This story is a product of a collaboration between Undark and Retraction Watch.

Sometime after 2010 — he isn’t exactly sure when — Richard Miller, a professor of pathology at the University of Michigan in Ann Arbor, looked up a former faculty member who had worked in his lab on the popular government research database, Medline. When he saw that the researcher, Ricky Malhotra, was publishing new work out of the University of Chicago, Miller said he was “surprised and upset.” That’s because he knew something about Malhotra that he bet Malhotra’s new employers didn’t.

If someone had called Miller to discuss his former mentee, he could have told them Malhotra left his lab — which focuses on the genetics of aging — after confessing to fabricating data. It wasn’t a minor case: In 2007, Malhotra admitted to performing 60 percent or less of the approximately 80 experiments expected from him, among other infractions.

But no one called Miller, and now that he knew Malhotra was conducting research at another institution, he was torn. On the one hand, he thought “it would be good for the scientific community to call the University of Chicago and tell them what was going on,” Miller said. At the same time, the University of Michigan was still conducting an investigation of Malhotra’s misdeeds there, and that investigation was confidential. “I wasn’t sure,” Miller said, “how to reconcile those two separate obligations.”

So he said nothing.

In 2016, nine years after Malhotra left Michigan, the federal Office of Research Integrity (ORI), part of the United States Department of Health and Human Services, announced that Malhotra had continued to manipulate data while at the University of Chicago. During his tenure at both institutions, the ORI determined, he made up more than 70 experiments and falsified more than 100 laboratory tests. What’s more, his research had been supported by American taxpayers.

Malhotra is not alone — both in his apparent proclivity for scientific misconduct, and in his ability to slip through the cracks of university science and bring those tendencies with him from one institution to another. At the end of 2017, the Office of Research Integrity announced that a postdoctoral researcher, Mahandranauth Chetram, had committed misconduct at both Georgetown and Emory Universities — and did so at the latter after learning he had been found guilty of misconduct at the former. In 2011, nursing researcher Scott Weber lost his job at Walden University, a Minneapolis-based online institution, after it learned that he had earlier committed misconduct at the University of Pittsburgh. And these are just examples that were made public.

Love Undark? Sign up for our newsletter! Email *

When an individual scientist is accused of misconduct, academic officials – like those in any other vocation, from bankers and doctors to police officers and teachers — have to balance the accused’s privacy with any future employer’s right to know. The stakes in academia can be high: Students and researchers struggling for limited grant funding all suffer when institutions simply let someone with a troubled history and a trail of bad data hop from post to post — and continue injecting that bad data into the literature, according to C.K. Gunsalus, former associate provost and research standards officer at the University of Illinois at Urbana-Champaign. Gunsalus said she is aware of multiple institutions that simply stopped investigating someone after they left, leaving future employers completely blind to the researchers’ history of allegations.

There are multiple reasons why, she said – but in many cases, the institution is afraid a researcher will sue them for defamation if anything leaks out. “I think there are times that lawyers have too much sway in this process,” she said.

And even when a fraudster is found guilty and dismissed, many institutional officials feel — or at least behave — as if the problem is solved, said John Dahlberg, former deputy director at the ORI. As a result, they often feel no compulsion to notify potential employers. “There have been cases in which people go somewhere else and no one knows about it,” said Dahlberg. Indeed, one reason ORI was formed 26 years ago was to publicize cases of misconduct, he said — “so people couldn’t disappear so easily.”

As it stands, institutions are obligated to notify the ORI only when alleged misconduct involves federally funded biomedical research, and internal investigations can take years to complete — a limbo period during which an accused scientist can easily apply for another position. Precisely what, if any, action should be taken — and by whom — during that time is far from clear. ORI privacy rules do allow institutions to notify others that an investigation is underway if they have a “need to know” interest in the case. But who, exactly, has a need to know? That decision, Dahlberg said, is left to the institutions.

It’s a complex problem, with no easy fix – but experts say it’s worth trying to figure out if there’s a better way. “I don’t think it’s enough to say – ‘it’s privacy, that trumps everything.’ I don’t think it’s enough to say – ‘it’s an employer’s right to know, that trumps everything,’” said Gunsalus. Figuring out how to protect both an individual’s privacy, and the larger academic community, “can be nuanced professional judgments,” she added. “Grown-up professionals make nuanced decisions all the time. This ought to not be as hard as we’re making it,” Gunsalus said.

The letter dated April 23, 2010, to Peter Dunn, then-research integrity officer at Purdue University in West Lafayette, Indiana, was damning. In it, whistleblowers alleged that Mark Jackson, a professor in the Department of Mechanical Engineering Technology, had plagiarized figures, data, and text in at least eight papers. They also believed the papers included fabricated or falsified data. On November 18, 2010, according to documents obtained through a public records request, Dunn learned of additional allegations of plagiarism affecting some of Jackson’s book chapters. A Purdue committee reviewed the allegations, and in June 2011, informed Jackson that a formal investigation of misconduct would be underway. But before that happened, Jackson left Purdue.

The university spent the next three years trying to find him. Dunn emailed and sent a certified letter to his last known address, but received no response. Finally, in August 2014, they found him hiding in plain sight — Jackson was the head of the department of Engineering Technology at Kansas State University Polytechnic Campus in Salina, where he held an endowed chair position. Dunn sent a courier to Jackson’s new home address and told him Purdue was moving forward with its investigation.

For his part, Jackson had given varying explanations for the alleged misconduct. In 2010 and 2011, he said that his colleagues or students had prepared the figures and images in question. Then, when he was re-questioned in 2015, Jackson said the papers were submitted by a third party without his knowledge. He also suggested that while his email was provided as the corresponding author on the papers in question, the same unnamed third party hacked into his computers and emails to intercept any communications with the journals, and then deleted the emails to avoid detection. Not convinced, the Purdue committee unanimously concluded in May 2016 that Jackson had committed misconduct in the form of plagiarism, falsification, and fabrication.

On a brief phone call, Jackson said he is still a department chair at Kansas State, and that he is “speaking to an attorney” — though Deborah Rupp, the current research integrity officer at Purdue, said her institution has received “no notice of any suit by Dr. Jackson or contact from any lawyer on his behalf.”

And what did Kansas know about Jackson’s past, and when? “This office has taken steps to ensure that Kansas State University has access to the information that it seeks regarding this matter,” Rupp said, though she declined to comment further or to clarify the timing of interactions between the two universities. A representative of Kansas State said the university does not comment on “personnel matters.”

This isn’t the only time an investigation of someone who obtained new employment became a legal matter: In the 1990s, neuroscientist Kimon J. Angelides took a job at the University of Durham in the U.K. after being fired from Baylor College of Medicine. When Baylor concluded Angelides had committed misconduct – falsifying dozens of figures in five papers – he sued the college, the committee who had investigated his work, and some of the people who testified against him, arguing that the accusers had ruined his career. In 1999, the ORI announced it had upheld Baylor’s finding that Angelides had committed misconduct. By that time, Angelides had resigned from Durham; once the ORI finding was public, he dismissed the lawsuit as well.

Paul Thaler, an attorney with the firm Cohen Seglias, who has frequently represented researchers accused of misconduct, said scientists should fight for their privacy during a misconduct investigation. “The right to privacy is an important right, and it’s a constitutional right,” he said. “An allegation of research misconduct – short of being accused of being a criminal – is one of the worst things that can happen to a scientist,” Thaler added. In conversations with others, he said he always asks, “What would you want if you were them?” Most people side with the scientist’s right to privacy, he said. That privacy should be maintained even during the ORI’s portion of the investigation, Thaler said, since the agency doesn’t always support the institution’s findings. “There are plenty of circumstances in which scientists are going to be exonerated. You have to allow for that possibility.”

And yet, waiting for the ORI to consider and adjudicate charges of misconduct can sometimes take years – long enough for significant collateral damage to occur.

In January 2007, according to documents obtained by Retraction Watch following a public records request, Malhotra learned that a whistleblower reported to the University of Michigan that they suspected he was fabricating data. He was supposed to be exposing cells from different mouse strains to various stress agents, and taking snapshots of the effects using an imaging device known as a Storm Phosphorimager. The series of 45 experiments should have produced 90 images. But Malhotra’s laptop had no original data, and the login records showed he’d only used the Storm Phosphorimager twice in the last year.

An inquiry, completed in July 2007, found “substantial reason to believe research misconduct (data fabrication) occurred.” In August 2007, Stephen Forrest, then-vice president for research at the university, authorized a formal investigation; because Malhotra’s research involved federal funds, the university was obligated to notify the ORI.

In a statement dated November 9, 2007, Malhotra confessed. He admitted to completing only 50 to 60 percent of the experiments he was expected to conduct. “For the last 9-10 months I have been living under this huge cloud of guilt and wanted to confess my misdoing but for some inexplicable reasons I could not gather the courage to do so.” Malhotra left the university.

Nearly three years went by.

On August 23, 2010, to his surprise, Malhotra received an email from Judy Nowack, then-associate vice president for research at the University of Michigan, with the subject line “closure.” In it, Nowack said she “did not properly pursue the next steps” after Malhotra’s confession, which entailed negotiating an agreement with the ORI on a final resolution. On August 24, Malhotra said he was “confused” by her email: “When I last spoke to my attorney David Nacht almost three years ago, I recall he had mentioned that after I make my honest and sincere admission the University of Michigan will render an immediate and final settlement. For the last three years there has been no response whatsoever from your office either by email, phone or a mailed letter, regarding the outcome of my admission. Considering this situation and the resultant predicament I was placed in, I was forced to work out of town and have patiently suffered the pain and trauma of staying away.” In a response, Nowack noted: “The fault is mine. I deeply regret your stress and apologize.”

In fact, Malhotra had moved to the University of Chicago; according to LinkedIn, he spent more than four years there, starting in August 2007, working as a research assistant professor. He published five papers and investigated the fate of cardiac cells after injury. While there, according to the ORI, he manipulated data in a grant application to the NIH, a grant progress report, and a 2010 paper in the Journal of Biological Chemistry. That paper — and another, in the same journal — have been retracted. (The ORI also found one of his colleagues at Chicago guilty of fabricating or falsifying data in a grant and two papers.)

Malhotra declined to comment for the story. His LinkedIn profile lists him as actively seeking opportunities in biotech sector,” living in the Greater Boston area.

So how much did Chicago know about Malhotra’s history, and when did it find out? It remains unclear. Susan Zonia, the director of research integrity at the University of Chicago, told us that none of the people directly involved in the case are still at the university. They could “comb through notes,” she said, but “even then, I’m not sure we would have the full picture. I am afraid I will not be able to assist you.”

In theory, Michigan could have notified the ORI of its inquiry as early as 2007, and resolved the case within a few years to enable the ORI to make the findings public, but the university’s delay significantly extended the process. And in the interim, Miller said that officials at Chicago did not call to ask about the researcher’s behavior — though even if they had, Miller had been instructed not to say much: While the Michigan investigation was ongoing, he had been told that if he was contacted by any prospective employers, he was supposed to say the day Malhotra started working for him, and the day Malhotra left, and “nothing else.”

The prescribed code of silence was documented in a 2011 letter from Nowack to Dahlberg at the ORI, which concludes with: “[name redacted] has expressed an eagerness to notify Dr. Malhotra’s current employer and co-authors about the experience in his laboratory. We have advised against his direct communication, noting that ORI is in the best position to evaluate the need for and to make those notifications directly to Dr. Malhotra’s employers on NIH-funded research or the NIH institute supporting that research.” Although he was “uncomfortable” with being asked to stay silent, Miller said, “I am a faculty here, and I am supposed to abide by the university’s rules, whether I agree with them or not.”

According to Rick Fitzgerald, a spokesperson for the University of Michigan, “U-M takes allegations of scientific misconduct seriously, and likewise takes seriously the federal regulatory requirements of confidentiality, which limit notifications to those with a ‘need to know.’ Moreover, as ORI is the final arbiter on research misconduct matters under its purview, and its assessment of the Dr. Malhotra case was still in progress, the university did not reach out to others in 2010, particularly in the absence of any indication of any intervening misconduct or of any ongoing risk to human subjects. This approach is reflected in our November 2010 letter to ORI, in which we noted the question of external notifications, including to Dr. Malhotra’s current employer, and our deference to ORI’s determinations in that regard.”

Dahlberg balked at the idea ORI was responsible for the communications, given privacy laws: “They can say it should be ORI, but they very well knew we couldn’t tell Chicago much.”

Some universities have found effective ways to balance privacy with transparency. Years ago, Gunsalus and her colleagues at the University of Illinois at Urbana-Champaign had to walk that line with a faculty member who had been found guilty on some charges of misconduct, then started to look for other jobs. The university struck a deal with his attorney: He could resign, and if queried by future employers, one person at Illinois (a dean) was designated to provide a statement. The statement — negotiated with the attorney — included that there had been serious allegations, some of which were substantiated, and Illinois could provide a full report if the individual signed a release. “I think that was an appropriate institutional response. It respected the fact there had been a process,” said Gunsalus. If a potential employer contacted Illinois, they would know “there was a red flag.”

In the end, it’s up to employers to check applicants’ references — and call former colleagues who aren’t on the list, said Gunsalus. She advises that hiring committees listen to what those former colleagues say, as well as what they don’t say: If they dodge certain questions (such as “would you hire them again?”) and instead repeat the same phrases (such as his starting and ending dates, or the same compliment “he was conscientious and diligent”), as would have been the case for Malhotra, that’s a sign there may be something they can’t disclose.

Thaler also recommends to his clients that they tell a new employer they’re under investigation – if they don’t, and the investigation becomes public, it will seem like they weren’t honest. Although such honesty may make it harder to find a job, it “also shows a level of integrity that you’re not holding back,” said Thaler. “Most universities are savvy enough to understand the misconduct process and know that if someone’s accused … doesn’t mean necessarily that they’re bad scientists or bad professors.”

Everyone agrees there is no easy answer here. “What I see springing from this, maybe, would be some form of summit, discussion, to include all the various stakeholders, to discuss this,” Thaler said.

Whether or not that’s likely is unclear, but Gunsalus is firm in her belief that something needs to change. As it stands now, even solutions that aim to strike the right balance between privacy and disclosure can fail.

After Gunsalus and her colleagues settled the case of the researcher found guilty of misconduct at the University of Illinois at Urbana-Champaign, they received a query from two other potential employers. The dean read the negotiated statement to both, but one hired him — with tenure — anyway, without seeking a copy of the full report. Years later, while on an airplane, Gunsalus read a news article reporting that the institution had later dismissed the researcher “for the same exact behavior,” she said.

“I remember so viscerally being on that airplane and reading that article. It felt like a punch to the stomach,” she said. “It was an entirely predictable result.”

Alison McCook is the editor of Retraction Watch, a publication of the Center for Scientific Integrity covering retractions of scientific papers and related topics.