CCPA Scam – Human subject research study conducted by Princeton University • Hacker News Board

Re: CCPA Scam – Human subject research study conducted by Princeton University

#281

Post by ineedasername » Sat, Dec 18, 2021, 5:40 PM UTC

fastball wrote: post #72

ineedasername wrote: post #44

Earlier quoted context omitted.

Because he said the response was overwhelming positive at the same time that he is dealing with anxious & irate recipients of his messages.

There is such a thing as a vocal minority. In fact it is a surprisingly common phenomenon.

That is true, although I think it would still be a poor choice of words to say "overwhelmingly" without tempering that with a note about assuaging the fears of some few that misunderstood the nature of the communication. Assuming he was aware that some were stressed and involving legal council.

The "secret shopper" justification for not informing participants ahead of time about the study can only take him so far, and I don't think it was necessary here to begin with. His research is to determine the policies in place at target recipients' organizations, and that doesn't require secrecy. In fact that justification undermines the exemption status of the study: he expected that people may react differently if they thought it was a user vs. a research study.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#282

Post by PeterisP » Sat, Dec 18, 2021, 5:44 PM UTC

Shaanie wrote: post #229

blagie wrote: post #224

Earlier quoted context omitted.

Sounds like a good place for a class action! Those legal fees ought to come out of Princeton.

Why? If that's indeed the law, then it's up to the website owner to comply. Whether it's Princeton or a private individual writing the email doesn't matter.

A key point is that it's not indeed the law. Many (probably most) of the recipients - including the author of the original article - are not actually required by Section 1798.130 of the California Civil Code do do anything even if it was a legitimate question from a real person, because their websites are far below the limits were those CCPA requirements start to apply.

The survey was making a fraudulent legal threat, requiring the recipient do some things for the benefit of the sender (namely, providing them with data for the study; also lying about how that data will be used) based on false allegations that there is a legal duty for them to respond in some certain time, while in fact there is none.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#283

Post by msla » Sat, Dec 18, 2021, 5:44 PM UTC

ad404b8a372f2b9 wrote: post #256

vmception wrote: post #196

Earlier quoted context omitted.

You realize that the internal regulation is wrong, right? Like the semantic distinction doesnt matter because nobody gives a fuck about Princeton’s organizational policy.

This is not Princeton's organizational policy or internal regulation, this is the regulatory definition of human subjects research as set by the government. Its semantic interpretation and the "about whom" requirement is exactly how you go about making a determination about whether your research is human subjects research.

Any research which involves human subjects is human subject research.

Nobody can disagree with that.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#284

Post by ad404b8a372f2b9 » Sat, Dec 18, 2021, 6:03 PM UTC

msla wrote: post #283

ad404b8a372f2b9 wrote: post #256

Earlier quoted context omitted.

This is not Princeton's organizational policy or internal regulation, this is the regulatory definition of human subjects research as set by the government. Its semantic interpretation and the "about whom" requirement is exactly how you go about making a determination about whether your research is human subjects research.

Any research which involves human subjects is human subject research. Nobody can disagree with that.

The US federal government does, as do many western governments. Research that involves humans usually comes under many delineations and sub-delineations with precise names that reflect specific ways in which the research takes place and the corresponding laws and regulations which the researchers must follow.

Determining which category a specific research project comes under usually involves checking specific criteria, in the US they have flowcharts, in Europe they have tables. Either way you can be sure a lot of people are going to be looking at it, most of whom have had to undertake ethics training as part of their career, and some of whom have spent their entire life studying these questions and seen them put to the test over hundreds of trials.

In that light, whether this category of research has got "human" in its name is not going to get you far wrt understanding the problem at hand.

source: I've undertaken interventionist medical research in the U.S and Europe.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#285

Post by ineedasername » Sat, Dec 18, 2021, 6:08 PM UTC

The researcher is using the "secret shopper" justification for why secrecy was needed here.

This completely undermines his receipt of exempt status for full review of human subjects in research. If he anticipated that behaviors of recipients would be different as a result of knowing whether or not the communication was an authentic request from a user.

This is a bit of a subtle point and wouldn't necessarily expect a PhD student to pickup: It's really something-- depending on how the application was presented-- that the IRB should have caught. I'm surprised that any IRB would grant an exempt status under those conditions because it fundamentally meant the study was not passive data collection such as a surveys, which usually are exempt.

Hopefully there is a public post mortem of how this approval went down. Considering the adverse impacts on display it was defacto a study that needed complete human subject review.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#286

Post by wtallis » Sat, Dec 18, 2021, 6:32 PM UTC

dr_dshiv wrote: post #218

eli wrote: post #151

Earlier quoted context omitted.

That's a very generous assumption. Especially in the context of an email sent under false pretenses and a false name and an anonymous domain. It's either a veiled threat or a serious error. Either way, this study needed more oversight.

Calls for more oversight are calls for more bureaucratic procedures and this whole situation is already bureaucracy gone mad.

> and this whole situation is already bureaucracy gone mad.

That sounds like you're referring to the CCPA itself as the bureaucracy gone mad, and probably have already made up your mind about what outcomes research like this will find. If so, that's not really a helpful attitude for this kind of discussion.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#287

Post by mindslight » Sat, Dec 18, 2021, 6:35 PM UTC

If this email had actually been sent down by a shakedown attorney, there would be absolutely no recourse. But the sender is part of an institution that admits outside criticism, and so there is an angle to strike back. Regardless of the research ethics here, it seems most of the outrage is precisely because this perp has a chance to be held accountable.

The real overarching problem is that anyone can be subject to life-altering lawsuits through the legal system, which will cost unreasonable amounts of time, money, and personal sanity. There's no hope for justice for small time actors, since the damage has been dealt out before ever seeing an informed decision by a judge. And even if you can invest enough to pay for a real judgement, the chance of getting awarded legal fees is slim, never mind rewards for lost time and emotional distress!

I don't think the problem is specifically the CCPA, since it does except small time actors. Rather the setup for the problem is a heavyweight legal system, draconian laws that do apply to individual actors, and the massive fan out caused by being globally connected. Anybody is basically one doxxing away from a barrage of legal demands, and our poor technical architectures basically guarantee anybody who puts themselves out there even slightly can be doxxed.

I don't know that there is a straightforward fix. The dynamics have been explored to death, and we seem to be trapped in this state because the real beneficiaries of the legal system (well-funded corporations and other professional actors) are happy to keep it this way. But this situation is a lightning rod that illustrates how outrage over it is growing. If it continues to not be reformed, eventually something is going to break catastrophically.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#288

Post by akira2501 » Sat, Dec 18, 2021, 6:40 PM UTC

southerntofu wrote: post #242

jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

In my understanding (from a french cultural context), asking people questions as part of a field study is not human subjects research. Ethical questions arise when you ask people to take specific actions in order to measure their reactions, not when you're asking about the status quo.

> Ethical questions arise when you ask people to take specific actions in order to measure their reactions

"Answer my questions within 45 days or I will sue you." That seems to read like a demand for a specific action.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#289

Post by mamaa-throwaway » Sat, Dec 18, 2021, 6:44 PM UTC

geofft wrote: post #250

mamaa-throwaway wrote: post #221

Earlier quoted context omitted.

Quoted post unavailable.

Fortunately there are a lot of other more-senior leaders in larger companies and longer-lasting non-profits who believe people can learn from their mistakes and there is no magical class of people who never make mistakes. Obviously mistakes were made here, and obviously at least the PIs should have known better - but deciding that you're going to keep the student on some mental blacklist forever, and instead find peo…

No post body was provided.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#290

Post by ineedasername » Sat, Dec 18, 2021, 6:54 PM UTC

karmanyaahm wrote: post #156

reilly3000 wrote: post #130

Let me help: We’re some students from Princeton trying to understand how businesses are responding to CCPA and GRPR requests. Could you help us with our study? How would you answer these questions? … The point is disclosure. It’s unethical to do otherwise, especially given that is about the use of data. I’d love for there to be more data published about the impacts of these policies, but please don’t use the tactics…

It is likely that quite a few people would lie if they knew they were going to be observed/studied or reported on. However, I'm sure they could've made the actual email less threatening and more friendly/ethical without revealing research intent. (or the intent to research this specfic aspect)

>people would lie

Possibly. And the IRB review process may allow for non disclosure under circumstances of that sort.

The problem is not merely that the IRB allowed non disclosure. It's that the IRB also granted an exemption from full review as human subject research. If the researcher expected that human behavior might change based on secrecy vs. disclosure then it is fundamentally not passive data collection.

But debating the secrecy issue or limits if what constitutes a human subject are all besides the point: the research protocol had an adverse impact on humans involved with the study. Not matter any other considerations, that makes the research defacto one that should have had full IRB review. Evaluating the potential for adverse impact is literally one of the foundational reasons for the existence of IRBs. The presence of an adverse impact is defacto proof that an exemption should not have been granted and that a full review should have been done to determine how the protocols could be tweaked to mitigate the issue.