Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

321–330 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#321

Post by southerntofu »

paranoidrobot wrote: post #316
southerntofu wrote: post #241

Earlier quoted context omitted.

How is a reminder of the law a legal threat? More specifically when you feel like you're not impacted by this law, it's as far from a legal threat as could be.

> How is a reminder of the law a legal threat? In the same way that "This is a nice place you've got here, it'd be a real shame if something were to happen to it", when spoken by a Mafia enforcer is most definitely a threat. It's not, outright, threatening to bring a lawsuit, however the language of that last paragraph is definitely something which you'd expect to see from a lawyer in preparation for such legal actio…

I'm not a lawyer, and i've both sent and received email like that over the years, none of which ever produced a legal action. That's standard procedure for private data requests.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#322

Post by stavros »

I got one of these emails. Not being in the US, my usual reaction is "sue me", especially when someone emails me for a data access request on a static website. I can imagine how stressful it must be if you're actually in the US and there's a probability that you could actually be sued, though.

For shame, Princeton.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#323

Post by rolandm »

Maybe the principal investigator Jonathan Mayer [1] should have read his own paper [2] about dark patterns. From the abstract "There is a rapidly growing literature on dark patterns [...] that researchers deem problematic" [2].

This research looks like a dark pattern to me.

[1] https://privacystudy.cs.princeton.edu/ [2] https://dl.acm.org/doi/abs/10.1145/3411764.3445610

Re: CCPA Scam – Human subject research study conducted by Princeton University

#324

Post by [deleted] »

southerntofu wrote: post #319
zebraflask wrote: post #312

Earlier quoted context omitted.

It's obviously implying a threat if you're at all familiar with the legal sphere. Passive-aggressive language, sure, but still not exactly inviting the recipient to a picnic, and passive-aggressive language doesn't get you off the hook. Related, doesn't matter if it is completely without merit and could never succeed. This entire story and thread is just something else. Talk about failing to meet even baseline ethica…

> It's obviously implying a threat if you're at all familiar with the legal sphere. And if you're not a lawyer it's just a very normal message of someone trying to get answers and have their privacy rights respected. I've both sent and received many messages like this one over the years (CNIL requests) and there's nothing frightening about it. > Talk about failing to meet even baseline ethical standards. This study c…

[deleted]

Re: CCPA Scam – Human subject research study conducted by Princeton University

#325

Post by gendal »

I received one of these emails but, interestingly, whilst the email was about my personal blog, the email was sent to my work address, which is not listed on my blog. Implying they did a bit of manual work to figure out how to reach me? If so, I wonder whether whatever they did is itself covered by CCPA or GDPR? Idly considering whether to should send them a request that is near identical to the time-wasting, deceptive email they sent me?

Re: CCPA Scam – Human subject research study conducted by Princeton University

#326

Post by UncleMeat »

michaelhoffman wrote: post #118
geofft wrote: post #107

Earlier quoted context omitted.

The fact that Ross didn't mean to do this is all the more reason why someone - maybe an IRB, maybe not (your argument makes sense) - should be assisting 20-something researchers with having a well-informed perspective. In the absence of an organization that's good at this (which doesn't seem to exist and should), this probably should be the supervising professors.

As a research group leader, I find it unfortunate that the grad student seems to be the public face of this and is therefore attracting most of the ire. Feels like the student is being thrown under the bus, and responsibility for ensuring the study is conducted ethically should ultimately be that of the principal investigator.

Mayer posted an apology last night taking full responsibility. Hardly throwing his student under the bus.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#327

Post by ravel-bar-foo »

seoaeu wrote: post #125
collectedparts wrote: post #117

Earlier quoted context omitted.

If I had to guess, the wording is in the study's FAQ is carefully chosen: "an application detailing our research methods" doesn't necessarily mean "an application with the verbatim text of the emails we planned to send, including our thinly veiled legal threat at the end." Not trying to turn this thread into a generic flameware against "academic" research methods, but this whole things seems oddly reminiscent of the…

The problem, like in that previous case, is that "human subject research" is a pretty narrowly defined category. It is mostly meant to cover testing out drugs on human subjects, and stuff like that. Notably, there is plenty of unethical research that doesn't qualify. So when an IRB gets a proposal that amounts to "I'm going to send some emails/interact with some folks online" their reply is likely to be along them li…

But when the Sokal squared hoaxers were submitting fake papers to humanities journals, it was deemed human subject research and widely denounced (by humanities researchers) for lack of ethical review. This seems to be a very analogous situation.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#328

Post by junon »

southerntofu wrote: post #242
jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

In my understanding (from a french cultural context), asking people questions as part of a field study is not human subjects research. Ethical questions arise when you ask people to take specific actions in order to measure their reactions, not when you're asking about the status quo.

The email ended with a "looking forward to your response within 45 days". Immediately in-house council was under the impression it was someone trying to entrap the website owners into a lawsuit for not being compliant.

There was a Twitter thread of a number of in-house forwarding to external council which costs time and money. This study incurred monetary damages.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#329

Post by [deleted] »

webmaven wrote: post #294
collectedparts wrote: post #117

Earlier quoted context omitted.

If I had to guess, the wording is in the study's FAQ is carefully chosen: "an application detailing our research methods" doesn't necessarily mean "an application with the verbatim text of the emails we planned to send, including our thinly veiled legal threat at the end." Not trying to turn this thread into a generic flameware against "academic" research methods, but this whole things seems oddly reminiscent of the…

> Not trying to turn this thread into a generic flameware against "academic" research methods, but this whole things seems oddly reminiscent of the "let's try to insert malicious code into Linux" fiasco [1]. I'm conceptually fine with generic passive tools like web crawlers to conduct research, but since when did the internet become a place where nonconsensual interactive research became fine? In a very real sense, e…

[deleted]

Re: CCPA Scam – Human subject research study conducted by Princeton University

#330

Post by [deleted] »

southerntofu wrote: post #241
eli wrote: post #145

Earlier quoted context omitted.

The false legal threat is particularly galling, but this absolutely should have gone through IRB even without it. Someone should have had to at least consider the impact on recipients of the messages before they were sent. IRB review is typically required even for just simple research surveys.

How is a reminder of the law a legal threat? More specifically when you feel like you're not impacted by this law, it's as far from a legal threat as could be.

[deleted]
Post reply on HN