Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

171–180 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#171

Post by gpm »

adminprof wrote: post #158
seoaeu wrote: post #152

Earlier quoted context omitted.

The key phrase is: > a living individual about whom an investigator (whether professional or student) conducting research: The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a…

This is actually the most technically correct answer on this page. Everyone is going by their own opinions about definitions of what constitutes human subjects research, rather than starting from the primary sources. IRB guidelines are dictated by the federal government "common rule", a common standard adopted by all institutions that receive federal funding. "about whom" is a key criteria from the federal government…

Information about the people contacted was collected and analyzed, it's a study fundamentally about how they react to this email, it is not (just) about a third party. In the case of websites run by a single individual (such as OP) there is no third party at all, but in all cases information about the first party was being collected and analyzed.

To be a bit more pithy, here is one example of such an analysis (admittedly, I'm not sure comments on twitter count): https://twitter.com/RossTeixeira/status/1471249559879929861

Re: CCPA Scam – Human subject research study conducted by Princeton University

#172

Post by Thorrez »

RubberSoul wrote: post #157
eli wrote: post #153

Earlier quoted context omitted.

Who is the subject of the emails sent to personal domains?

Not sure I follow your question. An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy. An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website. I realize that may seem like a subtle difference, but it's an important distinction from an IRB p…

I think one problem is that with small websites run by a single person or small group, a person can feel the website is an extension of herself. So a question about the website in some way becomes a question about the person.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#173

Post by patmcc »

nikitaga wrote: post #86
malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

* When you do something to people to see how they act, it's a human experiment. The purpose of this study was officially "to understand how websites would respond to real users" * The participants / subjects of the study are people, not "websites" as the study claims. Websites don't read and respond to emails, people do. * The participants of this study were selected without their consent * The participants were not…

I think there's a scale issue here - if they email an entity that the CCPA actually applies to (for profit, >$25mil revenue, etc.) then it's likely going to a customer service rep who has a policy to follow and doesn't have any skin in the game, and at that point I'd agree it's not really a human experiment. Like if they emailed google with these questions, I wouldn't bat an eye.

When they email a single person who runs a website, that's very different.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#175

Post by wtallis »

RubberSoul wrote: post #157
eli wrote: post #153

Earlier quoted context omitted.

Who is the subject of the emails sent to personal domains?

Not sure I follow your question. An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy. An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website. I realize that may seem like a subtle difference, but it's an important distinction from an IRB p…

> An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy.

No, that's an example of human subjects research that may be exempt from the regulations due to specific reasons, such as by only interacting with subjects through surveys and interviews (while adhering to further restrictions, that this research probably runs afoul of since it's not anonymous).

> For example, if a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter, that inquiry would not meet the definition of research with human subjects because the information requested is not 'about' the director.

What a terrible example. They've only demonstrated that the director does not qualify as a human subject, while ignoring the question of whether the women staying at the shelter would qualify as human subjects!

Re: CCPA Scam – Human subject research study conducted by Princeton University

#176

Post by doublepg23 »

earleybird wrote: post #144

Bryan Cantrill (DTrace etc) has a good talk on ethics in software engineering[0]. Skip to 12:29 where he recalls Facebook in 2011 experimenting with users news feeds. [0] https://www.youtube.com/watch?v=0wtvQZijPzg

Is there ever a bad Cantrill talk? thanks for the link.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#177

Post by KingMachiavelli »

I don't really see the issue with this. Nothing stops someone from mass sending fake CCPA/GDPR inquiry emails. It seems like a perfectly reasonable thing to ask.

Is asking people their favorite type of ice cream unethical because a very small percentage or going to have a negative mental/emotional reaction?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#178

Post by adminprof »

wtallis wrote: post #170
adminprof wrote: post #158

Earlier quoted context omitted.

This is actually the most technically correct answer on this page. Everyone is going by their own opinions about definitions of what constitutes human subjects research, rather than starting from the primary sources. IRB guidelines are dictated by the federal government "common rule", a common standard adopted by all institutions that receive federal funding. "about whom" is a key criteria from the federal government…

The bit you've quoted is intended to clarify that "about whom" means the subject is the patient, even if the researcher gets the information indirectly through the patient's doctor. Earlier in the document you linked, it states: > If for the purpose of a research study [...] An investigator [...] interacts with a living individual, [...] Then The research likely involves human subjects. What's up for debate here is w…

Not at all,

1) this is clearly not an exempt study, which is a category of its own that the IRB reviews and makes a judgment on. The authors would immediately have been able to point out the protocol number of the exempt study if it were exempt. Rather it's not considered human subjects as the authors clearly state on their FAQ.

2) it seems like you're thrown off by the example, because if you ended your sentence as "The bit you've quoted is intended to clarify that "about whom" means the subject is the patient" then we would be in agreement, and it'd be more obvious that the subject is, in fact, the website's policies/procedures. Here's an excerpt from the written text of the common rule,

"“About whom” – a human subject research project requires the data received from the living individual to be about the person."

https://hso.research.uiowa.edu/defining-human-subjects

Re: CCPA Scam – Human subject research study conducted by Princeton University

#179

Post by earleybird »

doublepg23 wrote: post #176
earleybird wrote: post #144

Bryan Cantrill (DTrace etc) has a good talk on ethics in software engineering[0]. Skip to 12:29 where he recalls Facebook in 2011 experimenting with users news feeds. [0] https://www.youtube.com/watch?v=0wtvQZijPzg

Is there ever a bad Cantrill talk? thanks for the link.

Anecdotally - no, I've yet to come across one.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#180

Post by wildrhythms »

the_optimist wrote: post #25
apignotti wrote: post #5

Yep, we got the same. Seriously unethical behavior.

Please explain why this is unethical. The worst case is that you’re simply subject to the law. Presumably you’re abiding by the law. edit: I'm playing devil's advocate. I think the law sucks, the study is weird, and I empathize directly with the blog author. That said, downvoting to 'disagree' without explaining your reasoning is below the grade of this fine institution.

This 'study' is effectively a survey. Can you explain what ethical survey 1) does not inform its participants that it's a survey, 2) poses as a fake individual persona to conceal the identity of the surveyor, 3) cites either knowingly or unknowingly scary legal jargon to coerce participation, 4) does not make any attempt to disclose confidentiality?
Post reply on HN