Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

121–130 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#121

Post by kstrauser »

tzs wrote: post #103

Some jurisdictions consider IP addresses to be personal identifying information, and so if you run a web site that logs the IP addresses of visitors you should generally try to be aware of the privacy laws in any jurisdiction that might think its laws apply to you. These fall into three groups. First, there are those jurisdictions in which you and/or your site are actually located. You almost always have to care abou…

I wholly support the CCPA and GDPR. They have their issues, but they’re big steps in the right direction.

In the case of the CCPA, nothing I do is subject to it as it applies only to business, and only to those 1) making at least $25M in revenue, 2) handling the information of at least 50,000 Californians, or 3) making at least half their annual revenue from selling Californian’s personal information.

I’m running a free website as a hobby, have $0 in revenue, have way fewer than 50,000 users total, and again have $0 in revenue.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#122

Post by PeterisP »

User23 wrote: post #20

Serious question: why should academic institutions be held to a higher standard than commercial ones? Google and Facebook, to just name two, routinely perform human subject research without informed consent as a matter of course. That's what A/B testing is. Ethically speaking the fine print in the ToS obviously isn't actually informed consent, even if the law says it is. I don't see why being a for-profit company sho…

IMHO this is not the proper frame of question for this case - it's not about whether academic institutions should be held to this standard, but rather that they have publicly committed to doing so and have made it a binding requirement on their researchers, and in this case have violated this commitment.

A different aspect (not sure if it's relevant in this particular case) is that certain sources of research funding will impose certain ethical requirements, including specific process for human subject research - and that would apply also to for-profit companies if they would receive such funding for some project; and of course, the owners/shareholders of for-profit companies are also free to impose a higher ethical bar for e.g. A/B testing in their company, just as shareholders/owners currently are imposing various other ethical and social goals for their management and company policies.

But for the actual question of "why should academic institutions be held to a higher standard than commercial ones?" IMHO a good answer is "why not?" - I mean, if they do not object to having this higher ethical bar (and these institutions generally do not), that's entirely a good thing.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#123

Post by pessimizer »

ziddoap wrote: post #105
kiklion wrote: post #99

Earlier quoted context omitted.

Websites aren’t sentient beings, but they are more similar to commercial entities than people. Even if not intentional, websites gain traffic and can display ads. They have Google ranking. They have an audience and can get paid to share information with their audience. Would there be an issue if they sent out letters to businesses asking how they comply with a California regulation?

> Would there be an issue if they sent out letters to businesses asking how they comply with a California regulation? I think this is where you may be overlooking the context. People aren't mad they asked about compliance with a law, they are mad about the way it was asked: from fake personas implying legal threat, while cataloguing the replies for their study no one asked to be involved in.

That seems like a pretense.

The researcher was an actual human being, so all they would have to do to require a response is to register on the site before sending the email. If they had registered accounts, then requested their information be sent to them and required its deletion, it would have been an order of magnitude more work for the site owners than just sending answers about the process (which, if the site is subject to the law, should already be prepared.)

I think people are mad precisely because they were asked about compliance with a law. Largely because emails went out to sites that were not commercial or too small to be bound by the law, so they weren't aware of it and panicked.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#124

Post by DannyBee »

Paul-E wrote: post #73
kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

I've met Ross during my time at Princeton and he is a really genuine person, he is not trying to ruin anyone's life. This incident is the result of an uncharacteristic blind spot in empathy: a mistake. I also have experience with the Princeton IRB on similar topics. The reality is that Princeton's IRB, and IRBs in general, are not equipped to deal with this sort of online research. IRBs were created as a reaction to…

UCI, for example, seems to have a very well defined notion of human subjects research, and this would clearly meet it.

Let's look: https://services-web.research.uci.edu/compliance/human-resea...

"Any systematic investigation (including pilot studies, program evaluations, qualitative research), that is designed to develop or contribute to generalizable (scholarly) knowledge, and which uses living humans or identifiable private information about living humans qualifies as human subjects research. See Definition of Human Subjects Research for more information."

Down the rabbit hole to https://services-web.research.uci.edu/compliance/human-resea...

"Research is as a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. ...

Examples of systematic investigations include:

Surveys and questionnaires

"

So far, we got it in one.

I'll skip the part of whether it's generalizable - it's clearly intended to be here.

"A human subject means a living individual about whom an investigator (whether professional or student) conducting research:

Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or

...

Interaction includes communication or interpersonal contact between investigator and subject.

... "

Well, there we go.

Seems a lot more straightforward in various IRBs than you seem to say. As an aside, lots of IRB's also have mass email policies and are required to approve the text.

Now, maybe Princeton's IRB does not have as clear a definition. I can buy it, in fact!

But honestly, it doesn't seem that hard. If you are going to simulate fake emails to humans, for the purpose of gathering their responses, you are in fact, doing human subject research.

It also doesn't seem very hard to draw bright lines:

1. If you are interacting with people to see what their response is, even by email, they need to consent.

2. Do not deliberately deceive humans.

(You can even modify #2 to "do not deliberately deceive humans without an IRB explicitly understanding and weighing the cost/benefit" if you like, but most of the time, you actually do not need to deceive humans)

It's also really really hard to believe someone went to an IRB, and said "i'm going to survey people by sending them emails from fake people that seem mildly threatening, and seeing how they respond.", and an IRB was like "yeah, that seems okay, it's definitely not human subjects research".

It's up to the researchers to explain precisely what thy are doing in an accurate way. Saying you are surveying websites is totally inaccurate and confusing.

If a sociological researcher was like "whoa, i'm not emailing people asking for their family histories", that would be human subject research. Instead, i'm just "retrieving directed graph data from remote email addresses". I don't think that would go over very well.

Finally, as for not seeing the ethical dimension of their work, there is an easy fix for this (IMHO): Make ethics classes required. In fact, in lots of places, IRB's wont' review things if you haven't!

Re: CCPA Scam – Human subject research study conducted by Princeton University

#125

Post by seoaeu »

collectedparts wrote: post #117
kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

If I had to guess, the wording is in the study's FAQ is carefully chosen: "an application detailing our research methods" doesn't necessarily mean "an application with the verbatim text of the emails we planned to send, including our thinly veiled legal threat at the end." Not trying to turn this thread into a generic flameware against "academic" research methods, but this whole things seems oddly reminiscent of the…

The problem, like in that previous case, is that "human subject research" is a pretty narrowly defined category. It is mostly meant to cover testing out drugs on human subjects, and stuff like that. Notably, there is plenty of unethical research that doesn't qualify. So when an IRB gets a proposal that amounts to "I'm going to send some emails/interact with some folks online" their reply is likely to be along them lines "not our problem", and it becomes the responsibility of the research to assess the ethics of what they're doing.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#126

Post by PeterisP »

the_optimist wrote: post #21

This regulation explicitly tasks everyone with responsibilities. The human consequences of those tasks are something we each simply have to be aware of as citizens. I like this study because it renders the obligation explicit, and it raises awareness of the society we are building. It should happen with all regulation.

It does not task everyone with responsibilities, and a key flaw of this study is that it lied that a responsibility exists to people who, in fact did not have any - as the article explains why.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#127

Post by dang »

N00bN00b wrote: post #91
kstrauser wrote: post #38

Earlier quoted context omitted.

I'm just running a hobby website. I'm not at all used to receiving letters that bring up legal questions, then give me a time frame to reply as per a specific law. To my non-lawyer reading, that looks like someone's doing their homework to figure out how to drag me into court. Judging from a lot of the responses I've gotten from other recipients, I'm far from the only one.

I don't know buddy... Might be worth it to invest some time into anxiety/stress management. Meditation, keep an eye on your sleep, exercise, maybe go talk to someone. You're not supposed to have anxiety attacks over fairly lame sounding emails. Not to mention, it's just a matter of time before you get another (spam/scam) email like this. I get these quite frequently? I don't know how often, but definitely at least on…

Please don't cross into personal attack in HN comments.

https://news.ycombinator.com/newsguidelines.html

Re: CCPA Scam – Human subject research study conducted by Princeton University

#128

Post by zajio1am »

michaelhoffman wrote: post #112
Paul-E wrote: post #73

Earlier quoted context omitted.

I've met Ross during my time at Princeton and he is a really genuine person, he is not trying to ruin anyone's life. This incident is the result of an uncharacteristic blind spot in empathy: a mistake. I also have experience with the Princeton IRB on similar topics. The reality is that Princeton's IRB, and IRBs in general, are not equipped to deal with this sort of online research. IRBs were created as a reaction to…

Howdy Paul! I definitely see a problem in that some people think that if the IRB doesn't object to what they're doing, it's OK. But ethics is a responsibility of the entire research team, and the research team is usually far better placed to understand the implications of their research strategy than the IRB. The following are big problems here: - lack of informed consent - deception Researchers should be trained tha…

Aren't these issues common in many other societal studies, for example fake resume hiring studies?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#129

Post by dang »

0xFF0123 wrote: post #28
dang wrote: post #8

Earlier quoted context omitted.

We've gotten them too, including one as far back as last April.

Interesting, did HN respond, or was it considered spam?

We always respond, and we get a plethora of them. Far beyond this particular study.

There's a whole other blog post waiting to be written about the intersection between GDPR/CCPA threats and spam.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#130

Post by reilly3000 »

Let me help:

We’re some students from Princeton trying to understand how businesses are responding to CCPA and GRPR requests. Could you help us with our study? How would you answer these questions?

…

The point is disclosure. It’s unethical to do otherwise, especially given that is about the use of data. I’d love for there to be more data published about the impacts of these policies, but please don’t use the tactics of creeps in the process.

Post reply on HN