Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

141–150 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#141

Post by eli »

malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

One of the requests landed on my desk to figure out how to process. I'm a human. Others have received them on personal domains where the "organization" is just them.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#142

Post by morpheuskafka »

> I’m not confident that I could remain civil when talking to the person who inflicted this on me without my permission or knowledge.

I'm not sure how long anyone can last in business if this is their response to receiving a kind-of-threat of a lawsuit. I get that it may be a hassle but businesses get these kind of garbage threats frequently and often can be ignored unless and until they actually file something. If the threat is BS then its certainly wrong for them to waste your time but being so mad you can't even speak to them seems a bit much.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#143

Post by turnerc »

morpheuskafka wrote: post #142

> I’m not confident that I could remain civil when talking to the person who inflicted this on me without my permission or knowledge. I'm not sure how long anyone can last in business if this is their response to receiving a kind-of-threat of a lawsuit. I get that it may be a hassle but businesses get these kind of garbage threats frequently and often can be ignored unless and until they actually file something. If t…

The author states this after knowing the true identity of who sent the bogus email. At that point they know it's not legitimate.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#145

Post by eli »

kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

The false legal threat is particularly galling, but this absolutely should have gone through IRB even without it. Someone should have had to at least consider the impact on recipients of the messages before they were sent.

IRB review is typically required even for just simple research surveys.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#147

Post by tw04 »

malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

How would a website “respond” without human interaction? If all they were testing was whether or not a website had an automated response to emails with ccpa in the subject or body they could have included a disclaimer at the end of the email about what they were doing.

This was clearly seeking a human response and is a human experiment.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#148

Post by dataflow »

elliekelly wrote: post #137
kf6nux wrote: post #88

From the study's FAQ[0]: > Did an Institutional Review Board consider this study? > We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. From the social experiment[as reported by OP's link]: > I look forward to your reply without undue delay and at most within 45 days of this emai…

I don’t think it’s intended as a veiled threat of a lawsuit so much as a statement of the compliance requirements. Unfortunately it seems they misunderstood the scope which makes the it inaccurate. But if the statement was true and accurate I would just take it as a helpful reminder of the timeframe.

> if the statement was true and accurate I would just take it as a helpful reminder of the timeframe.

People don't go through the trouble of digging up the particular section number of the specific statute of the specific jurisdiction in question for the mere sake of a generic "helpful reminder of the timeframe" required by law.

And similarly for the "without undue delay" part.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#149

Post by tqi »

malwarebytess wrote: post #70

I'm confused how this is human experimentation. Were they not merely collecting information on how a site handles these requests? Is it because they erroneously sent emails to sites that do not fall under the umbrella of the law they were examining? An email asking an organization for answers to questions is human experimentation? I must be missing something.

To me yes, for the same reason pulling fire alarms at various company office buildings to see how they respond would be considered human experimentation.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#150

Post by RubberSoul »

jimmar wrote: post #100

It is interesting in the study web page ( https://privacystudy.cs.princeton.edu/ ) that they consistently mention contacting "websites" instead of "people." As if a website is some autonomous thing that can communicate with a researcher. I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking the…

This is incorrect. It's only human subjects research if the researcher is obtaining data about a human. This is the "about whom" requirement. A classic example is calling a business and asking someone about the products and prices they offer. That's not human subjects research.
Post reply on HN