Apology from the PI, permanent suspension of sending emails, possible follow up emails telling people to disregard the original emails, and commitment to a formal research ethics study: https://twitter.com/jonathanmayer/status/1472427321047101442
I was part of a human subject research study without my consent
261–270 of 382 posts
Re: I was part of a human subject research study without my consent
#262Earlier quoted context omitted.
> In the US even a meritless legal threat will require hiring a lawyer to ensure you are in the clear which requires significant amount of money, in addition to the stress. So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? The site still needs to determine if the law applies to them and if so what they must do to satisfy th…
It would have been possible to make the requests without a threat of suit. The thinly veiled threat of suit came from a portion of the email that quoted a specific section and used legal verbiage to get people to respond within a certain time frame (as required by the law) This was taken as a legal threat. The request would have been just as valid without the threat
Though due to the nature of the requests, they were not actually subject to that specific section of the law, and thus the demand of a response within 45 days had no genuine legal foundation.
Re: I was part of a human subject research study without my consent
#263A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop. The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes. As a result, any researchers who send…
"Are you totally in the clear legally?"
Based on the way the system works, especially the civil side, it's sometimes impossible to even answer this question.
Re: I was part of a human subject research study without my consent
#264Earlier quoted context omitted.
> Can someone help me understand the ethical problem here? The ethical problem is that you can't do research on people without their consent. The fact that the researchers knew they were doing research, not actually asking a question as an ordinary user of the website, makes a difference. Intent matters.
> The ethical problem is that you can't do research on people without their consent. But can you do research on a business without the businesses consent? Or do I need a businesses consent before sending out identical resumes except one has a stereotypical minority name to attempt to judge discrimination? Because websites aren’t people. Websites are businesses. A lot don’t make money or fail. They may have a small st…
> Because websites aren’t people.
But websites cannot answer questions.
If your study is simply "how do the servers of various websites respond to my HTTP requests", that doesn't require informed consent, because it's not involving humans.
Once your study moves into the realm of "how do the operators of websites respond to me legal requests", that requires informed consent, because website operators are humans.
It's really very, very simple. If you need responses from human beings, that's human subjects research, and it requires informed consent and greater scrutiny from the IRB.
Re: I was part of a human subject research study without my consent
#265Earlier quoted context omitted.
Getting “informed consent” is one of the big, guiding principles for research done on humans. My guess is the author deliberately used that language of the scientific community, to make clear that they did not agree to be part of the research.
Yeah, but the idea of “informed consent” is misunderstood broadly. There is no constitutional right to informed consent. Not all human subjects research requires informed consent — or even consent. There are other institutional ethical lapses that are much more dangerous — and there are also ethical attitudes that rest on the researcher, not the institution. Righteous indignation over something like this is dangerous…
It sounds like this type research - which could alter the subject's actions and cause harm (costs) - should have included consent.
Re: I was part of a human subject research study without my consent
#266Earlier quoted context omitted.
It would have been possible to make the requests without a threat of suit. The thinly veiled threat of suit came from a portion of the email that quoted a specific section and used legal verbiage to get people to respond within a certain time frame (as required by the law) This was taken as a legal threat. The request would have been just as valid without the threat
Though due to the nature of the requests, they were not actually subject to that specific section of the law, and thus the demand of a response within 45 days had no genuine legal foundation.
Which brings us back to the comment about meritless legal action still being costly for those it is used against.
Re: I was part of a human subject research study without my consent
#267Can someone help me understand the ethical problem here? If I as an ordinary citizen contacted the webmaster with a similar worded email, the result would have been the same. The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. If submitting such a request has the potential to cause such undue stress,…
The unethical part is not that the experimenters sent these messages to the owners of the websites.
It's that they:
a) did not get the people's informed consent to participate in human subjects research,
b) misrepresented themselves as being potentially-litigious parties interested in the handling of their own data under the CCPA, who further were misrepresenting the degree to which the CCPA applied to them, and
c) misled their IRB into believing this was not human subjects research, so that they did not get stopped from doing (a). (That, or the IRB itself is culpable for this aspect of the unethical behavior; I haven't seen specific information one way or the other.)
And to be clear about these requirements:
You may recall stories about psychological experiments during the Cold War, like the Milgram Experiments (where the participants were told to administer electric shocks to people), and the Stanford Prison Experiment (where they assigned a bunch of undergrads to be prisoners and guards). Due to wildly unethical experiments like those, the scientific institutions of our country developed the system of Institutional Review Boards (the aforementioned IRB), which have fairly clear standards that they hold researchers to (though, granted, those standards will naturally vary somewhat from institution to institution).
One of the primary purposes of IRBs is to ensure that all human scientific research participants give informed consent to participate in the study. That means, among other things, they have to be informed of the risks of the study—and those risks, by design, must include the mental distress that can be caused by the experiment. (That, after all, was the primary negative outcome of the Milgram Experiments and the Stanford Prison Experiment: they caused serious psychological distress.)
I don't work at Princeton, so I can't speak to the specifics of how they consider such things, but I do work for the psychology department of a university with a strong tradition of research—in fact, I built the web-based system the IRB here now uses to manage their workflow, so I've worked closely with them for over a decade now—and I can tell you with some certainty that letters like these would not in any way be considered acceptable without a signed informed consent form. They are very clearly designed to evoke an emotional response in the recipients—a fear response, specifically—and that absolutely requires the full scrutiny of the IRB.
Re: I was part of a human subject research study without my consent
#268I'm so confused by the comments here. Californian consumers regularly, and rightly IMO, laud the CCPA. Then when on the receiving side, view it as a threat and freak out. Note: I'm ignoring the whole lying aspect for now, because it isn't pertinent to my argument. So it sounds like it's good for consumers, and a nightmare for producers. Seems the crux of the problem is the law itself.
Yeah this one is weird to me. How many "I sent GDPR requests to all the services I use and this is what happened" blog posts did we read when GDPR first went into effect?
Should academic research be held to a high bar? Yes. Did this cross a line? From the response and subsequent apology, clearly. But the outrage here feels at least a little disproportionate.
Re: I was part of a human subject research study without my consent
#269Earlier quoted context omitted.
> very slightly worrisome Recommend you don’t spend “ thousands of dollars to hire a lawyer and file a response” on something that you find very slightly worrisome. Again, I think you, too, are being suckered into spam. Plenty of people fall for spam scams. It is nothing to be ashamed of. Think of all the people who fall for the fake IRS phone calls. But learn from it: keep your guard up when you get emails, phone ca…
> Recommend you don’t spend “ thousands of dollars to hire a lawyer and file a response” on something that you find very slightly worrisome. I call a lawyer any time I have a legal question for which I am not confident about the answer. If it’s not a real problem, a lawyer will be able to answer it a fraction of an hour’s worth of billable time.
...which I hope you recognize is a very privileged position to be in.
Re: I was part of a human subject research study without my consent
#270I received one of these as well, but the wording was different. From reading this, it sounds like the one I received was the one they send when they aren’t confident they have the correct email address. I didn’t respond. Here’s the email (I redacted my domain name and replaced it with [mydomain].) To Whom It May Concern, We are researchers at Princeton University conducting a study of how websites are implementing th…
That just sounds like a fixed version, I presume to continue the study, where the researcher is transparent about their identity and intention.
The researchers have already publicly announced that they've halted all emails and the continuation of the study permanently.
What is more likely is that they have multiple templates to try to determine if there were different responses depending on whether the request was known to be for research.