Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

41–50 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#41

Post by ineedasername »

kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

There is a separate Research Integrity group to address exactly this sort of problem. I'd call and email them [0] and then maybe cc' the office of General Council (their lawyers) [1] so they are aware of the type of liability that lax research oversight may be causing.

For good measure, his research advisors should hear about this as well. Per his own website (now unavailable but archived on wayback [2]) they are Jonathan Mayer [3] and Jenifer Rexford. [4]

Ross: should you come across this HN post, read through every comment. You need to understand-- especially studying tech policy!!!-- just how poorly done this was. Really not a great way to begin your reputation in this field.

[0] https://ria.princeton.edu/report-concern

[1] https://ogc.princeton.edu/

[2] https://web.archive.org/web/20210122100955/https://www.rosst...

[3] https://jonathanmayer.org/

[4] https://www.cs.princeton.edu/~jrex/

Re: CCPA Scam – Human subject research study conducted by Princeton University

#42

Post by kstrauser »

User23 wrote: post #20

Serious question: why should academic institutions be held to a higher standard than commercial ones? Google and Facebook, to just name two, routinely perform human subject research without informed consent as a matter of course. That's what A/B testing is. Ethically speaking the fine print in the ToS obviously isn't actually informed consent, even if the law says it is. I don't see why being a for-profit company sho…

You're asking this backward: why should commercial institutions be held to a lower bar than academic ones. The response isn't to make it easier for universities to conduct research on you, but to make it harder for companies to.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#43

Post by gpm »

User23 wrote: post #23
kstrauser wrote: post #17

Earlier quoted context omitted.

Almost certainly. The law seems pretty clear that they'd have to completely delete all information about if you ask them to.

I guarantee you that they don't even know what all the information about you they have is and even if they wanted to they couldn't actually delete all of it because their systems have so many levels of redundancy to prevent data loss that even intentional deletion is impracticable, at least if you want it to be comprehensive.

GDPR and CCPA compliance has been a big thing in the enterprise space recently. I wouldn't be surprised if they missed a small amount, and would assume that they didn't properly 0 out the bytes on the actual hard disk (as opposed to deleting the metadata used to find them - ssds in particular can make actually 0ing data hard), but I bet they do a reasonably good job.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#44

Post by ineedasername »

ajkjk wrote: post #27
ineedasername wrote: post #26

Ross Teixeira, the PhD student that did this, had the brazen nerve to post this lie on Twitter: Responses to the study have been overwhelmingly positive, and I particularly appreciate the notes of encouragement that some websites have sent. We look forward to sharing results in the coming year, with the goals of identifying best practices and informing future policy making. https://mobile.twitter.com/RossTeixeira/sta…

How could you know it's a lie?

Because he said the response was overwhelming positive at the same time that he is dealing with anxious & irate recipients of his messages.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#45

Post by kstrauser »

cblconfederate wrote: post #39

> resident of Nice, France I wonder why they d use a french as a hypothetical privacy nazi

Dude. Annoyed as I am with the researcher, there's no need to bring that kind of nonsense into the conversation.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#46

Post by kstrauser »

ineedasername wrote: post #44
ajkjk wrote: post #27

Earlier quoted context omitted.

How could you know it's a lie?

Because he said the response was overwhelming positive at the same time that he is dealing with anxious & irate recipients of his messages.

It's possible that he's only seeing positive responses, because entities who had a negative reaction are either laying low or hiring lawyers.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#47

Post by GauntletWizard »

User23 wrote: post #23
kstrauser wrote: post #17

Earlier quoted context omitted.

Almost certainly. The law seems pretty clear that they'd have to completely delete all information about if you ask them to.

I guarantee you that they don't even know what all the information about you they have is and even if they wanted to they couldn't actually delete all of it because their systems have so many levels of redundancy to prevent data loss that even intentional deletion is impracticable, at least if you want it to be comprehensive.

Having worked at these companies and those like it, there's a lot to unpack in this law. The short version is, they have to delete data "about you", not data that was generated by you. Business records, such as receipts, are allowed to can be kept. They just delete your name and phone number, your photos and videos, and documents that were visible to you, but all of the actually useful tracking information is encoded into "Anonymized rows". It's bullshit and everyone knows it except the legislators writing the laws.

That said, there's also a clever but effective workaround to all that redundancy - They store all your documents and photos encrypted with a key that's unique per user. When you request all your data, they delete the key - It's much easier for them to completely and quickly purge all that as a singular key, and clean up the files later. It's not a cop-out, because there's no effective way to get at your data once the key has been deleted. Those systems still have backups, but with much shorter lifetimes and explicit audit logs.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#48

Post by dredmorbius »

dang wrote: post #9
dredmorbius wrote: post #2

Note that the title doesn't provide the full meat. It reads: "CCPA Scam November 2021" Story update notes: "This is a human subject research study conducted Princeton University" I was attempting to submit my own instance of this when I discovered ColinWright's. My suggested title was going to be "CCPA Scam ... is a human subject research study conducted by Princeton University". Panicking small web operators without…

Ok we've squeezed that in above. Thanks!

And thanks.

I was concerned that might be too much adaptation. Apparently not.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#49

Post by annoyingnoob »

kstrauser wrote: post #16
simple_phrases wrote: post #11

Earlier quoted context omitted.

Here's to hoping you're awarded damages for pain and suffering, or at least get a nice settlement.

If there's a settlement, I hope it's in the form of a nice bottle of scotch, and a letter from Princeton apologizing and swearing not to do it again. I'm not out money; I'm out peace of mind.

I don't think this reaches the level of a cash settlement, personally. It is certainly shocking and would upset me. I agree that Princeton should try harder.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#50

Post by [deleted] »

the_optimist wrote: post #25
apignotti wrote: post #5

Yep, we got the same. Seriously unethical behavior.

Please explain why this is unethical. The worst case is that you’re simply subject to the law. Presumably you’re abiding by the law. edit: I'm playing devil's advocate. I think the law sucks, the study is weird, and I empathize directly with the blog author. That said, downvoting to 'disagree' without explaining your reasoning is below the grade of this fine institution.

[deleted]
Post reply on HN