Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was part of a human subject research study without my consent

christine.website

Post reply on HN
Print view View original

341–350 of 382 posts

Re: I was part of a human subject research study without my consent

#341

Post by bborud »

dawnbreez wrote: post #332
bborud wrote: post #285

Earlier quoted context omitted.

Someone on the Internet is lying and misrepresenting themselves? Nooo! (The rest isn't a response to seanhunter's comment, but a comment on the discussion in general) If we take a step back from the discussion; I'd have to say that this is in a gray area that kind of ends up being mostly in the "ok" region - or possibly in the "probably not worth giving a shit about" region. There is a simple litmus test you can make…

> how would people have reacted if this had been limited to large corporations you do not like? Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of whoever sent the email). It is acceptable to react differently when the victim is defenseless. That is why we would have a different reaction to a large corporation being struck by t…

So you are making the argument that one should apply different rules to different people depending on how much money they have. Well, no way that could go wrong.

Interesting how you also make the tortured argument that privacy laws create victims.

Re: I was part of a human subject research study without my consent

#342

Post by dawnbreez »

5tefan wrote: post #162

I think you need some basic legal understanding to sort that kind of stuff into valid, unsure and invalid. It then depends on your confidence level if you require legal advise. Easier said than done. From my point of view 45 days is plenty of time to read into the topic. On the other hand: Referring to 45 days was shooting way beyond the target here and unnecessary. Scaring the author was wrong and by definition alwa…

As has been pointed out elsewhere: "Consent" here is the correct term. This was a study, and studies are supposed to gather consent from participants before they start (barring certain very specific examples).

Re: I was part of a human subject research study without my consent

#343

Post by dawnbreez »

Ekaros wrote: post #293
throwaway600090 wrote: post #155

Would it make sense to pursue a class-action claim against Princeton and the researchers to recover everyone’s legal costs and business disruption costs? Probably wouldn’t be that difficult to get the contact information of every business that was contacted during discovery, right?

I wonder if there really is a case. I don't think you can sue anyone for your needs of fulfilling your legal obligations. After all, if these people had fulfilled their legal obligations they could have given response with minimal cost.

Not a lawyer, but I'd imagine the most useful point to make is that the researchers misrepresented their identity while sending these threats. Lying about who you are while trying to sue someone is a pretty big no-no.

Re: I was part of a human subject research study without my consent

#344

Post by dawnbreez »

a-dub wrote: post #197

am i missing something? i don't see anything about research or studies in the original email. maybe it's a legitimate inquiry? maybe it's performance art? (does the blog post have to be taken down if a right to be forgotten request is filed?) does the ccpa even apply to hobby or non-revenue generating endeavors?

> am i missing something? i don't see anything about research or studies in the original email.

That is, in fact, the entire problem. The researchers doing the study lied about who they were and where they were from (in another case, they claimed to be from France; in this case, from Germany) and did not tell anyone it was a study until after some subjects contacted lawyers.

Also the CCPA isn't supposed to apply to hobby/no-revenue sites, but one of the things that qualifies you for CCPA is having PII from 50k Cali residents, so if you log IPs in just the 'right' way and Hackernews finds your site you may end up qualifying overnight.

Re: I was part of a human subject research study without my consent

#346

Post by seanhunter »

xena wrote: post #329
seanhunter wrote: post #273

Earlier quoted context omitted.

"People lie all the time for good reasons. Are those actions unethical?" is whataboutism of the worst kind. We're not talking about any other hypothetical case where a person might lie for good reasons. We're talking about this case, and the lie/misrepresentation was at the heart of why it was unethical. Secondly, you say you don't see who was harmed - the person who posted the original blog post was clearly harmed.…

OP of the blog article. I didn't have a panic attack. If you want access to my private medical information and are not my doctor, you will not get it. Do not assume anything further.

Sorry. I read another article on here on the same topic where the person did and conflated the two.

...and actually checking again the person said they "verged on" a panic attack, which is clearly less bad

https://blog.freeradical.zone/post/ccpa-scam-2021-12/

Re: I was part of a human subject research study without my consent

#347

Post by nr2x »

josefx wrote: post #211
nr2x wrote: post #203

Earlier quoted context omitted.

specifically, deception studies are really hard to get approved - and for good reason. looks like this wasn't properly reviewed.

"Hard to get approved" my ass. The attacks on the Linux code review process with real harm code and zero safeguards against successfully hijacking a production kernel got approved and the review board even reaffirmed its decision when confronted about it, as far as I remember by claiming that the study wasn't focused medical issues. Did this study focus on medical issues? If not then at least one review board out the…

Because one IRB makes a bad decision doesn't mean, in general, deception studies are easy to get approved. Furthermore, this study used an "no human subjects" exemption to avoid a full review - which should not have happened. The Linux code attack study has also roundly criticized in the research community because it was such an abnormal failure of IRB.

Re: I was part of a human subject research study without my consent

#348

Post by kstrauser »

dawnbreez wrote: post #327
smsm42 wrote: post #160

Earlier quoted context omitted.

That code talks about businesses, and not just any businesses, but ones with revenue over $25M: https://oag.ca.gov/privacy/ccpa#sectiona Random blogger who's not a business does not have any connection to this. It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

As someone in another comment thread pointed out, the requirements also put you on the spot if 50,000 Cali citizens have personal data that you've got access to. And, as someone also pointed out in that thread, being on Hackernews and having IP logging may be enough to trigger that requirement. Further, with the absolute shitshow that is the US court system, if someone brings a frivolous suit you're looking at thousa…

I wrote the blog post from yesterday’s HN story, and that last paragraph is what worried me. I know I’m not a business, and I don’t make money from my project, and believe I’m not subject to the CCPA because of that. I dread the idea of having to prove that in court, though, and how expensive it might be to (hopefully!) prove I’m not liable for even accidentally violating it.

There’s a reason patent trolls, copyright trolls, ADA trolls, etc. go after small entities: they’re more like to pay a small settlement out of fear than risk taking it to court and being bankrupted.

Re: I was part of a human subject research study without my consent

#349

Post by a-dub »

dawnbreez wrote: post #344
a-dub wrote: post #197

am i missing something? i don't see anything about research or studies in the original email. maybe it's a legitimate inquiry? maybe it's performance art? (does the blog post have to be taken down if a right to be forgotten request is filed?) does the ccpa even apply to hobby or non-revenue generating endeavors?

> am i missing something? i don't see anything about research or studies in the original email. That is, in fact, the entire problem. The researchers doing the study lied about who they were and where they were from (in another case, they claimed to be from France; in this case, from Germany) and did not tell anyone it was a study until after some subjects contacted lawyers. Also the CCPA isn't supposed to apply to h…

i see. it appears the post has been updated. last night it had the title and reference to the university of minnesota kernel security study, but no actual reference (unless i missed it!) to the fact that this was a princeton study.

Re: I was part of a human subject research study without my consent

#350

Post by mirker »

dcow wrote: post #304
mirker wrote: post #299

Earlier quoted context omitted.

It is unethical because you are lying to people in an effort to manipulate their natural state. As a researcher, you have to balance the good in a research study versus the bad, and you can’t always predict how bad the outcome will be. There are review boards in place to make theses decisions. Here’s an example. Your doctor calls to talk to you about you sexual health. You discuss at length about all the issues you’v…

Human subjects research guidelines are very clear as to where the line is. If your research is gathering information about a person , then the subject is a human and additional steps must be taken to ensure responsible conduct (this applies in your first example case which is clearly ethically problematic because the subject was not informed). If the information you are collecting, is about a process or procedure or…

I don’t agree with the definition of “human research” you are using. For example, Cornell IRB defines it as 1) extracting data from humans OR 2) collecting private information. The email collects information from a human, therefore, by 1) it is human and subject to IRB review. My understanding of the intent of IRB is to govern any research actions that directly or indirectly interact with a human. Even simple surveys or scraping reddit needs IRB.

For the deception, you have to weigh the pros and cons. The harm isn’t very high but 1) it undermines public trust of research and 2) includes the participant in a study they did not consent for. The participant is not getting paid for their time and is in fact getting indirectly threatened/coerced with legal action.

The IRB board of course makes all these calls. But it’s not “obvious” that the research is ethical. For example, research can be unethical _with participant consent_ if participants are offered too much money, because people will do _very_ bad things for large sums of money, so it’s basically coercion. In this case, there is an implication of legal action if the participant does not participate and they may not have an option to withhold their participation.

Consider the alternative: “Hi, I am a researcher from Princeton. For your time answering these 4 questions, you will receive $50 and an opportunity to advance our understanding of ____.”

[1] https://researchservices.cornell.edu/resources/irb-faqs

Post reply on HN