Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

81–90 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#81

Post by zippergz »

kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

I love how they say they are "contacting websites" as if websites are sentient beings that can respond to questions, rather than operations run by human beings who will receive and respond to the communication.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#82

Post by kstrauser »

dangom wrote: post #65
kstrauser wrote: post #29

Earlier quoted context omitted.

Done, thanks. I'm not sure what the difference is between that and their RIA ( https://ria.princeton.edu/report-concern ), but now I've reported it to both.

You should report this to the IRB. The research is conducted on information obtained by interacting with humans, and therefore should be classify as Human Subjects Research [1]. Waivers of informed consent can be obtained under some circumstances, for example in the case of a retrospective study where the data has already been collected and contacting subjects would be difficult/unnecessary, or it can be shown to adv…

That’s great information, thanks! I’m learning an awful lot about this stuff very quickly.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#83

Post by dboreham »

GauntletWizard wrote: post #47
User23 wrote: post #23

Earlier quoted context omitted.

I guarantee you that they don't even know what all the information about you they have is and even if they wanted to they couldn't actually delete all of it because their systems have so many levels of redundancy to prevent data loss that even intentional deletion is impracticable, at least if you want it to be comprehensive.

Having worked at these companies and those like it, there's a lot to unpack in this law. The short version is, they have to delete data "about you", not data that was generated by you. Business records, such as receipts, are allowed to can be kept. They just delete your name and phone number, your photos and videos, and documents that were visible to you, but all of the actually useful tracking information is encoded…

> except the legislators writing the laws

Quite likely they do (or their staffers who do the actual work do).

This is an example of regulatory capture.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#84

Post by endisneigh »

ajkjk wrote: post #30
kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

I don't understand why you reacted so strongly. I feel like it's not a big deal to receive a message like that; what am I missing?

I see that you're being downvoted, but for what it's worth I agree with you. I read the message and if I received it I wouldn't have thought much of it. Honestly I would've just thought it was spam. It's a shame though if the OP did have mental duress as a result of it, though.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#85

Post by kingcharles »

kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

I don't know California statutes, but in Illinois that would be a crime:

(720 ILCS 5/17-50) (was 720 ILCS 5/16D-5 and 5/16D-6) Sec. 17-50. Computer fraud. (a) A person commits computer fraud when he or she knowingly: (1) Accesses or causes to be accessed a computer or any part thereof, or a program or data, with the intent of devising or executing any scheme or artifice to defraud, or as part of a deception;

Re: CCPA Scam – Human subject research study conducted by Princeton University

#86

Post by nikitaga »

malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

* When you do something to people to see how they act, it's a human experiment. The purpose of this study was officially "to understand how websites would respond to real users"

* The participants / subjects of the study are people, not "websites" as the study claims. Websites don't read and respond to emails, people do.

* The participants of this study were selected without their consent

* The participants were not told that they are in a study, nor the purpose of that study

* The participants were lied to, as the researcher pretended to be someone else

* The researcher deliberately communicated in a way that heavily implied legal consequences if they don't get what they demand

* The researcher's threats and demands do not actually match what is afforded to them by the law

* The study caused undue stress and financial losses (e.g. hiring lawyers) to the participants, including those that were not subject to CCPA at all.

I don't care what labels you choose to put or not put on it, it's a shitty, abusive study that should have never passed ethics review.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#87

Post by krisoft »

the_optimist wrote: post #40
0xFF0123 wrote: post #33

Earlier quoted context omitted.

From the perspective of someone not living in the US, how on earth would one be expected to know what "the law" in California is?

Part of the premise of the nation state is that you don't need to abide by other countries' laws. If you're doing business within that nation state, you're required to operate by their laws.

Quick, someone tell that to Julian Assange. :) Or all the webpages which choose to implement GDPR by blocking european visitors.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#88

Post by kf6nux »

From the study's FAQ[0]:

> Did an Institutional Review Board consider this study?

> We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research.

From the social experiment[as reported by OP's link]:

> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.

I'm pretty sure most people would find that to be a thinly veiled threat of a lawsuit. I'd like to know if the review board considered the text of the email that the "researchers"[1] intended to send and the fact that they were likely to send it to individuals instead of solely publicly traded companies.

[0] https://archive.md/cSDGT

[1] Seems to fall more under experimental psychology to me https://en.wikipedia.org/wiki/Experimental_psychology?wprov=...

Re: CCPA Scam – Human subject research study conducted by Princeton University

#89

Post by kstrauser »

Paul-E wrote: post #73
kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

I've met Ross during my time at Princeton and he is a really genuine person, he is not trying to ruin anyone's life. This incident is the result of an uncharacteristic blind spot in empathy: a mistake. I also have experience with the Princeton IRB on similar topics. The reality is that Princeton's IRB, and IRBs in general, are not equipped to deal with this sort of online research. IRBs were created as a reaction to…

I don’t doubt that Ross is a nice person, and I think he meant well. FWIW, I think this is a great thing to study and in other circumstances I’d be glad he’s doing it. But much as Ross didn’t intend for me to be hyperventilating, heart pounding as I imagine trying to explain to my wife how my little hobby is getting us sued, that’s exactly what happened. That was a whole awful lot of extra stress that I didn’t need.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#90

Post by ajkjk »

ineedasername wrote: post #44
ajkjk wrote: post #27

Earlier quoted context omitted.

How could you know it's a lie?

Because he said the response was overwhelming positive at the same time that he is dealing with anxious & irate recipients of his messages.

That sounds.. plausible?
Post reply on HN