Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

191–200 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#191

Post by pseudalopex »

DannyBee wrote: post #124
Paul-E wrote: post #73

Earlier quoted context omitted.

I've met Ross during my time at Princeton and he is a really genuine person, he is not trying to ruin anyone's life. This incident is the result of an uncharacteristic blind spot in empathy: a mistake. I also have experience with the Princeton IRB on similar topics. The reality is that Princeton's IRB, and IRBs in general, are not equipped to deal with this sort of online research. IRBs were created as a reaction to…

UCI, for example, seems to have a very well defined notion of human subjects research, and this would clearly meet it. Let's look: https://services-web.research.uci.edu/compliance/human-resea... "Any systematic investigation (including pilot studies, program evaluations, qualitative research), that is designed to develop or contribute to generalizable (scholarly) knowledge, and which uses living humans or identifiabl…

I think their point was IRBs say information isn't about an individual when the individual would say it is. Everything you quoted depends on the word about. And UCI's policy refers to US regulations. Those regulations contain surprisingly broad exemptions.[1]

People talk about emailing web sites any time they don't know if it's a person or a company in my experience. And ethics classes don't give everyone the same understanding of ethics.

[1] https://www.hhs.gov/ohrp/regulations-and-policy/regulations/...

Re: CCPA Scam – Human subject research study conducted by Princeton University

#192

Post by [deleted] »

ajkjk wrote: post #93
ineedasername wrote: post #59

Earlier quoted context omitted.

Because receiving a letter citing chapter & verse of the legal code is generally never the precursor to a nice friendly chat. The actual-not-fake-researcher (instead of fictional people) could have sent a nice friendly request saying, "I'm a PhD candidate working on public policy in the tech sector. Could you please answer the following questions regarding your process of CCPA compliance, if applicable"

Sure, of course not, but a near panic attack still seems a bit... out of proportion.

[deleted]

Re: CCPA Scam – Human subject research study conducted by Princeton University

#193

Post by Miner49er »

ineedasername wrote: post #59
ajkjk wrote: post #30

Earlier quoted context omitted.

I don't understand why you reacted so strongly. I feel like it's not a big deal to receive a message like that; what am I missing?

Because receiving a letter citing chapter & verse of the legal code is generally never the precursor to a nice friendly chat. The actual-not-fake-researcher (instead of fictional people) could have sent a nice friendly request saying, "I'm a PhD candidate working on public policy in the tech sector. Could you please answer the following questions regarding your process of CCPA compliance, if applicable"

Legal threats are a common occurance nowadays though. I get calls weekly saying a warrant had been issued for my arrest or that my "SSN is about to be revoked".

The email also clearly says they are not sending a request at this time and it seems nicely written to me. I guess I don't get why this is on HN and everyone is so livid about it.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#194

Post by ineedasername »

ajkjk wrote: post #93
ineedasername wrote: post #59

Earlier quoted context omitted.

Because receiving a letter citing chapter & verse of the legal code is generally never the precursor to a nice friendly chat. The actual-not-fake-researcher (instead of fictional people) could have sent a nice friendly request saying, "I'm a PhD candidate working on public policy in the tech sector. Could you please answer the following questions regarding your process of CCPA compliance, if applicable"

Sure, of course not, but a near panic attack still seems a bit... out of proportion.

If you have run a business small enough that you don't have a lawyer on standby then you might understand a little better.

I have, and received a real legal threat. A bit of panic as you contemplate the financial devastation & wreckage it might leave your life in... well, a little bit of panic is actually a pretty reasonable response there.

If you've been in that situation and been totally calm about it then that's a good thing for you, but that's not the common response for someone contemplating a life-changing encounter with the legal system.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#195

Post by [deleted] »

RubberSoul wrote: post #157
eli wrote: post #153

Earlier quoted context omitted.

Who is the subject of the emails sent to personal domains?

Not sure I follow your question. An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy. An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website. I realize that may seem like a subtle difference, but it's an important distinction from an IRB p…

[deleted]

Re: CCPA Scam – Human subject research study conducted by Princeton University

#196

Post by vmception »

RubberSoul wrote: post #150
jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

This is incorrect. It's only human subjects research if the researcher is obtaining data about a human. This is the "about whom" requirement. A classic example is calling a business and asking someone about the products and prices they offer. That's not human subjects research.

You realize that the internal regulation is wrong, right?

Like the semantic distinction doesnt matter because nobody gives a fuck about Princeton’s organizational policy.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#197

Post by toast0 »

pessimizer wrote: post #123
ziddoap wrote: post #105

Earlier quoted context omitted.

> Would there be an issue if they sent out letters to businesses asking how they comply with a California regulation? I think this is where you may be overlooking the context. People aren't mad they asked about compliance with a law, they are mad about the way it was asked: from fake personas implying legal threat, while cataloguing the replies for their study no one asked to be involved in.

That seems like a pretense. The researcher was an actual human being, so all they would have to do to require a response is to register on the site before sending the email. If they had registered accounts, then requested their information be sent to them and required its deletion, it would have been an order of magnitude more work for the site owners than just sending answers about the process (which, if the site is…

If the researcher is at Princeton, which (last I checked) is neither in the EU nor in California, they may not have standing to compel a response under GDPR or CCPA, both of which apply to data about persons within their territories, as I understand it (although interpretations certainly vary).

According to the linked blog, the owner wasn't covered by CCPA anyway as I suspect is the case for a lot of the recipients, so there would still not be a response required. Some of the sites may have data exports and account deletion clearly available to users anyway, in which case no human interaction would be needed; but the research wasn't looking for that.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#198

Post by labcomputer »

neworbit wrote: post #61
ineedasername wrote: post #26

Ross Teixeira, the PhD student that did this, had the brazen nerve to post this lie on Twitter: Responses to the study have been overwhelmingly positive, and I particularly appreciate the notes of encouragement that some websites have sent. We look forward to sharing results in the coming year, with the goals of identifying best practices and informing future policy making. https://mobile.twitter.com/RossTeixeira/sta…

Would anyone be interested in organizing a class action lawsuit against Ross Teixeira and Princeton?

Is the point to get money or stop this from happening again?

If it’s the latter, I wonder if it would be more effective to bring this incident (and the apparent ineffectiveness of Princeton’s IRB) to the attention of the NIH. I would think the prospect of putting all that grant money in jeopardy would cause people in high places to take notice.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#199

Post by wtallis »

pseudalopex wrote: post #188
jameshart wrote: post #161

Earlier quoted context omitted.

This seems pretty cut-and-dried to me. > A human subject means a living individual about whom an investigator (whether professional or student) who is conducting research: > (i) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens The information they were looking for is 'how does this person respond when they recei…

I think individuals in a research group in a department in a university in a city in a state in a republic know organizations contain individuals. Your interpretation would make most of the definition redundant. They could just say any individual an investigator interacts with. IRBs don't interpret it like that.

> They could just say any individual an investigator interacts with.

Not quite, because the definition needs to also encompass individuals that researchers acquire information about without directly interacting—eg. getting patient data from a healthcare provider.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#200

Post by wtallis »

Miner49er wrote: post #193
ineedasername wrote: post #59

Earlier quoted context omitted.

Because receiving a letter citing chapter & verse of the legal code is generally never the precursor to a nice friendly chat. The actual-not-fake-researcher (instead of fictional people) could have sent a nice friendly request saying, "I'm a PhD candidate working on public policy in the tech sector. Could you please answer the following questions regarding your process of CCPA compliance, if applicable"

Legal threats are a common occurance nowadays though. I get calls weekly saying a warrant had been issued for my arrest or that my "SSN is about to be revoked". The email also clearly says they are not sending a request at this time and it seems nicely written to me. I guess I don't get why this is on HN and everyone is so livid about it.

> I guess I don't get why this is on HN and everyone is so livid about it.

I think this kind of scam would end up on HN even if it was a bunch of Nigerians doing it, and what's making people angry instead of merely taking note while rolling their eyes at scammers stooping to a new low is the fact that it's respectable universities rather than Nigerians.

Post reply on HN