Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

151–160 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#151

Post by eli »

elliekelly wrote: post #137
kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

I don’t think it’s intended as a veiled threat of a lawsuit so much as a statement of the compliance requirements. Unfortunately it seems they misunderstood the scope which makes the it inaccurate. But if the statement was true and accurate I would just take it as a helpful reminder of the timeframe.

That's a very generous assumption. Especially in the context of an email sent under false pretenses and a false name and an anonymous domain.

It's either a veiled threat or a serious error. Either way, this study needed more oversight.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#152

Post by seoaeu »

gpm wrote: post #136
seoaeu wrote: post #131

Earlier quoted context omitted.

> When you do something to people to see how they act, it's a human experiment. That's not the official definition an IRB would use. The official definition is a lot less broad than a lot of people on this thread seem to think. It requires that are collecting biospecimens, identifiable private information, or certain kinds of information about a specific person. [0] [0]: https://grants.nih.gov/policy/humansubjects/re…

You're misreading it, the definition quoted on that page is very broad, specifically a human subject is the following with irrelevant clauses in or's removed and replaced with [or ...]: > a living individual about whom an investigator (whether professional or student) conducting research: > - Obtains information [or ...] through [... or] interaction with the individual, and uses, studies, or analyzes the information…

The key phrase is:

> a living individual about whom an investigator (whether professional or student) conducting research:

The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a good hint

Re: CCPA Scam – Human subject research study conducted by Princeton University

#153

Post by eli »

RubberSoul wrote: post #150
jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

This is incorrect. It's only human subjects research if the researcher is obtaining data about a human. This is the "about whom" requirement. A classic example is calling a business and asking someone about the products and prices they offer. That's not human subjects research.

Who is the subject of the emails sent to personal domains?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#154

Post by RubberSoul »

tw04 wrote: post #147
malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

How would a website “respond” without human interaction? If all they were testing was whether or not a website had an automated response to emails with ccpa in the subject or body they could have included a disclaimer at the end of the email about what they were doing. This was clearly seeking a human response and is a human experiment.

That's not the definition of human subjects research. Not everything that involves a human responding to questions is human subjects research. A lot of comments in this thread are uninformed about the relevant definitions.

You can think the study is poorly designed, unethical, etc. But if they're not obtaining data about a living individual, then it's not human subjects research.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#155

Post by wtallis »

seoaeu wrote: post #152
gpm wrote: post #136

Earlier quoted context omitted.

You're misreading it, the definition quoted on that page is very broad, specifically a human subject is the following with irrelevant clauses in or's removed and replaced with [or ...]: > a living individual about whom an investigator (whether professional or student) conducting research: > - Obtains information [or ...] through [... or] interaction with the individual, and uses, studies, or analyzes the information…

The key phrase is: > a living individual about whom an investigator (whether professional or student) conducting research: The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a…

Can you explain a bit more why you added emphasis to "about whom" in the clause you quoted? I don't see how those two words create any kind of exception; this research gathered information about how the humans behaved in response to the requests and threats.

Are you accidentally reading an "is" into that clause to interpret it as "about whom an investigator is conducting research"? What matters is not whether the researcher considers the human to be the target of the research, but whether the human (or their privacy) is actually affected by the research.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#156

Post by karmanyaahm »

reilly3000 wrote: post #130

Let me help: We’re some students from Princeton trying to understand how businesses are responding to CCPA and GRPR requests. Could you help us with our study? How would you answer these questions? … The point is disclosure. It’s unethical to do otherwise, especially given that is about the use of data. I’d love for there to be more data published about the impacts of these policies, but please don’t use the tactics…

It is likely that quite a few people would lie if they knew they were going to be observed/studied or reported on. However, I'm sure they could've made the actual email less threatening and more friendly/ethical without revealing research intent. (or the intent to research this specfic aspect)

Re: CCPA Scam – Human subject research study conducted by Princeton University

#157

Post by RubberSoul »

eli wrote: post #153
RubberSoul wrote: post #150

Earlier quoted context omitted.

This is incorrect. It's only human subjects research if the researcher is obtaining data about a human. This is the "about whom" requirement. A classic example is calling a business and asking someone about the products and prices they offer. That's not human subjects research.

Who is the subject of the emails sent to personal domains?

Not sure I follow your question.

An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy.

An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website.

I realize that may seem like a subtle difference, but it's an important distinction from an IRB perspective. For reference, and because a lot of people seem confused on this thread, here's what the human subjects research training at my university says about this...

"...some research that involves interactions with people does not meet the regulatory definition of research with human subjects because the focus of the investigation is not the opinions, characteristics, or behavior of the individual. In other words, the information being elicited is not about the individual ('whom'), but rather is about 'what.' For example, if a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter, that inquiry would not meet the definition of research with human subjects because the information requested is not 'about' the director. If the researcher interviewed the director about her training, experience, and how she defines the problem of battering, then the inquiry becomes about her - and therefore 'about whom.'"

Re: CCPA Scam – Human subject research study conducted by Princeton University

#158

Post by adminprof »

seoaeu wrote: post #152
gpm wrote: post #136

Earlier quoted context omitted.

You're misreading it, the definition quoted on that page is very broad, specifically a human subject is the following with irrelevant clauses in or's removed and replaced with [or ...]: > a living individual about whom an investigator (whether professional or student) conducting research: > - Obtains information [or ...] through [... or] interaction with the individual, and uses, studies, or analyzes the information…

The key phrase is: > a living individual about whom an investigator (whether professional or student) conducting research: The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a…

This is actually the most technically correct answer on this page. Everyone is going by their own opinions about definitions of what constitutes human subjects research, rather than starting from the primary sources. IRB guidelines are dictated by the federal government "common rule", a common standard adopted by all institutions that receive federal funding.

"about whom" is a key criteria from the federal government to determine whether something fits the definition of human subjects research. Here's a quote from HHS:

"The phrase ‘about whom’ is important. A human subject is the person that the information is about, not necessarily the person providing the information. In the case of biospecimens, the human subject is the person from whom the specimen was taken."

https://www.hhs.gov/ohrp/sites/default/files/OHRP-HHS-Learni...

Reading that, it's clear that the Princeton study does not fit the definition of human subjects research. The complainants may be able to sue for damages to the university, but not because the study was improperly classified as human subjects.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#159

Post by complypls »

elliekelly wrote: post #137
kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

I don’t think it’s intended as a veiled threat of a lawsuit so much as a statement of the compliance requirements. Unfortunately it seems they misunderstood the scope which makes the it inaccurate. But if the statement was true and accurate I would just take it as a helpful reminder of the timeframe.

The context is important: if you deal with user support (especially in the context of privacy) then someone quoting law at you is a huge red flag for an impending nightmare. I’ve dealt with irate users who actually did go as far as to file lawsuits and the email from this “study” activated my fight or flight response because of how much it (unintentionally?) mirrors the way angry litigious internet users communicate. The only worse phrase to read is “free speech”.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#160

Post by wtallis »

nyolfen wrote: post #134
nikitaga wrote: post #86

Earlier quoted context omitted.

* When you do something to people to see how they act, it's a human experiment. The purpose of this study was officially "to understand how websites would respond to real users" * The participants / subjects of the study are people, not "websites" as the study claims. Websites don't read and respond to emails, people do. * The participants of this study were selected without their consent * The participants were not…

this might be the definition of human experiment in everyday speech but it is not for the purposes of an IRB -- they would have to be collecting PII from the subjects

Collecting PII is a sufficient condition to qualify it as human subject research, but it is not a necessary condition.
Post reply on HN