academia, I don't have much need for writing papers in LaTeX and doing fancy PowerPoint slides anymore. If those were still major uses of my time, I'd have to find another solution. Google Docs works perfectly well for the kind of writing and presentations I do these days; in fact, the sharing capabilities turn out to be more important than fancy formatting.

What about working offline!?!?! Who the hell ever works offline anymore? I certainly don't. Even on airplanes, the majority of the time I have WiFi. I generally can't get any work done without an Internet connection, so optimizing for "offline" use seems silly to me. If I'm really offline, I'll read a book.

Music? Google Play Music and the Amazon Cloud Player work great. I have a huge music library (some 1,200 albums) which I keep in both places.

Movies and TV shows? It's true that iTunes has the best selection, but what's available on Google Play and Amazon Instant Video is pretty good. I mostly watch movies and TV on my actual TV (crazy, I know) but for "on the road" I think streaming content will work well enough. There's no real offline video playback on the Chromebook as far as I know; for that I can use my Android tablet though. Netflix apparently works fine on the Chromebook, although I unsubscribed from Netflix when they started screwing people over on their pricing.

Of course, it's not all roses. A few pain points, so far:

Migrating my photo library to the cloud was more painful than I had hoped. I have around 70 GB of pictures and videos taken over the years, and wanted to get it onto Google Drive so I'd have direct access to it from the Chromebook. This involved installing the Google Drive Mac app which allowed me to copy everything over, although the upload took a day or so, and it wasn't clear at first if everything was syncing correctly. (I also had to make sure not to sync the photo library on my other machines which had the Drive app installed.)

Managing photos in the cloud still kind of sucks. I'm not happy with any of the cloud-based photo library management solutions that I've found. I have a Flickr Pro account which I use for sharing select pictures with family and friends, but I don't feel comfortable uploading all of my photos to Flickr. I could use Google+, however, it's more focused on sharing rather than large library management. I am not sure what is going on with Picasa these days. Dropbox is another option, which I use for general files, but its photo management is pretty rudimentary as well. For now I'm going to make do with the bare-bones photo support in Google Drive and think about a better way to manage this. What's cool is that I already take all of my photos on my phone which automatically syncs then to both Google Drive and Dropbox, so there's never a need to physically plug the phone in to anything.

Editing plain text files is -- surprisingly -- kind of hard. About the only use I have for plain text files (apart from coding) anymore is writing paper reviews -- I read a PDF in one window; fill in the plain-ASCII review form for HotCRP in the other. There are a couple of Chrome extensions with bare-bones text editors, but it's a far cry from a full-fledged editor. I am experimenting with Neutron Drive, which is a pretty cool editor/IDE Chrome Extension which uses Google Drive in the backend. Maybe I'll have to change my habits and just fill in my reviews in HotCRP directly (see above about not being able to get any work done offline).

Where to keep my really private stuff? By which I mean porn, of course. Or tax returns. Or anything I don't want (or can't) store in any of the cloud services. This article from VentureBeat does a good job at summarizing the policies of the popular cloud storage providers, but the upshot is that all of them have some mechanism to either take down objectionable content or report it to law enforcement.

What I'd really like is to set up a "private cloud", perhaps running a server at home which I could then access (securely) over the web. There are several solutions for private encrypted cloud storage out there (like Arq and Duplicati), but most of them require some form of specialized client (which won't work on ChromeOS any time soon). I guess I could run a WebDAV server or something on a local box or even a machine in the cloud which I could access through the browser. Still, I'm not sure what to do about this yet. It seems insane to me that it's 2013 and we still don't know how to get file sync right.

Disclaimer: Everything in this post is my personal opinion and does not represent the view of my employer.

Grad students: Learn how to give a talk

I've been to roughly a hundred academic conferences and listened to thousands of talks, mostly by grad students. Over the years, the quality of the speaking and presentations has not gotten any better -- if anything, it's gotten worse. A typical grad student talk is so horribly bad, and it's surprising how little effort is put into working on presentation and speaking skills, especially given how important this skill is for academics.

Grad students need to learn how to give good, clear, compelling presentations. Especially those who think they want to be professors one day.

It is difficult to overstate how important presentation skills are for academics. This is about much more than "being a good teacher" (which is a nice trait to have, but not actually that important for an academic's career in the long run). There is a huge division between the professors who are influential leaders, and those who are also-rans. In almost all cases that I can think of, the professors who are very successful are also good speakers, and good communicators overall. They can give good, clear, funny talks. They can engage in meaningful conversations at a technical level and at a personal level. They have a strong command of English and can use the language effectively to communicate complex ideas. So I claim that there is a strong correlation between good communication skills and overall research impact.

In some sense, a professor's job is to communicate the research ideas being done in their group. Although grad students often give the conference talks, professors give countless other talks at other universities, companies, workshops, and elsewhere. The professors write the grant proposals, and often the papers (or good chunks of them) as well. Once you're a professor, it matters a lot less how good of a hacker you are -- your job is to be the PR rep.

So it's surprising that grad students generally receive no formal training in presentation skills. A typical grad student might get three or four opportunities to give conference talks during their Ph.D., but this is hardly enough practice to hone their skills. Acting as a TA or giving "practice talks" isn't much help either. I honestly don't know how to fix this problem, short of running a course specifically on giving good presentations, which sounds like a drag -- but might be necessary.

The language barrier is a big part of the problem. Students who do not have English as their first language are almost invariably worse at giving talks than those who are native speakers, and students from Asia tend to be worse than those from Europe. (In academic Computer Science, English is the only language that matters.) But it's more than just command of the language -- it's about being expressive, funny, charismatic. The grad student who stands frozen in place and reads off their slides might speak English perfectly well, but that doesn't make them a good speaker.

It's also true that grad students are often "sized up" at conferences based on their speaking skills. If you can give a good talk at a conference, you'll get the attention of the professors who will be looking at your faculty job application later. Likewise, if your talk sucks, it's going to leave a bad impression (or, at best, you'll be forgettable).

So, please, grad students: If you're serious about pursuing an academic career, hone your presentation skills. This stuff matters more than you know.

My mobile systems research wish list

Working on mobile systems at Google gives me some insight into what the hard open problems are in this space. Sometimes I am asked by academic researchers what I think these problems are and what they should be working on. I've got a growing list of projects I'd really like to see the academic community try to tackle. This is not to say that Google isn't working on some of these things, but academics have fewer constraints and might be able to come up with some radically new ideas.

Disclaimer: Everything in this post is my personal opinion and does not represent the view of my employer, or anyone else. In particular, sending a grant proposal to Google on any of the following topics will by no means guarantee it will be funded!

First, a few words on what I think academics shouldn't be working on. I help review proposals for Google's Faculty Research Awards program, and (in my opinion) we get too many proposals for things that Google can do (or is already doing) already -- such as energy measurements on mobile phones, tweaks to Android or the Dalvik VM to improve performance or energy efficiency, or building a new mobile app to support some specific domain science goal (such as a medical or environmental study). These aren't very good research proposal topics, in my opinion -- they aren't far-reaching enough, and aren't going to yield a dramatic change five to ten years down the line.

I also see too many academics doing goofy things that make no sense. A common example these days is dusting off the whole peer-to-peer networking area from the late 1990s and trying to apply it in some way to smartphones. Most of these papers start off with the flawed premise that using P2P would help reduce congestion in the cellular network. A similar flawed argument is made for some of the "cloud offload" proposals that I have seen recently. What this fails to take into account is where cellular bandwidth is going: About half is video streaming, and the other half things like Web browsing and photo sharing. None of the proposed applications for smartphone P2P and cloud offload are going to make a dent in this traffic.

So I think it would help academics to understand what the real -- rather than imagined -- problems are in mobile systems. Some of the things on my own wish list are below.

Understanding the interaction between mobile apps and the cellular network. It's well known that cellular networks weren't designed for things like TCP/IP, Web browsing, and YouTube video streaming. And of course most mobile apps have no understanding of how cellular networks operate. I feel that there is a lot of low-hanging fruit in the space of understanding these interactions and tuning protocols and apps to perform better on cellular networks. Ever noticed how a video playback might stall a few seconds in when streaming over 3G? Or that occasionally surfing to a new web page might take a maddening few extra seconds for no apparent reason? Well, there's a lot of complexity there and the dynamics are not well understood.

3G and 4G networks have very different properties from wired networks, or even WiFi, in terms of latency, the impact of packet loss, energy consumption, and overheads for transitioning between different radio states. Transport-layer loss is actually rare in cellular networks, since there are many layers of redundancy and HARQ that attempt to mask loss in lower layers of the network stack. This of course throws TCP's congestion control algorithms for a loop since it typically relies on packet loss to signal congestion. Likewise, the channel bandwidth can vary dramatically over short time windows. (By the way, any study that tries to understand this using simple benchmarks such as bulk downloads is going to get it wrong -- bulk downloads don't look anything like real-world mobile traffic, even video streaming, which is paced above the TCP level.)

The lifetime of a cellular network connection is also fairly complex. Negotiating a dedicated cellular channel can take several seconds, and there are many variables that affect how the cell network decides which state the device should be in (and yes, it's usually up to the network). These parameters are often chosen to balance battery lifetime on the device; signaling overhead in the cell network; user-perceived delays; and overall network capacity. You can't expect to fix this just by hacking the device firmware.

To make things even more hairy, mobile carriers often use different network tuning parameters in different markets, based on what kind of equipment they have deployed and how much (and what kinds) of traffic they see there. So there is no one-size-fits-all solution; you can't just solve the problem for one network on one carrier and assume you're done.

Understanding the impact of mobile handoffs on application performance. This is an extension to the above, but I haven't seen much academic work in this space. Handoffs are a complex beast in cellular networks and nobody really understands what their impact is on what a user experiences, at least for TCP/IP-based apps. (Handoff mechanisms are often more concerned with not dropping voice calls.) Also, with the increased availability of both WiFi and cellular networks, there's a lot to be done to tune when and how handoffs across network types occur. I hate it when I'm trying to get driving directions when leaving my house, only to find that my phone is trying in vain to hang onto a weak WiFi connection that is about to go away. Lots of interesting problems there.

Why doesn't my phone last all day? This is a hot topic right now but I think the research community's approach tends to be to change the mobile app SDK, which feels like a non-starter to me. Unfortunately, the genie is out of the bottle with respect to mobile app development, in the sense that any proposal that suggests we should just get all of the apps to use a new API for saving energy is probably not going to fly. In the battle between providing more power and flexibility to app developers versus constraining the API to make apps more efficient, the developer wins every time. A lot of the problems with apps causing battery drainage are simply bugs -- but app developers are going to continue to have plenty of rope to hang themselves (or their users) with. There needs to be a more fundamental approach to solving the energy management issue in mobile. This can be solved at many layers -- the OS, the virtual machine, the compiler -- and understanding how apps interact with the network would go a long way towards fixing things.

Where is my data and who has access to it? Let's be frank: Many apps turn smartphones into tracking devices, by collecting lots of data on their users: location, network activity, and so forth. Some mobile researchers even (unethically) collect this data for their own research studies. Once this data is "in the cloud", who knows where it's going and who has access to it. Buggy and malicious apps can easily leak sensitive data, and currently there's no good way to keep tabs on what information is being collected, by whom, for what purpose. There's been some great research on this (including the unfortunately-named TaintDroid) but I think there's lots more to be done here -- although we are sadly in an arms race with developers who are always finding new and better ways to track users.

What should a mobile web platform look like 10 years from now? I think that the research community fails to appreciate the degree of complexity and innovation that goes into building a really good, fast web browser. Unfortunately, the intersection between the research and web dev communities is pretty low, and most computer scientists think that JavaScript is a joke. But make no mistake: The browser is basically an operating system in its own right, and is rapidly getting features that will make it possible to do everything that native apps can do (and more). On the other hand, I find the web development community to be pretty short-sighted, and unlikely to come up with really compelling new architectures for the web itself. Hell, the biggest breakthroughs in the web community right now are a sane layout model for CSS and using sockets from JavaScript. In the mobile space, we are stuck in the stone ages in terms of exploiting the web's potential. So I think there is a lot the research community can offer here.

In ten years, the number of mobile web users will outstrip desktop web users by an order of magnitude. So the web is going to be primarily a mobile platform, which suggests a bunch of new trends: ubiquitous geolocation; users carrying (and interacting with) several devices at a time; voice input replacing typing; using the camera and sensors as first-class input methods; enough compute power in your pocket to do things like real-time speech translation and machine learning to predict what you will do next. I think we take a too-narrow view of what "the web" is, and we still talk about silly things like "pages" and "links" when in reality the web is a full application development platform with some amazing features. We should be thinking now about how it will evolve over the next decade.

The ethics of mobile data collection

The mobile computing and networking research communities need to start paying closer attention to the data collection practices of researchers in our field. Now that it's easy to write mobile apps that collect data from real users, I'm going to argue that computer science publication venues should start requiring authors to document whether they have IRB approval for studies involving human subjects, and how the study participants were consented. This documentation requirement is standard in the medical and social science communities, and it makes sense for computer science conferences and journals to do the same. Otherwise I fear we run the risk of accepting papers that have collected data unethically, hence rewarding researchers for not adequately protecting the privacy of the study participants.

I am often asked to review papers in which the authors have deployed a mobile phone app that collects data about the app's users. In some cases, these apps are overtly used for data collection and the users of the app are told how this data will be collected and used. But I have read a number of papers in which data collection has been embedded into apps that have some other purpose -- such as games or photo sharing. The goal, of course, is to get a lot of people to install the app, which is great for getting lots of "real world" data for a research paper. In some cases, I have downloaded the app in question and installed it, only to discover that the app never informs the user that it is collecting sensitive data in the background.

The problem is, such practices are unethical (and possibly illegal) according to federal requirements for protecting the privacy for human subjects in a research study. Even if there is some fine print in the app the use of data for a research study, it's not clear to me that in all cases the researchers have actually gone through the federally-mandated Institutional Review Board approval process to collect this data.

Unfortunately, not many computer scientists seem to be familiar with the IRB approval requirement for studies involving human subjects. Our field is pretty lax about this, but I think it's time we started taking human subjects approval more seriously.

It is now dead simple to develop mobile apps that collect all kinds of data about their users. On the Android platform, an app can collect data such as the device's GPS location; which other apps are running and how much network traffic they use; what type of wireless network the device is using; the device manufacturer, model, and OS version; which cellular carrier the device uses; the device's battery level; and the current cell tower ID. Similar provisions exist on iOS and other mobile operating systems. With rooted devices, it's possible to collect even more information, such as a complete network packet trace and complete information on which websites and apps have been used.

Put together, this data can yield a rich picture of the usage patterns, mobility, and network performance experienced by a mobile user. It is very tempting for researchers to exploit this capability, and it's easy to get thousands of people to install your app by releasing it on Google Play or the Apple App Store. However, I have very little confidence that most researchers are adhering to legal and ethical guidelines for collecting such data -- I bet the typical scenario is that the data ends up being logged to an unsecured computer under some grad student's desk.

So, what is an IRB? In the US and many other countries, any institution that receives federal funding must ensure that research studies involving human subjects protect the rights and privacy of the participants in such studies. This is accomplished through Institutional Review Board review which much occur prior to the study taking place. The purpose of the IRB is to ensure that the study meets certain guidelines for protecting the privacy of the study participants. The Stanford IRB Website has some good background about the purpose of IRB approval and what the process is like. The principles underpinning IRB review were set forth in the Declaration of Helsinki, which has been the basis for many countries' laws regarding protection of human subjects.

Failing to get IRB approval for a research study is serious business. In the medical and social science communities, failing to get IRB approval is tantamount to faking data or plagiarism. The Retraction Watch blog has a long list of cases in which published articles have been retracted due to lack of IRB approval. In those fields, this kind of forced retraction can destroy an academic's career.

Documenting IRB approval and informed consent for study participants is becoming standard practice in the medical and social science communities. For example, the submission guidelines to the Annals of Internal Medicine require an explicit statement from authors regarding IRB approval:

"The authors must confirm review of the study by the appropriate institutional review board or affirm that the protocol is consistent with the principles of the Declaration of Helsinki (see World Medical Association). If the authors did not obtain institutional review board approval before the start of the study, they should so state and explain the circumstances. If the study was exempt from review, the authors must state that such exemption complied with the policy of their local institutional review board. They should affirm that study participants gave their informed consent or state than an institutional review board approved conduct of the research without explicit consent from the participants. If patients are identifiable from illustrations, photographs, pedigrees, case reports, or other study data, the authors must submit the release form for each such individual (or copies of the figures with the appropriate release statement) giving permission for publication with the manuscript. Consult the Research section of the American College of Physicians Ethics Manual for further information."

But yet, in computer science, we tend not to take this process very seriously. I suspect most computer scientists have never heard of, or dealt with, their institution's IRB. I was surprised to see that CHI, the top conference in the area of human-computer interaction (in which user studies are commonplace), says nothing in its call for papers about requiring IRB approval disclosure for human subjects studies -- perhaps the practice of obtaining IRB approval is already widespread in that community, though I doubt it.

Why do I think we should require authors to document IRB approval? For two reasons. First, to raise awareness of this issue and ensure that authors are aware of their obligations before they submit a paper to such venues. Second, to prevent paper reviewers from having to make a judgment call when a paper is unclear on whether and how a study protects its participants. The whole point of an IRB is to front-load the approval process before the research study even begins, well before a paper gets submitted. The nature of a research project may well change depending on the IRB's requirements for protecting user privacy.

To give an example of how this can be done properly, colleagues of mine at University of Michigan and University of Washington are developing a mobile app for collecting network performance data, called MobiPerf. The PIs have IRB approval for this study and the app clearly informs the users that the data will be collected for a research study when the app first starts; clicking "No thanks" immediately exits the app. Furthermore, there is a fairly detailed privacy statement and EULA on the app's website, explaining exactly what data is collected. It's true that going through these steps required more effort on the part of the researchers, but it's not just a good idea -- it's the law.

This is my personal blog. The views expressed here are mine alone and not those of my employer.