CCPA Scam – Human subject research study conducted by Princeton University • Hacker News Board

Re: CCPA Scam – Human subject research study conducted by Princeton University

#241

Post by southerntofu » Sat, Dec 18, 2021, 1:30 PM UTC

eli wrote: post #145

kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

The false legal threat is particularly galling, but this absolutely should have gone through IRB even without it. Someone should have had to at least consider the impact on recipients of the messages before they were sent. IRB review is typically required even for just simple research surveys.

How is a reminder of the law a legal threat? More specifically when you feel like you're not impacted by this law, it's as far from a legal threat as could be.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#242

Post by southerntofu » Sat, Dec 18, 2021, 1:33 PM UTC

jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

In my understanding (from a french cultural context), asking people questions as part of a field study is not human subjects research. Ethical questions arise when you ask people to take specific actions in order to measure their reactions, not when you're asking about the status quo.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#243

Post by dsr_ » Sat, Dec 18, 2021, 1:37 PM UTC

southerntofu wrote: post #241

eli wrote: post #145

Earlier quoted context omitted.

The false legal threat is particularly galling, but this absolutely should have gone through IRB even without it. Someone should have had to at least consider the impact on recipients of the messages before they were sent. IRB review is typically required even for just simple research surveys.

How is a reminder of the law a legal threat? More specifically when you feel like you're not impacted by this law, it's as far from a legal threat as could be.

Either there's another nonconsensual experiment underway or a legal threat scam involving security bounties, because the phrasing of this Princeton email is very similar to the security bounty emails I keep getting... at my personal, static, blog.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#244

Post by 1f60c » Sat, Dec 18, 2021, 1:37 PM UTC

h2odragon wrote: post #237

So it'd be perfectly reasonable to conduct an experiment to see how certain Princeton researches react to emails telling them bad things are going to happen to them and their families and pets, right? "If thrown from a tall building how high do you think you'd bounce?"

No, it wouldn't.

One is a polite but firm email reminding a website administrator of their obligations under the law, and the other is a thinly-veiled threat of bodily harm.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#245

Post by 1f60c » Sat, Dec 18, 2021, 1:41 PM UTC

I don't understand the outrage. Even knowing the context, the email is polite, to the point, tells the website administrator exactly what they need to do (something they are already legally required to do), and gives them ample time to do so.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#246

Post by throwawaytod85 » Sat, Dec 18, 2021, 1:43 PM UTC

Anyone else may want to preemptively opt-out from future studies. Info from https://privacystudy.cs.princeton.edu/

"Please contact the lead researcher for this study, Ross Teixeira (rapt@princeton.edu), if you have any questions, believe you received an email in error, or would like to opt out of any future communication related to the study."

Re: CCPA Scam – Human subject research study conducted by Princeton University

#247

Post by rtpg » Sat, Dec 18, 2021, 1:48 PM UTC

southerntofu wrote: post #242

jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

In my understanding (from a french cultural context), asking people questions as part of a field study is not human subjects research. Ethical questions arise when you ask people to take specific actions in order to measure their reactions, not when you're asking about the status quo.

Lying about who you are and pretending that you are allowed a certain thing… I mean legally it’s not fraud but it sure feels like it!

Imagine someone showing up to your office building pretending to have an interview , walking into the office waiting room, then walking out saying “oh, just an experiment!”

“It’s just an email” the ease of the mode of communication here is not super relevant to the action, right?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#248

Post by UncleMeat » Sat, Dec 18, 2021, 1:49 PM UTC

aviancrane wrote: post #115

Seems like a career academic with no experience in the real world playing around like this is some kind of game. I'm sure they meant no harm, because they don't consider anyone "participating" to be anything more than a potential subject in their agenda to get a good review on their paper. That letter and their social media posts are nothing more than a facade to maximize return with no consideration of impact. Total…

Mayer has a JD and is licensed in CA (I don't know about NJ), has worked for at least one US Senate office, and has been so involved in actual practical privacy work that ad companies pressured the president of Stanford to expel him for his legitimate work on DNT.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#249

Post by UncleMeat » Sat, Dec 18, 2021, 1:56 PM UTC

nikitaga wrote: post #86

malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

* When you do something to people to see how they act, it's a human experiment. The purpose of this study was officially "to understand how websites would respond to real users" * The participants / subjects of the study are people, not "websites" as the study claims. Websites don't read and respond to emails, people do. * The participants of this study were selected without their consent * The participants were not…

> When you do something to people to see how they act, it's a human experiment.

All AB testing is a human experiment?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#250

Post by geofft » Sat, Dec 18, 2021, 2:17 PM UTC

mamaa-throwaway wrote: post #221

TedDoesntTalk wrote: post #162

Earlier quoted context omitted.

I hope this fellow Ross does not become suicidal or otherwise depressed when he sees the weight of the internet coming down on him for this faux pas. Ross, none of this wil matter in a year. Or 5 years.

Quoted post unavailable.

Fortunately there are a lot of other more-senior leaders in larger companies and longer-lasting non-profits who believe people can learn from their mistakes and there is no magical class of people who never make mistakes. Obviously mistakes were made here, and obviously at least the PIs should have known better - but deciding that you're going to keep the student on some mental blacklist forever, and instead find people who haven't yet had the chance to learn from their mistakes, is short-sighted.

You've probably heard the story of IBM's Thomas Watson being asked if he was going to fire someone who made a mistake that cost the company $600,000 in lost sales. No, he said - I just spent $600,000 training you! Why would I want someone else to benefit from that training?

(Also, the fact that you are aware there might be enduring consequences to this comment if you associated it with your name, and are therefore keeping your name off of it, is ... interesting. My advice to Ross Texiera is that, until proven otherwise, the commenter above is some random troll in high school who doesn't know how the real world works. If they wanted the threat to be taken seriously, they'd post it on LinkedIn.)