Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was part of a human subject research study without my consent

christine.website

Post reply on HN
Print view View original

251–260 of 382 posts

Re: I was part of a human subject research study without my consent

#251

Post by kiklion »

pdonis wrote: post #88
dcow wrote: post #17

Can someone help me understand the ethical problem here? If I as an ordinary citizen contacted the webmaster with a similar worded email, the result would have been the same. The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. If submitting such a request has the potential to cause such undue stress,…

> Can someone help me understand the ethical problem here? The ethical problem is that you can't do research on people without their consent. The fact that the researchers knew they were doing research, not actually asking a question as an ordinary user of the website, makes a difference. Intent matters.

> The ethical problem is that you can't do research on people without their consent.

But can you do research on a business without the businesses consent? Or do I need a businesses consent before sending out identical resumes except one has a stereotypical minority name to attempt to judge discrimination?

Because websites aren’t people. Websites are businesses. A lot don’t make money or fail. They may have a small staff managing them. They may not be ‘for profit’ but they are still businesses.

That’s my issue with the complaints about the study. They blow up and claim to be unwitting participants of human subject research, drawing mental parallels with the Tuskegee experiment when it’s a closer parallel to research performed against companies who were never notified like when researchers sent out identical resumes except for their names.

The researcher definitely could have worded the email better so it didn’t come across as an ominous legal threat. There are valid criticisms against the research. But claiming to be an unwitting subject of a human research experiment is incredibly misleading.

Re: I was part of a human subject research study without my consent

#252

Post by netizen-936824 »

tzs wrote: post #249
42jd wrote: post #66

Earlier quoted context omitted.

Yep I posted this hoping to raise awareness, but the reaction was not what I expected. In the US even a meritless legal threat will require hiring a lawyer to ensure you are in the clear which requires significant amount of money, in addition to the stress. Researchers should never be putting anyone in that position.

> In the US even a meritless legal threat will require hiring a lawyer to ensure you are in the clear which requires significant amount of money, in addition to the stress. So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? The site still needs to determine if the law applies to them and if so what they must do to satisfy th…

It would have been possible to make the requests without a threat of suit. The thinly veiled threat of suit came from a portion of the email that quoted a specific section and used legal verbiage to get people to respond within a certain time frame (as required by the law) This was taken as a legal threat. The request would have been just as valid without the threat

Re: I was part of a human subject research study without my consent

#253

Post by the_af »

ZhangSWEFAANG wrote: post #11
TedDoesntTalk wrote: post #8

> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.

This is unlike traditional spam in the sense that it feels more legitimate.

The start with some Russian woman saying "hello, I'm Masha from..." triggers all sort of mental spam filters. Adding random legal codes from who knows where reminds me of "according to the CANSPAM law 134/38 this cannot be considered spam" that every spam mail used to have.

Seriously, just a few lines in this mail raises all sorts of flags.

Re: I was part of a human subject research study without my consent

#254

Post by hermitcrab »

I got 2 of these emails. One CCPA and one GDPR, but the exact same boilerplate. So I knew it was sketchy. But I still wasted an hour of my time deciding whether to reply. Several of my colleagues in other small comapnies also received these emails. Multiply that by the thousands of emails they must have sent and that is a lot of time wasted. I believe some people even paid laywers to respond. So potentially a lot of money wasted as well.

The senders either they didn't realize the sort of time and waste of money this would cause, in which case they are idiots, or they did, in which case they are arseholes.

How did this get past the Princeton ethics board?

What if every researcher started spamming thousands of businesses without their consent?

Re: I was part of a human subject research study without my consent

#255

Post by vasco »

dqv wrote: post #205
jcrawfordor wrote: post #175

I have pretty mixed feelings on this. On the one hand, I agree that the researcher's actions (particularly the use of a false identity) were inappropriate. I am hesitant to engage in "victim blaming" by calling the targets of the email naive. But I hope this has been a learning experience for everyone, as it seems to have revealed a lot of knowledge gaps that were surprising to me. I am not at all surprised that it w…

It is very much about experience. Now that I’m an old man in my late 20’s I can tell when it’s BS, but I empathize with the fear of the less-experienced. The first time I had a personal legal experience, I was confident about what the law was, and then got blown the fuck out. The second one was someone threatening some sort of criminal action to which I responded, “have the prosecutor reach out so we can put our lawy…

Same experience here, I can't understand someone who's reaction to a totally random email without any credentials or actual lawsuit is to spend thousands of dollars on lawyers. Maybe I was lucky to not have the privilege to even consider paying for lawyers when I got my first ones of these and always defaulted to just emailing the person back which in 100% of cases cleared the issue.

Re: I was part of a human subject research study without my consent

#257

Post by xena »

johnchristopher wrote: post #226

This really feels like the long consequences for "it's just a prank bro" and "it's a social experiment (to totally misguide you into a behavior and claim it's a prank")". Anyway, 127.0.0.1 - - [18/Dec/2021:04:04:57 +0000] "GET /security.txt HTTP/1.1" 404 2110 "-" "Go-http-client/2.0" I suppose there are no IP anyway and the reverse proxy doesn't forward them.

Author of the article, I replaced an actual IP address with 127.0.0.1 because I didn't want to list some random AWS IP on my blog without knowing who it is related to.

Re: I was part of a human subject research study without my consent

#258

Post by xena »

andybak wrote: post #232
smsm42 wrote: post #171

Earlier quoted context omitted.

It creates an obligation to businesses selling user data, or ones with revenues over 25 millions. It's not hard to find either: https://oag.ca.gov/privacy/ccpa The CCPA applies to for-profit businesses that do business in California and meet any of the following: Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devic…

I'm reading that and I can already see things that require me to think hard about whether it might apply. > any of the following OK > Buy, receive, or sell the personal information of 50,000 or more California residents, "receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging. You see? It's not clear cut from reading the thing you just said was very c…

As the author of that article, I bet I meet that bar as soon as one of my posts gets on the front page of Hacker News, very easily if I post multiple articles which ended up getting popular like I have this month.

Re: I was part of a human subject research study without my consent

#259

Post by richardw »

sillysaurusx wrote: post #224
hatsunearu wrote: post #219

Earlier quoted context omitted.

Deception is allowed, but should be scrutinized carefully to determine if it is necessary. In this case, it was not necessary. The researcher could have easily just said "we want to know if you are compliant with CCPA for the purpose of doing this research, could you tell us your policy please" https://research.oregonstate.edu/irb/research-involving-dece... quotes: a) Psychologists do not conduct a study involving de…

Are you sure that this is applicable to OP's situation? It appears to be a set of guidelines, not a requirement. And in fact, I'm skeptical that there are requirements, except on a university-by-university basis -- which is to say, the process seems much less formal than people are saying. For example, I would feel comfortable with this study if at the bottom it said "Just kidding, we're actually researchers. Can you…

As a pentester you’d likely get an OK from the client on which methods were acceptable. Can you phish, etc. An exec would hire you to test their company and you still wouldn’t have carte blanche on methods. I assume you didn’t just YOLO random companies that you thought would be good for your security paper.

Full disclosure: I’ve listened to at least 20 episodes of Darknet Diaries. I’m basically already in your network. ;)

Re: I was part of a human subject research study without my consent

#260

Post by xena »

TedDoesntTalk wrote: post #8

> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.

I am sorry I am a different person than you and as such have different reactions to this. It looked plausible to me and the geoIP lookup on the mail server said it was in California, AFAIK this is all you need for someone to be a CCPA subject. I do not want to fuck with the legal system.
Post reply on HN