Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

161–170 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#161

Post by jameshart »

pseudalopex wrote: post #140
danaris wrote: post #101

Earlier quoted context omitted.

> An email asking an organization for answers to questions is human experimentation? Organizations are made up of humans. Human experimentation is very broadly defined, for IRB purposes. As I understand it, if you're going to be asking humans to interact with researchers, in any way, and gathering data based on those interactions, that's human subjects research, and requires reasonable scrutiny from the IRB. Source:…

It could be your university's definition. Princeton's definition doesn't include information about organizations.[1] It would include information about solo projects arguably. [1] https://researchdata.princeton.edu/research-lifecycle-guide/...

This seems pretty cut-and-dried to me.

> A human subject means a living individual about whom an investigator (whether professional or student) who is conducting research:

> (i) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens

The information they were looking for is 'how does this person respond when they receive an email threatening legal action under CCPA?'

A human subject means ... a living individual ... about whom an investigator... obtains information... through intervention or interaction... and studies... the information.

That they mistakenly thought they were investigating how "an organization" responds when they receive an email is based on an erroneous assumption that an organization is itself an autonomous, sentient entity whose behavior can be studied independently of its human constituents.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#162

Post by TedDoesntTalk »

Paul-E wrote: post #132
michaelhoffman wrote: post #118

Earlier quoted context omitted.

As a research group leader, I find it unfortunate that the grad student seems to be the public face of this and is therefore attracting most of the ire. Feels like the student is being thrown under the bus, and responsibility for ensuring the study is conducted ethically should ultimately be that of the principal investigator.

Thank you for making this point. I didn't articulate it, but this is part of why I felt I had to say something.

I hope this fellow Ross does not become suicidal or otherwise depressed when he sees the weight of the internet coming down on him for this faux pas. Ross, none of this wil matter in a year. Or 5 years.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#163

Post by munchler »

seoaeu wrote: post #152
gpm wrote: post #136

Earlier quoted context omitted.

You're misreading it, the definition quoted on that page is very broad, specifically a human subject is the following with irrelevant clauses in or's removed and replaced with [or ...]: > a living individual about whom an investigator (whether professional or student) conducting research: > - Obtains information [or ...] through [... or] interaction with the individual, and uses, studies, or analyzes the information…

The key phrase is: > a living individual about whom an investigator (whether professional or student) conducting research: The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a…

It's pretty clear that the living individuals about whom the investigators were conducting research are the operators of the websites targeted by the study. The researchers perhaps misled their IRB by stating that they were studying the behavior of "websites", rather than people, but websites don't read and respond to email.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#164

Post by kstrauser »

morpheuskafka wrote: post #142

> I’m not confident that I could remain civil when talking to the person who inflicted this on me without my permission or knowledge. I'm not sure how long anyone can last in business if this is their response to receiving a kind-of-threat of a lawsuit. I get that it may be a hassle but businesses get these kind of garbage threats frequently and often can be ignored unless and until they actually file something. If t…

I’m not handling this in a business context. They emailed my personal address with a threat about my personal zero-revenue server I maintain for the fun of it.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#165

Post by wildrhythms »

elliekelly wrote: post #137
kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

I don’t think it’s intended as a veiled threat of a lawsuit so much as a statement of the compliance requirements. Unfortunately it seems they misunderstood the scope which makes the it inaccurate. But if the statement was true and accurate I would just take it as a helpful reminder of the timeframe.

What world do you live in that regular webmaster inquiry emails are footnoted with a reference to a law number?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#166

Post by tw04 »

RubberSoul wrote: post #154
tw04 wrote: post #147

Earlier quoted context omitted.

How would a website “respond” without human interaction? If all they were testing was whether or not a website had an automated response to emails with ccpa in the subject or body they could have included a disclaimer at the end of the email about what they were doing. This was clearly seeking a human response and is a human experiment.

That's not the definition of human subjects research. Not everything that involves a human responding to questions is human subjects research. A lot of comments in this thread are uninformed about the relevant definitions. You can think the study is poorly designed, unethical, etc. But if they're not obtaining data about a living individual, then it's not human subjects research.

You appear to be the one uninformed about the definition of human subject research.

>But if they're not obtaining data about a living individual, then it's not human subjects research.

Sure, if you completely ignore the other half of the definition, per the NIH:

https://grants.nih.gov/policy/humansubjects/research.htm

> Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens;

They are absolutely collecting information to analyze by interacting with the individual.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#167

Post by detaro »

elliekelly wrote: post #137
kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

I don’t think it’s intended as a veiled threat of a lawsuit so much as a statement of the compliance requirements. Unfortunately it seems they misunderstood the scope which makes the it inaccurate. But if the statement was true and accurate I would just take it as a helpful reminder of the timeframe.

I would guess as an attorney you're more used to that style of communication than a random blogger or small entity. Citing law has very different signaling purpose and effect in different contexts.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#168

Post by adminprof »

scblock wrote: post #102

I thought a friend Jim, a professor of Writing, Rhetoric, and Digital Studies at the University of Kentucky, had a good take on this: https://twitter.com/ridolfoj/status/1471536878658719748

He seems to have good intentions, but does not seem to have knowledge of IRB which may make this situation worse.

Specifically, he confuses "does not constitute human subjects research" with "exemption" which is a pretty big difference and anyone who works with human subjects should know this.

From his Twitter thread, "Update: They are now saying they have an exemption. They have not made any forms available or explained the lack of informed consent."

Exemptions are protocols that have been reviewed, and deemed exempt based on one of 8 very specific criteria. Studies deemed not constituting human subjects research are returned by the IRB, and not considered reviewed.

Given that the authors actually said "...to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research" this is clearly NOT an exemption, and informed consent is not a consideration as far as the IRB is concerned.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#169

Post by teraflop »

RubberSoul wrote: post #157
eli wrote: post #153

Earlier quoted context omitted.

Who is the subject of the emails sent to personal domains?

Not sure I follow your question. An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy. An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website. I realize that may seem like a subtle difference, but it's an important distinction from an IRB p…

I don't buy that interpretation. That is, I'm willing to believe that's how your university interprets the regulations, but I personally think it's perverse and unethical when applied to this situation.

When you deliberately deceive someone in order to obtain information that you think they would be otherwise unwilling to give you, the response you get back is as much "about" their behavior in response to your deception as it is about the subject of your inquiry. (And if the researchers in this case didn't think the deception would make their targets more willing to cooperate, why the threatening language?)

That doesn't necessarily mean this kind of research should never be allowed, but it should definitely go through an IRB's oversight.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#170

Post by wtallis »

adminprof wrote: post #158
seoaeu wrote: post #152

Earlier quoted context omitted.

The key phrase is: > a living individual about whom an investigator (whether professional or student) conducting research: The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a…

This is actually the most technically correct answer on this page. Everyone is going by their own opinions about definitions of what constitutes human subjects research, rather than starting from the primary sources. IRB guidelines are dictated by the federal government "common rule", a common standard adopted by all institutions that receive federal funding. "about whom" is a key criteria from the federal government…

The bit you've quoted is intended to clarify that "about whom" means the subject is the patient, even if the researcher gets the information indirectly through the patient's doctor. Earlier in the document you linked, it states:

> If for the purpose of a research study [...] An investigator [...] interacts with a living individual, [...] Then The research likely involves human subjects.

What's up for debate here is whether this research qualifies for one of the specific exemptions in the regulation. The general definition in the regulation is broad enough to include all interaction with living humans that produces information used for the study, and is only narrowed by later enumerated exemptions.

Post reply on HN